diff --git a/.claude/agents/debugger.md b/.claude/agents/debugger.md
index d7867633..060e3942 100644
--- a/.claude/agents/debugger.md
+++ b/.claude/agents/debugger.md
@@ -133,7 +133,7 @@ When diagnosing data-related bugs (unexpected values, failed joins, wrong coded
 When debugging Stage 8 analysis failures: if the error traceback involves a specific library, load the corresponding skill via the Skill tool (see § Language-Conditional Skill Loading for the full mapping). Each library skill's `gotchas.md` reference file documents common failure modes:
 
 **Python libraries:**
-- **pyfixest:** Formula syntax errors, singleton fixed effect warnings, SE specification issues, v0.40.0 breaking changes
+- **pyfixest:** Formula syntax errors, singleton fixed effect warnings, SE specification issues, cumulative 0.40→0.60 breaking changes
 - **statsmodels:** Convergence failures, perfect separation in logit, singular matrix in GLS, missing formula API import
 - **linearmodels:** Entity effects specification, absorbed variable errors, GMM weight matrix issues
 - **geopandas:** CRS mismatch errors, invalid geometry, spatial join row explosion, Shapely 2.x migration issues
diff --git a/.claude/hooks/context-reporter.sh b/.claude/hooks/context-reporter.sh
index 98e5a27e..25fd1afb 100755
--- a/.claude/hooks/context-reporter.sh
+++ b/.claude/hooks/context-reporter.sh
@@ -24,8 +24,10 @@
 #
 # Performance:
 #   Uses transcript byte-size + mtime signatures to reuse model caches without
-#   rescanning unchanged files. Changed transcripts are resolved from `tail -50`,
-#   which also bounds usage parsing to the end of the JSONL.
+#   rescanning unchanged files. When a transcript has changed, the model and
+#   usage are recovered from a full scan of the JSONL (last non-synthetic model,
+#   last positive usage sum) so a long run of trailing zero-token shim
+#   placeholders cannot hide the real values.
 #
 # Subagent support:
 #   settings.json PreToolUse hooks also fire for tool calls made BY subagents.
@@ -46,6 +48,17 @@
 #   orchestrator's utilization into the subagent's context, causing subagents
 #   to falsely throttle or refuse work at HIGH/CRITICAL.
 #
+# Parent-model isolation:
+#   The parent/session model is derived ONLY from a genuinely-parent source —
+#   the parent model cache (/tmp/claude-model-<session_id>) refreshed from the
+#   parent's MAIN transcript. It is NEVER inferred by re-parsing a path that is
+#   itself a subagent transcript. When Claude Code passes the subagent's own
+#   transcript directly (basename == agent-<id>.jsonl) there is no parent
+#   transcript to scan, so the parent model comes from the cache alone (or is
+#   left empty). A measured subagent is then mapped by ITS OWN model/window and
+#   never assumed to share the session model (see Convention 10 in the
+#   hardening spec).
+#
 # Threshold tier (see calculate()):
 #   The severity thresholds are keyed on the model identity of the agent being
 #   measured — main-session measurements use the session model; subagent
@@ -86,6 +99,17 @@ is_canonical_positive_decimal() {
     [[ "$value" == "$max_value" || "$value" < "$max_value" ]]
 }
 
+# Bounded identifier allowlist (Convention 2). Leading alnum, then
+# alnum/dot/underscore/hyphen, max 128 chars. Rejects slashes, traversal (..),
+# control chars, leading dash, empty, and >128. Every session_id / agent_id must
+# pass this BEFORE it is interpolated into any transcript or /tmp cache path, so
+# an attacker-shaped id can neither escape the /tmp namespace nor the subagent
+# transcript subtree. A present-but-invalid id is rejected exactly like an
+# absent one (key-presence contract).
+is_safe_id() {
+    [[ "${1:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]
+}
+
 # Return a signature that changes when a transcript is appended or rewritten.
 # GNU stat supplies byte size plus nanosecond-resolution mtime in one probe.
 transcript_signature() {
@@ -98,9 +122,13 @@ transcript_signature() {
 # paths consumed by audit-log.sh and statusline components. The neighboring
 # .transcript-signature sidecar is the commit marker: unchanged signatures reuse
 # a nonempty bare cache without parsing; changed signatures refresh from the last
-# nonempty, non-synthetic model. Both files are replaced through same-directory
-# temporary siblings, with the signature moved last so interrupted writes force
-# a safe refresh on the next invocation.
+# nonempty, non-synthetic model via a FULL scan of the JSONL (Convention 4 —
+# a long tail of zero-token/synthetic placeholders cannot hide the real model).
+# Both files are replaced through same-directory temporary siblings, with the
+# signature moved last so interrupted writes force a safe refresh on the next
+# invocation. When called with an empty transcript (e.g. the parent transcript
+# is unavailable in the direct-subagent branch) it returns the cached value
+# without scanning or writing.
 resolve_model_cache() {
     local transcript="${1:-}"
     local cache="${2:-}"
@@ -119,16 +147,20 @@ resolve_model_cache() {
     fi
 
     if [[ -n "$transcript" && -f "$transcript" ]]; then
-        model=$(tail -n 50 "$transcript" 2>/dev/null | jq -rs '
+        model=$(jq -rs '
             [.[] | (.message.model // empty)
              | select(. != "" and . != "<synthetic>")] | last // empty
-        ' 2>/dev/null) || model=""
+        ' < "$transcript" 2>/dev/null) || model=""
     fi
     [[ -z "$model" ]] && model="$cached_model"
 
     if [[ -n "$model" && -n "$signature" ]]; then
-        if printf '%s' "$model" > "$model_tmp" 2>/dev/null &&
-           printf '%s' "$signature" > "$signature_tmp" 2>/dev/null &&
+        # Convention 6: wrap the redirection so an open() failure on the temp
+        # target cannot leak "No such file"/"Permission denied" to the display
+        # stream (redirections apply left-to-right, so a bare `> f 2>/dev/null`
+        # would still print the open() diagnostic before 2> takes effect).
+        if { printf '%s' "$model" > "$model_tmp"; } 2>/dev/null &&
+           { printf '%s' "$signature" > "$signature_tmp"; } 2>/dev/null &&
            mv "$model_tmp" "$cache" 2>/dev/null &&
            mv "$signature_tmp" "$signature_cache" 2>/dev/null; then
             :
@@ -146,47 +178,92 @@ SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null) || SE
 TRANSCRIPT_PATH=$(echo "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null) || TRANSCRIPT_PATH=""
 AGENT_ID=$(echo "$INPUT" | jq -r '.agent_id // empty' 2>/dev/null) || AGENT_ID=""
 
+# Convention 2: allowlist ids BEFORE any path/cache interpolation. Fail open
+# (emit nothing, exit 0) on a rejected id — do not construct or read/write any
+# path built from it. SESSION_ID is always used (every /tmp cache is keyed on
+# it); AGENT_ID is only checked when present (its absence marks the main
+# session). A present-but-invalid id is rejected like an absent one.
+is_safe_id "$SESSION_ID" || exit 0
+if [[ -n "$AGENT_ID" ]]; then
+    is_safe_id "$AGENT_ID" || exit 0
+fi
+
+# Production caches live in /tmp. The override is a deterministic-test seam so
+# Bats can exercise the gate/model/window cache reads and writes inside project
+# scratch without touching live session state. The default is /tmp so
+# production behavior is byte-identical; the name follows the per-script
+# DAAF_<SCRIPT>_CACHE_DIR convention shared with context-bar.sh
+# (DAAF_CONTEXT_BAR_CACHE_DIR) and subagent-bar.sh (DAAF_SUBAGENT_BAR_CACHE_DIR).
+reporter_cache_dir="${DAAF_CONTEXT_REPORTER_CACHE_DIR:-/tmp}"
+
 # ---------------------------------------------------------------------------
 # Agent-aware measurement setup: decide WHICH transcript to measure, whether
-# the sidechain filter applies, and which rate-limit gate file to use.
+# the sidechain filter applies, which rate-limit gate file to use, and which
+# path (if any) is a genuine PARENT transcript for session-model inference.
 # ---------------------------------------------------------------------------
 if [[ -n "$AGENT_ID" ]]; then
     # Subagent-fired call: measure the subagent's OWN transcript.
     [[ -z "$TRANSCRIPT_PATH" ]] && exit 0
     if [[ "$(basename "$TRANSCRIPT_PATH")" == "agent-${AGENT_ID}.jsonl" ]]; then
         # Robustness for future Claude Code versions that may pass the
-        # subagent's transcript path directly.
+        # subagent's transcript path directly. In this case the supplied path
+        # IS the subagent transcript, so there is NO parent transcript to scan
+        # (Convention 10): the parent/session model must come from the parent
+        # cache alone, never by re-parsing this subagent transcript.
         MEASURE_TRANSCRIPT="$TRANSCRIPT_PATH"
+        PARENT_TRANSCRIPT=""
     else
         MEASURE_TRANSCRIPT="$(dirname "$TRANSCRIPT_PATH")/${SESSION_ID}/subagents/agent-${AGENT_ID}.jsonl"
+        # The supplied path is the parent's MAIN transcript — a genuine parent
+        # source for session-model inference.
+        PARENT_TRANSCRIPT="$TRANSCRIPT_PATH"
     fi
     # Fail silent, never wrong: no fallback to the parent transcript here.
     [[ ! -f "$MEASURE_TRANSCRIPT" ]] && exit 0
     # Subagent transcripts are entirely isSidechain:true — disable the filter.
     ALLOW_SIDECHAIN=true
     # Per-agent gate so parent and subagents don't race on a shared timer.
-    LAST_INJECT_FILE="/tmp/claude-ctx-ts-${SESSION_ID}-${AGENT_ID}"
+    LAST_INJECT_FILE="${reporter_cache_dir}/claude-ctx-ts-${SESSION_ID}-${AGENT_ID}"
 else
     # Main session: measure the parent transcript's main chain only.
     [[ -z "$TRANSCRIPT_PATH" ]] && exit 0
     MEASURE_TRANSCRIPT="$TRANSCRIPT_PATH"
+    PARENT_TRANSCRIPT="$TRANSCRIPT_PATH"
     ALLOW_SIDECHAIN=false
-    LAST_INJECT_FILE="/tmp/claude-ctx-ts-${SESSION_ID}"
+    LAST_INJECT_FILE="${reporter_cache_dir}/claude-ctx-ts-${SESSION_ID}"
 fi
 
 INJECT_INTERVAL=60  # seconds between injections
 
+# Convention 3: closed-set GPT flagship grammar. Only these exact terminal
+# slugs (after stripping any provider path prefix) are eligible for the
+# 1,050,000-token physical window and the 370k ChatGPT-lane cap arm. New
+# codenames are a deliberate one-line registry edit (validate-before-trust,
+# consistent with DAAF policy). Stored in a variable to avoid [[ =~ ]] quoting
+# pitfalls. Accepts gpt-5.4/5.5/5.6 with an optional -sol/-terra/-luna codename
+# and an optional [1m] badge; rejects malformed suffixes (gpt-5.4-,
+# gpt-5.6-experimental, gpt-5.6-sol[1m]x), mini/chat, and gpt-5.60.
+GPT_FLAGSHIP_RE='^gpt-5\.(4|5|6)(-(sol|terra|luna))?(\[1m\])?$'
+# Closed-set mini/chat grammars (Convention 3), byte-consistent with
+# subagent-bar.sh and context-bar.sh's anchored EREs. These replace the old
+# open-ended inner globs (*-mini*/*-chat*) so suffixed near-misses (e.g.
+# gpt-5.6-mini-preview) fail the anchor and fall through to the conservative
+# 200k default rather than being mapped to 400k/128k. Anchored on the same
+# provider-stripped PHYSICAL_SLUG the globs inspected.
+GPT_MINI_RE='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-mini(\[1m\])?$'
+GPT_CHAT_RE='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-chat(\[1m\])?$'
+
 # Read context window size from shared cache (written by context-bar.sh
 # statusline). Subagent-fired hook calls carry the PARENT's session_id, so
 # this resolves the SESSION's window; a subagent running on a different model
 # than the session is corrected below. If the cache is absent, fall back to
 # the most recent cache from any session, then to 200k as a last resort.
-CTX_CACHE="/tmp/claude-ctx-window-${SESSION_ID}"
+CTX_CACHE="${reporter_cache_dir}/claude-ctx-window-${SESSION_ID}"
 MAX_CONTEXT=""
 if [[ -f "$CTX_CACHE" ]]; then
     MAX_CONTEXT=$(cat "$CTX_CACHE" 2>/dev/null)
 else
-    LATEST_CTX=$(ls -t /tmp/claude-ctx-window-* 2>/dev/null | head -1)
+    LATEST_CTX=$(ls -t "${reporter_cache_dir}"/claude-ctx-window-* 2>/dev/null | head -1)
     if [[ -n "${LATEST_CTX:-}" ]]; then
         MAX_CONTEXT=$(cat "$LATEST_CTX" 2>/dev/null)
     fi
@@ -199,10 +276,15 @@ fi
 # Refresh model identity before same/different-model window selection, final-cap
 # selection, and quality-tier selection. The main and subagent consumers share
 # these bare cache paths and their synchronized .transcript-signature sidecars.
-SESSION_MODEL=$(resolve_model_cache "$TRANSCRIPT_PATH" "/tmp/claude-model-${SESSION_ID}")
+# Convention 10: the session model is derived ONLY from a genuine parent source
+# (PARENT_TRANSCRIPT — empty when the supplied path is itself a subagent
+# transcript), never by re-parsing a subagent transcript. An empty
+# PARENT_TRANSCRIPT makes resolve_model_cache return the cached parent model (or
+# empty), so a direct subagent measurement is never mistaken for the session.
+SESSION_MODEL=$(resolve_model_cache "$PARENT_TRANSCRIPT" "${reporter_cache_dir}/claude-model-${SESSION_ID}")
 AGENT_MODEL=""
 if [[ -n "$AGENT_ID" ]]; then
-    AGENT_MODEL_CACHE="/tmp/claude-subagent-model-${SESSION_ID}-${AGENT_ID}"
+    AGENT_MODEL_CACHE="${reporter_cache_dir}/claude-subagent-model-${SESSION_ID}-${AGENT_ID}"
     AGENT_MODEL=$(resolve_model_cache "$MEASURE_TRANSCRIPT" "$AGENT_MODEL_CACHE")
     MEASURE_MODEL="$AGENT_MODEL"
 else
@@ -213,9 +295,14 @@ fi
 # session gets the window Claude Code provisions for ITS model, not the
 # session's (e.g. a sonnet subagent inside a 1M fable session has 200k — its
 # severity must be computed against 200k, or HIGH/CRITICAL fire far too late).
-# Physical GPT classification uses the terminal provider-stripped slug. Valid
-# flagship versions begin that slug and are followed by end-of-slug, '-' or '[';
-# mini/chat retain precedence. Physical size remains independent of quality tier.
+# When SESSION_MODEL is empty (no parent cache) and AGENT_MODEL is set, they
+# differ, so the correction still runs and maps the subagent by its OWN window
+# rather than inheriting the session's — never assuming same-model (Convention
+# 10). Physical GPT classification uses the terminal provider-stripped slug and
+# the closed-set flagship predicate (Convention 3): the 1,050,000 flagship
+# window is granted only to exact matches, while mini/chat retain their smaller
+# windows and malformed codenames fall through to the conservative default.
+# Physical size remains independent of the quality tier.
 if [[ -n "$AGENT_ID" && -n "$AGENT_MODEL" && "$AGENT_MODEL" != "$SESSION_MODEL" ]]; then
     PHYSICAL_SLUG="${AGENT_MODEL##*/}"
     case "$AGENT_MODEL" in
@@ -224,13 +311,27 @@ if [[ -n "$AGENT_ID" && -n "$AGENT_MODEL" && "$AGENT_MODEL" != "$SESSION_MODEL"
         z-ai/glm-5.2|z-ai/glm-5.2-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])
             MAX_CONTEXT=1048576 ;;
         *)
+            # gpt-5.4/5.5/5.6 family (broad glob selects the arm). Within it:
+            # mini/chat keep their smaller windows and take precedence; the
+            # 1,050,000 flagship window is granted ONLY to an exact closed-set
+            # match (GPT_FLAGSHIP_RE). A malformed codename that entered the arm
+            # (gpt-5.6-experimental, gpt-5.4-, gpt-5.6-sol[1m]x) is neither
+            # mini/chat nor an exact flagship, so it maps conservatively to 200k
+            # instead of inheriting the flagship window.
             case "$PHYSICAL_SLUG" in
                 gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-                    case "$PHYSICAL_SLUG" in
-                        *-mini*) MAX_CONTEXT=400000 ;;
-                        *-chat*) MAX_CONTEXT=128000 ;;
-                        *) MAX_CONTEXT=1050000 ;;
-                    esac
+                    # Closed-set classification (Convention 3), byte-consistent
+                    # with subagent-bar.sh and context-bar.sh: only the anchored
+                    # flagship/mini/chat grammars earn a GPT window. Order
+                    # flagship, then mini, then chat. Malformed suffixes that
+                    # reached this family glob (gpt-5.4-, gpt-5.6-experimental,
+                    # gpt-5.6-mini-preview, gpt-5.6-sol[1m]x) match none and map
+                    # conservatively to 200k rather than inheriting a GPT window.
+                    if   [[ "$PHYSICAL_SLUG" =~ $GPT_FLAGSHIP_RE ]]; then MAX_CONTEXT=1050000
+                    elif [[ "$PHYSICAL_SLUG" =~ $GPT_MINI_RE ]];     then MAX_CONTEXT=400000
+                    elif [[ "$PHYSICAL_SLUG" =~ $GPT_CHAT_RE ]];     then MAX_CONTEXT=128000
+                    else MAX_CONTEXT=200000
+                    fi
                     ;;
                 gpt-5|gpt-5[-\[]*|gpt-5.2|gpt-5.2[-\[]*)
                     case "$PHYSICAL_SLUG" in
@@ -258,19 +359,18 @@ fi
 
 # ChatGPT-subscription/Codex final physical-window accounting constraint.
 # Canonical activation requires BOTH exact lane signals and a measured model in
-# the anchored gpt-5.4/5.5/5.6 flagship arm; mini/chat variants are excluded by
-# ordering. Probe 2026-07-16 (gpt-5.6-sol) accepted 369,941 real input tokens and
-# rejected 372,905, so 370000 is the lane-wide accounting ceiling for this arm.
-# Applying min(resolved, 370000) after model/cache/override resolution prevents
-# stale or unsafe ordinary values from surviving while preserving lower valid
-# values. This is accounting, not compaction or a transport-level blocker.
+# the anchored gpt-5.4/5.5/5.6 flagship arm (Convention 3 closed set; mini/chat
+# are excluded because they carry suffixes the ERE does not accept). Probe
+# 2026-07-16 (gpt-5.6-sol) accepted 369,941 real input tokens and rejected
+# 372,905, so 370000 is the lane-wide accounting ceiling for this arm. Applying
+# min(resolved, 370000) after model/cache/override resolution prevents stale or
+# unsafe ordinary values from surviving while preserving lower valid values.
+# This is accounting, not compaction or a transport-level blocker.
 GPT_FLAGSHIP=0
 PHYSICAL_SLUG="${MEASURE_MODEL##*/}"
-case "$PHYSICAL_SLUG" in
-    gpt-5*-mini*|gpt-5*-chat*) ;;
-    gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-        GPT_FLAGSHIP=1 ;;
-esac
+if [[ "$PHYSICAL_SLUG" =~ $GPT_FLAGSHIP_RE ]]; then
+    GPT_FLAGSHIP=1
+fi
 if [[ "${DAAF_PROVIDER_SHIM:-}" == "openai" && \
       "${SHIM_BACKEND_MODE:-}" == "chatgpt" && \
       "$GPT_FLAGSHIP" -eq 1 ]] && \
@@ -287,8 +387,9 @@ MAX_K=$((MAX_CONTEXT / 1000))
 
 # ---------------------------------------------------------------------------
 # calculate: Parse the transcript's most recent usage data and format a
-# utilization message with timestamp. Uses tail -50 to avoid parsing the
-# entire JSONL file.
+# utilization message with timestamp. Scans the FULL JSONL (Convention 4) and
+# takes the last POSITIVE usage sum, so trailing zero-token shim placeholders
+# cannot mask a real reading.
 # Args: $1 = transcript path, $2 = allow_sidechain (true/false). When true,
 # sidechain entries count; when false, only main-chain entries count.
 # $3 = model id of the agent being measured (drives the threshold tier; may
@@ -305,7 +406,9 @@ calculate() {
     # Map each qualifying usage entry to its token sum, then take the last
     # POSITIVE sum. Shim-routed transcripts can end with zero-token streaming
     # placeholders; native Claude transcripts are unchanged by last-positive.
-    tokens=$(tail -50 "$transcript" 2>/dev/null | jq -s --argjson allow_sidechain "$allow_sidechain" '
+    # Convention 4: full-transcript scan via `< "$transcript"` (the -f guard
+    # above keeps a missing/binary file fail-open).
+    tokens=$(jq -s --argjson allow_sidechain "$allow_sidechain" '
         [.[] | select(
             .message.usage and
             ((.isSidechain != true) or $allow_sidechain) and
@@ -315,9 +418,15 @@ calculate() {
             (.message.usage.cache_read_input_tokens // 0) +
             (.message.usage.cache_creation_input_tokens // 0)
         )] | map(select(. > 0)) | last // 0
-    ' 2>/dev/null) || tokens=0
+    ' < "$transcript" 2>/dev/null) || tokens=0
 
-    [[ "$tokens" -le 0 ]] && return
+    # Convention 5: bound the numerator before tokens*100 so a huge (but
+    # jq-emitted, int64-valid) value cannot overflow signed-64 and wrap pct
+    # negative. Require a canonical positive decimal <= floor(INT64_MAX/100);
+    # anything else (including 0, non-numeric, or over-large) fails open by
+    # omitting the injection — symmetric with the validated denominator.
+    is_canonical_positive_decimal "$tokens" || return
+    [[ "$tokens" -le 92233720368547758 ]] || return
 
     local pct=$((tokens * 100 / MAX_CONTEXT))
     [[ $pct -gt 100 ]] && pct=100
@@ -360,6 +469,15 @@ NOW=$(date +%s)
 LAST_INJECT=0
 [[ -f "$LAST_INJECT_FILE" ]] && LAST_INJECT=$(cat "$LAST_INJECT_FILE" 2>/dev/null)
 
+# Convention 11: a corrupt or future gate timestamp would make (NOW - LAST_INJECT)
+# negative — always under the interval — and suppress every future report
+# indefinitely. Treat a non-canonical value OR one greater than NOW as corrupt
+# and reset to 0 (allow the report). The short-circuit keeps the -gt arithmetic
+# off any non-integer value. A legitimate recent-past value still suppresses.
+if ! is_canonical_positive_decimal "$LAST_INJECT" || [[ "$LAST_INJECT" -gt "$NOW" ]]; then
+    LAST_INJECT=0
+fi
+
 if [[ $((NOW - LAST_INJECT)) -lt $INJECT_INTERVAL ]]; then
     # Interval not elapsed — skip injection, don't block
     exit 0
@@ -369,8 +487,11 @@ fi
 MSG=$(calculate "$MEASURE_TRANSCRIPT" "$ALLOW_SIDECHAIN" "$MEASURE_MODEL")
 [[ -z "${MSG:-}" ]] && exit 0
 
-# Update the per-agent timestamp gate
-printf '%s' "$NOW" > "$LAST_INJECT_FILE" 2>/dev/null
+# Update the per-agent timestamp gate. Convention 6: wrap the redirection so an
+# open() failure (unwritable /tmp, ENOTDIR) cannot leak its diagnostic to the
+# display stream before 2> takes effect. If the write fails, continue without
+# gating — display output is preserved and the hook still exits 0.
+{ printf '%s' "$NOW" > "$LAST_INJECT_FILE"; } 2>/dev/null
 
 # ---------------------------------------------------------------------------
 # Event dispatch (format differs per event, but both share the gate above)
diff --git a/.claude/hooks/remind-orchestrator.sh b/.claude/hooks/remind-orchestrator.sh
index 563b70ac..0a23a3d2 100755
--- a/.claude/hooks/remind-orchestrator.sh
+++ b/.claude/hooks/remind-orchestrator.sh
@@ -1,12 +1,18 @@
 #!/usr/bin/env bash
 # remind-orchestrator.sh — Remind main-session LLM to load daaf-orchestrator
 #
-# Hook: UserPromptSubmit (main session only — subagents never trigger this)
+# Hook: UserPromptSubmit (main session only — explicit caller guard below)
 #
 # On each user message, checks whether the daaf-orchestrator skill has been
 # loaded this session. If not, injects a reminder via stdout that appears as
 # <user-prompt-submit-hook> text in the LLM's context.
 #
+# While that normal reminder branch is active, genuine terminal gpt-* session
+# models also receive a compact collaborator-guidance reminder. Model identity
+# comes only from the session-scoped /tmp/claude-model-<session_id> cache written
+# by context-bar.sh. Missing, empty, or malformed identity is a silent no-op for
+# GPT-specific guidance; the ordinary orchestrator reminder still fires.
+#
 # Additionally, on the user's FIRST EVER session (detected via activity.log
 # line count), injects a first-run transparency statement that Claude must
 # present before proceeding with normal workflow. The transparency content
@@ -41,13 +47,93 @@
 #   0 = always (never block user messages)
 
 INPUT=$(cat)
-SESSION_ID=$(echo "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null) || SESSION_ID="default"
-FLAG="${HOME}/.claude/daaf-state/orchestrator-loaded-${SESSION_ID}"
+INPUT_PARSED=0
+SESSION_ID=""
+CALLER_ELIGIBLE=0
+
+# One jq pass validates caller eligibility and session identity before either
+# value crosses into Bash. The path-safe session grammar is complete and
+# anchored inside jq, so command substitution/read cannot normalize a newline,
+# NUL, unit separator, or other control into a different cache identity. Caller
+# eligibility is also reduced to a trusted 0/1 scalar inside jq: raw agent fields
+# never enter Bash, and non-string or malformed nonempty identities stay silent.
+# Missing jq, malformed/non-object JSON, or extraction failure preserves the
+# ordinary reminder but can never authorize a model-cache read or GPT guidance.
+if command -v jq >/dev/null 2>&1; then
+    if IFS=$'\x1f' read -r SESSION_ID CALLER_ELIGIBLE < <(printf '%s' "$INPUT" | jq -er '
+        def valid_session_id:
+            if type == "string" then
+                (test("[[:cntrl:]]") | not) and
+                test("^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+            else false
+            end;
+
+        if type != "object" then error("hook payload must be an object")
+        else
+            [ (if (.session_id? | valid_session_id)
+               then .session_id
+               else ""
+               end),
+              (if ((.agent_id? == null) or
+                   ((.agent_id? | type) == "string" and .agent_id == "")) and
+                  ((.agent_type? == null) or
+                   ((.agent_type? | type) == "string" and
+                    (.agent_type == "" or .agent_type == "orchestrator")))
+               then "1"
+               else "0"
+               end) ]
+            | join("")
+        end
+    ' 2>/dev/null); then
+        INPUT_PARSED=1
+    fi
+fi
+
+# Explicit main-thread guard. Successfully parsed subagent or malformed caller
+# identity stays silent. Unresolved payload identity preserves the fail-open
+# ordinary reminder while GPT-specific guidance remains disabled below.
+if [[ "$INPUT_PARSED" -eq 1 && "$CALLER_ELIGIBLE" -ne 1 ]]; then
+    exit 0
+fi
+
+# Session IDs become path components for both the transcript-lifetime flag and
+# the session-runtime model cache. Only jq-validated IDs are exposed to Bash.
+# Invalid or absent IDs retain historical "default" LOADED-FLAG semantics, but
+# never select a shared default model cache.
+SESSION_ID_VALID=0
+FLAG_SESSION_ID="default"
+if [[ "$INPUT_PARSED" -eq 1 && -n "$SESSION_ID" ]]; then
+    SESSION_ID_VALID=1
+    FLAG_SESSION_ID="$SESSION_ID"
+fi
+
+FLAG="${HOME}/.claude/daaf-state/orchestrator-loaded-${FLAG_SESSION_ID}"
 
 if [[ ! -f "$FLAG" ]]; then
     # Always remind to load the orchestrator
     echo "You are interacting with a human user. You MUST IMMEDIATELY invoke the daaf-orchestrator skill (Skill tool with skill: \"daaf-orchestrator\") BEFORE doing any other work."
 
+    # The statusline payload is the authoritative source for the active session
+    # model. No transcript or environment fallback is used: stale or unresolved
+    # identity must suppress GPT-specific guidance rather than guess.
+    MODEL_ID=""
+    if [[ "$INPUT_PARSED" -eq 1 && "$SESSION_ID_VALID" -eq 1 ]]; then
+        MODEL_CACHE_DIR="${DAAF_REMIND_MODEL_CACHE_DIR:-/tmp}"
+        MODEL_CACHE="${MODEL_CACHE_DIR}/claude-model-${SESSION_ID}"
+        if [[ -s "$MODEL_CACHE" ]]; then
+            # Command substitution removes trailing newlines. Append a sentinel
+            # byte before substitution, then remove only that byte afterward so
+            # cache whitespace — including a final newline — remains detectable.
+            MODEL_ID_WITH_SENTINEL=$(cat "$MODEL_CACHE" 2>/dev/null; printf 'x')
+            MODEL_ID="${MODEL_ID_WITH_SENTINEL%x}"
+        fi
+    fi
+
+    MODEL_SLUG="${MODEL_ID##*/}"
+    if [[ -n "$MODEL_ID" && "$MODEL_ID" != *[[:space:]]* && "$MODEL_SLUG" == gpt-?* ]]; then
+        echo "For this GPT session, treat the user as an equal stakeholder and thoughtful collaborator. Default to concise, user-relevant responses in plain language at their demonstrated technical depth. Lead with the answer or decision; put an immediate action first only when action is what they need. Make required actions, options, recommendations, and consequences easy to spot. When several independent decisions are genuinely needed, present them separately rather than collapsing them into one question. Put secondary technical and implementation detail in clearly marked optional sections or artifacts. Be warm, direct, and easy to scan, never patronizing. Keep full evidence and reproducibility detail available, while surfacing the uncertainty, caveats, citations, safety warnings, and consent checkpoints that affect the current decision."
+    fi
+
     # Check if this is the user's first-ever session
     ACTIVITY_LOG="${CLAUDE_PROJECT_DIR:-.}/.claude/logs/activity.log"
     LINE_COUNT=0
@@ -60,7 +146,7 @@ if [[ ! -f "$FLAG" ]]; then
     if [[ "$LINE_COUNT" -le 1 ]]; then
         # First session ever — inject transparency statement
         HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-        TRANSPARENCY_FILE="${HOOK_DIR}/first-run-transparency.txt"
+        TRANSPARENCY_FILE="${DAAF_REMIND_TRANSPARENCY_FILE:-${HOOK_DIR}/first-run-transparency.txt}"
         if [[ -f "$TRANSPARENCY_FILE" ]]; then
             echo ""
             cat "$TRANSPARENCY_FILE"
diff --git a/.claude/scripts/context-bar.sh b/.claude/scripts/context-bar.sh
index bca525c9..95fe2b23 100755
--- a/.claude/scripts/context-bar.sh
+++ b/.claude/scripts/context-bar.sh
@@ -4,24 +4,29 @@
 # lavender, rose, gold, slate, cyan (see the case block below for the codes).
 COLOR="blue"
 
-# Color codes
-C_RESET='\033[0m'
-C_GRAY='\033[38;5;245m'  # explicit gray for default text
-C_BAR_EMPTY='\033[38;5;238m'
+# Color codes.
+# ANSI-C quoting ($'...') so the real ESC byte lives in these TRUSTED variables.
+# The final render uses printf '%s' (not '%b'), so backslash sequences arriving
+# in UNTRUSTED fields (model name, effort label, cwd basename, git branch, last
+# user message) stay inert literals and can never be re-materialized into escape
+# sequences. See the render at the end of the file.
+C_RESET=$'\033[0m'
+C_GRAY=$'\033[38;5;245m'  # explicit gray for default text
+C_BAR_EMPTY=$'\033[38;5;238m'
 # Segment colors for the rate-limit addition (kept subtle so they do not
 # compete with the single-accent context bar).
-C_AMBER='\033[38;5;179m'   # rate limit warning (>=70%)
-C_RED='\033[38;5;167m'     # rate limit danger (>=90%)
+C_AMBER=$'\033[38;5;179m'   # rate limit warning (>=70%)
+C_RED=$'\033[38;5;167m'     # rate limit danger (>=90%)
 case "$COLOR" in
-    orange)   C_ACCENT='\033[38;5;173m' ;;
-    blue)     C_ACCENT='\033[38;5;74m' ;;
-    teal)     C_ACCENT='\033[38;5;66m' ;;
-    green)    C_ACCENT='\033[38;5;71m' ;;
-    lavender) C_ACCENT='\033[38;5;139m' ;;
-    rose)     C_ACCENT='\033[38;5;132m' ;;
-    gold)     C_ACCENT='\033[38;5;136m' ;;
-    slate)    C_ACCENT='\033[38;5;60m' ;;
-    cyan)     C_ACCENT='\033[38;5;37m' ;;
+    orange)   C_ACCENT=$'\033[38;5;173m' ;;
+    blue)     C_ACCENT=$'\033[38;5;74m' ;;
+    teal)     C_ACCENT=$'\033[38;5;66m' ;;
+    green)    C_ACCENT=$'\033[38;5;71m' ;;
+    lavender) C_ACCENT=$'\033[38;5;139m' ;;
+    rose)     C_ACCENT=$'\033[38;5;132m' ;;
+    gold)     C_ACCENT=$'\033[38;5;136m' ;;
+    slate)    C_ACCENT=$'\033[38;5;60m' ;;
+    cyan)     C_ACCENT=$'\033[38;5;37m' ;;
     *)        C_ACCENT="$C_GRAY" ;;  # gray: all same color
 esac
 
@@ -39,46 +44,150 @@ is_canonical_positive_decimal() {
     [[ "$value" == "$max_value" || "$value" < "$max_value" ]]
 }
 
+# As above, but ALSO accepts a canonical zero. The codex quota fields
+# used_percent and *-reset-after-seconds are legitimately 0 (e.g. an unused
+# window or an all-zero secondary), which is_canonical_positive_decimal rejects.
+# Same length/lexical bounds run before any arithmetic so oversized or
+# non-canonical values can never reach an arithmetic context.
+is_canonical_nonneg_decimal() {
+    local value="${1:-}"
+    local max_value="9223372036854775807"
+    [[ "$value" =~ ^(0|[1-9][0-9]*)$ ]] || return 1
+    [[ ${#value} -lt ${#max_value} ]] && return 0
+    [[ ${#value} -gt ${#max_value} ]] && return 1
+    # Equal-length canonical decimals are intentionally compared lexicographically before arithmetic.
+    # shellcheck disable=SC2071
+    [[ "$value" == "$max_value" || "$value" < "$max_value" ]]
+}
+
 input=$(cat)
 
-# Single consolidated jq pass over the payload: extract every field used below
-# as one tab-separated record, then read into shell variables. This replaces
-# what were ~5 separate `jq` invocations on "$input" (one process fork each).
-# Field order and defaults are preserved byte-for-byte from the prior per-field
-# calls so downstream logic (OpenRouter override, transcript parsing, the
-# /tmp/claude-ctx-window write) behaves identically:
-#   model            = .model.display_name // .model.id // "?"
-#   cwd              = .cwd // ""
-#   transcript_path  = .transcript_path // ""
-#   max_context      = .context_window.context_window_size // 200000
-#   session_id       = .session_id // "default"
-#   model_id         = .model.id // ""           (used by the OpenRouter block)
-# New optional segments (all default to empty when absent, e.g. API-key sessions):
-#   effort_level     = .effort.level
-#   rl_5h            = .rate_limits.five_hour.used_percentage
-#   rl_5h_reset      = .rate_limits.five_hour.resets_at
-#   rl_7d            = .rate_limits.seven_day.used_percentage
-#   rl_7d_reset      = .rate_limits.seven_day.resets_at
-# Fields are joined with the ASCII unit separator \x1f, NOT @tsv: tab is IFS
-# *whitespace* in bash, so consecutive tabs collapse and any EMPTY field (e.g.
-# transcript_path at session start, or the absent effort/rate-limit fields)
-# would silently shift every later field left. A non-whitespace IFS preserves
-# empty fields. See subagent-bar.sh FIELD-JOINING NOTE for the discovery story.
-IFS=$'\x1f' read -r model cwd transcript_path max_context session_id model_id \
-    effort_level rl_5h rl_5h_reset rl_7d rl_7d_reset < <(echo "$input" | jq -r '
-    [ (.model.display_name // .model.id // "?"),
-      (.cwd // ""),
-      (.transcript_path // ""),
-      (.context_window.context_window_size // 200000 | tostring),
-      (.session_id // "default"),
-      (.model.id // ""),
-      (.effort.level // ""),
-      (.rate_limits.five_hour.used_percentage // ""),
-      (.rate_limits.five_hour.resets_at // ""),
-      (.rate_limits.seven_day.used_percentage // ""),
-      (.rate_limits.seven_day.resets_at // "") ]
-    | map(tostring) | join("\u001f")
-')
+# One jq pass validates and normalizes every field before joining it with an
+# ASCII unit separator. Identity/path strings containing C0/DEL controls become
+# empty; display-only strings have those controls removed; numeric fields accept
+# only their expected JSON scalar type. The session ID is validated against the
+# complete path-safe grammar inside jq, before Bash can normalize a newline or
+# drop a NUL. Therefore every emitted field is delimiter/control-free and the
+# fixed-order read cannot be shifted by untrusted JSON content.
+model="?"
+cwd=""
+transcript_path=""
+max_context="200000"
+session_id=""
+model_id=""
+model_id_state="invalid"
+effort_level=""
+rl_5h=""
+rl_5h_reset=""
+rl_7d=""
+rl_7d_reset=""
+payload_parsed=0
+if command -v jq >/dev/null 2>&1; then
+    if IFS=$'\x1f' read -r model cwd transcript_path max_context session_id model_id \
+    model_id_state effort_level rl_5h rl_5h_reset rl_7d rl_7d_reset < <(printf '%s' "$input" | jq -er '
+        def has_control:
+            test("[[:cntrl:]]");
+        def display_string($fallback):
+            if type == "string" then gsub("[[:cntrl:]]"; "")
+            else $fallback
+            end;
+        def control_free_string:
+            if type == "string" then
+                if has_control then "" else . end
+            else ""
+            end;
+        def reset_scalar:
+            if type == "number" then tostring
+            elif type == "string" then
+                if has_control then "" else . end
+            else ""
+            end;
+        def valid_session_id:
+            if type == "string" then
+                (has_control | not) and
+                test("^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+            else false
+            end;
+
+        if type != "object" then error("statusline payload must be an object")
+        else
+            [ ((.model.display_name? // .model.id? // "?") | display_string("?")),
+              ((.cwd? // "") | control_free_string),
+              ((.transcript_path? // "") | control_free_string),
+              (if (.context_window.context_window_size? | type) == "number" then
+                   if .context_window.context_window_size > 0 and
+                          (.context_window.context_window_size | floor) == .context_window.context_window_size
+                   then (.context_window.context_window_size | tostring)
+                   else "200000"
+                   end
+               else "200000"
+               end),
+              (if (.session_id? | valid_session_id)
+               then .session_id
+               else ""
+               end),
+              ((.model.id? // "") | control_free_string),
+              (if (.model | type) == "object" and (.model | has("id")) and
+                       .model.id != null
+               then
+                   if (.model.id | type) == "string" and
+                          ((.model.id | has_control) | not) and
+                          (.model.id | length) > 0 and
+                          (.model.id | length) <= 160
+                   then "valid"
+                   else "invalid"
+                   end
+               else "absent"
+               end),
+              ((.effort.level? // "") | display_string("")),
+              (if (.rate_limits.five_hour.used_percentage? | type) == "number"
+               then (.rate_limits.five_hour.used_percentage | tostring)
+               else ""
+               end),
+              ((.rate_limits.five_hour.resets_at? // "") | reset_scalar),
+              (if (.rate_limits.seven_day.used_percentage? | type) == "number"
+               then (.rate_limits.seven_day.used_percentage | tostring)
+               else ""
+               end),
+              ((.rate_limits.seven_day.resets_at? // "") | reset_scalar) ]
+            | join("\u001f")
+        end
+    ' 2>/dev/null); then
+        payload_parsed=1
+    fi
+fi
+
+# Production caches live in /tmp. The override is a deterministic-test seam so
+# Bats can exercise writes inside project scratch without touching live session
+# state. Cache eligibility requires a successfully parsed payload plus a
+# nonempty session ID in the established UUID-safe character set and bounded
+# length. All other cases keep statusline rendering fail-open while skipping
+# every session-scoped cache read and write below.
+context_cache_dir="${DAAF_CONTEXT_BAR_CACHE_DIR:-/tmp}"
+session_id_safe=0
+if [[ "$payload_parsed" -eq 1 && \
+      "$session_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ && \
+      ${#session_id} -le 128 ]]; then
+    session_id_safe=1
+fi
+
+# Seed the authoritative main-session model cache from the statusline's
+# .model.id. Replace through a same-directory sibling so reminder/reporting
+# hooks never observe a partial write. An empty authoritative ID intentionally
+# replaces any stale value with an empty file, causing GPT-specific consumers to
+# treat identity as unresolved rather than guess.
+if [[ "$session_id_safe" -eq 1 ]]; then
+    model_cache="${context_cache_dir}/claude-model-${session_id}"
+    model_tmp="${model_cache}.tmp.$$"
+    # Brace-wrap the redirect so 2>/dev/null also covers an open() failure on '>'
+    # (redirections apply left-to-right; a bare `> f 2>/dev/null` still prints the
+    # open() diagnostic before 2> takes effect). Convention 6.
+    if { printf '%s' "$model_id" > "$model_tmp"; } 2>/dev/null; then
+        mv "$model_tmp" "$model_cache" 2>/dev/null || rm -f "$model_tmp" 2>/dev/null
+    else
+        rm -f "$model_tmp" 2>/dev/null
+    fi
+fi
 
 # Guard against an unparseable payload leaving max_context empty (which would
 # cause a divide-by-zero in the pct arithmetic below). Valid payloads always
@@ -90,10 +199,18 @@ fi
 # Directory basename from cwd
 dir=$(basename "$cwd" 2>/dev/null || echo "?")
 
-# Get git branch only (skip expensive status/sync checks)
+# Get git branch only (skip expensive status/sync checks). The branch name does
+# not pass through the jq control-strip stage, so strip controls here before it
+# reaches the printf '%s' render. jq -Rs (not tr) makes the strip Unicode-aware:
+# gsub([[:cntrl:]]) removes C0, DEL, AND C1 (U+0080-U+009F) — git refnames only
+# forbid bytes < 0x20 and DEL, so a hostile repo can name a branch with a
+# UTF-8-encoded C1 control (e.g. U+009B, 8-bit CSI on xterm-class terminals),
+# which byte-wise `tr -d '[:cntrl:]'` passed through. jq's UTF-8 decoding also
+# replaces raw stray bytes with inert U+FFFD. If jq is unavailable the branch
+# segment is simply omitted (fail-open; the bar is already degraded without jq).
 branch=""
 if [[ -n "$cwd" && -d "$cwd" ]]; then
-    branch=$(git -C "$cwd" branch --show-current 2>/dev/null)
+    branch=$(git -C "$cwd" branch --show-current 2>/dev/null | jq -Rsr 'gsub("[[:cntrl:]]"; "")' 2>/dev/null) || branch=""
 fi
 
 # Context window size: from JSON above, but override for OpenRouter models where
@@ -110,23 +227,28 @@ fi
 # authoritative catalogue result and must not be mistaken for the generic
 # fallback by the static map below.
 or_context_resolved=0
-# Production uses /tmp so hooks and statuslines share one session cache. The
-# override is a deterministic-test seam only: Bats points it at project scratch
-# so fake OpenRouter catalogues never write fixture data outside the repository.
-context_cache_dir="${DAAF_CONTEXT_BAR_CACHE_DIR:-/tmp}"
-if [[ "${ANTHROPIC_BASE_URL:-}" == *openrouter.ai* ]]; then
+# context_cache_dir and the session-ID path guard are initialized immediately
+# after payload extraction. Malformed session IDs skip this cache-backed branch.
+if [[ "$session_id_safe" -eq 1 && "${ANTHROPIC_BASE_URL:-}" == *openrouter.ai* ]]; then
     # model_id already extracted in the consolidated jq pass above
     # (byte-identical to the old `.model.id // empty`).
     or_cache="${context_cache_dir}/claude-or-models-${session_id}"
 
     if [[ -n "$model_id" && ! -s "$or_cache" ]]; then
         # Fetch models list once per session (3s timeout to avoid blocking statusline).
-        # Write to a temp file first and move atomically to prevent truncated JSON
-        # from a mid-download timeout from poisoning the cache for the entire session.
-        or_tmp="${or_cache}.tmp"
-        if curl -sf --connect-timeout 3 --max-time 3 \
-            "https://openrouter.ai/api/v1/models" > "$or_tmp" 2>/dev/null; then
-            mv "$or_tmp" "$or_cache" 2>/dev/null
+        # Writer-private temp ($$ suffix) prevents a fixed-name race under
+        # overlapping session refreshes. Validate that the body is a JSON object
+        # carrying a .data array BEFORE the atomic promote, so a truncated or
+        # garbage 200-body (curl -sf already rejects non-2xx/timeout) cannot poison
+        # the cache for the rest of the session. Convention 6/8.
+        or_tmp="${or_cache}.tmp.$$"
+        if { curl -sf --connect-timeout 3 --max-time 3 \
+            "https://openrouter.ai/api/v1/models" > "$or_tmp"; } 2>/dev/null; then
+            if jq -e '.data | type == "array"' "$or_tmp" >/dev/null 2>&1; then
+                mv "$or_tmp" "$or_cache" 2>/dev/null || rm -f "$or_tmp" 2>/dev/null
+            else
+                rm -f "$or_tmp" 2>/dev/null
+            fi
         else
             rm -f "$or_tmp" 2>/dev/null
         fi
@@ -170,11 +292,30 @@ fi
 # have smaller windows than the base gpt-5.4/5.5/5.6 flagships (the whole
 # gpt-5.6 Sol/Terra/Luna family is 1,050,000), so they must precede the broad
 # flagship and *gpt-5* fallbacks. Verified against OpenRouter on 2026-07-09.
+# Closed-set GPT flagship grammar (Convention 3). Only the exact flagship set —
+# bare gpt-5.4/5.5/5.6 plus the sol/terra/luna codenames, with an optional [1m]
+# badge — is eligible for the 1,050,000 physical window (and the 370k ChatGPT-lane
+# cap arm below). Anchored so malformed suffixes (gpt-5.4-, gpt-5.6-experimental,
+# gpt-5.5[1m, gpt-5.6-sol[1m]x) fall through to the ordinary default rather than
+# being mapped to the flagship window. New codenames are a deliberate one-line edit
+# here, consistent with DAAF's validate-before-trust policy. Stored in a variable
+# to avoid [[ =~ ]] quoting pitfalls; defined unconditionally so it is in scope for
+# the ChatGPT-lane predicate below even when this static-map block is skipped.
+gpt_flagship_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?(\[1m\])?$'
+# Closed-set mini/chat grammars (Convention 3), byte-consistent with
+# subagent-bar.sh's anchored EREs. These replace the old open-ended inner globs
+# (*-mini*/*-chat*) so suffixed near-misses (e.g. gpt-5.6-mini-preview) fail the
+# anchor and fall through to the conservative 200k default rather than being
+# mapped to 400k/128k. Anchored on the same provider-stripped physical_slug the
+# globs inspected. Defined here alongside the flagship grammar for locality.
+gpt_mini_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-mini(\[1m\])?$'
+gpt_chat_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-chat(\[1m\])?$'
 if [[ -n "$model_id" && "$or_context_resolved" -eq 0 && "$max_context" -eq 200000 ]]; then
     # Physical-family classification operates on the terminal provider-stripped
-    # slug only. Supported flagship versions must begin the slug and be followed
-    # by end-of-slug, '-' or '['; this rejects notgpt-5.6 and gpt-5.60 while
-    # retaining provider prefixes and established hyphen/[1m] variants.
+    # slug only. mini/chat variants have smaller windows and are matched by their
+    # own arms before the anchored flagship test; the flagship 1,050,000 window is
+    # granted only when the anchored grammar matches, so notgpt-5.6, gpt-5.60, and
+    # trailing-junk near-misses stay on the ordinary default.
     physical_slug="${model_id##*/}"
     case "$model_id" in
         z-ai/glm-5.2|z-ai/glm-5.2-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])
@@ -182,11 +323,17 @@ if [[ -n "$model_id" && "$or_context_resolved" -eq 0 && "$max_context" -eq 20000
         *)
             case "$physical_slug" in
                 gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-                    case "$physical_slug" in
-                        *-mini*) max_context=400000 ;;
-                        *-chat*) max_context=128000 ;;
-                        *) max_context=1050000 ;;
-                    esac
+                    # Closed-set classification (Convention 3), byte-consistent
+                    # with subagent-bar.sh: only the anchored flagship/mini/chat
+                    # grammars earn a GPT window. Order flagship, then mini, then
+                    # chat. Malformed suffixes that reached this family glob (e.g.
+                    # gpt-5.4-, gpt-5.6-experimental, gpt-5.6-mini-preview,
+                    # gpt-5.6-sol[1m]x) match none and fall through to the 200k
+                    # default (max_context is already 200000 in this block).
+                    if   [[ "$physical_slug" =~ $gpt_flagship_re ]]; then max_context=1050000
+                    elif [[ "$physical_slug" =~ $gpt_mini_re ]];     then max_context=400000
+                    elif [[ "$physical_slug" =~ $gpt_chat_re ]];     then max_context=128000
+                    fi
                     ;;
                 gpt-5|gpt-5[-\[]*|gpt-5.2|gpt-5.2[-\[]*)
                     case "$physical_slug" in
@@ -222,11 +369,12 @@ fi
 # lane values fail-open, while API/OpenRouter routes retain their wider windows.
 gpt_flagship=0
 physical_slug="${model_id##*/}"
-case "$physical_slug" in
-    gpt-5*-mini*|gpt-5*-chat*) ;;
-    gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-        gpt_flagship=1 ;;
-esac
+# Same anchored closed-set predicate as the static map (Convention 3): the 370k
+# lane cap applies only to the exact flagship set, so mini/chat variants and
+# malformed near-misses keep their resolved (wider or default) window fail-open.
+if [[ "$physical_slug" =~ $gpt_flagship_re ]]; then
+    gpt_flagship=1
+fi
 if [[ "${DAAF_PROVIDER_SHIM:-}" == "openai" && \
       "${SHIM_BACKEND_MODE:-}" == "chatgpt" && \
       "$gpt_flagship" -eq 1 && "$max_context" -gt 370000 ]]; then
@@ -235,8 +383,23 @@ fi
 
 max_k=$((max_context / 1000))
 
-# Share context window size with hooks (which don't receive it in their input payload)
-echo "$max_context" > "${context_cache_dir}/claude-ctx-window-${session_id}" 2>/dev/null
+# Share context window size with hooks (which don't receive it in their input
+# payload). Unsafe session IDs skip the path construction and retain fail-open
+# statusline output without creating an attacker-controlled cache path.
+if [[ "$session_id_safe" -eq 1 ]]; then
+    # Atomic publish (Convention 7): a concurrent reader (context-reporter.sh) must
+    # never observe a momentarily-empty file from a direct truncate-write and fall
+    # back to 200k. Write a writer-private temp then rename, mirroring the model
+    # cache above. Brace-wrap so 2>/dev/null covers an open() failure on '>' too
+    # (Convention 6); if the cache dir is unusable, skip caching and keep rendering.
+    ctx_window_cache="${context_cache_dir}/claude-ctx-window-${session_id}"
+    ctx_window_tmp="${ctx_window_cache}.tmp.$$"
+    if { printf '%s\n' "$max_context" > "$ctx_window_tmp"; } 2>/dev/null; then
+        mv "$ctx_window_tmp" "$ctx_window_cache" 2>/dev/null || rm -f "$ctx_window_tmp" 2>/dev/null
+    else
+        rm -f "$ctx_window_tmp" 2>/dev/null
+    fi
+fi
 
 # Calculate context bar from transcript
 if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
@@ -255,14 +418,21 @@ if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
             (.message.usage.cache_read_input_tokens // 0) +
             (.message.usage.cache_creation_input_tokens // 0)
         )] | map(select(. > 0)) | last // 0
-    ' < "$transcript_path")
+    ' < "$transcript_path" 2>/dev/null)
 
     # 20k baseline: conservative default estimate for system prompt, tools, memory,
     # skills, env block, XML framing, and other dynamic context
     baseline=20000
     bar_width=10
 
-    if [[ "$context_length" -gt 0 ]]; then
+    # Bounded numerator (Convention 5): only multiply context_length by 100 when it
+    # is a canonical positive decimal AND <= floor(INT64_MAX/100) = 92233720368547758,
+    # so a huge but int64-valid token count cannot overflow signed-64 arithmetic and
+    # wrap pct negative (a negative pct evades the `-gt 100` clamp and would render).
+    # is_canonical_positive_decimal guarantees the value fits in int64, so the -le
+    # comparison is itself overflow-safe. Anything else falls to the baseline estimate.
+    if is_canonical_positive_decimal "$context_length" && \
+       [[ "$context_length" -le 92233720368547758 ]]; then
         pct=$((context_length * 100 / max_context))
         pct_prefix=""
     else
@@ -327,11 +497,28 @@ fi
 # is the unmodified name.
 model_name="$model"
 gpt_model=0
-# Detect a GPT/shim model from either the id or the display name (belt-and-braces:
-# some payloads carry the slug only in display_name).
-case "${model_id}${model_name}" in
-    *gpt-*|*GPT-*) gpt_model=1 ;;
-esac
+# Classify only a bounded, anchored terminal GPT slug. The consolidated payload
+# parser preserves whether model.id is valid, genuinely absent/null, or present
+# but invalid; display_name is a fallback only for the absent/null state. Provider
+# prefixes are stripped before matching, while malformed left boundaries such as
+# notgpt-*, xgpt-*, and foo-gpt-* cannot match.
+# The display fallback first removes the established effort suffix and duplicate
+# [1m] cosmetic so legitimate shim display slugs retain their prior behavior.
+gpt_status_slug_re='^(gpt|GPT)-[A-Za-z0-9][A-Za-z0-9._-]*(\[1m\])?$'
+gpt_status_candidate=""
+if [[ "$model_id_state" == "valid" ]]; then
+    gpt_status_candidate="${model_id##*/}"
+elif [[ "$model_id_state" == "absent" ]]; then
+    gpt_status_candidate="${model_name##*/}"
+    gpt_status_candidate="${gpt_status_candidate%%#*}"
+    while [[ "$gpt_status_candidate" == *'[1m][1m]' ]]; do
+        gpt_status_candidate="${gpt_status_candidate%'[1m]'}"
+    done
+fi
+if [[ ${#gpt_status_candidate} -le 160 && \
+      "$gpt_status_candidate" =~ $gpt_status_slug_re ]]; then
+    gpt_model=1
+fi
 
 if [[ "$gpt_model" -eq 1 ]]; then
     # 1) strip a trailing "#<effort>" token (and anything the client appended
@@ -352,6 +539,132 @@ if [[ -n "$effort_level" && "$gpt_model" -ne 1 ]]; then
     model_disp="${model_name} (${effort_level})"
 fi
 
+# --- GPT provider-shim Fast indicator ---
+# Render one route-neutral ON-only label. The indicator requires the existing
+# statusline GPT classification, an exact supported shim route, exact local
+# native-Fast disablement, and a strictly validated /health ON state. Every
+# missing, invalid, OFF, ineffective, mismatched, or unavailable state is silent.
+gpt_tier_seg=""
+if [[ "$gpt_model" -eq 1 && \
+      "${DAAF_PROVIDER_SHIM:-}" == "openai" && \
+      ( "${SHIM_BACKEND_MODE:-}" == "chatgpt" || \
+        "${SHIM_BACKEND_MODE:-}" == "openai" ) && \
+      "${CLAUDE_CODE_DISABLE_FAST_MODE:-}" == "1" ]]; then
+    gpt_route="${SHIM_BACKEND_MODE}"
+    health_port="${SHIM_PORT:-4141}"
+    if ! is_canonical_positive_decimal "$health_port" || \
+       [[ "$health_port" -gt 65535 ]]; then
+        health_port=4141
+    fi
+
+    health_on=""
+    if command -v curl >/dev/null 2>&1 && \
+       command -v python3 >/dev/null 2>&1 && \
+       command -v jq >/dev/null 2>&1; then
+        # Disable ambient curl config with first-option -q, then enforce hardcoded
+        # loopback, proxy bypass, zero allowed redirects, short deadlines, and a
+        # 16 KiB transfer ceiling. Before jq, Python's stdlib parser rejects duplicate
+        # member names at every object depth and emits canonical JSON; pipefail makes
+        # any transport/parser/semantic failure silent. Only literal "on" enters Bash.
+        health_on=$(
+            set -o pipefail
+            curl -q --fail --silent --show-error \
+                --location --max-redirs 0 \
+                --noproxy '*' --proxy '' \
+                --connect-timeout 0.2 --max-time 0.6 \
+                --max-filesize 16384 \
+                "http://127.0.0.1:${health_port}/health" 2>/dev/null |
+            python3 -c '
+import json, sys
+reject = lambda pairs: dict(pairs) if len(pairs) == len(dict(pairs)) else (_ for _ in ()).throw(ValueError("duplicate object member"))
+reject_constant = lambda value: (_ for _ in ()).throw(ValueError("invalid JSON constant"))
+json.dump(json.load(sys.stdin, object_pairs_hook=reject, parse_constant=reject_constant), sys.stdout, ensure_ascii=False, allow_nan=False, separators=(",", ":"))
+' 2>/dev/null |
+            jq -er --arg expected_backend "$gpt_route" '
+                def exact_keys($expected):
+                    type == "object" and
+                    ((keys | sort) == ($expected | sort));
+                def canonical_version:
+                    type == "string" and
+                    test("^[A-Za-z0-9._+-]{1,64}$");
+                def bounded_terminal_model:
+                    type == "string" and
+                    test("^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$");
+
+                if type != "object" then error("health must be an object") else . end
+                | select(.service == "daaf-anthropic-openai-shim")
+                | select(.status == "ok")
+                | select(.version | canonical_version)
+                | select(.backend_mode == $expected_backend)
+                | .gpt_service_tier as $g
+                | select($g | exact_keys([
+                    "backend_mode", "requested_tier_vocabulary", "policy",
+                    "native_fast_disabled", "latest_terminal"
+                  ]))
+                | select($g.backend_mode == $expected_backend)
+                | select(
+                    ($expected_backend == "chatgpt" or
+                     $expected_backend == "openai") and
+                    $g.requested_tier_vocabulary == "priority"
+                  )
+                | select($g.native_fast_disabled | type == "boolean")
+                | $g.policy as $p
+                | select($p | exact_keys([
+                    "status", "backend_mode", "enabled", "effective"
+                  ]))
+                | select(["ok", "missing", "invalid", "unreadable", "unsafe"] |
+                         index($p.status))
+                | select($p.backend_mode == null or
+                         $p.backend_mode == "chatgpt" or
+                         $p.backend_mode == "openai")
+                | select(($p.enabled | type) == "boolean" and
+                         ($p.effective | type) == "boolean")
+                | select(
+                    ($p.status == "ok" and $p.backend_mode != null) or
+                    ($p.status != "ok" and $p.backend_mode == null and
+                     ($p.enabled | not) and ($p.effective | not))
+                  )
+                | select(($p.effective | not) or
+                         ($p.enabled and $p.backend_mode == $expected_backend))
+                | $g.latest_terminal as $l
+                | select($l == null or (
+                    ($l | exact_keys([
+                      "model", "requested_service_tier", "requested_source",
+                      "served_service_tier", "completed_at"
+                    ])) and
+                    ($l.model == null or ($l.model | bounded_terminal_model)) and
+                    ($l.requested_service_tier == null or
+                     (($expected_backend == "chatgpt" or
+                       $expected_backend == "openai") and
+                      $l.requested_service_tier == "priority")) and
+                    (["none", "anthropic", "shim_global", "both"] |
+                     index($l.requested_source)) and
+                    (($l.requested_source == "none") ==
+                     ($l.requested_service_tier == null)) and
+                    ([null, "fast", "priority", "default", "flex", "scale", "auto"] |
+                     index($l.served_service_tier)) and
+                    (($l.completed_at | type) == "string") and
+                    ($l.completed_at |
+                     test("^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$")) and
+                    (($l.completed_at |
+                      try (fromdateiso8601 | strftime("%Y-%m-%dT%H:%M:%SZ")) catch "") ==
+                     $l.completed_at)
+                  ))
+                | select($g.native_fast_disabled == true)
+                | select($p.status == "ok" and
+                         $p.backend_mode == $expected_backend and
+                         $p.enabled == true and
+                         $p.effective == true)
+                | "on"
+            ' 2>/dev/null
+        ) || health_on=""
+    fi
+
+    if [[ "$health_on" == "on" ]]; then
+        gpt_tier_seg=" ${C_GRAY}|${C_RESET} ${C_GRAY}GPT Fast On${C_RESET}"
+    fi
+fi
+
 # --- Rate-limit segment ---
 # Present only for Claude.ai subscriber sessions (absent on API-key sessions).
 # Renders as: Plan usage: 5h:42%(2h10m) 7d:13%(3d4h)
@@ -392,6 +705,16 @@ fmt_reset() {
         printf '(%dh%dm)' $((remain / 3600)) $(((remain % 3600) / 60))
     fi
 }
+window_label_for() {
+    # $1 = window length in whole minutes (a validated positive integer). Echoes a
+    # compact window label: divisible by 1440 -> "<N>d" (10080 -> 7d), else divisible
+    # by 60 -> "<N>h" (300 -> 5h), else "<N>m". Pure arithmetic on a pre-validated int.
+    local min="$1"
+    if   [[ $((min % 1440)) -eq 0 ]]; then printf '%dd' $((min / 1440))
+    elif [[ $((min % 60)) -eq 0 ]];   then printf '%dh' $((min / 60))
+    else                                   printf '%dm' "$min"
+    fi
+}
 if [[ -n "$rl_5h" || -n "$rl_7d" ]]; then
     rl_body=""
     if [[ -n "$rl_5h" ]]; then
@@ -414,13 +737,141 @@ if [[ -n "$rl_5h" || -n "$rl_7d" ]]; then
     [[ -n "$rl_body" ]] && rl_seg=" ${C_GRAY}|${C_RESET} ${C_GRAY}Plan usage:${C_RESET} ${rl_body}"
 fi
 
-# Build output: Model (effort) | Dir | Branch | Context [| Plan usage]
+# --- Codex (ChatGPT-subscription) Plan-usage fallback ---
+# On shim-lane sessions the native Anthropic rate-limit payload fields are absent;
+# instead the provider shim caches its latest ChatGPT-subscription quota snapshot to
+# scripts/provider_shim/logs/quota_state.json (see anthropic_openai_shim.py
+# _write_quota_state — install-shared under the shared-/daaf assumption). Render that
+# file as the SAME unchanged "Plan usage:" segment, reusing rl_color_for/fmt_reset.
+# Gate (belt-and-braces): the exact shim lane AND no native rate limits in the payload
+# (if the payload somehow carries native limits, they win and this read is skipped).
+# Everything here is pure string/arithmetic + one local file read; any parse or
+# validation failure yields no segment and leaves the rest of the statusline untouched.
+if [[ -z "$rl_seg" && \
+      "${DAAF_PROVIDER_SHIM:-}" == "openai" && \
+      "${SHIM_BACKEND_MODE:-}" == "chatgpt" && \
+      -z "$rl_5h" && -z "$rl_7d" ]]; then
+    # State-file path: default derived from this script's own location
+    # (.claude/scripts -> repo root -> scripts/provider_shim/logs/quota_state.json).
+    # DAAF_QUOTA_STATE_FILE is a deterministic-test seam mirroring
+    # DAAF_CONTEXT_BAR_CACHE_DIR: Bats points it at project scratch so tests never
+    # depend on a live shim's log directory.
+    quota_state_file="${DAAF_QUOTA_STATE_FILE:-}"
+    if [[ -z "$quota_state_file" ]]; then
+        cb_scripts_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P 2>/dev/null)" || cb_scripts_dir=""
+        if [[ -n "$cb_scripts_dir" ]]; then
+            quota_state_file="${cb_scripts_dir%/.claude/scripts}/scripts/provider_shim/logs/quota_state.json"
+        fi
+    fi
+
+    if [[ -n "$quota_state_file" && -f "$quota_state_file" ]] && command -v jq >/dev/null 2>&1; then
+        # One jq pass: require a top-level object, emit captured_at plus the six
+        # numeric primary/secondary fields as an ASCII-unit-separated record. String
+        # fields carrying any control character (including the \x1f delimiter) become
+        # empty so untrusted content cannot shift the fixed-order read; every emitted
+        # field is validated numerically in Bash below before any use.
+        q_captured=""
+        q_p_pct=""
+        q_p_win=""
+        q_p_reset=""
+        q_s_pct=""
+        q_s_win=""
+        q_s_reset=""
+        codex_parsed=0
+        if IFS=$'\x1f' read -r q_captured q_p_pct q_p_win q_p_reset q_s_pct q_s_win q_s_reset \
+            < <(jq -er '
+                def num_string:
+                    if type == "string" then (if test("[[:cntrl:]]") then "" else . end)
+                    elif type == "number" then tostring
+                    else "" end;
+                if type != "object" then error("quota_state must be an object")
+                else
+                    [ (if (.captured_at? | type) == "number" and
+                            (.captured_at | floor) == .captured_at
+                       then (.captured_at | tostring) else "" end),
+                      (.primary_used_pct? | num_string),
+                      (.primary_window_min? | num_string),
+                      (.primary_reset_s? | num_string),
+                      (.secondary_used_pct? | num_string),
+                      (.secondary_window_min? | num_string),
+                      (.secondary_reset_s? | num_string) ]
+                    | join("\u001f")
+                end
+            ' "$quota_state_file" 2>/dev/null); then
+            codex_parsed=1
+        fi
+
+        # Plan-usage percent parity with the native rate-limit path (Convention 9):
+        # floor a fractional percent (69.9 -> 69) so a legitimate fractional value
+        # is KEPT rather than dropped by the integer-only validator below, and so
+        # the <=100 clamp has an integer to compare. The strip is gated on a strict
+        # plain-decimal shape (^[0-9]+\.[0-9]+$) so ONLY a genuine fractional is
+        # floored: an exponent-notation value carrying a dot (e.g. "1.0e999") must not
+        # survive the strip as "1" and render "1%" — leaving it intact makes the
+        # is_canonical_nonneg_decimal gate below drop it (fail-closed). A non-numeric or
+        # negative value likewise stays intact and remains a fail-closed drop.
+        [[ "$q_p_pct" =~ ^[0-9]+\.[0-9]+$ ]] && q_p_pct="${q_p_pct%.*}"
+        [[ "$q_s_pct" =~ ^[0-9]+\.[0-9]+$ ]] && q_s_pct="${q_s_pct%.*}"
+
+        # Primary window is mandatory: captured_at + used-percent (0 allowed) + a
+        # positive window length + reset-after (0 allowed) must all validate.
+        if [[ "$codex_parsed" -eq 1 ]] && \
+           is_canonical_nonneg_decimal "$q_captured" && \
+           is_canonical_nonneg_decimal "$q_p_pct" && \
+           is_canonical_positive_decimal "$q_p_win" && \
+           is_canonical_nonneg_decimal "$q_p_reset"; then
+            # Clamp to <=100 (parity with the native path's intent): a stale/overshoot
+            # cached percent must not render as e.g. 101%. Validated int64 above, so
+            # the arithmetic comparison is safe.
+            (( q_p_pct > 100 )) && q_p_pct=100
+            now_epoch=$(date +%s 2>/dev/null) || now_epoch=""
+            # Both operands are already bounded to int64-representable canonical decimals
+            # (is_canonical_nonneg_decimal above), but if their sum were ever to overflow
+            # bash's 64-bit arithmetic, it wraps negative -- which safely fails the
+            # `-gt now_epoch` staleness check below rather than corrupting the display.
+            primary_reset_epoch=$((q_captured + q_p_reset))
+            # Staleness: an expired primary window means the cached percent is stale, so
+            # drop the ENTIRE segment (no display beats a wrong display).
+            if [[ "$now_epoch" =~ ^[0-9]+$ && "$primary_reset_epoch" -gt "$now_epoch" ]]; then
+                cbody=""
+                pwl=$(window_label_for "$q_p_win")
+                pcolor=$(rl_color_for "$q_p_pct")
+                pcd=$(fmt_reset "$primary_reset_epoch")
+                cbody+="${pcolor}${pwl}:${q_p_pct}%${C_RESET}"
+                [[ -n "$pcd" ]] && cbody+="${C_GRAY}${pcd}${C_RESET}"
+                # Secondary renders only when its window is > 0 and its percent
+                # validates; live data shows an all-zero secondary, which is omitted.
+                if is_canonical_positive_decimal "$q_s_win" && \
+                   is_canonical_nonneg_decimal "$q_s_pct"; then
+                    (( q_s_pct > 100 )) && q_s_pct=100
+                    swl=$(window_label_for "$q_s_win")
+                    scolor=$(rl_color_for "$q_s_pct")
+                    cbody+=" ${scolor}${swl}:${q_s_pct}%${C_RESET}"
+                    if is_canonical_nonneg_decimal "$q_s_reset"; then
+                        secondary_reset_epoch=$((q_captured + q_s_reset))
+                        scd=$(fmt_reset "$secondary_reset_epoch")
+                        [[ -n "$scd" ]] && cbody+="${C_GRAY}${scd}${C_RESET}"
+                    fi
+                fi
+                rl_seg=" ${C_GRAY}|${C_RESET} ${C_GRAY}Plan usage:${C_RESET} ${cbody}"
+            fi
+        fi
+    fi
+fi
+
+# Build output: Model (effort) | Dir | Branch | Context
+#               [| GPT Fast On] [| Plan usage]
 output="${C_ACCENT}${model_disp}${C_GRAY} | 📁${dir}"
 [[ -n "$branch" ]] && output+=" | 🔀${branch}"
 output+=" | ${ctx}${C_RESET}"
+output+="${gpt_tier_seg}"
 output+="${rl_seg}"
 
-printf '%b\n' "$output"
+# Render with %s (not %b): the color bytes already live in the $'...' constants,
+# so untrusted field content (model name, effort, cwd, branch, message) is emitted
+# verbatim and its backslash sequences stay inert — a printable \033]52;c;... OSC
+# payload in a field can never be re-materialized into a real escape. Convention 1.
+printf '%s\n' "$output"
 
 # Get user's last message (text only, not tool results, skip unhelpful messages)
 if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
@@ -443,7 +894,7 @@ if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
         map(.message.content |
             if type == "string" then .
             else [.[] | select(.type == "text") | .text] | join(" ") end |
-            gsub("\n"; " ") | gsub("  +"; " ")) |
+            gsub("[[:cntrl:]]"; " ") | gsub("  +"; " ")) |
         map(select(is_unhelpful | not)) |
         first // ""
     ' < "$transcript_path" 2>/dev/null)
diff --git a/.claude/scripts/subagent-bar.sh b/.claude/scripts/subagent-bar.sh
index fa8ba185..900e9823 100755
--- a/.claude/scripts/subagent-bar.sh
+++ b/.claude/scripts/subagent-bar.sh
@@ -63,9 +63,14 @@
 set -u
 
 # --- Color codes ---
-C_RESET='\033[0m'
-C_GRAY='\033[38;5;245m'
-C_BAR_EMPTY='\033[38;5;238m'
+# ANSI-C quoting ($'…') so the ESC byte lives in these TRUSTED constants, not in
+# a printf '%b' pass over the assembled string (Convention 1). The final render
+# uses printf '%s' (see the emit step), so a printable backslash escape arriving
+# in an untrusted field (model name, agentType, description) stays inert rather
+# than being re-materialized into a real ESC/OSC/BEL sequence.
+C_RESET=$'\033[0m'
+C_GRAY=$'\033[38;5;245m'
+C_BAR_EMPTY=$'\033[38;5;238m'
 # Severity palette aligned to the Context Quality Curve. The exact numeric
 # thresholds are quality-tier conditional (see the per-row severity block near
 # the bottom of the loop): Fable/Mythos patterns use ELEVATED >= 30% OR >= 300k,
@@ -79,10 +84,10 @@ C_BAR_EMPTY='\033[38;5;238m'
 #   ELEVATED amber
 #   HIGH     orange  (bold to distinguish from amber)
 #   CRITICAL red
-C_NOMINAL='\033[38;5;71m'    # green
-C_ELEVATED='\033[38;5;179m'  # amber
-C_HIGH='\033[1;38;5;173m'    # orange, bold
-C_CRITICAL='\033[38;5;167m'  # red
+C_NOMINAL=$'\033[38;5;71m'    # green
+C_ELEVATED=$'\033[38;5;179m'  # amber
+C_HIGH=$'\033[1;38;5;173m'    # orange, bold
+C_CRITICAL=$'\033[38;5;167m'  # red
 
 # Accept only canonical positive decimal integers that Bash can represent
 # safely. Lexical and length/string bounds run before any arithmetic, so values
@@ -98,6 +103,16 @@ is_canonical_positive_decimal() {
     [[ "$value" == "$max_value" || "$value" < "$max_value" ]]
 }
 
+# Bounded identifier allowlist for values interpolated into cache/transcript
+# paths (session_id, per-agent id). Leading alnum, then alnum/dot/underscore/
+# hyphen, max 128 chars (Convention 2). Rejects slashes, traversal (..), control
+# chars, leading dash, empty, and >128. A present-but-invalid id is rejected
+# exactly like an absent one (key-presence contract shared with context-bar.sh
+# and the provider shim). Same name + regex across the hardened renderers.
+is_safe_id() {
+    [[ "${1:-}" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]]
+}
+
 # Return a signature that changes when a transcript is appended or rewritten.
 # GNU stat supplies byte size plus nanosecond-resolution mtime in one probe.
 transcript_signature() {
@@ -131,18 +146,29 @@ resolve_model_cache() {
     fi
 
     if [[ -n "$transcript" && -f "$transcript" ]]; then
-        model=$(tail -n 50 "$transcript" 2>/dev/null | jq -rs '
+        # Full-transcript scan (Convention 4): no `tail -n 50` bound, so more than
+        # 50 trailing synthetic/placeholder model entries cannot hide the last
+        # real model. The `< "$transcript"` redirect keeps a missing/binary file
+        # fail-open, mirroring context-bar.sh's recovery idiom.
+        model=$(jq -rs '
             [.[] | (.message.model // empty)
              | select(. != "" and . != "<synthetic>")] | last // empty
-        ' 2>/dev/null) || model=""
+        ' < "$transcript" 2>/dev/null) || model=""
     fi
     [[ -z "$model" ]] && model="$cached_model"
 
     if [[ -n "$model" && -n "$signature" ]]; then
-        if printf '%s' "$model" > "$model_tmp" 2>/dev/null &&
-           printf '%s' "$signature" > "$signature_tmp" 2>/dev/null &&
-           mv "$model_tmp" "$cache" 2>/dev/null &&
-           mv "$signature_tmp" "$signature_cache" 2>/dev/null; then
+        # Group the writes+moves under ONE stderr redirect (Convention 6): a
+        # `> "$tmp"` open() failure emits its diagnostic BEFORE a trailing
+        # `2>/dev/null` on the same simple command takes effect, so the whole
+        # sequence is wrapped to suppress the open() error too. If the cache dir
+        # is unusable, drop the temps and continue without caching (fail-open).
+        if {
+            printf '%s' "$model" > "$model_tmp" &&
+            printf '%s' "$signature" > "$signature_tmp" &&
+            mv -- "$model_tmp" "$cache" &&
+            mv -- "$signature_tmp" "$signature_cache"
+        } 2>/dev/null; then
             :
         else
             rm -f "$model_tmp" "$signature_tmp" 2>/dev/null
@@ -164,6 +190,18 @@ IFS=$'\x1f' read -r session_id transcript_path < <(printf '%s' "$input" | jq -r
 session_id="${session_id:-}"
 transcript_path="${transcript_path:-}"
 
+# Reject a present-but-unsafe session id before it reaches any cache/transcript
+# path (Convention 2). Blanking it makes every session-scoped cache read/write
+# below no-op via the existing [[ -n "$session_id" ]] guards, and the window
+# falls back to the newest cache / 200k default — fail-open, no row lost.
+is_safe_id "$session_id" || session_id=""
+
+# Cache base dir. Production caches live in /tmp; the override is a
+# deterministic-test seam (mirrors context-bar.sh's DAAF_CONTEXT_BAR_CACHE_DIR)
+# so bats can point writes at project scratch and exercise ENOTDIR paths without
+# touching live session state. Default preserves production behavior exactly.
+cache_dir="${DAAF_SUBAGENT_BAR_CACHE_DIR:-/tmp}"
+
 # Sidecar directory holding agent-<id>.meta.json (agentType lookup source).
 subagents_dir=""
 if [[ -n "$transcript_path" && -n "$session_id" ]]; then
@@ -175,11 +213,11 @@ fi
 # cache written by context-bar.sh, else the most recent cache from any session,
 # else 200000. This script NEVER writes the cache.
 max_context=""
-if [[ -n "$session_id" && -f "/tmp/claude-ctx-window-${session_id}" ]]; then
-    max_context=$(cat "/tmp/claude-ctx-window-${session_id}" 2>/dev/null)
+if [[ -n "$session_id" && -f "${cache_dir}/claude-ctx-window-${session_id}" ]]; then
+    max_context=$(cat "${cache_dir}/claude-ctx-window-${session_id}" 2>/dev/null)
 fi
 if [[ -z "$max_context" ]]; then
-    latest_ctx=$(ls -t /tmp/claude-ctx-window-* 2>/dev/null | head -1)
+    latest_ctx=$(ls -t "${cache_dir}"/claude-ctx-window-* 2>/dev/null | head -1)
     if [[ -n "${latest_ctx:-}" ]]; then
         max_context=$(cat "$latest_ctx" 2>/dev/null)
     fi
@@ -194,7 +232,7 @@ fi
 # current signature so a real model switch cannot leave the comparison stale.
 session_model=""
 if [[ -n "$session_id" ]]; then
-    session_model=$(resolve_model_cache "$transcript_path" "/tmp/claude-model-${session_id}")
+    session_model=$(resolve_model_cache "$transcript_path" "${cache_dir}/claude-model-${session_id}")
 fi
 
 # --- Extract tasks (single jq pass, one \x1f-joined record per line) ---
@@ -202,10 +240,19 @@ fi
 # are dropped (they cannot be keyed in the output). label/name are sanitized
 # of newlines/tabs/\x1f so one task always stays one record line.
 tasks_rec=$(printf '%s' "$input" | jq -r '
-    def clean: tostring | gsub("[\n\r\t]"; " ");
+    # clean strips ALL C0 controls + DEL (Convention 1), not just \n\r\t\x1f: a
+    # JSON-escaped control (e.g. an escaped ESC) parses to a real ESC byte here,
+    # so stripping it stops the byte reaching the rendered row. Replacement is a
+    # space (not "") to preserve the \x1f record structure. C1 bytes are handled
+    # upstream: jq rejects raw C1 in JSON input, so they never reach this stage.
+    def clean: tostring | gsub("[[:cntrl:]]"; " ");
     (.tasks // [])[]
-    | select((.id // "") != "")
-    | [ (.id // "" | clean),
+    # id must be a string (Convention 2): a JSON number/object id is malformed
+    # input and is dropped here; a path-unsafe string id is rejected later by
+    # is_safe_id in the render loop before any path is built from it.
+    | select((.id | type) == "string")
+    | select((.id | clean) != "")
+    | [ (.id | clean),
         (.type // "" | clean),
         (.name // "" | clean),
         (.status // "" | clean),
@@ -216,10 +263,28 @@ tasks_rec=$(printf '%s' "$input" | jq -r '
 
 [[ -z "$tasks_rec" ]] && exit 0
 
+# Closed-set GPT classifier grammar (Convention 3). Anchored EREs on the
+# provider-stripped terminal slug replace the old open-ended case-globs
+# (gpt-5.6[-\[]*), which mapped malformed ids (gpt-5.6-experimental,
+# gpt-5.6-sol[1m]x, gpt-5.4-) into the 1.05M physical window. A new codename is a
+# deliberate one-line registry edit here, consistent with validate-before-trust.
+#   flagship  -> 1,050,000 physical window + eligible for the 370k ChatGPT cap
+#   mini      -> 400,000
+#   chat      -> 128,000
+#   prev (gpt-5 / gpt-5.2) -> 400,000, or 128,000 for its -chat variant
+gpt_flagship_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?(\[1m\])?$'
+gpt_mini_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-mini(\[1m\])?$'
+gpt_chat_re='^gpt-5\.(4|5|6)(-(sol|terra|luna))?-chat(\[1m\])?$'
+gpt_prev_re='^gpt-5(\.2)?(-mini)?(\[1m\])?$'
+gpt_prev_chat_re='^gpt-5(\.2)?-chat(\[1m\])?$'
+
 # --- Render one output line per task ---
 bar_width=5
 while IFS=$'\x1f' read -r id type name status tokens label; do
-    [[ -z "$id" ]] && continue
+    # Reject a path-unsafe agent id before it is interpolated into any transcript
+    # or cache path (Convention 2); omit the row, keep the native rendering.
+    # is_safe_id also subsumes the empty-id guard (the regex requires >=1 char).
+    is_safe_id "$id" || continue
 
     # Normalize token count to a non-negative integer (strip any fraction).
     tokens=${tokens%.*}
@@ -238,13 +303,17 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
     # exists; any jq failure yields empty, and the numeric re-guard leaves
     # tokens at 0 (which keeps native rendering, this script's failure mode).
     if [[ "$tokens" -le 0 && -n "$subagents_dir" && -f "${subagents_dir}/agent-${id}.jsonl" ]]; then
-        tokens=$(tail -n 50 "${subagents_dir}/agent-${id}.jsonl" 2>/dev/null | jq -s '
+        # Full-transcript scan (Convention 4): drop the `tail -n 50` bound so more
+        # than 50 trailing zero-token shim placeholders cannot hide the real
+        # usage. The `< file` redirect keeps a missing/binary transcript
+        # fail-open, mirroring context-bar.sh's recovery idiom.
+        tokens=$(jq -s '
             [.[] | select(.message.usage and .isApiErrorMessage != true) | (
                 (.message.usage.input_tokens // 0) +
                 (.message.usage.cache_read_input_tokens // 0) +
                 (.message.usage.cache_creation_input_tokens // 0)
             )] | map(select(. > 0)) | last // 0
-        ' 2>/dev/null) || tokens=0
+        ' < "${subagents_dir}/agent-${id}.jsonl" 2>/dev/null) || tokens=0
         tokens=${tokens%.*}
         [[ "$tokens" =~ ^[0-9]+$ ]] || tokens=0
     fi
@@ -258,11 +327,24 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
     task_model=""
     model_cache=""
     task_transcript=""
-    [[ -n "$session_id" ]] && model_cache="/tmp/claude-subagent-model-${session_id}-${id}"
+    [[ -n "$session_id" ]] && model_cache="${cache_dir}/claude-subagent-model-${session_id}-${id}"
     [[ -n "$subagents_dir" ]] && task_transcript="${subagents_dir}/agent-${id}.jsonl"
     if [[ -n "$model_cache" ]]; then
         task_model=$(resolve_model_cache "$task_transcript" "$model_cache")
     fi
+    # Control-strip the resolved model id before it is used for display
+    # (agent_disp) or slug classification (Convention 1). The bare cache file is
+    # read with `cat`, so a corrupt/hostile cache is the one path that can carry
+    # raw control bytes past the payload clean; a legitimate model id never
+    # contains them. jq -Rs makes the strip Unicode-aware: gsub([[:cntrl:]])
+    # removes C0, DEL, AND C1 (U+0080-U+009F — Oniguruma's [[:cntrl:]] is the
+    # Unicode Cc category, unlike byte-wise bash/tr ranges, which pass
+    # UTF-8-encoded C1 through), and jq's UTF-8 decoding replaces raw stray
+    # bytes (a lone 8-bit C1) with inert U+FFFD. Slurp (-s) keeps an embedded
+    # newline inside the one string so it is stripped rather than re-emitted as
+    # a second line. Fail-open: on any jq failure the model reads as unresolved
+    # (empty) and the row still renders.
+    task_model=$(printf '%s' "$task_model" | jq -Rsr 'gsub("[[:cntrl:]]"; "")' 2>/dev/null) || task_model=""
     # Default: the session window (covers same-model subagents and alternative
     # providers, where the mapping below does not apply).
     row_window="$max_context"
@@ -287,28 +369,24 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
             z-ai/glm-5.2|z-ai/glm-5.2-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])
                 row_window=1048576 ;;
             *)
-                case "$physical_slug" in
-                    gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-                        case "$physical_slug" in
-                            *-mini*) row_window=400000 ;;
-                            *-chat*) row_window=128000 ;;
-                            *) row_window=1050000 ;;
-                        esac
-                        ;;
-                    gpt-5|gpt-5[-\[]*|gpt-5.2|gpt-5.2[-\[]*)
-                        case "$physical_slug" in
-                            *-chat*) row_window=128000 ;;
-                            *) row_window=400000 ;;
-                        esac
-                        ;;
-                    *)
-                        case "$task_model" in
-                            *fable-5*|*mythos-5*|*opus-4-7*|*opus-4-8*|*\[1m\]*)
-                                row_window=1000000 ;;
-                            *) row_window=200000 ;;
-                        esac
-                        ;;
-                esac
+                # Closed-set classification on the provider-stripped slug
+                # (Convention 3). Only the enumerated flagship/mini/chat/prev
+                # slugs earn a GPT physical window; anything else (malformed
+                # flagship-looking ids included) falls through to the
+                # conservative Claude/[1m]/200k map. Order: flagship, then mini,
+                # then chat before prev so a prev-chat is not shadowed.
+                if   [[ "$physical_slug" =~ $gpt_flagship_re ]];  then row_window=1050000
+                elif [[ "$physical_slug" =~ $gpt_mini_re ]];      then row_window=400000
+                elif [[ "$physical_slug" =~ $gpt_chat_re ]];      then row_window=128000
+                elif [[ "$physical_slug" =~ $gpt_prev_chat_re ]]; then row_window=128000
+                elif [[ "$physical_slug" =~ $gpt_prev_re ]];      then row_window=400000
+                else
+                    case "$task_model" in
+                        *fable-5*|*mythos-5*|*opus-4-7*|*opus-4-8*|*\[1m\]*)
+                            row_window=1000000 ;;
+                        *) row_window=200000 ;;
+                    esac
+                fi
                 ;;
         esac
     fi
@@ -329,13 +407,14 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
     # capped while lower positive values survive. This is utilization/statusline
     # accounting, NOT compaction and NOT a transport-level request blocker; the
     # backend remains the ultimate hard ceiling.
+    # Flagship predicate for the ChatGPT-lane cap uses the SAME closed-set ERE
+    # (Convention 3); mini/chat slugs simply do not match it, so no explicit
+    # exclusion arm is needed. The 370k min-ceiling ordering below is unchanged.
     gpt_flagship=0
     physical_slug="${task_model##*/}"
-    case "$physical_slug" in
-        gpt-5*-mini*|gpt-5*-chat*) ;;
-        gpt-5.4|gpt-5.4[-\[]*|gpt-5.5|gpt-5.5[-\[]*|gpt-5.6|gpt-5.6[-\[]*)
-            gpt_flagship=1 ;;
-    esac
+    if [[ "$physical_slug" =~ $gpt_flagship_re ]]; then
+        gpt_flagship=1
+    fi
     if [[ "${DAAF_PROVIDER_SHIM:-}" == "openai" && \
           "${SHIM_BACKEND_MODE:-}" == "chatgpt" && \
           "$gpt_flagship" -eq 1 ]] && \
@@ -349,6 +428,17 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
         row_window=200000
     fi
 
+    # Numerator bound (Convention 5): tokens is already ^[0-9]+$, but an int64-
+    # valid value above floor(INT64_MAX/100)=92233720368547758 would overflow
+    # tokens*100 below and wrap pct negative. row_window is already validated
+    # above; bound the numerator symmetrically. tokens==0 is legitimate (0%), so
+    # only non-zero values are checked; is_canonical_positive_decimal guarantees
+    # tokens<=INT64_MAX first, making the -gt comparison itself overflow-safe.
+    if [[ "$tokens" != "0" ]] && \
+       { ! is_canonical_positive_decimal "$tokens" || [[ "$tokens" -gt 92233720368547758 ]]; }; then
+        tokens=0
+    fi
+
     pct=$((tokens * 100 / row_window))
     [[ $pct -gt 100 ]] && pct=100
     used_k=$((tokens / 1000))
@@ -410,7 +500,12 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
     # fall back to registered name, then task type, then "agent".
     agent_disp=""
     if [[ -n "$subagents_dir" && -f "${subagents_dir}/agent-${id}.meta.json" ]]; then
-        agent_disp=$(jq -r '.agentType // empty' \
+        # Control-strip agentType (Convention 1): this sidecar read bypasses the
+        # main-payload clean, so a JSON-escaped control in agentType would
+        # otherwise reach the row. jq rejects raw C1 in the file, and gsub
+        # removes any C0/DEL that arrived as a JSON escape.
+        agent_disp=$(jq -r '(.agentType // empty) | tostring
+            | gsub("[[:cntrl:]]"; " ")' \
             "${subagents_dir}/agent-${id}.meta.json" 2>/dev/null)
     fi
     [[ -z "$agent_disp" ]] && agent_disp="$name"
@@ -436,11 +531,16 @@ while IFS=$'\x1f' read -r id type name status tokens label; do
         content+="${C_GRAY} [${status}]${C_RESET}"
     fi
 
-    # Emit {"id","content"} as ONE compact JSON line. ANSI codes are
-    # materialized via printf %b, then JSON-encoded through jq (-R raw,
-    # -s slurp, -c compact) so quotes/escapes/ESC bytes are handled safely.
-    rendered=$(printf '%b' "$content")
-    printf '%s' "$rendered" | jq -Rsc --arg id "$id" '{id: $id, content: .}' 2>/dev/null
+    # Emit {"id","content"} as ONE compact JSON line. Color CSI bytes already
+    # live as real ESC in the trusted $'…' constants, so the render uses
+    # printf '%s' — NOT '%b' (Convention 1): a printable backslash escape in an
+    # untrusted field (model name, agentType, description) stays inert instead of
+    # being re-materialized into a real ESC/OSC/BEL. jq (-R raw, -s slurp,
+    # -c compact) then JSON-encodes the line. Note that JSON-encoding ALONE does
+    # NOT neutralize escapes — the consumer decodes  back to ESC — which is
+    # why untrusted fields are control-stripped at extraction (clean, the
+    # agentType read, and task_model) rather than relying on the encode step.
+    printf '%s' "$content" | jq -Rsc --arg id "$id" '{id: $id, content: .}' 2>/dev/null
 done <<< "$tasks_rec"
 
 exit 0
diff --git a/.claude/settings.json b/.claude/settings.json
index 461a1485..43cfe02d 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -94,21 +94,27 @@
       "Edit(environment_settings.txt)",
       "Edit(.claude/hooks/*)",
       "Write(.claude/hooks/*)",
-      "Edit(.claude/logs/*)",
-      "Write(.claude/logs/*)",
+      "Edit(/.claude/logs/**)",
+      "Write(/.claude/logs/**)",
+      "Edit(//home/appuser/.claude/**/*.jsonl)",
+      "Write(//home/appuser/.claude/**/*.jsonl)",
+      "Edit(/research/*/logs/**)",
+      "Write(/research/*/logs/**)",
       "Write(//tmp/**)",
       "Edit(//tmp/**)"
     ]
   },
   "env": {
     "ANTHROPIC_MODEL": "claude-opus-4-8[1m]",
-    "CLAUDE_CODE_EFFORT_LEVEL": "high",
     "CLAUDE_CODE_DISABLE_AUTO_MEMORY": "1",
     "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
     "DISABLE_AUTOUPDATER": "1",
-    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
     "ENABLE_PROMPT_CACHING_1H": "1"
   },
+  "effortLevel": "high",
+  "skillOverrides": {
+    "claude-api": "off"
+  },
   "outputStyle": "Explanatory",
   "disableWorkflows": true,
   "verbose": true,
diff --git a/.claude/skills/daaf-orchestrator/references/reproducibility-verification-mode.md b/.claude/skills/daaf-orchestrator/references/reproducibility-verification-mode.md
index 612bda28..64127ab4 100644
--- a/.claude/skills/daaf-orchestrator/references/reproducibility-verification-mode.md
+++ b/.claude/skills/daaf-orchestrator/references/reproducibility-verification-mode.md
@@ -28,6 +28,8 @@ Two decisions must be confirmed at **mode confirmation** AND reconfirmed **after
 At mode confirmation: present defaults, ask user to confirm or adjust.
 After RV-1: present the script inventory, original-artifact inventory, and evidence gaps, then ask the user to reconfirm both decisions with the scope now concrete. If the user chose frozen data but `original_files/data/raw/` has no copied raw files, stop and require a new choice before RV-2; do not silently fall back to re-fetching or to processed data.
 
+> **Bind-mounted inputs depend on externally-guaranteed files.** If the original analysis read inputs from a user-configured host bind mount (`/host_data`) rather than from data archived inside the project, those files live outside DAAF's hash/backup boundary — verification then depends on the user supplying the *same* mount contents. Confirm the frozen `data/raw/` copy (or an equivalent user-provided snapshot) is present before treating such a reproduction as complete; DAAF cannot hash-verify data it never archived.
+
 ---
 
 ## Reproducibility Verification Workflow
diff --git a/.claude/skills/daaf-orchestrator/references/user-support-mode.md b/.claude/skills/daaf-orchestrator/references/user-support-mode.md
index 12c2b1d5..8b9a0157 100644
--- a/.claude/skills/daaf-orchestrator/references/user-support-mode.md
+++ b/.claude/skills/daaf-orchestrator/references/user-support-mode.md
@@ -128,6 +128,8 @@ Users frequently have questions about the tools DAAF runs on, not just DAAF itse
 | Question About | Where to Look (local) | Authoritative External Docs |
 |----------------|----------------------|----------------------------|
 | Docker setup, container management, resource allocation, security | `user_reference/01_installation_and_quickstart.md`, `user_reference/07_faq_technical.md` | https://docs.docker.com/reference/ |
+| Bind mounts / sharing host folders into the container | `user_reference/01_installation_and_quickstart.md`, `user_reference/07_faq_technical.md` | https://docs.docker.com/engine/storage/bind-mounts/ |
+| Running Claude and ChatGPT installs in parallel / sharing one research workspace | `user_reference/01_installation_and_quickstart.md`, `user_reference/07_faq_technical.md` | https://docs.docker.com/reference/compose-file/volumes/ |
 | Git usage, version control, diffs, commits | `user_reference/01_installation_and_quickstart.md`, `user_reference/03_best_practices.md` | https://git-scm.com/docs |
 | Claude Code features, configuration, model selection, IDE integration | `user_reference/07_faq_technical.md`, `user_reference/01_installation_and_quickstart.md` | https://code.claude.com/docs/en/overview |
 | Running without Docker, alternative AI providers | `user_reference/07_faq_technical.md` | — |
diff --git a/.claude/skills/fixest/SKILL.md b/.claude/skills/fixest/SKILL.md
index 4ad4f2a8..958c68bd 100644
--- a/.claude/skills/fixest/SKILL.md
+++ b/.claude/skills/fixest/SKILL.md
@@ -52,8 +52,9 @@ estimation in applied economics and quantitative social science:
 ## Version Notes
 
 This skill targets **fixest 0.14.0** (R 4.5.3). fixest 0.13 introduced the
-breaking changes that pyfixest 0.40.0 adopted (default SE changed to IID,
-singleton removal by default, ssc argument renames). fixest 0.14.0 is a stable
+breaking changes that pyfixest adopted in 0.40.0 (default SE changed to IID,
+singleton removal by default, ssc argument renames); DAAF now ships pyfixest
+0.60.0, which keeps those fixest-0.13-aligned defaults. fixest 0.14.0 is a stable
 release building on those defaults.
 
 Key defaults in 0.14.0:
@@ -101,7 +102,7 @@ knowledge lack.
 
 | Skill | Relationship |
 |-------|-------------|
-| `pyfixest` | Python port of this package — near-identical formula syntax, some features missing (feglm with FE, etable maturity). Load when execution language is Python. |
+| `pyfixest` | Python port of this package — near-identical formula syntax; residual gaps are GLM families beyond logit/probit/gaussian and `fenegbin`. Load when execution language is Python. |
 | `data-scientist` | Methodology guidance — load for "why and when" behind methods |
 | `r-python-translation` | Cross-language mappings for R fixest vs Python pyfixest and statsmodels |
 | `plm` | Random effects, between estimator, Hausman test — complements fixest when FE-only is insufficient |
diff --git a/.claude/skills/fixest/references/gotchas.md b/.claude/skills/fixest/references/gotchas.md
index 8ee25dd5..7617a8c3 100644
--- a/.claude/skills/fixest/references/gotchas.md
+++ b/.claude/skills/fixest/references/gotchas.md
@@ -282,9 +282,9 @@ etable(fit_ols, fit_pois, fit_logit,
 
 ## pyfixest vs fixest Differences
 
-| Feature | R fixest 0.14 | pyfixest 0.40 |
+| Feature | R fixest 0.14 | pyfixest 0.60 |
 |---------|--------------|---------------|
-| feglm with FE | Fully supported | NOT supported |
+| feglm with FE | Fully supported | Supported (since 0.50) |
 | sunab() | Formula function | `event_study(estimator="saturated")` |
 | did2s | Not built-in (use `did2s` package) | `pf.did2s()` built-in |
 | lpdid | Not built-in | `pf.lpdid()` built-in |
diff --git a/.claude/skills/fixest/references/models.md b/.claude/skills/fixest/references/models.md
index d34431ca..86d192a8 100644
--- a/.claude/skills/fixest/references/models.md
+++ b/.claude/skills/fixest/references/models.md
@@ -73,7 +73,8 @@ Poisson coefficients are semi-elasticities (in the log-linear model):
 ## feglm: Generalized Linear Models with FE
 
 `feglm()` supports GLM families with absorbed high-dimensional fixed effects.
-This is a major advantage over pyfixest, where `feglm()` does NOT support FE.
+pyfixest's `feglm()` gained FE support in 0.50 (logit/probit/gaussian); R fixest
+retains broader family coverage (e.g., Gamma) and `fenegbin`.
 
 ### Supported Families
 
@@ -95,9 +96,9 @@ summary(fit)
 fit <- feglm(binary_y ~ x1 + x2 | entity + year, data = df, family = binomial)
 ```
 
-This is one of the strongest features of R fixest over pyfixest. In Python,
-logit/probit with high-dimensional FE requires manual dummies (which is infeasible
-with many FE levels) or using a linear probability model instead.
+pyfixest (>= 0.50, DAAF ships 0.60.0) matches this for logit/probit/gaussian via
+`pf.feglm("y ~ x1 | entity", family="logit")`; families beyond those (e.g., Gamma)
+still require R fixest or manual approaches in Python.
 
 ### Probit with Fixed Effects
 
diff --git a/.claude/skills/fixest/references/quickstart.md b/.claude/skills/fixest/references/quickstart.md
index 52115b9f..4202ac46 100644
--- a/.claude/skills/fixest/references/quickstart.md
+++ b/.claude/skills/fixest/references/quickstart.md
@@ -327,7 +327,7 @@ fit <- feols(y ~ x1 | entity + year, data = df,
 | Clustered SE | `vcov = ~g` | `vcov={"CRV1": "g"}` |
 | Two-way cluster | `vcov = ~g1 + g2` | `vcov={"CRV1": "g1+g2"}` |
 | Poisson + FE | `fepois(y ~ x \| fe, data)` | `pf.fepois("y ~ x \| fe", data)` |
-| GLM + FE | `feglm(y ~ x \| fe, data, family)` | **Not supported** |
+| GLM + FE | `feglm(y ~ x \| fe, data, family)` | `pf.feglm("y ~ x \| fe", data, family="logit")` (since 0.50; logit/probit/gaussian) |
 | IV + FE | `feols(y ~ 1 \| fe \| x ~ z, data)` | `pf.feols("y ~ 1 \| fe \| x ~ z", data)` |
 | Sun-Abraham | `feols(y ~ sunab(g,t) \| ...)` | `pf.event_study(estimator="saturated")` |
 | Regression table | `etable(fit1, fit2)` | `pf.etable([fit1, fit2])` |
@@ -339,7 +339,7 @@ The most notable syntax differences:
 1. **Clustering**: R uses one-sided formula (`~state`); Python uses dict (`{"CRV1": "state"}`)
 2. **Multiple outcomes**: R uses `c()`; Python uses `+`
 3. **Formulas are unquoted in R**, quoted strings in Python
-4. **feglm with FE**: Works in R, not in pyfixest (major gap)
+4. **feglm with FE**: Supported in both (pyfixest since 0.50, logit/probit/gaussian); Gamma and `fenegbin` remain R-only
 5. **Sun-Abraham**: R uses `sunab()` in formula; Python uses separate `event_study()` function
 
 ## Next Steps
diff --git a/.claude/skills/pyfixest/SKILL.md b/.claude/skills/pyfixest/SKILL.md
index 9bd7cc78..88bd1c16 100644
--- a/.claude/skills/pyfixest/SKILL.md
+++ b/.claude/skills/pyfixest/SKILL.md
@@ -5,8 +5,8 @@ description: >-
 metadata:
   audience: research-coders
   domain: python-library
-  library-version: "0.40.0"
-  skill-last-updated: "2026-03-27"
+  library-version: "0.60.0"
+  skill-last-updated: "2026-07-23"
 ---
 
 # pyfixest Skill
@@ -18,7 +18,7 @@ Comprehensive skill for fixed effects regression, instrumental variables, and di
 ## What is pyfixest?
 
 pyfixest is a Python implementation of the R **fixest** package (Berge, Butts, & McDermott, 2026):
-- **Fast**: Multi-way FE demeaning via alternating projections with numba/JAX/GPU backends
+- **Fast**: Multi-way FE demeaning via alternating projections; since 0.60 the default backend is a compiled Rust extension shipped in the wheel (numba is now optional), with PyTorch/CuPy/SciPy LSMR backends available for GPU/large problems
 - **Concise formula syntax**: Fixed effects after `|`, IV after second `|`, multiple estimation via `sw()`/`csw()`
 - **Modern DiD**: Built-in did2s, local projections DiD (lpdid), and Sun-Abraham saturated estimator
 - **Flexible inference**: Switch SE types post-estimation; wild bootstrap, randomization inference, CCV
@@ -26,11 +26,24 @@ pyfixest is a Python implementation of the R **fixest** package (Berge, Butts, &
 
 ## Version Notes
 
-This skill targets **pyfixest 0.40.0**, the major release aligning with R fixest 0.13. Breaking changes from earlier versions:
+This skill targets **pyfixest 0.60.0** (pre-installed in the DAAF container). Only three release lines sit between the previous target and this one — 0.40.0/0.40.1, 0.50.0/0.50.1, and 0.60.0 (there are no 0.41–0.49 releases). The cumulative changes that matter for existing code, oldest first:
+
+**0.40.0 (aligned with R fixest 0.13) — silent result changes:**
 - Default standard errors changed from "cluster by first FE" to `"iid"` — old code silently produces different SEs
-- `ssc()` arguments renamed: `adj` → `k_adj`, `fixef_k` → `k_fixef`, `cluster_adj` → `G_adj`, `cluster_df` → `G_df`
+- `ssc()` arguments renamed: `adj` → `k_adj`, `fixef_k` → `k_fixef`, `cluster_adj` → `G_adj`, `cluster_df` → `G_df`; the old names still work but raise a `DeprecationWarning` (verified live). The option *value* `"nested"` was renamed to `"nonnested"` — passing `"nested"` now errors
 - `fixef_rm` default changed from `"none"` to `"singleton"` — singletons now dropped by default
-- Multicollinearity tolerance reduced from 1e-10 to 1e-09
+- Multicollinearity tolerance reduced from 1e-10 to 1e-09; Gelbach `decompose()` reworked to return a `GelbachDecomposition` object (arg `param` → `decomp_var`)
+
+**0.50.0 — table backend + FE-GLMs:**
+- `etable()`/`dtable()` moved to the `maketables` backend (the `great_tables` dependency was replaced). The public `etable()` API is unchanged and, in this install, the default and `type="gt"` still return a `great_tables.gt.GT` object rendered via maketables (verified live)
+- **`feglm()` now supports fixed effects** (logit/probit/gaussian) — the pre-0.50 "feglm does not support FE" limitation is gone (verified live: `pf.feglm("ybin ~ X1 | f1", family="logit")` fits)
+
+**0.60.0 — Rust demeaner default, numba optional, typed backend API:**
+- The Rust MAP demeaner is now the default; **numba is an optional extra** (`pyfixest[numba]`). numba is still used for `MapDemeaner(backend="numba")` and fast randomization inference (`ritest(..., choose_algorithm="fast")`). DAAF's image ships numba transitively (via umap-learn/wildboottest), so the numba paths remain available here
+- The loose `demeaner_backend`, `fixef_tol`, and `fixef_maxiter` kwargs are deprecated in favor of a typed `demeaner=MapDemeaner(...)` / `LsmrDemeaner(...)` object; the old kwargs still work but raise a `DeprecationWarning` (verified live)
+- `etable(type="typst")` added; `fepois(offset=...)` exposure terms added
+
+See `gotchas.md` for the full cumulative breaking-change detail and migration notes.
 
 ## How to Use This Skill
 
@@ -47,7 +60,7 @@ Each topic in `./references/` contains focused documentation:
 | `tables-and-plots.md` | etable, coefplot, iplot, dtable | Reporting results |
 | `advanced-inference.md` | Wild bootstrap, randomization inference, MHT corrections, Gelbach | Advanced statistical inference |
 | `integration.md` | Multiple estimation, Poisson, GLM, marginaleffects, online learning | Advanced features |
-| `gotchas.md` | Common errors, v0.40 breaking changes, fixest vs pyfixest | Debugging issues |
+| `gotchas.md` | Common errors, 0.40→0.60 cumulative breaking changes, fixest vs pyfixest | Debugging issues |
 
 ### Reading Order
 
@@ -129,8 +142,8 @@ Presenting results?
 ```
 Having issues?
 ├─ Different results from old code → ./references/gotchas.md
-├─ feglm with fixed effects error → ./references/gotchas.md
-├─ numba installation problems → ./references/gotchas.md
+├─ feglm / GLM with fixed effects → ./references/gotchas.md
+├─ numba / demeaner backend questions → ./references/gotchas.md
 ├─ CRV3 memory issues → ./references/gotchas.md
 ├─ Poisson convergence → ./references/gotchas.md
 ├─ Formula parsing errors → ./references/gotchas.md
@@ -172,6 +185,7 @@ import pyfixest as pf
 |----------|---------|
 | `pf.feols("Y ~ X \| fe", data=df)` | OLS with fixed effects |
 | `pf.fepois("Y ~ X \| fe", data=df)` | Poisson with fixed effects |
+| `pf.feglm("Y ~ X \| fe", data=df, family="logit")` | GLM (logit/probit/gaussian) with fixed effects (since 0.50) |
 | `pf.feols("Y ~ X2 \| fe \| X1 ~ Z1", data=df)` | IV / 2SLS |
 | `pf.did2s(data, yname, first_stage, second_stage, treatment, cluster)` | Gardner (2022) DiD |
 | `pf.event_study(data, yname, idname, tname, gname, estimator)` | Unified event study |
@@ -257,9 +271,9 @@ pf.panelview(data, unit, time, treat)  # Treatment pattern visualization
 | Polars DataFrame input | `./references/gotchas.md` |
 | Polars-to-pandas conversion | `./references/quickstart.md` |
 | DiD clustering level | `./references/difference-in-differences.md` |
-| v0.40 breaking changes | `./references/gotchas.md` |
-| feglm FE limitation | `./references/gotchas.md` |
-| numba issues | `./references/gotchas.md` |
+| 0.40→0.60 breaking changes | `./references/gotchas.md` |
+| feglm with fixed effects | `./references/gotchas.md` |
+| numba / Rust demeaner backend | `./references/gotchas.md` |
 | Formula parsing | `./references/gotchas.md` |
 | R fixest differences | `./references/gotchas.md` |
 
diff --git a/.claude/skills/pyfixest/references/advanced-inference.md b/.claude/skills/pyfixest/references/advanced-inference.md
index bef0aeda..d1f3ddba 100644
--- a/.claude/skills/pyfixest/references/advanced-inference.md
+++ b/.claude/skills/pyfixest/references/advanced-inference.md
@@ -164,6 +164,8 @@ Do NOT routinely apply corrections to:
 
 Gelbach (2016) decomposes the change in a coefficient when additional controls are added. This answers: "Which specific controls explain most of the change in the coefficient of interest?"
 
+Since 0.40, `fit.decompose()` returns a `GelbachDecomposition` object (previously a `pd.DataFrame`), takes the coefficient to decompose as `decomp_var` (previously `param`), and defaults to reporting normalized contributions. Use its `.etable()`, `.tidy()`, and `.coefplot()` methods (shown below) to view results.
+
 ### Basic Usage
 
 ```python
diff --git a/.claude/skills/pyfixest/references/fixed-effects.md b/.claude/skills/pyfixest/references/fixed-effects.md
index f925db14..a0ee9ccf 100644
--- a/.claude/skills/pyfixest/references/fixed-effects.md
+++ b/.claude/skills/pyfixest/references/fixed-effects.md
@@ -36,9 +36,12 @@ fit = pf.feols("Y ~ X1 | entity ^ year", data=df)
 pyfixest absorbs fixed effects via the **Frisch-Waugh-Lovell theorem** using alternating projections (iterative demeaning). This is fast and memory-efficient — it avoids creating dummy variable matrices.
 
 Key parameters controlling demeaning:
-- `fixef_tol=1e-08`: Convergence tolerance (decrease for more precision)
-- `fixef_maxiter=100000`: Maximum demeaning iterations
-- `fixef_rm="singleton"`: Remove singleton FE groups (default since v0.40)
+- `fixef_rm="singleton"`: Remove singleton FE groups (default since 0.40)
+- Convergence tolerance and iteration caps: since 0.60 these are set on a **typed
+  demeaner object**, e.g. `demeaner=pf.MapDemeaner(backend="rust", fixef_tol=1e-08)`
+  or `pf.LsmrDemeaner(...)`. The loose `fixef_tol`/`fixef_maxiter`/`demeaner_backend`
+  kwargs still work but raise a `DeprecationWarning` (verified live). See
+  [Backend Options](#backend-options-for-performance) below.
 
 ### Extracting Fixed Effects
 
@@ -183,45 +186,58 @@ fit = pf.feols("Y ~ X1 | fe", data=df,
 | Parameter | Default | Meaning |
 |-----------|---------|---------|
 | `k_adj` | `True` | Apply (N-1)/(N-k) small-sample adjustment |
-| `k_fixef` | `"none"` | Count FE in k: `"none"`, `"full"`, or `"nonnested"` |
+| `k_fixef` | `"nonnested"` | Count FE in k: `"none"`, `"full"`, or `"nonnested"` (live default is `"nonnested"`) |
 | `G_adj` | `True` | Apply G/(G-1) cluster adjustment |
 | `G_df` | `"min"` | Two-way cluster DOF: `"min"` (conservative) or `"conventional"` |
 
-**v0.40 breaking change:** These parameter names were all renamed. See `gotchas.md` for the mapping.
+**Breaking change (0.40):** These parameter names were all renamed (`adj`→`k_adj`, `fixef_k`→`k_fixef`, `cluster_adj`→`G_adj`, `cluster_df`→`G_df`), and the value `"nested"` became `"nonnested"`. The old argument names still work but raise a `DeprecationWarning`; passing the old value `"nested"` errors. See `gotchas.md` for the full mapping.
 
 ## Backend Options for Performance
 
-The `demeaner_backend` parameter controls the FE demeaning algorithm:
+Since 0.60 the demeaning backend is configured through a **typed demeaner object**
+passed as `demeaner=`. The default is the compiled Rust MAP demeaner, which ships
+in the wheel — no numba JIT warm-up on the default path.
 
-| Backend | Install | Best For |
-|---------|---------|----------|
-| `"numba"` | Included by default | CPU, general use — fastest on CPU |
-| `"jax"` | `pip install pyfixest[jax]` | GPU acceleration (Nvidia A100+) |
-| `"cupy"` | CuPy + CUDA toolkit | GPU via sparse LSMR solver |
-| `"scipy"` | Included by default | Fallback if numba fails |
-| `"rust-cg"` | Rust extension | Conjugate gradient solver |
+```python
+# Default — Rust MAP demeaner (no configuration needed)
+fit = pf.feols("Y ~ X1 | f1 + f2", data=df)
 
-> **DAAF note:** The `jax` backend is **not available** in the DAAF container —
-> jax is not pre-installed and runtime installs (`pip install pyfixest[jax]`) are
-> blocked (see CLAUDE.md § Runtime Package Installation). Use the default `numba`
-> backend (or the `scipy` fallback), both included in the base install; to enable
-> the jax GPU backend, escalate to add it to the Dockerfile user-additions block
-> and rebuild.
+# Explicit typed demeaner (0.60 API)
+fit = pf.feols("Y ~ X1 | f1 + f2", data=df,
+               demeaner=pf.MapDemeaner(backend="rust", fixef_tol=1e-08))
 
-```python
-# Use JAX backend for GPU acceleration
-fit = pf.feols("Y ~ X1 | f1 + f2", data=df, demeaner_backend="jax")
+# numba MAP backend (numba is an optional extra; present in the DAAF image)
+fit = pf.feols("Y ~ X1 | f1 + f2", data=df,
+               demeaner=pf.MapDemeaner(backend="numba"))
 
-# Use scipy fallback if numba is problematic
-fit = pf.feols("Y ~ X1 | f1 + f2", data=df, demeaner_backend="scipy")
+# LSMR demeaner with a GPU device (torch backend)
+fit = pf.feols("Y ~ X1 | f1 + f2", data=df,
+               demeaner=pf.LsmrDemeaner(backend="torch", device="cuda"))
 ```
 
-GPU acceleration targets the iterative alternating-projections demeaning step, which dominates computation time for models with many FE levels. For small datasets (<100K observations) the overhead of GPU transfer may exceed the speedup — numba on CPU is typically fastest.
-
-The `solver` parameter separately controls the linear algebra solver for the regression itself:
-- `"scipy.linalg.solve"` (default)
-- `"numpy.linalg.solve"`
-- `"jax"` (for GPU)
+| Demeaner | `backend=` | Best For |
+|----------|-----------|----------|
+| `MapDemeaner` | `"rust"` (default) | CPU, general use — compiled, no JIT warm-up |
+| `MapDemeaner` | `"numba"` | CPU; JIT-compiled MAP (numba optional extra) |
+| `LsmrDemeaner` | `"torch"` (`device="cuda"`/`"mps"`) | GPU acceleration |
+| `LsmrDemeaner` | `"scipy"` | CPU LSMR path — **deprecated in 0.60** (use the default MAP demeaner instead) |
+
+> **Deprecated loose kwargs:** The old `demeaner_backend="numba"|"scipy"|"rust"|"jax"|"cupy"`,
+> `fixef_tol`, and `fixef_maxiter` keyword arguments still work but raise a
+> `DeprecationWarning` (verified live). The JAX MAP backend and the CuPy/SciPy LSMR
+> *backends* are deprecated in 0.60 — prefer the default Rust MAP, or
+> `LsmrDemeaner(backend="torch", device="cuda")` for GPU. Migrate loose kwargs to
+> the typed `demeaner=` object.
+
+> **DAAF note:** The `torch`/`jax` GPU backends are **not available** in the DAAF
+> container (no GPU, and `pyfixest[jax]`/torch runtime installs are blocked — see
+> CLAUDE.md § Runtime Package Installation). Use the default Rust MAP demeaner (or
+> `MapDemeaner(backend="numba")`, since numba is present transitively). To enable a
+> GPU backend, escalate to add it to the Dockerfile user-additions block and rebuild.
+
+GPU acceleration targets the iterative alternating-projections demeaning step, which dominates computation time for models with many FE levels. For small datasets (<100K observations) the overhead of GPU transfer may exceed the speedup — the CPU Rust demeaner is typically fastest.
+
+The `solver` parameter separately controls the linear algebra solver for the regression itself (`"scipy.linalg.solve"` default, `"numpy.linalg.solve"`).
 
 ## References and Further Reading
 
diff --git a/.claude/skills/pyfixest/references/gotchas.md b/.claude/skills/pyfixest/references/gotchas.md
index 9861449a..87b9a42b 100644
--- a/.claude/skills/pyfixest/references/gotchas.md
+++ b/.claude/skills/pyfixest/references/gotchas.md
@@ -2,9 +2,9 @@
 
 ## Contents
 
-- [v0.40 Breaking Changes](#v040-breaking-changes)
-- [feglm Does NOT Support Fixed Effects](#feglm-does-not-support-fixed-effects)
-- [numba Dependency](#numba-dependency)
+- [Cumulative Breaking Changes (0.40 → 0.60)](#cumulative-breaking-changes-040--060)
+- [feglm Now Supports Fixed Effects](#feglm-now-supports-fixed-effects)
+- [numba Optional; Rust Demeaner Default](#numba-optional-rust-demeaner-default)
 - [Formula Parsing](#formula-parsing)
 - [CRV3 Memory Usage](#crv3-memory-usage)
 - [Convergence in fepois](#convergence-in-fepois)
@@ -14,14 +14,18 @@
 - [fixest (R) vs pyfixest Differences](#fixest-r-vs-pyfixest-differences)
 - [Matching Stata Results](#matching-stata-results)
 
-## v0.40 Breaking Changes
+## Cumulative Breaking Changes (0.40 → 0.60)
 
-Version 0.40.0 aligned pyfixest with R fixest 0.13, introducing several breaking changes that **silently change results**:
+DAAF ships pyfixest 0.60.0. The behavior-changing releases between the old 0.40
+target and now are 0.40.0 (fixest-0.13 alignment), 0.50.0 (maketables + FE-GLMs),
+and 0.60.0 (Rust demeaner default, numba optional, typed backend API). The items
+below **silently change results** or break old code. (There are no 0.41–0.49
+releases.)
 
-### Default Standard Errors Changed
+### Default Standard Errors Changed (0.40)
 
-**Before v0.40:** Default SE was cluster-robust by the first fixed effect variable.
-**After v0.40:** Default SE is `"iid"`.
+**Before 0.40:** Default SE was cluster-robust by the first fixed effect variable.
+**Since 0.40:** Default SE is `"iid"`.
 
 ```python
 # Old behavior: fit.vcov was auto-set to {"CRV1": "f1"}
@@ -33,7 +37,7 @@ fit = pf.feols("Y ~ X | f1", data=df, vcov={"CRV1": "f1"})
 
 **Impact:** Code that relied on the old default will produce **different standard errors, t-statistics, and p-values** without any error or warning. Always specify `vcov` explicitly to avoid ambiguity.
 
-### ssc() Arguments Renamed
+### ssc() Arguments Renamed (0.40)
 
 | Old Name (pre-0.40) | New Name (0.40+) |
 |----------------------|-------------------|
@@ -43,19 +47,22 @@ fit = pf.feols("Y ~ X | f1", data=df, vcov={"CRV1": "f1"})
 | `cluster_df` | `G_df` |
 
 ```python
-# Old (will error in v0.40+)
-pf.ssc(adj=True, fixef_k="nested", cluster_adj=True)
+# Old argument NAMES still work but raise a DeprecationWarning (verified live on 0.60):
+pf.ssc(adj=True, cluster_adj=True, cluster_df="min")   # DeprecationWarning x3
 
-# New
+# New (preferred)
 pf.ssc(k_adj=True, k_fixef="nonnested", G_adj=True)
 ```
 
-Note: the option value `"nested"` was also renamed to `"nonnested"`.
+Note: the option *value* `"nested"` was renamed to `"nonnested"`. Unlike the
+argument names, the old value is **not** back-compatible — `pf.ssc(k_fixef="nested")`
+raises `TypeError: k_fixef must be 'none', 'full', or 'nonnested'` (verified live).
+The live `ssc()` default for `k_fixef` is `"nonnested"`.
 
-### Singleton Removal Default Changed
+### Singleton Removal Default Changed (0.40)
 
-**Before v0.40:** `fixef_rm="none"` — singletons kept by default.
-**After v0.40:** `fixef_rm="singleton"` — singletons dropped by default.
+**Before 0.40:** `fixef_rm="none"` — singletons kept by default.
+**Since 0.40:** `fixef_rm="singleton"` — singletons dropped by default.
 
 Singleton fixed effects are groups with only one observation. Keeping them can inflate degrees of freedom and produce misleading inference.
 
@@ -64,52 +71,71 @@ Singleton fixed effects are groups with only one observation. Keeping them can i
 fit = pf.feols("Y ~ X | fe", data=df, fixef_rm="none")
 ```
 
-### Multicollinearity Tolerance
+### Multicollinearity Tolerance (0.40)
 
 Default `collin_tol` changed from 1e-10 to 1e-09. This may cause some near-collinear variables to be dropped that were previously kept.
 
-## feglm Does NOT Support Fixed Effects
+### etable Moved to maketables (0.50)
 
-This is the most common source of confusion. `feglm()` (logit, probit, Gaussian GLM) does **not** currently support FE demeaning:
+`etable()`/`dtable()` render through the `maketables` backend since 0.50 (pyfixest
+no longer depends on `great_tables` directly — maketables wraps it for HTML/GT
+output). The **public API is unchanged**, and on
+0.60.0 the default and `type="gt"` still return a `great_tables.gt.GT` object
+(rendered via maketables, verified live). One behavior trap: significance stars are
+now governed by the `coef_fmt` string's `*` token. Stars are on by default, but a
+custom `coef_fmt` that omits `*` drops them. See `tables-and-plots.md` § Output
+Formats. (A stars-dropping regression here was fixed in 0.50.1.)
 
-```python
-# This RAISES NotImplementedError:
-pf.feglm("binary_Y ~ X | entity", data=df, family="logit")
-```
-
-### Workarounds
-
-| Approach | When to Use |
-|----------|-------------|
-| Linear probability model: `pf.feols("binary_Y ~ X \| fe", data=df)` | Most cases; coefficients are percentage-point changes |
-| Manual dummies with statsmodels | Small/moderate number of FE levels |
-| Conditional logit (statsmodels) | Binary outcome with entity FE |
-| `pf.fepois()` for count-like binary | If log-linear is acceptable |
+### Gelbach decompose() Return Type (0.40)
 
-The linear probability model with heteroskedasticity-robust or clustered SEs is the most common approach in applied economics when FE are needed with a binary outcome.
+`fit.decompose()` returns a `GelbachDecomposition` object (was a `pd.DataFrame`),
+the argument is `decomp_var` (was `param`), and it defaults to normalized effects.
+See `advanced-inference.md` § Gelbach Decomposition.
 
-## numba Dependency
+### Typed Demeaner API; Loose Kwargs Deprecated (0.60)
 
-pyfixest uses numba for the default FE demeaning backend. numba can be tricky to install:
+The `demeaner_backend`, `fixef_tol`, and `fixef_maxiter` keyword arguments are
+deprecated in favor of a typed `demeaner=pf.MapDemeaner(...)` / `pf.LsmrDemeaner(...)`
+object. The old kwargs still work but raise a `DeprecationWarning` (verified live).
+The `jax` MAP backend and the `cupy`/`scipy` LSMR *backends* are deprecated. See
+`fixed-effects.md` § Backend Options.
 
-### Common Issues
+## feglm Now Supports Fixed Effects
 
-**Problem:** numba fails to install (especially on M-series Macs or minimal environments).
+**This reverses earlier guidance.** Since 0.50, `feglm()` supports fixed-effects
+demeaning for the `logit`, `probit`, and `gaussian` families. Verified live on
+0.60.0:
 
 ```python
-# Error: ModuleNotFoundError: No module named 'numba'
-# Or: numba compilation errors on first use
+# All of these fit and return finite coefficients on 0.60.0:
+pf.feglm("binary_Y ~ X1 | entity", data=df, family="logit")
+pf.feglm("binary_Y ~ X1 | entity", data=df, family="probit")
+pf.feglm("binary_Y ~ X1 | entity + year", data=df, family="logit")
 ```
 
-**Fix:** Use the scipy fallback backend:
+Pyfixest before 0.50 raised `NotImplementedError` for `feglm()` with fixed effects,
+and older skill guidance recommended the linear probability model (LPM) as a
+workaround. That software limitation is gone.
 
-```python
-fit = pf.feols("Y ~ X | fe", data=df, demeaner_backend="scipy")
-```
+**Remaining caveat (statistical, not a bug):** Nonlinear FE-GLMs with many *small*
+FE groups can suffer incidental-parameters bias — a property of the estimator, not
+of pyfixest. When FE groups are small, the LPM (`pf.feols("binary_Y ~ X | fe", ...)`,
+coefficients as percentage-point changes) remains a useful robustness comparison.
+
+## numba Optional; Rust Demeaner Default
+
+Since 0.60 the **default FE demeaning backend is a compiled Rust extension** shipped
+in the wheel — there is no numba JIT warm-up on the default path. **numba is now an
+optional extra** (`pyfixest[numba]`); it is still used for `MapDemeaner(backend="numba")`
+and the fast randomization-inference path (`ritest(..., choose_algorithm="fast")`).
 
-**Problem:** First call is very slow (numba JIT compilation).
+**In the DAAF image:** numba is present transitively (via umap-learn/wildboottest;
+the smoke test recorded numba 0.66.0), so the numba paths remain available here
+without any action. You do not need to worry about numba installation in DAAF.
 
-**Fix:** This is expected — numba compiles on first use, then caches. Subsequent calls are fast. For scripts, this is a one-time cost.
+**First-call latency:** The old numba JIT warm-up on the first call no longer applies
+to the default Rust path. If you explicitly select `MapDemeaner(backend="numba")`,
+the first call still pays a one-time JIT compilation cost.
 
 ## Formula Parsing
 
@@ -256,13 +282,13 @@ fit.vcov("HC3")  # Error: HC3 not supported with IV
 | Feature | R fixest | pyfixest | Notes |
 |---------|----------|----------|-------|
 | Sun-Abraham | `sunab()` function | `event_study(estimator="saturated")` | Different API, same estimator |
-| etable maturity | Full-featured | Evolving (migrating to maketables) | R version more polished |
-| feglm with FE | Supported | NOT supported | Major gap in pyfixest |
-| Default SE (v0.40+) | iid | iid | Now aligned |
+| etable maturity | Full-featured | maketables backend (since 0.50) | R version still more polished for styling |
+| feglm with FE | Supported | Supported (since 0.50) | Formerly a gap; now closed |
+| Default SE (0.40+) | iid | iid | Aligned (fixest 0.13 / pyfixest 0.40) |
 | Wild bootstrap | `fwildclusterboot` (R) | `wildboottest` (Python) | Separate packages |
 | sunab aggregation | `aggregate()` | `fit.aggregate()` | Similar API |
 | Formula syntax | Nearly identical | Nearly identical | `i()` and `|` notation shared |
-| `etable()` type argument | `"latex"`, `"md"` | `"tex"`, `"md"`, `"gt"`, `"df"` | Slight naming difference |
+| `etable()` type argument | `"latex"`, `"md"` | `"gt"` (default), `"df"`, `"md"`, `"tex"`, `"typst"`, `"html"` | Slight naming difference; `typst`/`html` added 0.60 |
 | Multiple LHS | `c(Y1, Y2)` | `Y1 + Y2` | Syntax differs |
 
 ### Features in R fixest Not Yet in pyfixest
@@ -322,9 +348,10 @@ Passing a Polars DataFrame directly may raise a `TypeError` or produce unexpecte
 | Symptom | Likely Cause | Fix |
 |---------|-------------|-----|
 | TypeError with Polars DataFrame | pyfixest expects pandas | `df = df_polars.to_pandas()` |
-| Different SEs from old code | v0.40 default SE change | Specify `vcov` explicitly |
-| `NotImplementedError` with feglm | FE not supported in feglm | Use feols (LPM) or statsmodels |
-| Very slow first call | numba JIT compilation | Normal; or use `demeaner_backend="scipy"` |
+| Different SEs from old code | 0.40 default SE change (now iid) | Specify `vcov` explicitly |
+| Missing significance stars in etable | Custom `coef_fmt` without a `*` token (0.60) | Include `*` in `coef_fmt` (e.g. `"b* \n (se)"`) |
+| `DeprecationWarning` on `demeaner_backend`/`fixef_tol` | Loose kwargs deprecated in 0.60 | Use `demeaner=pf.MapDemeaner(...)` |
+| Very slow first call with `backend="numba"` | numba JIT compilation | Normal for numba; the default Rust demeaner has no JIT warm-up |
 | Memory error with CRV3 | Too many clusters × params | Use CRV1 or wild bootstrap |
 | Poisson won't converge | Separation or sparse data | Increase maxiter, check for separation |
 | Many singletons dropped | Fine-grained FE | Expected; check FE specification |
@@ -333,7 +360,7 @@ Passing a Polars DataFrame directly may raise a `TypeError` or produce unexpecte
 
 ## References and Further Reading
 
-- pyfixest changelog: https://py-econometrics.github.io/pyfixest/changelog.html
+- pyfixest changelog: https://pyfixest.org/changelog.html
 - pyfixest GitHub issues: https://github.com/py-econometrics/pyfixest/issues
 - Berge, L., Butts, K., and McDermott, G. (2026). "Fast and User-Friendly Econometrics Estimations: The R Package fixest." arXiv:2601.21749
 - Cameron, A.C. and Miller, D.L. (2015). "A Practitioner's Guide to Cluster-Robust Inference." *Journal of Human Resources*, 50(2), 317-372
diff --git a/.claude/skills/pyfixest/references/integration.md b/.claude/skills/pyfixest/references/integration.md
index 41d3f7f0..3d66b74c 100644
--- a/.claude/skills/pyfixest/references/integration.md
+++ b/.claude/skills/pyfixest/references/integration.md
@@ -99,6 +99,17 @@ fit = pf.fepois("Y ~ X1 | fe1 + fe2", data=df,
                 )
 ```
 
+### Exposure / Offset (0.60)
+
+`fepois()` accepts an `offset=` column name for exposure terms (e.g., population
+at risk, person-years) — the classic use case for count/rate models. Verified live
+on 0.60.0.
+
+```python
+# Model a rate: offset is the log-exposure column
+fit = pf.fepois("events ~ X1 | entity + year", data=df, offset="log_exposure")
+```
+
 **Separation** occurs when some FE levels perfectly predict zero counts. Separated observations have infinite likelihood and must be detected and handled. pyfixest can check for separation but the user should be aware of this possibility with sparse count data.
 
 ### Poisson with Multiple Estimation
@@ -111,12 +122,13 @@ pf.etable(fits)
 
 ## GLM (Logit/Probit)
 
-`feglm()` estimates generalized linear models.
+`feglm()` estimates generalized linear models, **including with fixed effects**
+since 0.50.
 
 ### Basic Usage
 
 ```python
-# Logit model
+# Logit model (no FE)
 fit = pf.feglm("binary_Y ~ X1 + X2", data=df, family="logit",
                vcov="hetero")
 fit.summary()
@@ -129,15 +141,32 @@ fit = pf.feglm("binary_Y ~ X1 + X2", data=df, family="probit",
 fit = pf.feglm("Y ~ X1 + X2", data=df, family="gaussian")
 ```
 
-### Fixed Effects Limitation
+### Fixed Effects (Supported Since 0.50)
+
+`feglm()` supports fixed-effects demeaning for the `logit`, `probit`, and
+`gaussian` families. Verified live on 0.60.0: `pf.feglm("ybin ~ X1 | f1", family="logit")`
+and `... | f1 + f2` both fit and return finite coefficients.
 
-**`feglm()` does NOT currently support fixed effects demeaning.** This is a work in progress. Attempting `pf.feglm("Y ~ X | fe", ...)` raises `NotImplementedError`.
+```python
+# Logit with one-way FE
+fit = pf.feglm("binary_Y ~ X1 | entity", data=df, family="logit",
+               vcov={"CRV1": "entity"})
+
+# Probit with two-way FE
+fit = pf.feglm("binary_Y ~ X1 | entity + year", data=df, family="probit")
+```
 
-**Workarounds:**
-- **Linear probability model**: Use `pf.feols("binary_Y ~ X | fe", data=df)` — interprets coefficients as percentage point changes in probability
-- **Manual dummies**: Include FE as explicit dummy variables (slow for many levels)
-- **statsmodels**: For logit/probit with moderately many FE levels, use `statsmodels` with dummy variables
-- **Conditional logit**: For binary outcomes with entity FE, Chamberlain's conditional logit eliminates the incidental parameters problem
+> **Historical note:** Pyfixest before 0.50 raised `NotImplementedError` for
+> `feglm()` with fixed effects, and older skill guidance recommended the linear
+> probability model as a workaround. That limitation no longer applies — FE-GLMs
+> are estimated natively.
+
+**Incidental-parameters caveat (statistical, not a software limit):** Nonlinear
+FE-GLMs (logit/probit) with many small FE groups can suffer incidental-parameters
+bias. This is a property of the estimator, not of pyfixest. When entity groups are
+small, consider the linear probability model (`pf.feols("binary_Y ~ X | fe", ...)`,
+coefficients as percentage-point changes) or bias-correction methods as robustness
+checks, and interpret nonlinear FE-GLM coefficients accordingly.
 
 ## Quantile Regression
 
@@ -176,7 +205,9 @@ fit = pf.quantreg("Y ~ X1 + X2", data=df, quantile=0.5,
 | `"cfm1"` (default multi) | Independent estimation of each quantile |
 | `"cfm2"` | Faster but uses asymptotic equivalence approximation |
 
-**Note:** Quantile regression is marked **experimental** in pyfixest. Check the changelog for stability updates.
+**Note:** Quantile regression (`pf.quantreg`/`pf.qplot`, both present in 0.60.0)
+matured through the 0.50 line (multi-quantile process, robust/clustered SEs via a
+Rust CRV1 vcov loop). Check the changelog for the latest stability status.
 
 ## marginaleffects Integration
 
@@ -251,30 +282,40 @@ fit = pf.feols("Y ~ X1 + X2 | fe", data=df,
                use_compression=True)
 ```
 
-Returns a `FeolsCompressed` object. Point estimates are identical to standard `feols()`; inference adjusts for the compression.
+Returns a `FeolsCompressed` object. Point estimates are identical to standard `feols()`; inference adjusts for the compression. Compressed regression supports only CRV1 inference, and the cluster variable must appear among the model features (verified live: passing `use_compression=True` with a default `iid` vcov, or with a cluster variable not in the model, raises `NotImplementedError`).
+
+> **0.60 note:** The `use_compression` (Wong et al. 2021 Mundlak compression) path
+> is flagged for deprecation in the 0.60 release notes in favor of the `duckreg`
+> package. The feature remains present in 0.60.0 (probed live only up to its
+> CRV1/cluster constraints, not through a full compressed run), but prefer
+> `duckreg` for new compressed-regression work if it is available.
 
 ## Performance Tuning
 
-### Backend Selection
+### Backend Selection (0.60 typed API)
+
+Since 0.60 the demeaning backend is set via a typed `demeaner=` object; the default
+is the compiled Rust MAP demeaner. The loose `demeaner_backend` kwarg is deprecated
+(still works with a `DeprecationWarning`). See `fixed-effects.md` § Backend Options
+for the full table.
 
 | Component | Parameter | Options | Default |
 |-----------|-----------|---------|---------|
-| FE demeaning | `demeaner_backend` | `"numba"`, `"jax"`, `"cupy"`, `"scipy"`, `"rust-cg"` | `"numba"` |
-| Linear solver | `solver` | `"scipy.linalg.solve"`, `"numpy.linalg.solve"`, `"jax"` | `"scipy.linalg.solve"` |
+| FE demeaning | `demeaner=` | `MapDemeaner(backend="rust"\|"numba")`, `LsmrDemeaner(backend="torch"\|"scipy")` | `MapDemeaner(backend="rust")` |
+| Linear solver | `solver` | `"scipy.linalg.solve"`, `"numpy.linalg.solve"` | `"scipy.linalg.solve"` |
 
 ### When to Switch Backends
 
 | Scenario | Recommendation |
 |----------|---------------|
-| Standard use (<1M obs) | Default (numba + scipy) |
-| Large data, many FE | Try `jax` or `cupy` with GPU |
-| numba installation issues | `demeaner_backend="scipy"` |
-| GPU available (Nvidia A100+) | `demeaner_backend="jax"`, `solver="jax"` |
+| Standard use (<1M obs) | Default (Rust MAP demeaner) |
+| Large data, many FE, GPU available | `demeaner=pf.LsmrDemeaner(backend="torch", device="cuda")` |
+| Prefer JIT MAP path | `demeaner=pf.MapDemeaner(backend="numba")` |
 
 ```python
-# GPU-accelerated estimation
+# GPU-accelerated estimation (requires a torch GPU build — not in the DAAF image)
 fit = pf.feols("Y ~ X1 | f1 + f2 + f3", data=large_df,
-               demeaner_backend="jax", solver="jax")
+               demeaner=pf.LsmrDemeaner(backend="torch", device="cuda"))
 ```
 
 ### Other Performance Parameters
diff --git a/.claude/skills/pyfixest/references/quickstart.md b/.claude/skills/pyfixest/references/quickstart.md
index 05df2e0c..3139b3c4 100644
--- a/.claude/skills/pyfixest/references/quickstart.md
+++ b/.claude/skills/pyfixest/references/quickstart.md
@@ -11,20 +11,26 @@
 
 ## Installation
 
-No installation needed in DAAF: `pyfixest` (0.40.0) is pre-installed in the
-container, along with `wildboottest`, `marginaleffects`, and `great-tables` (used
-by `etable` output). Runtime installs are blocked in DAAF (`pip install`/`uv add`
-are refused both at the command line and inside executed scripts — see CLAUDE.md
-§ Runtime Package Installation). If an extra that is not pre-installed (e.g.,
-`pyfixest[jax]` for the JAX backend, or `lets-plot`) is genuinely required,
-escalate to the user to add it to the Dockerfile (user additions block near the
-end) and rebuild.
+No installation needed in DAAF: `pyfixest` (0.60.0) is pre-installed in the
+container, along with `wildboottest`, `marginaleffects`, `maketables` (the table
+rendering backend since 0.50), and `great-tables` (which maketables uses to render
+`etable(type="gt")` output; `great-tables` is pinned independently in DAAF's
+Dockerfile). Since 0.60 the default FE demeaning backend is a compiled Rust
+extension shipped in the wheel, so no numba JIT warm-up is needed for the default
+path; `numba` is now an optional extra but is present transitively in the DAAF
+image (transitively, e.g. via wildboottest), so `MapDemeaner(backend="numba")` and fast
+randomization inference still work here. Runtime installs are blocked in DAAF
+(`pip install`/`uv add` are refused both at the command line and inside executed
+scripts — see CLAUDE.md § Runtime Package Installation). If an extra that is not
+pre-installed (e.g., `pyfixest[jax]` for the JAX backend, or `lets-plot`) is
+genuinely required, escalate to the user to add it to the Dockerfile (user
+additions block near the end) and rebuild.
 
 ### Verify Installation
 
 ```python
 import pyfixest as pf
-print(pf.__version__)  # Should be 0.40.0+
+print(pf.__version__)  # DAAF ships 0.60.0
 ```
 
 ## Your First Regression
diff --git a/.claude/skills/pyfixest/references/tables-and-plots.md b/.claude/skills/pyfixest/references/tables-and-plots.md
index 7724aa71..4197f9f9 100644
--- a/.claude/skills/pyfixest/references/tables-and-plots.md
+++ b/.claude/skills/pyfixest/references/tables-and-plots.md
@@ -30,15 +30,29 @@ pf.etable([fit1, fit2, fit3, fit4])
 
 ### Output Formats
 
+Since 0.50, `etable()` renders through the `maketables` backend (the `great_tables`
+dependency was replaced). The public API is unchanged. Return types verified live
+on 0.60.0:
+
+| `type=` | Returns | Notes |
+|---------|---------|-------|
+| *(default)* / `"gt"` | `great_tables.gt.GT` | HTML table object, rendered via maketables |
+| `"df"` | `pandas.DataFrame` | For further processing |
+| `"md"` | prints to stdout, returns `None` | Markdown |
+| `"tex"` | `str` | LaTeX (requires booktabs, threeparttable, makecell) |
+| `"typst"` | `str` | Typst markup (added 0.60) |
+| `"html"` | `str` | Raw HTML string |
+
 ```python
-# Interactive HTML table (default, requires great_tables)
+# Interactive HTML table (default, returns a great_tables GT object via maketables)
 pf.etable([fit1, fit2], type="gt")
 
-# Markdown table
+# Markdown table (printed to stdout)
 pf.etable([fit1, fit2], type="md")
 
-# LaTeX (requires booktabs, threeparttable, makecell)
+# LaTeX / Typst (both return a string)
 pf.etable([fit1, fit2], type="tex")
+pf.etable([fit1, fit2], type="typst")
 
 # DataFrame for further processing
 df_table = pf.etable([fit1, fit2], type="df")
@@ -47,6 +61,14 @@ df_table = pf.etable([fit1, fit2], type="df")
 pf.etable([fit1, fit2], type="tex", file_name="regression_table.tex")
 ```
 
+> **Significance stars and `coef_fmt` (0.60 behavior):** Stars are **on by default**
+> — verified live, the default `type="df"` output shows cells like `-0.950*** \n (0.066)`.
+> In 0.60 the star behavior is governed by the `coef_fmt` string: a `*` token on a
+> statistic (e.g. `"b* \n (se)"` or `"b:.3f*"`) requests stars. The trap: if you pass
+> a **custom `coef_fmt` that omits `*`, the table loses its significance stars**. A
+> stars-dropping regression in this area was fixed in 0.50.1, so on 0.60 the default
+> is starred; keep the `*` token when customizing `coef_fmt` if you want to retain them.
+
 ### Customization
 
 ```python
@@ -58,9 +80,11 @@ pf.etable(
     exact_match=False,           # False = regex matching (default)
 
     # Formatting
-    coef_fmt="b \n (se)",        # Format: b=coef, se=SE, p=p-val, ci=CI
+    coef_fmt="b* \n (se)",       # Format: b=coef, se=SE, p=p-val, ci=CI; the `*`
+                                 #   token requests significance stars (omit it and
+                                 #   the column loses stars — see note above)
     digits=3,                    # Decimal places
-    signif_code=[0.001, 0.01, 0.05],  # Significance stars
+    signif_code=[0.001, 0.01, 0.05],  # Significance thresholds for the stars
 
     # Labels
     labels={"X1": "Education", "X2": "Experience"},
@@ -79,10 +103,14 @@ The `coef_fmt` parameter controls how coefficients are displayed:
 
 | Template | Output |
 |----------|--------|
-| `"b \n (se)"` | Coefficient with SE below (default) |
-| `"b (se)"` | Coefficient and SE on same line |
-| `"b [ci]"` | Coefficient with confidence interval |
-| `"b \n (se) \n [p]"` | Coefficient, SE, and p-value |
+| `"b* \n (se)"` | Coefficient (starred) with SE below |
+| `"b* (se)"` | Coefficient and SE on same line |
+| `"b* [ci]"` | Coefficient with confidence interval |
+| `"b* \n (se) \n [p]"` | Coefficient, SE, and p-value |
+
+The `*` token controls significance stars (0.60 behavior — see the note above). A
+statistic token also accepts a format spec, e.g. `"b:.3f*"` for three decimals with
+stars.
 
 ### Fixed Effects Rows
 
diff --git a/.claude/skills/python-r-translation/SKILL.md b/.claude/skills/python-r-translation/SKILL.md
index eeef45af..f0347e36 100644
--- a/.claude/skills/python-r-translation/SKILL.md
+++ b/.claude/skills/python-r-translation/SKILL.md
@@ -8,7 +8,7 @@ description: >-
 metadata:
   audience: research-coders
   domain: cross-language
-  skill-last-updated: "2026-05-13"
+  skill-last-updated: "2026-07-24"
 ---
 
 # Python-to-R Translation Skill
@@ -179,7 +179,7 @@ reference files note the change.
 | R Package | R Version (CRAN) | Python Equivalent | DAAF Version |
 |---|---|---|---|
 | dplyr + tidyr + data.table | dplyr 1.2.0, tidyr 1.3.2, data.table 1.18.2 | polars | 1.39.3 |
-| fixest | 0.14.0 | pyfixest | 0.40.0 |
+| fixest | 0.14.0 | pyfixest | 0.60.0 |
 | ggplot2 | 4.0.2 | plotnine | 0.15.3 |
 | plotly (R) | 4.12.0 | plotly | 6.5.2 |
 | base R stats + lmtest + sandwich | lmtest 0.9-40, sandwich 3.1-1 | statsmodels | 0.14.6 |
diff --git a/.claude/skills/python-r-translation/references/causal-inference.md b/.claude/skills/python-r-translation/references/causal-inference.md
index f7e8f5fd..6df75b95 100644
--- a/.claude/skills/python-r-translation/references/causal-inference.md
+++ b/.claude/skills/python-r-translation/references/causal-inference.md
@@ -13,7 +13,7 @@ DAAF's R stack provides strong coverage:
 
 > **Versions referenced:**
 > R: fixest 0.14.0, marginaleffects 0.32.0, rdrobust 3.0.0
-> Python: pyfixest 0.40.0, marginaleffects 0.5.0, rdrobust 1.3.0
+> Python: pyfixest 0.60.0, marginaleffects 0.5.0, rdrobust 1.3.0
 > See SKILL.md § Library Versions for the complete version table.
 
 > **Availability:** Of the R packages below, `fixest`, `marginaleffects`,
@@ -173,7 +173,7 @@ statsmodels, pyfixest, and scikit-learn.
 | **Weighting** | `WeightIt` | No equivalent | **Significant gap** |
 | Synthetic control | `Synth`, `augsynth`, `gsynth` | `CausalPy` (Bayesian) | Low |
 | Causal forests | `grf` | `econml` | Medium |
-| **GLM + FE** | `fixest::feglm()` | **Not supported** | **Major gap** |
+| GLM + FE | `fixest::feglm()` | `pf.feglm()` (logit/probit/gaussian, since 0.50) | High for those families; Gamma/negbin still R-only |
 | Survival/Cox | `survival::coxph()` | `lifelines` | High |
 
 > **Sources:** Cunningham, *Causal Inference: The Mixtape* (2021);
diff --git a/.claude/skills/python-r-translation/references/external-resources.md b/.claude/skills/python-r-translation/references/external-resources.md
index 2bc0e998..c2fa08c5 100644
--- a/.claude/skills/python-r-translation/references/external-resources.md
+++ b/.claude/skills/python-r-translation/references/external-resources.md
@@ -25,7 +25,8 @@ should be cross-checked against current documentation.
   will find the API intentionally parallel.
 - **For Python users:** The formula syntax is nearly identical to pyfixest. The
   main differences are clustering syntax (`~entity` vs `{"CRV1": "entity"}`) and
-  that `feglm()` with FE works in R but not in pyfixest.
+  that R fixest's `feglm()` covers more GLM families with FE (e.g., Gamma) plus
+  `fenegbin`; pyfixest's `feglm()` supports FE for logit/probit/gaussian since 0.50.
 
 ### ggplot2 Documentation
 
diff --git a/.claude/skills/python-r-translation/references/regression-modeling.md b/.claude/skills/python-r-translation/references/regression-modeling.md
index a78015a3..455a6635 100644
--- a/.claude/skills/python-r-translation/references/regression-modeling.md
+++ b/.claude/skills/python-r-translation/references/regression-modeling.md
@@ -15,7 +15,7 @@ DAAF's R modeling stack:
 
 > **Versions referenced:**
 > R: fixest 0.14.0, lmtest 0.9-40, sandwich 3.1-1, plm 2.6-7, lme4 2.0-1
-> Python: pyfixest 0.40.0, statsmodels 0.14.6, linearmodels 7.0
+> Python: pyfixest 0.60.0, statsmodels 0.14.6, linearmodels 7.0
 > See SKILL.md § Library Versions for the complete version table.
 
 ---
@@ -168,14 +168,16 @@ fit <- glm(y ~ x1 + x2, data = df, family = binomial(link = "logit"))
 fit <- feglm(y ~ x1 | entity + year, data = df, family = binomial)
 ```
 
-R fixest's `feglm()` supports logit/probit with high-dimensional FE. This is a
-**major gap in pyfixest** -- `pf.feglm()` does NOT support fixed effects.
+R fixest's `feglm()` supports logit/probit/gaussian with high-dimensional FE.
+pyfixest gained this too in 0.50 (DAAF ships 0.60.0): `pf.feglm("y ~ x | fe",
+family="logit")` maps almost directly. Families beyond logit/probit/gaussian
+(e.g., Gamma) and `fenegbin` still favor R fixest.
 
 | R | Python |
 |---|--------|
 | `glm(y ~ x, family = binomial)` | `smf.logit("y ~ x", data=df).fit()` |
 | `glm(y ~ x, family = poisson)` | `smf.poisson("y ~ x", data=df).fit()` |
-| `feglm(y ~ x | fe, family = binomial)` | **Not supported** in pyfixest |
+| `feglm(y ~ x | fe, family = binomial)` | `pf.feglm("y ~ x | fe", data=df, family="logit")` (since 0.50) |
 | `fepois(y ~ x | fe)` | `pf.fepois("y ~ x | fe", data=df)` |
 
 ---
@@ -247,6 +249,6 @@ R's diagnostic functions are typically single-call convenience wrappers.
 Python often requires assembling the inputs manually.
 
 > **Sources:** Berge, Butts, & McDermott, *fixest* (CRAN);
-> Fischer et al., *pyfixest* (pyfixest.org, accessed 2026-03-28);
+> Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-24);
 > Seabold & Perktold, *statsmodels* (v0.14.6);
 > Croissant & Millo, *plm* (CRAN)
diff --git a/.claude/skills/r-python-translation/SKILL.md b/.claude/skills/r-python-translation/SKILL.md
index 0359b1f3..2a25550c 100644
--- a/.claude/skills/r-python-translation/SKILL.md
+++ b/.claude/skills/r-python-translation/SKILL.md
@@ -190,7 +190,7 @@ files note the change.
 | Python Package | DAAF Version | R Equivalent | R Version (CRAN) |
 |---|---|---|---|
 | polars | 1.39.3 | dplyr + tidyr + data.table | dplyr 1.2.0, tidyr 1.3.2, data.table 1.18.2 |
-| pyfixest | 0.40.0 | fixest | 0.14.0 |
+| pyfixest | 0.60.0 | fixest | 0.14.0 |
 | plotnine | 0.15.3 | ggplot2 | 4.0.2 |
 | plotly | 6.5.2 | plotly (R) | 4.12.0 |
 | statsmodels | 0.14.6 | base R stats + lmtest + sandwich | lmtest 0.9-40, sandwich 3.1-1 |
diff --git a/.claude/skills/r-python-translation/references/causal-inference.md b/.claude/skills/r-python-translation/references/causal-inference.md
index 5fe7b8ce..42d45178 100644
--- a/.claude/skills/r-python-translation/references/causal-inference.md
+++ b/.claude/skills/r-python-translation/references/causal-inference.md
@@ -20,14 +20,14 @@ equivalent in DAAF), generalized random forests (no grf port), and multiple
 imputation (no mice equivalent). These are documented honestly in this reference.
 
 > **Versions referenced:**
-> Python: pyfixest 0.40.0, marginaleffects 0.5.0, rdrobust 1.3.0 (all pre-installed)
+> Python: pyfixest 0.60.0, marginaleffects 0.5.0, rdrobust 1.3.0 (all pre-installed)
 > R: fixest 0.14.0, marginaleffects 0.32.0, rdrobust 3.0.0, did 2.3.0, did2s 1.2.1
 > See SKILL.md § Library Versions for the complete version table.
 
 > **Sources:** Cunningham, *Causal Inference: The Mixtape* (Yale, 2021);
 > Huntington-Klein, *The Effect* (CRC Press, 2021);
 > Berge, Butts, & McDermott, *fixest* (CRAN, v0.13);
-> Fischer et al., *pyfixest* (pyfixest.org, v0.40.0, accessed 2026-03-28);
+> Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-23);
 > Cattaneo, Idrobo, & Titiunik, *rdrobust* (rdpackages.github.io);
 > Arel-Bundock, Greifer, & Heiss, "How to Interpret Statistical Models Using
 > marginaleffects for R and Python" (JSS, 2024)
@@ -890,7 +890,7 @@ exporting the completed datasets.
 |--------|-----------|------------------|----------|---------|----------------|
 | **OLS + FE** | `fixest::feols()` | `pf.feols()` | Very High | Pre-installed | Cluster SE syntax differs |
 | **Poisson + FE** | `fixest::fepois()` | `pf.fepois()` | Very High | Pre-installed | Identical formula syntax |
-| **GLM + FE** | `fixest::feglm()` | **Not supported** | N/A | N/A | **Major gap** |
+| **GLM + FE** | `fixest::feglm()` | `pf.feglm()` (since 0.50) | High | Pre-installed | logit/probit/gaussian; Gamma and negbin remain R-only |
 | **TWFE DiD** | `fixest::feols()` | `pf.feols()` | Very High | Pre-installed | Cluster SE syntax only |
 | **did2s** | `did2s::did2s()` | `pf.did2s()` | Very High | Pre-installed | `cluster_var` vs `cluster` |
 | **Sun-Abraham** | `fixest::sunab()` | `pf.event_study(est="saturated")` | High | Pre-installed | Different API, same estimator |
diff --git a/.claude/skills/r-python-translation/references/external-resources.md b/.claude/skills/r-python-translation/references/external-resources.md
index 1df0b519..18273724 100644
--- a/.claude/skills/r-python-translation/references/external-resources.md
+++ b/.claude/skills/r-python-translation/references/external-resources.md
@@ -38,7 +38,8 @@ currency concerns should be cross-checked against current documentation.
   difference-in-differences estimators (TWFE, did2s, lpdid, Sun-Abraham), and
   publication-quality tables via `etable()`. Formula syntax documentation makes
   direct comparison to R straightforward.
-- **Limitations:** Some R fixest features (feglm with FE) not yet implemented.
+- **Limitations:** Residual gaps vs R fixest are GLM families beyond
+  logit/probit/gaussian (e.g., Gamma) and `fenegbin`.
   See the DAAF pyfixest skill's gotchas.md for the full gap list.
 
 ### plotnine Documentation
@@ -539,8 +540,8 @@ these as the "source" for the patterns that DAAF's Python stack translates.
 - **DAAF Python equivalent:** pyfixest (intentionally parallel API)
 - **Key mapping:** `feols()` to `pf.feols()`, `fepois()` to `pf.fepois()`,
   `etable()` to `pf.etable()`, `coefplot()` to `pf.coefplot()`. Formula syntax
-  is identical: `Y ~ X1 + X2 | fe1 + fe2`. Note: `feglm()` with FE is not yet
-  supported in pyfixest.
+  is identical: `Y ~ X1 + X2 | fe1 + fe2`. `feglm()` maps to `pf.feglm()`
+  (FE support since pyfixest 0.50: logit/probit/gaussian).
 
 ### survey
 
diff --git a/.claude/skills/r-python-translation/references/gotchas.md b/.claude/skills/r-python-translation/references/gotchas.md
index 12033abc..0e87ac28 100644
--- a/.claude/skills/r-python-translation/references/gotchas.md
+++ b/.claude/skills/r-python-translation/references/gotchas.md
@@ -8,7 +8,7 @@ This reference focuses on the DAAF Python stack: polars for data manipulation,
 pyfixest/statsmodels for modeling, and plotnine for visualization.
 
 > **Versions referenced:**
-> Python: polars 1.39.3, pyfixest 0.40.0, statsmodels 0.14.6
+> Python: polars 1.39.3, pyfixest 0.60.0, statsmodels 0.14.6
 > R: R 4.5.3
 > See SKILL.md § Library Versions for the complete version table.
 
@@ -316,13 +316,14 @@ in fixest also defaults to IID (since fixest 0.13).
 
 | Library | Default SE | Notes |
 |---------|-----------|-------|
-| pyfixest (v0.40+) | IID | Aligned with R fixest 0.13 |
+| pyfixest (0.40+, incl. 0.60.0) | IID | Aligned with R fixest 0.13 |
 | statsmodels OLS | Non-robust (IID) | Use `.get_robustcov_results()` for robust |
 | scikit-learn | No SEs provided | Not a statistical inference tool |
 
 pyfixest's alignment with fixest means R users get familiar defaults.
-However, pre-v0.40 pyfixest defaulted to clustering by the first FE, so
-older code may produce different results.
+However, pre-0.40 pyfixest defaulted to clustering by the first FE, so
+older code may produce different results. This default is unchanged through the
+current 0.60.0.
 
 ## Environment Traps
 
diff --git a/.claude/skills/r-python-translation/references/regression-modeling.md b/.claude/skills/r-python-translation/references/regression-modeling.md
index aeff9e34..547ee725 100644
--- a/.claude/skills/r-python-translation/references/regression-modeling.md
+++ b/.claude/skills/r-python-translation/references/regression-modeling.md
@@ -14,12 +14,12 @@ DAAF's Python modeling stack has three tiers:
 This reference provides side-by-side translations for every major regression task.
 
 > **Versions referenced:**
-> Python: pyfixest 0.40.0, statsmodels 0.14.6, linearmodels 7.0
+> Python: pyfixest 0.60.0, statsmodels 0.14.6, linearmodels 7.0
 > R: fixest 0.14.0, lmtest 0.9-40, sandwich 3.1-1, plm 2.6-7, lme4 2.0-1
 > See SKILL.md § Library Versions for the complete version table.
 
 > **Sources:** Berge, Butts, & McDermott, *fixest* (CRAN, v0.13);
-> Fischer et al., *pyfixest* (pyfixest.org, v0.40.0, accessed 2026-03-28);
+> Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-23);
 > Seabold & Perktold, *statsmodels* (v0.14.6);
 > Sheppard, *linearmodels* (v7.0);
 > Croissant & Millo, *plm: Linear Models for Panel Data* (CRAN, v2.6)
@@ -473,7 +473,7 @@ fit = smf.glm("count_y ~ x1 + x2", data=df,
 | Gamma | `family=Gamma` | `family=Gamma()` |
 | Inverse Gaussian | `family=inverse.gaussian` | `family=InverseGaussian()` |
 
-### The feglm Gap: GLM with Fixed Effects
+### feglm: GLM with Fixed Effects (Gap Closed in pyfixest 0.50)
 
 R fixest provides `feglm()` which supports logit, probit, and other GLMs with
 absorbed high-dimensional fixed effects:
@@ -483,15 +483,22 @@ absorbed high-dimensional fixed effects:
 fit <- feglm(y ~ x1 | entity + year, data = df, family = binomial)
 ```
 
-**pyfixest `feglm()` does NOT support fixed effects.** Attempting
-`pf.feglm("y ~ x | fe", ...)` raises `NotImplementedError`. This is the single
-largest feature gap between R fixest and pyfixest.
+**pyfixest `feglm()` supports fixed effects since 0.50** (logit/probit/gaussian),
+so this maps almost directly:
 
-**Workarounds:**
+```python
+# Python (pyfixest 0.60.0): FE-GLM works — verified live
+fit = pf.feglm("y ~ x1 | entity + year", data=df, family="logit")
+```
+
+Pyfixest before 0.50 raised `NotImplementedError` for `feglm()` with fixed effects,
+which older guidance called the single largest R-fixest/pyfixest gap; that gap is
+now closed. The alternatives below remain useful mainly as robustness comparisons
+(e.g., when nonlinear FE-GLMs risk incidental-parameters bias with small FE groups):
 
 | Approach | Code | When to Use |
 |----------|------|-------------|
-| Linear probability model | `pf.feols("binary_y ~ x \| fe", data=df)` | Most cases; interpret coefficients as pp changes |
+| Linear probability model | `pf.feols("binary_y ~ x \| fe", data=df)` | Robustness check; interpret coefficients as pp changes |
 | Manual dummies + statsmodels | `smf.logit("y ~ x + C(entity)", data=df).fit()` | Small/moderate number of FE levels |
 | Conditional logit | `sm.discrete.ConditionalLogit(...)` | Binary outcome with entity FE |
 | Poisson pseudo-ML | `pf.fepois("binary_y ~ x \| fe", data=df)` | If log-linear approximation acceptable |
@@ -589,9 +596,10 @@ fit = PanelOLS.from_formula("y ~ x + EntityEffects", data=df_panel).fit(
   or IV. With FE, use HC1 or clustered SEs.
 - **Two-way clustering in statsmodels** is not directly supported. Use pyfixest or
   linearmodels instead.
-- **Default SE changed in pyfixest v0.40**: Both R fixest 0.13 and pyfixest 0.40
-  now default to `"iid"`. Older code that relied on automatic clustering by the
-  first FE will silently produce different results.
+- **Default SE changed in pyfixest 0.40** (unchanged through 0.60): Both R fixest
+  0.13 and pyfixest (0.40 onward, including the current 0.60.0) default to `"iid"`.
+  Older code that relied on automatic clustering by the first FE will silently
+  produce different results.
 
 ---
 
diff --git a/.claude/skills/r-python-translation/references/visualization.md b/.claude/skills/r-python-translation/references/visualization.md
index 03e46b93..7aaa518b 100644
--- a/.claude/skills/r-python-translation/references/visualization.md
+++ b/.claude/skills/r-python-translation/references/visualization.md
@@ -709,7 +709,7 @@ into plotnine natively. Other ggforce geoms require matplotlib workarounds.
 > 2026-03-28); plotnine feature parity guide (plotnine.org/guide/feature-coverage.html,
 > accessed 2026-03-28); Plotly R reference (plotly.com/r/, accessed 2026-03-28);
 > Plotly Python reference (plotly.com/python/, accessed 2026-03-28); pyfixest
-> documentation (py-econometrics.github.io/pyfixest/, accessed 2026-03-28);
+> documentation (pyfixest.org, accessed 2026-07-23);
 > Arel-Bundock, V., marginaleffects Python package (marginaleffects.com, accessed
 > 2026-03-28); Tidy Intelligence, "ggplot2 vs plotnine" (blog.tidy-intelligence.com,
 > accessed 2026-03-28)
diff --git a/.claude/skills/stata-python-translation/SKILL.md b/.claude/skills/stata-python-translation/SKILL.md
index 87a171e5..2d4cf4a1 100644
--- a/.claude/skills/stata-python-translation/SKILL.md
+++ b/.claude/skills/stata-python-translation/SKILL.md
@@ -5,7 +5,7 @@ description: >-
 metadata:
   audience: research-coders
   domain: cross-language
-  skill-last-updated: "2026-03-28"
+  skill-last-updated: "2026-07-24"
 ---
 
 # Stata-to-Python Translation Skill
@@ -221,7 +221,7 @@ versions, the reference files note the change.
 | Python Package | DAAF Version | Stata Equivalent | Stata Version |
 |---|---|---|---|
 | polars | 1.39.3 | Data management commands (gen, replace, merge, etc.) | Stata 18 |
-| pyfixest | 0.40.0 | regress, areg, reghdfe, ivreghdfe, ppmlhdfe, esttab | Stata 18 + reghdfe 6.x |
+| pyfixest | 0.60.0 | regress, areg, reghdfe, ivreghdfe, ppmlhdfe, esttab | Stata 18 + reghdfe 6.x |
 | statsmodels | 0.14.6 | regress, logit, probit, poisson, nbreg, glm | Stata 18 |
 | linearmodels | 7.0 | xtreg, sureg, ivregress | Stata 18 |
 | plotnine | 0.15.3 | graph twoway, graph bar, graph box, histogram | Stata 18 |
diff --git a/.claude/skills/stata-python-translation/references/causal-inference.md b/.claude/skills/stata-python-translation/references/causal-inference.md
index abd7a3d0..b4299c31 100644
--- a/.claude/skills/stata-python-translation/references/causal-inference.md
+++ b/.claude/skills/stata-python-translation/references/causal-inference.md
@@ -20,7 +20,7 @@ DAAF's Python stack covers the most common causal designs:
 This reference documents both what translates cleanly and where real gaps remain.
 
 > **Versions referenced:**
-> Python: pyfixest 0.40.0, rdrobust 1.3.0, marginaleffects 0.5.0 (all
+> Python: pyfixest 0.60.0, rdrobust 1.3.0, marginaleffects 0.5.0 (all
 > pre-installed).
 > Stata: Stata 18 (SE/MP)
 > See SKILL.md for the complete version table.
@@ -39,7 +39,7 @@ This reference documents both what translates cleanly and where real gaps remain
 
 > **Sources:** Cunningham, *Causal Inference: The Mixtape* (Yale, 2021);
 > Huntington-Klein, *The Effect* (CRC Press, 2021);
-> Fischer et al., *pyfixest* (pyfixest.org, v0.40.0, accessed 2026-03-28);
+> Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-24);
 > Cattaneo, Idrobo, & Titiunik, *A Practical Introduction to Regression
 > Discontinuity Designs* (Cambridge, 2020);
 > Arel-Bundock, Greifer, & Heiss, "marginaleffects for R and Python" (JSS, 2024);
@@ -762,7 +762,7 @@ correction, Sargan/Hansen tests for over-identification).
 | `teffects psmatch` SE correction | SEs accounting for estimated propensity scores | **High** | Run matching in Stata/R; import matched data |
 | `teffects ipwra` / `teffects aipw` | Doubly-robust AIPW with correct SEs | **High** | `econml.dr.DRLearner` (different implementation) |
 | `xtabond` / `xtabond2` / `xtdpd` | Dynamic panel GMM (Arellano-Bond, Blundell-Bond) | **High** | No adequate Python equivalent |
-| `feglm` / GLM + high-dim FE | pyfixest `feglm()` does not support FE absorption | **High** | LPM, manual dummies, or `fepois` |
+| `feglm` / GLM + high-dim FE | pyfixest `feglm()` covers logit/probit/gaussian FE-GLMs since 0.50; Gamma and negative-binomial FE-GLMs still unported | **Low** | Direct `pf.feglm()` for logit/probit/gaussian; R fixest for Gamma/negbin |
 | `synth_runner` | Automated SC inference and placebo tests | **Medium** | Manual iteration; `scpi` for prediction intervals |
 | `psmatch2` balance diagnostics | Balance tables, variance ratios | **Medium** | Manual computation |
 | `cem` (coarsened exact matching) | Limited Python coverage | **Medium** | `pymatchit-causal` partial support |
@@ -837,6 +837,6 @@ correction, Sargan/Hansen tests for over-identification).
 > Goodman-Bacon, "Difference-in-Differences with Variation in Treatment Timing"
 > (*J. Econometrics*, 2021);
 > Arel-Bundock, "marginaleffects" (marginaleffects.com, accessed 2026-03-28);
-> Fischer et al., *pyfixest* (pyfixest.org, v0.40.0, accessed 2026-03-28);
+> Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-24);
 > Naqvi, "DiD estimator comparison" (asjadnaqvi.github.io/DiD);
 > Stata `teffects` manual (stata.com/manuals/causal.pdf)
diff --git a/.claude/skills/stata-python-translation/references/external-resources.md b/.claude/skills/stata-python-translation/references/external-resources.md
index 937437a5..b58d3003 100644
--- a/.claude/skills/stata-python-translation/references/external-resources.md
+++ b/.claude/skills/stata-python-translation/references/external-resources.md
@@ -44,9 +44,11 @@ documentation.
 - **Strengths:** Near-identical formula syntax to Stata's reghdfe; includes
   multiple estimation shortcuts (`sw()`, `csw()`, `split`); publication-quality
   tables via `etable()` with LaTeX, markdown, and HTML output.
-- **Limitations:** `feglm()` does not yet support fixed effects absorption (the
-  single largest feature gap vs Stata). Some fixest R features not yet ported.
-  See the DAAF pyfixest skill's gotchas.md for the full gap list.
+- **Limitations:** `feglm()` supports fixed effects absorption since 0.50
+  (logit/probit/gaussian; DAAF ships 0.60.0), so the historically largest GLM gap
+  vs Stata/R is closed for those families; families beyond them (e.g., Gamma) and
+  negative binomial still require R fixest. Some other fixest R features remain
+  unported. See the DAAF pyfixest skill's gotchas.md for the full gap list.
 
 ### statsmodels Documentation
 
diff --git a/.claude/skills/stata-python-translation/references/gotchas.md b/.claude/skills/stata-python-translation/references/gotchas.md
index 6854b264..91dfe567 100644
--- a/.claude/skills/stata-python-translation/references/gotchas.md
+++ b/.claude/skills/stata-python-translation/references/gotchas.md
@@ -8,7 +8,7 @@ This reference focuses on the DAAF Python stack: polars for data manipulation,
 pyfixest/statsmodels for modeling, and plotnine for visualization.
 
 > **Versions referenced:**
-> Python: polars 1.39.3, pyfixest 0.40.0, statsmodels 0.14.6
+> Python: polars 1.39.3, pyfixest 0.60.0, statsmodels 0.14.6
 > Stata: Stata 18
 > See SKILL.md -- Library Versions for the complete version table.
 
@@ -554,5 +554,5 @@ range(1, 11)       # [1, 2, ..., 10] -- exclusive upper bound
 > 2026-03-28); Turrell, "Coming from Stata" in *Coding for Economists*
 > (aeturrell.github.io, accessed 2026-03-28); pandas documentation, "Comparison with
 > Stata" (pandas.pydata.org, accessed 2026-03-28); polars User Guide (docs.pola.rs,
-> accessed 2026-03-28); pyfixest documentation (pyfixest.org, accessed 2026-03-28);
+> accessed 2026-03-28); pyfixest documentation (pyfixest.org, v0.60.0, accessed 2026-07-24);
 > statsmodels documentation (statsmodels.org, accessed 2026-03-28)
diff --git a/.claude/skills/stata-python-translation/references/paradigm-differences.md b/.claude/skills/stata-python-translation/references/paradigm-differences.md
index 872bfeed..fe5946ca 100644
--- a/.claude/skills/stata-python-translation/references/paradigm-differences.md
+++ b/.claude/skills/stata-python-translation/references/paradigm-differences.md
@@ -643,7 +643,7 @@ m1.resid()        # residuals
 > **Sources:** UCLA Statistical Consulting, "Returned results" (stats.oarc.ucla.edu,
 > accessed 2026-03-28); StataCorp, "Estimation and postestimation commands" User's Guide
 > Ch. 20 (stata.com/manuals/u20.pdf, accessed 2026-03-28); pyfixest documentation
-> (pyfixest.org, v0.40.0, accessed 2026-03-28); marginaleffects documentation
+> (pyfixest.org, v0.60.0, accessed 2026-07-24); marginaleffects documentation
 > (marginaleffects.com, accessed 2026-03-28)
 
 ---
diff --git a/.claude/skills/stata-python-translation/references/regression-modeling.md b/.claude/skills/stata-python-translation/references/regression-modeling.md
index 60db58dc..e702903f 100644
--- a/.claude/skills/stata-python-translation/references/regression-modeling.md
+++ b/.claude/skills/stata-python-translation/references/regression-modeling.md
@@ -17,11 +17,11 @@ as variables. There is no `estimates store` / `estimates restore` — every
 `pf.feols()` or `smf.ols().fit()` already returns a persistent object.
 
 > **Versions referenced:**
-> Python: pyfixest 0.40.0, statsmodels 0.14.6, linearmodels 7.0, marginaleffects 0.5.0
+> Python: pyfixest 0.60.0, statsmodels 0.14.6, linearmodels 7.0, marginaleffects 0.5.0
 > Stata: Stata 18 (SE/MP)
 > See SKILL.md for the complete version table.
 
-> **Sources:** Fischer et al., *pyfixest* (pyfixest.org, v0.40.0, accessed 2026-03-28);
+> **Sources:** Fischer et al., *pyfixest* (pyfixest.org, v0.60.0, accessed 2026-07-24);
 > Seabold & Perktold, *statsmodels* (v0.14.6);
 > Sheppard, *linearmodels* (bashtage.github.io/linearmodels, v7.0);
 > Correia, "reghdfe" (scorreia.com);
@@ -472,20 +472,30 @@ Stata's `nbreg` uses the NB2 parameterization by default (variance = mu +
 alpha*mu^2). statsmodels' `NegativeBinomial` supports `"nb2"`, `"nb1"`, and
 `"geometric"` via the `loglike_method` parameter.
 
-### GLM with Fixed Effects: The Major Gap
+### GLM with Fixed Effects
 
 Stata can absorb high-dimensional FE in GLM models via `ppmlhdfe` (Poisson) or
 manual dummies with `logit y x i.fe_var`. R fixest has `feglm()`.
 
-**pyfixest's `feglm()` does NOT support fixed effects absorption.** This is the
-single largest feature gap between Stata/R and the DAAF Python stack for GLM
-estimation.
+**pyfixest's `feglm()` supports fixed effects absorption since 0.50** (DAAF ships
+0.60.0) for logit/probit/gaussian families, so this maps almost directly:
 
-**Workarounds:**
+```python
+# pyfixest 0.60.0: FE-GLM works — verified live
+fit = pf.feglm("binary_y ~ x1 | fe_var", data=df, family="logit")
+```
+
+Pyfixest before 0.50 raised `NotImplementedError` for `feglm()` with fixed effects,
+which older guidance called the single largest GLM feature gap between Stata/R and
+the DAAF Python stack; that gap is now closed for logit/probit/gaussian. Families
+beyond those (e.g., Gamma) and negative binomial (`fenegbin` in R) still require R
+fixest or manual approaches in Python. The alternatives below remain useful mainly
+as robustness comparisons (e.g., when nonlinear FE-GLMs risk incidental-parameters
+bias with small FE groups):
 
 | Approach | Code | When to Use |
 |----------|------|-------------|
-| Linear probability model | `pf.feols("binary_y ~ x \| fe", data=df)` | Most cases; interpret coefficients as pp changes |
+| Linear probability model | `pf.feols("binary_y ~ x \| fe", data=df)` | Robustness check; interpret coefficients as pp changes |
 | Manual dummies + statsmodels | `smf.logit("y ~ x + C(fe_var)", data=df).fit()` | Small/moderate number of FE levels |
 | Conditional logit | `sm.discrete.ConditionalLogit(...)` | Binary outcome with entity FE |
 | Poisson pseudo-ML | `pf.fepois("binary_y ~ x \| fe", data=df)` | If log-linear approximation acceptable |
@@ -774,9 +784,10 @@ fit.summary()                          # Now shows new SEs
   or IV. With FE, use HC1 or clustered SEs.
 - **Two-way clustering in statsmodels** is not directly supported. Use pyfixest or
   linearmodels instead.
-- **Default SE changed in pyfixest v0.40**: Both R fixest 0.13 and pyfixest 0.40
-  now default to `"iid"`. Older pyfixest code that relied on automatic clustering
-  by the first FE variable will silently produce different results.
+- **Default SE changed in pyfixest v0.40** (still the default through 0.60): Both
+  R fixest 0.13 and pyfixest (v0.40 onward, including the 0.60.0 DAAF ships) now
+  default to `"iid"`. Older pyfixest code that relied on automatic clustering by
+  the first FE variable will silently produce different results.
 - **Stata's `robust` = HC1**: When a Stata do-file uses `, robust`, the Python
   equivalent is `vcov="hetero"` (pyfixest) or `cov_type="HC1"` (statsmodels). Do
   not use HC0 or HC3 when replicating Stata results unless the Stata code
@@ -943,7 +954,7 @@ R's `vif()` and Stata's `estat vif` are single function calls; Python requires
 a manual loop. This pattern recurs throughout diagnostics — where Stata wraps
 complexity in one command, Python requires manual assembly.
 
-> **Sources:** Fischer et al., *pyfixest* (pyfixest.org, v0.40.0);
+> **Sources:** Fischer et al., *pyfixest* (pyfixest.org, v0.60.0);
 > Seabold & Perktold, *statsmodels* (v0.14.6);
 > Sheppard, *linearmodels* (bashtage.github.io/linearmodels, v7.0);
 > Correia, "reghdfe" (scorreia.com);
diff --git a/.claude/skills/stata-python-translation/references/visualization.md b/.claude/skills/stata-python-translation/references/visualization.md
index 54076078..b8b7ba1b 100644
--- a/.claude/skills/stata-python-translation/references/visualization.md
+++ b/.claude/skills/stata-python-translation/references/visualization.md
@@ -11,7 +11,7 @@ plotnine requires pandas DataFrames as input. In DAAF, convert polars DataFrames
 before plotting: `df_pd = df.to_pandas()`.
 
 > **Versions referenced:**
-> Python: plotnine 0.15.3, plotly 6.5.2, pyfixest 0.40.0, binsreg (latest)
+> Python: plotnine 0.15.3, plotly 6.5.2, pyfixest 0.60.0, binsreg (latest)
 > Stata: Stata 18 (graph system stable across recent versions)
 > See SKILL.md Section: Library Versions for the complete version table.
 
@@ -927,7 +927,7 @@ maintained by the same methodological authors.
 > **Sources:** plotnine documentation, v0.15.3 (plotnine.org, accessed
 > 2026-03-28); Stata Graphics Reference Manual (stata.com/manuals, accessed
 > 2026-03-28); pyfixest documentation, coefplot and iplot functions
-> (pyfixest.org, accessed 2026-03-28); Cattaneo, Crump, Farrell, & Feng,
+> (pyfixest.org, v0.60.0, accessed 2026-07-24); Cattaneo, Crump, Farrell, & Feng,
 > binsreg package documentation (nppackages.github.io/binsreg/, accessed
 > 2026-03-28); Turrell, "Data Visualisation using the Grammar of Graphics with
 > Plotnine" in *Coding for Economists* (aeturrell.github.io, accessed
diff --git a/.claude/skills/stata-r-translation/SKILL.md b/.claude/skills/stata-r-translation/SKILL.md
index 00d6db77..3f4e031b 100644
--- a/.claude/skills/stata-r-translation/SKILL.md
+++ b/.claude/skills/stata-r-translation/SKILL.md
@@ -8,7 +8,7 @@ description: >-
 metadata:
   audience: research-coders
   domain: cross-language
-  skill-last-updated: "2026-05-13"
+  skill-last-updated: "2026-07-24"
 ---
 
 # Stata-to-R Translation Skill
diff --git a/.claude/skills/stata-r-translation/references/regression-modeling.md b/.claude/skills/stata-r-translation/references/regression-modeling.md
index 889e7902..b916dd42 100644
--- a/.claude/skills/stata-r-translation/references/regression-modeling.md
+++ b/.claude/skills/stata-r-translation/references/regression-modeling.md
@@ -150,14 +150,16 @@ fit <- fepois(y ~ x1 + x2 | state + year, data = df)
 # Negative binomial (MASS)
 fit <- MASS::glm.nb(y ~ x1 + x2, data = df)
 
-# GLM with FE (fixest -- unlike pyfixest, R fixest DOES support feglm with FE)
+# GLM with FE (fixest -- broader family coverage than pyfixest's feglm)
 fit <- feglm(y ~ x1 + x2 | state, data = df, family = binomial)
 fit <- fenegbin(y ~ x1 + x2 | state, data = df)
 ```
 
-**Key advantage over Python:** R's fixest `feglm()` and `fenegbin()` support
-FE absorption for GLM models. This is a major gap in pyfixest that does not
-exist in R fixest.
+**Advantage over Python:** R's fixest `feglm()` absorbs FE across the full GLM
+family range (including Gamma), and `fenegbin()` adds FE negative binomial with no
+Python equivalent. pyfixest's `feglm()` gained FE support in 0.50 (DAAF ships
+0.60.0) but only for logit/probit/gaussian — so for those three families the two
+are on par, while Gamma and negative-binomial FE-GLMs still favor R fixest.
 
 ---
 
diff --git a/.claude/skills/statsmodels/references/gotchas.md b/.claude/skills/statsmodels/references/gotchas.md
index d0fb6b8d..249fd27c 100644
--- a/.claude/skills/statsmodels/references/gotchas.md
+++ b/.claude/skills/statsmodels/references/gotchas.md
@@ -346,9 +346,9 @@ the confidence interval because it accounts for irreducible residual variance.
 | OLS with multi-way fixed effects | **pyfixest** | Absorbs FE via demeaning — much faster and memory-efficient than dummies |
 | OLS without fixed effects | **statsmodels** | Full diagnostics suite; linearmodels `IV2SLS` also works |
 | Logit / probit | **statsmodels** | Full GLM framework, marginal effects, convergence diagnostics |
-| Logit with fixed effects | **pyfixest** (LPM via `feols`) or **statsmodels** (dummies) | pyfixest: use `feols()` on binary outcome (linear probability model); statsmodels: include dummies directly but slow at scale |
+| Logit with fixed effects | **pyfixest** (`feglm()`) | `pf.feglm(family="logit")` with absorbed FE (since 0.50); LPM via `feols()` remains a robustness alternative; statsmodels dummies are slow at scale |
 | Poisson regression | **statsmodels** | Full GLM: NegBin, zero-inflated, hurdle models all available |
-| Poisson with FE | **pyfixest** | `fepois()` for Poisson with absorbed FE (note: `feglm` does NOT support FE) |
+| Poisson with FE | **pyfixest** | `fepois()` for Poisson with absorbed FE (`feglm()` also supports FE since 0.50: logit/probit/gaussian) |
 | Time series (ARIMA, VAR, ARCH) | **statsmodels** | pyfixest and linearmodels have no time series support |
 | IV / 2SLS without FE | **linearmodels** | `IV2SLS`, `IVLIML`, `IVGMM` — richer estimator set than pyfixest for non-FE IV |
 | IV / 2SLS with FE | **pyfixest** | Three-part formula syntax; linearmodels has no Panel IV |
diff --git a/.github/workflows/ci-scripts.yml b/.github/workflows/ci-scripts.yml
index 186c181d..9a8c6476 100644
--- a/.github/workflows/ci-scripts.yml
+++ b/.github/workflows/ci-scripts.yml
@@ -3,7 +3,7 @@
 # Validates all .sh and .ps1 scripts across the repository.
 # Companion workflow: ci-integration.yml runs Docker integration tests weekly.
 #
-# Nine jobs:
+# Eleven jobs:
 #   1. lint-bash           - ShellCheck on all .sh files (ubuntu)
 #   2. lint-powershell     - PSScriptAnalyzer on all .ps1 files (ubuntu/pwsh 7)
 #   3. hygiene-checks      - Executable bits, LF endings, script pair parity
@@ -11,7 +11,8 @@
 #   5. bats-tests          - BATS unit/smoke tests for .sh scripts (ubuntu)
 #   6. pester-tests        - Pester tests for .ps1 scripts (ubuntu + windows)
 #   7. daaf-conventions    - Custom DAAF-specific lint checks (ubuntu)
-#   7b. deployment-smoke   - Harness self-tests (provider-free, stdlib only)
+#   7b. deploy-smoke-unit   - Harness self-tests (provider-free, stdlib only)
+#   7c. provider-shim-tests - Provider-shim unit suite (offline loopback harness)
 #   8. smoke-tests         - Cross-platform dry-run smoke tests (ubuntu + macos + windows)
 #   9. bats-bash32         - Host-script BATS suite under real Bash 3.2 (ubuntu container)
 #
@@ -32,6 +33,7 @@ on:
       - 'scripts/**.py'
       - 'scripts/**.R'
       - 'tests/python/**'
+      - 'tests/provider_shim/**'
       - 'tests/bash/**.py'
       - 'tests/fixtures/**'
   pull_request:
@@ -40,12 +42,13 @@ on:
       - '**.ps1'
       - '**.bats'
       - '**/*.Tests.ps1'
-      - 'tests/lint/**'
       - '.github/workflows/ci-scripts.yml'
       - '.github/linters/**'
+      - 'tests/lint/**'
       - 'scripts/**.py'
       - 'scripts/**.R'
       - 'tests/python/**'
+      - 'tests/provider_shim/**'
       - 'tests/bash/**.py'
       - 'tests/fixtures/**'
 
@@ -281,6 +284,36 @@ jobs:
         run: python3 -m unittest discover -s tests/python -p 'test_deploy_smoke.py' -v
 
 
+  # ---------------------------------------------------------------------------
+  # Job 7c: Provider-shim unit suite (offline: loopback harness + fake-codex
+  # stub; no network, no credentials, no real codex binary). The only
+  # third-party imports across the shim and its tests are httpx and uvicorn,
+  # pinned here to the versions validated in the DAAF container image.
+  # ---------------------------------------------------------------------------
+  provider-shim-tests:
+    name: Provider Shim Unit Tests
+    runs-on: ubuntu-latest
+    # The suite normally completes in ~3 minutes; the cap guards runner minutes
+    # against a hung asyncio/socket test rather than the 6-hour GitHub default.
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      # The loopback harness spawns the production shim with a HOME redirected
+      # to per-instance scratch (v1.3.8 policy isolation), which hides pip
+      # user-site packages (~/.local) from the child interpreter. A venv is
+      # immune: its site-packages travel with sys.executable, which the harness
+      # uses to spawn the shim, so the pinned deps resolve regardless of HOME.
+      - name: Install shim runtime dependencies (venv)
+        run: |
+          python3 -m venv .shim-venv
+          .shim-venv/bin/python -m pip install httpx==0.28.1 uvicorn==0.51.0
+
+      - name: Run provider-shim unit tests
+        run: .shim-venv/bin/python -m unittest discover -s tests/provider_shim -t tests -p 'test_*.py' -v
+
+
   # ---------------------------------------------------------------------------
   # Job 8: Cross-platform dry-run smoke tests (no Docker needed)
   # ---------------------------------------------------------------------------
diff --git a/.gitignore b/.gitignore
index 72e08134..97ce9541 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,7 @@ wheels/
 venv/
 ENV/
 env/
+.shim-venv/
 
 # IDE
 .vscode/
@@ -69,4 +70,9 @@ environment_settings*.txt
 **/logs/session_manifest.json
 
 # Provider shim runtime logs and pidfiles (regenerated at runtime)
-scripts/provider_shim/logs/
\ No newline at end of file
+scripts/provider_shim/logs/
+
+# Scratch / transient working files (inside the audit boundary, not tracked; e.g. the
+# provider-shim test harness's runner-level in-process seam files land here — both the
+# quota-state seam and the reasoning-cache seam)
+scripts/scratch/
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a8ee588..0e3ae26f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ All notable changes to DAAF for each release version are documented here, in rev
 
 ## Table of Contents
 
+- [v3.0.1 -- 2026-07-29](#v301--2026-07-29)
 - [v3.0.0 -- 2026-07-17](#v300--2026-07-17)
 - [v2.1.0 -- 2026-05-02](#v210--2026-05-02)
 - [v2.0.1 -- 2026-04-05](#v201--2026-04-05)
@@ -12,6 +13,60 @@ All notable changes to DAAF for each release version are documented here, in rev
 
 ---
 
+## v3.0.1 -- 2026-07-29
+
+### Data Analyst Augmentation Framework -- Minor Fixes
+
+v3.0.1 is a simple patch release: no flashy new functionality to be aware of, just steady work making v3.0.0's foundations more solid and adding a handful of genuinely useful conveniences on top. Most of it is under-the-hood hardening -- backups that fail loudly instead of quietly, lifecycle scripts that handle more edge cases, and OpenAI provider routing that's steadier and easier to sign into -- alongside a few new opt-in features worth knowing about: read-only host-folder mounts (give DAAF access to an actual folder on your computer!), setting up a shared research workspace across separate DAAF installs, and speed controls for the GPT provider route.
+
+One practical note for existing users: updating will prompt a rebuild (the updater detects the Dockerfile change and offers it to you) -- accept it and you're done.
+
+### Detailed Notes
+
+Disclosure: These notes were AI-drafted from a verified inventory of the release's commits and then reviewed by hand -- they're kept concise for a patch release, but they capture what actually changed.
+
+#### Provider Shim Improvements
+
+The provider shim (the local adapter that lets DAAF run on your OpenAI or ChatGPT account) advanced to **v1.3.9**, with the work concentrated in making it smoother for operating with daily use:
+
+- **Multimodal handling** so image-bearing requests translate cleanly through the shim (e.g., for data visualization design work).
+- **GPT Fast / GPT Priority speed controls** -- a new operator command, `bash /daaf/scripts/provider_shim/gpt_fast.sh {on|off|status}`, lets you opt into faster priority service on the GPT route, turn it back off, and check the current state at a glance.
+- **Better logging and diagnostics** for when something needs troubleshooting.
+- **Steadier stability and sign-in.** ChatGPT-lane authentication is now handled by the bundled `codex` CLI, which makes signing in more reliable, and your ChatGPT plan-usage quota is now surfaced right in the status bar.
+
+#### Link Host Folders and Share a Workspace Across Installs
+
+Two new opt-in conveniences for people whose data or workflows don't fit neatly inside a single Docker container management system:
+
+- **Read-only host-folder mounts.** You can now expose a folder from your own machine to DAAF as a read-only `/host_data` mount -- handy for large local datasets you'd rather not copy in by hand. It's read-only by design, so DAAF can draw from it but never writes back (or corrupts data!); the usual reproducibility conventions still ask you to copy anything you actually use into the project itself, but feel free to override as you see fit.
+- **A shared research workspace.** A new `DAAF_DATA_VOLUME_NAME` setting lets two installs point at the same research volume, so you can (for example) run one body of work across two differently-configured containers (pit Claude models against GPT models, for example!).
+
+#### Analytics Stack: pyfixest 0.60
+
+The Python fixed-effects library `pyfixest` moved from 0.40 to **0.60**. The old 0.40 wheel shipped broken dependency metadata; 0.60 is clean and current. The corresponding skill got a full refresh so agents work against the real 0.60 API rather than a stale mental model, a now-incorrect cross-skill note (about `feglm` fixed-effects support) was corrected in the same sweep, and new smoke tests guard the analytical stack against silent breakage on future rebuilds.
+
+#### Safer Housekeeping
+
+A cluster of quiet reliability fixes across the host tooling and the safety system:
+
+- **DAAF File Backups fail loudly, not silently.** If a copy is corroborated as truncated, the backup now reports a hard failure instead of a false success.
+- **Hardened lifecycle scripts.** Parsing, rounding, and environment handling were tightened on both the Bash and PowerShell sides, closing a class of platform-specific edge cases.
+- **Broader write-protection** for session logs and audit trails, keeping the record tamper-resistant.
+- **Effort level is now an overridable default** rather than a hard pin, so the `/effort` command works as expected.
+
+#### Status Bar and Context Monitoring
+
+The status bar now surfaces your Codex plan-usage quota if you're using that route, and both its rendering and the underlying model detection were hardened so the display stays accurate across a wider range of setups.
+
+#### For Contributors
+
+A couple of contributor-facing improvements. DAAFBench -- DAAF's model-behavior benchmark harness -- got reliability work and scoring-validity corrections. In the interest of transparency: one scoring correction was significant enough that I rescored the archived results in place, and previously published GPT dispatch-compliance numbers rose as a result (from roughly 49% to 74%). On the testing side, the provider shim gained a dedicated CI suite (184 offline tests), and the Bash/PowerShell test coverage expanded further.
+
+**Full Changelog**: [v3.0.0...v3.0.1](https://github.com/DAAF-Contribution-Community/daaf/compare/v3.0.0...v3.0.1)
+<!-- AT TAG TIME: verify tag exists and this compare link resolves -->
+
+---
+
 ## v3.0.0 -- 2026-07-17
 
 ### Data Analyst Augmentation Framework -- Opening Doors
diff --git a/CITATION.cff b/CITATION.cff
index 17ea44c0..1cb062e5 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -12,8 +12,8 @@ authors:
   - family-names: Kim
     given-names: Brian Heseung
     orcid: "https://orcid.org/0000-0002-7988-1802"
-version: "3.0.0"
-date-released: "2026-07-17"
+version: "3.0.1"
+date-released: "2026-07-29"
 license: LGPL-3.0-or-later
 url: "https://github.com/DAAF-Contribution-Community/daaf"
 repository-code: "https://github.com/DAAF-Contribution-Community/daaf"
diff --git a/CLAUDE.md b/CLAUDE.md
index c898e1bf..61488c2d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -276,6 +276,7 @@ Context management is NEVER about reducing the quality or completeness of work.
 
 - You MUST NEVER write working files to `/tmp` (redirects, `cp`/`mv`/`tee`/`mkdir`/`touch`, downloads, `sed -i`, archive extraction, or `git clone` targeting `/tmp`). `/tmp` is outside the Docker-volume backup boundary and the audit trail, and the session log viewer marks `/tmp` paths as ephemeral, unarchived references — files written there are lost silently. Temporary and intermediate files belong inside the project (see § Project Conventions > Scratch Files).
 - **Exception — reads are fine:** DAAF's own hooks and statuslines legitimately cache coordination state in `/tmp` (e.g. `/tmp/claude-ctx-window-*`, `/tmp/claude-model-*`). *Reading* those caches via Bash is permitted; only *writes* to `/tmp` are blocked. Reading a `/tmp` cache and redirecting the output into the project is the sanctioned rescue pattern.
+- **Read-only external data via bind mount (`/host_data`):** when a user has configured a bind mount, `/host_data` is a **read-only** external data source that sits outside the backup and audit boundary. Read from it freely, but never write to it, and copy any inputs you actually use into the project's own data directory (with the usual raw-data conventions) so provenance is preserved and the analysis stays reproducible from the archived working copy.
 
 ### Safety-System Integrity
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 282fba1e..b429a7e3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -427,12 +427,27 @@ pwsh -NoProfile -Command "Get-ChildItem ./scripts/host/*.ps1 | ForEach-Object {
 
 `DAAF_DEV` is an opt-in build flag: when it is unset or `0` (the default), none of this tooling is installed and the image is identical to a standard build. See `user_reference/01_installation_and_quickstart.md` ("Building with the developer test toolchain") for details.
 
-**Working on R support?** The R execution environment (R, the R package set, and Quarto) is part of the standard DAAF image — there is nothing to enable. The R smoke tests in `scripts/smoke_tests/` exercise each R library skill and run in any container; a Python import-smoke (`smoke_imports.py`) additionally verifies every pinned Python analysis package imports. Both run via `run_all_smoke_tests.sh`. (The per-skill R smokes came first because the newly added R package set needed install verification the mature Python stack had long since earned; the Python import-smoke rounds out the suite.) See `user_reference/01_installation_and_quickstart.md` ("R support (included)") for what the image ships with.
+**Working on R support?** The R execution environment (R, the R package set, and Quarto) is part of the standard DAAF image — there is nothing to enable. The R smoke tests in `scripts/smoke_tests/` exercise each R library skill and run in any container; the Python import smoke (`smoke_imports.py`) covers explicit Docker pins and asserts the exact provider-shim runtime versions `httpx==0.28.1` and `uvicorn==0.51.0`. Both run via `run_all_smoke_tests.sh`. (The per-skill R smokes came first because the newly added R package set needed install verification the mature Python stack had long since earned; the Python import smoke rounds out the suite.) See `user_reference/01_installation_and_quickstart.md` ("R support (included)") for what the image ships with.
 
 ### For Deployment or Provider-Configuration Changes
 
 If your change touches how DAAF talks to a model provider -- a new or changed API key, a model remap (`ANTHROPIC_DEFAULT_*`), a provider-shim change, a base-URL switch -- or you just want to confirm a rebuilt install still works end-to-end, use the **deployment smoke suite** (`scripts/deploy_smoke/`). Unlike the R/Python library smokes above (which verify packages load) or DAAFBench (which scores model *behavior*), this suite verifies the *deployment itself* functions in whatever provider route it is configured for. It auto-detects the active route (anthropic-subscription, OpenRouter, or the chatgpt-subscription/openai-api shim routes) and runs tiered probes. It requires the `DAAF_DEV=1` image.
 
+**Provider-shim changes have a stricter release gate.** A reviewable shim PR should show all of the following, with commands and observed results rather than a remembered pass claim:
+
+1. **Production-path deterministic coverage.** Exercise the real translator/ASGI/subprocess paths in `tests/provider_shim/`, not a duplicate implementation inside a test. Run the provider-shim suite, the lifecycle suite at `tests/bash/start_shim.bats`, the DAAFBench route/provenance tests under `benchmarks/tests/`, and the deploy-smoke harness self-tests at `tests/python/test_deploy_smoke.py`.
+2. **Lifecycle and privacy invariants.** A reviewer should be able to confirm each of these still holds — each is stated with why it matters:
+   - **Strict readiness** (exact service identity, `ok` status, source-derived version, normalized backend mode) — so a stale shim, or an unrelated service answering on the port, can't masquerade as healthy.
+   - **Nonfatal `--auto` boot contract** — container boot records one machine-readable result and continues even when the opt-in shim can't become ready, so a shim problem never blocks the container.
+   - **Serialized lifecycle ownership** — `--restart`/`--start`/`--stop` run under one lock, and a restart emits exactly-once begin/result records with distinct stop, launch, and readiness-failure outcomes, so concurrent invocations can't collide and every restart is auditable.
+   - **Safe process signaling** — PID/PGID identity checks ensure the manager only signals the process it actually started, never a shared or unrelated one.
+   - **Serialized, bounded, private logging** — a single append path prevents interleaved or duplicated records, retention is size-bounded, and every request lifecycle has exactly-once terminal and cleanup accounting.
+   - **The privacy never-list** — diagnostics may record request IDs (local/client/provider), transport class/phase, bounded timings, and retry attribution, but **never** prompts or text, tool inputs/arguments, image data or URLs/query strings, file IDs/names, credentials/cookies, raw SSE, complete bodies, or free-form backend prose.
+3. **Image-contract evidence.** User-message and tool-result images must preserve source ordering and fail locally on unsupported or malformed content rather than silently dropping it. The public OpenAI Responses schema is the documented basis. The private ChatGPT/Codex wire is not an official image guarantee: fixtures for it must come from observed live evidence, never a guessed documentation shape, and the capture process must not log payloads. Run a privacy-safe live image probe on that lane before claiming ChatGPT image compatibility.
+4. **Image and deployment validation.** If Docker dependencies change, run `scripts/smoke_tests/run_all_smoke_tests.sh`; its Python gate verifies 50 import targets plus two metadata-only distributions — 52 explicit pinned distributions in total. It preserves exact-version checks for `httpx==0.28.1` and `uvicorn==0.51.0` and uses metadata-only presence/exact-version checks for `svy-rs==0.10.0` and `svy-io==0.1.1` rather than inventing import names. After deploying the changed shim, restart it with the single atomic command `bash /daaf/scripts/provider_shim/start_shim.sh --restart`, confirm the source version through strict `/health`, then run deployment-smoke Tier 0 and Tier 1 against the active route. When the current Claude Code session itself routes through the shim, never schedule `--stop` and `--start` as separate assistant turns—the first turn can remove the transport needed for the second. Deterministic success is necessary, but it does not substitute for this deployed round-trip.
+
+For tolerated private-wire differences, aggregate bounded diagnostics rather than flooding logs: the known `arguments.done`-without-`name` case records the first occurrence and periodic count summaries. Hard or conflicting protocol errors must remain visible and fail explicitly.
+
 Start with the free, no-API preflight, then add live tiers as needed:
 
 ```bash
@@ -476,10 +491,10 @@ DAAF's components are wired together at many small registration points -- an age
 | A **reference file** in `agent_reference/` | § 4 (R1-R6 / RM1-RM4) -- CLAUDE.md table plus every "When to Read" trigger | Link and cross-reference checks; render the Markdown |
 | A **hook** (`.claude/hooks/`) | § 5 (H1-H5) -- note hooks are human-deployed (deny-protected) | The safety regression batteries `bash scripts/test_safety_hooks.sh` and `bash scripts/test_enforce_single_command.sh`, plus both allow and block scenarios |
 | A **host-facing script** (`scripts/host/`) | § 6 (HS1-HS11) -- install lists, updater filter, CI smoke lists, `.sh`/`.ps1` parity | `bats tests/bash/`, Pester, `shellcheck`, `PSScriptAnalyzer`, and `bash tests/lint/check-daaf-conventions.sh` (all run in CI) |
-| The **provider shim** (`scripts/provider_shim/`) | § 7 (P1-P11 / PM1-PM6) -- `/health` schema, `SHIM_*` env-var lockstep, lane-gate triplication, `SHIM_VERSION` bump | The shim and benchmark suites, plus a deploy-smoke run: Tier 0 `/health` preflight and a Tier 1 live round-trip; confirm the new `SHIM_VERSION` via `GET /health` |
+| The **provider shim** (`scripts/provider_shim/`) | § 7 (P1-P11 / PM1-PM6) -- `/health` schema, `SHIM_*` env-var lockstep, lane-gate triplication, `SHIM_VERSION` bump | Production-path shim tests, lifecycle Bats, route/provenance and deploy-smoke self-tests; package smoke when Docker pins change; after deployment, Tier 0 + Tier 1 and strict `/health` version confirmation; privacy-safe live image validation before a ChatGPT compatibility claim |
 | A **deployment / provider configuration** (API key, model remap, base URL) | Route/env coherence | deploy-smoke Tier 0 (free preflight), adding Tier 1/2 as needed (Tier 2 ≈ $0.60-3.00) |
 | **Documentation only** | -- | Read it aloud, check links and cross-references, render the Markdown |
-| **Any of the above** | § 8 cross-cutting (CC1-CC7) | Sweep for stale count words, broken cross-references, and naming drift |
+| **Any of the above** | § 8 cross-cutting (CC1-CC8) | Sweep for stale count words, broken cross-references, naming drift, and stale examples/templates |
 
 Two zero-cost batteries are worth knowing regardless of what you touched: the deployment smoke suite's **Tier D** deterministic battery (bats, Pester, lint, and safety-hook tests) and the conventions linter both run without any provider cost, and both run in CI on every push that touches a script.
 
diff --git a/Dockerfile b/Dockerfile
index ce159d8a..093bc13b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -397,6 +397,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # -----------------------------------------------
 
 # Install core data science packages
+# NOTE: pyfixest pinned 0.60.0 — the 0.40.0 wheel declared zero runtime deps
+#       (packaging bug: no Requires-Dist in METADATA; import only worked because
+#       numba/formulaic/etc. arrived transitively via umap-learn, wildboottest,
+#       linearmodels), and the 0.40.1 hotfix declares a scipy upper bound that
+#       conflicts with scipy==1.17.0. 0.60.0 has correct metadata; expect one
+#       new transitive dep (maketables, its table backend) in the image.
 RUN uv pip install --system \
     numpy==2.4.2 \
     pandas==3.0.0 \
@@ -413,7 +419,7 @@ RUN uv pip install --system \
     umap-learn==0.5.11 \
     pyyaml==6.0.3 \
     statsmodels==0.14.6 \
-    pyfixest==0.40.0 \
+    pyfixest==0.60.0 \
     tabulate==0.10.0 \
     great-tables==0.21.0 \
     wildboottest==0.3.2
@@ -486,6 +492,17 @@ RUN uv pip install --system \
 RUN uv pip install --system \
     faker==40.31.0
 
+# Install provider-shim direct runtime dependencies after all other framework
+# Python packages. Both arrive transitively today (httpx via svy; uvicorn via
+# marimo), but the persistent shim imports them directly and must not depend on
+# unrelated packages retaining compatible versions. Keeping these direct pins
+# last in the Python stack also prevents a later framework Python block from
+# replacing them. The build is still root here; the single runtime transition to
+# appuser remains at the existing security boundary below.
+RUN uv pip install --system \
+    httpx==0.28.1 \
+    uvicorn==0.51.0
+
 # ============================================
 # Install R Data Science Packages + Quarto
 # ============================================
@@ -695,6 +712,23 @@ RUN mkdir -p /home/appuser/.local/share/code-server/User \
     && chown -R appuser:appuser /home/appuser/.local \
                                 /home/appuser/.config
 
+# ============================================
+# Node.js runtime for codex-plugin-cc
+# ============================================
+# codex-plugin-cc (the Codex plugin for Claude Code) needs a Node.js runtime in
+# the container. Node already arrives transitively via libnode-dev (the R gt/V8
+# stack), but that presence is incidental -- install `nodejs` explicitly so a
+# future R-stack change cannot silently drop it (no exact version pin, per DAAF
+# convention: the distro's packaged Node tracks the base image release). The
+# build-time floor assertion FAILS the build loudly if the packaged Node is
+# older than 18.18 (the minimum codex-plugin-cc supports), rather than letting
+# a too-old runtime surface as an obscure plugin failure later.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        nodejs \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && node -e 'const v=process.versions.node, [maj,min]=v.split(".").map(Number); if (maj<18 || (maj===18 && min<18)) { console.error("ERROR: Node "+v+" is older than the 18.18 floor required by codex-plugin-cc"); process.exit(1); } console.log("Node "+v+" satisfies the codex-plugin-cc >= 18.18 floor");'
+
 # ============================================
 # Set up working directory
 # ============================================
diff --git a/README.md b/README.md
index 4eec7af5..e723964c 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 <!--
-  README v3.0.0
+  README v3.0.1
 -->
 
 ## Summary: What is DAAF?
@@ -7,7 +7,7 @@
 <img width="1258" height="433" alt="daaf_20_thumbnail4" src="https://github.com/user-attachments/assets/21b17b1d-a4d8-4558-a91d-a9ecb0d43f22" />
 
 <p align="center">
-  <a href="https://github.com/DAAF-Contribution-Community/daaf/releases"><img src="https://img.shields.io/badge/version-v3.0.0-blue" alt="Version v3.0.0"></a>
+  <a href="https://github.com/DAAF-Contribution-Community/daaf/releases"><img src="https://img.shields.io/badge/version-v3.0.1-blue" alt="Version v3.0.1"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-LGPL--3.0--or--later-green" alt="License: LGPL-3.0-or-later"></a>
   <a href="https://github.com/DAAF-Contribution-Community/daaf/stargazers"><img src="https://img.shields.io/github/stars/DAAF-Contribution-Community/daaf?style=flat" alt="GitHub Stars"></a>
   <a href="https://github.com/DAAF-Contribution-Community/daaf/commits/main"><img src="https://img.shields.io/github/last-commit/DAAF-Contribution-Community/daaf" alt="Last Commit"></a>
@@ -84,7 +84,7 @@ cd daaf-docker
 .\daaf.ps1
 ```
 
-On first launch, Claude Code will prompt you to authenticate. DAAF defaults to **Opus 4.8** with 1 million token context. Anthropic's lower-cost **Sonnet** tier is also an excellent choice that [matches the Opus line on DAAF's orchestration benchmarks](https://daaf.openaugments.org/bench/) at a fraction of the cost; if you'd like to use it, type `/model` to switch.  You're ready to go; see [Understanding DAAF](user_reference/02_understanding_daaf.md) for some suggestions on how to get started with progressively more complex tasks with DAAF!
+On first launch, Claude Code will prompt you to authenticate. DAAF defaults to **Opus 4.8** with 1 million token context. Several other models also perform excellently at very different price points — Anthropic's lower-cost **Sonnet** tier [sits in the top performance tier on DAAF's orchestration benchmarks](https://daaf.openaugments.org/bench/) at roughly half the cost, and strong GPT-5.6 and open-weight options exist too (see the [model-selection FAQ](user_reference/07_faq_technical.md#q-which-claude-model-should-i-use)); if you'd like to switch, type `/model`.  You're ready to go; see [Understanding DAAF](user_reference/02_understanding_daaf.md) for some suggestions on how to get started with progressively more complex tasks with DAAF!
 
 ---
 
@@ -246,7 +246,7 @@ If you use DAAF in your research, please cite it and all underlying data sources
 
 **Plain text (APA):**
 
-> Kim, B. H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.0) [Computer software]. [https://doi.org/10.5281/zenodo.19343886](https://doi.org/10.5281/zenodo.19343886)
+> Kim, B. H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.1) [Computer software]. [https://doi.org/10.5281/zenodo.19343886](https://doi.org/10.5281/zenodo.19343886)
 
 **BibTeX:**
 
@@ -257,7 +257,7 @@ If you use DAAF in your research, please cite it and all underlying data sources
   year = {2026},
   url = {https://github.com/DAAF-Contribution-Community/daaf},
   doi = {10.5281/zenodo.19343886},
-  version = {3.0.0},
+  version = {3.0.1},
   license = {LGPL-3.0-or-later}
 }
 ```
diff --git a/agent_reference/AI_DISCLOSURE_REFERENCE.md b/agent_reference/AI_DISCLOSURE_REFERENCE.md
index 6504c8f5..92b065fd 100644
--- a/agent_reference/AI_DISCLOSURE_REFERENCE.md
+++ b/agent_reference/AI_DISCLOSURE_REFERENCE.md
@@ -219,7 +219,7 @@ When referencing the GUIDE-LLM framework in publications, use:
 
 When citing DAAF in publications, use:
 
-> Kim, B. H. (2026). *DAAF: The Data Analyst Augmentation Framework* (Version 3.0.0) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf
+> Kim, B. H. (2026). *DAAF: The Data Analyst Augmentation Framework* (Version 3.0.1) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf
 
 **BibTeX:**
 
@@ -229,7 +229,7 @@ When citing DAAF in publications, use:
   title = {{DAAF}: The Data Analyst Augmentation Framework},
   year = {2026},
   url = {https://github.com/DAAF-Contribution-Community/daaf},
-  version = {3.0.0},
+  version = {3.0.1},
   license = {LGPL-3.0-or-later}
 }
 ```
diff --git a/agent_reference/CITATION_REFERENCE.md b/agent_reference/CITATION_REFERENCE.md
index f94908a2..71b916a4 100644
--- a/agent_reference/CITATION_REFERENCE.md
+++ b/agent_reference/CITATION_REFERENCE.md
@@ -24,7 +24,7 @@ Cite when the library's **analytical functionality** drives a result. Do NOT cit
 
 | Library | Canonical Citation | Cite When | Do NOT Cite When |
 |---------|-------------------|-----------|------------------|
-| DAAF | Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.0) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf | Always (pre-populated in STATE.md) | — |
+| DAAF | Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.1) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf | Always (pre-populated in STATE.md) | — |
 | pyfixest | Berge, L., Butts, K., & McDermott, G. (2026). pyfixest: Fast high-dimensional fixed effects estimation [Computer software]. Based on fixest (R). | Used for regression estimation or DiD | Only imported but not used for estimation |
 | statsmodels | Seabold, S. & Perktold, J. (2010). "Statsmodels: Econometric and Statistical Modeling with Python." *Proceedings of the 9th Python in Science Conference*. | Used for GLM, time series, or statistical testing | Only used for post-estimation diagnostics supporting another library's estimation |
 | linearmodels | Sheppard, K. linearmodels: Econometric models for panel, IV, and system regression [Computer software]. https://bashtage.github.io/linearmodels/ | Used for panel, IV/GMM, or system estimation | — |
diff --git a/agent_reference/REPORT_TEMPLATE.md b/agent_reference/REPORT_TEMPLATE.md
index 1e7b9c19..c5319011 100644
--- a/agent_reference/REPORT_TEMPLATE.md
+++ b/agent_reference/REPORT_TEMPLATE.md
@@ -167,7 +167,7 @@ This analysis has the following limitations that should be considered when inter
 
 ### Software & Tools
 
-> Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.0) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf
+> Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.1) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf
 > *Cited because: Analysis framework*
 
 > [Additional software citations from STATE.md > Citations Accumulated > Software & Tools]
diff --git a/agent_reference/STATE_TEMPLATE.md b/agent_reference/STATE_TEMPLATE.md
index 44cdce27..bb246222 100644
--- a/agent_reference/STATE_TEMPLATE.md
+++ b/agent_reference/STATE_TEMPLATE.md
@@ -308,7 +308,7 @@ Copy this template to `STATE.md` in the project folder when starting a Full Pipe
 
 | Library | Citation | Rationale | Stage | Script |
 |---------|----------|-----------|-------|--------|
-| DAAF | Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.0) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf | Analysis framework | — | — |
+| DAAF | Kim, B.H. (2026). *DAAF: Data Analyst Augmentation Framework* (Version 3.0.1) [Computer software]. https://github.com/DAAF-Contribution-Community/daaf | Analysis framework | — | — |
 | marimo | marimo team. marimo: Reactive Python notebook [Computer software]. https://marimo.io/ | Analysis notebook format (Python projects) | — | — |
 
 > **Language-conditional pre-population:** For Python projects, pre-populate the marimo row above. For R projects, replace the marimo row with R, Quarto, and tidyverse:
diff --git a/benchmarks/README.md b/benchmarks/README.md
index 61165f44..19813358 100644
--- a/benchmarks/README.md
+++ b/benchmarks/README.md
@@ -9,6 +9,13 @@ the framework's protocols?
 
 ## 1. What This Is
 
+> **Just want to pick a model?** This README documents the benchmark's
+> internals for contributors. The user-facing guidance distilled from these
+> results lives in the FAQ —
+> [Which Claude model should I use?](../user_reference/07_faq_technical.md#q-which-claude-model-should-i-use)
+> — and the live results page is
+> [daaf.openaugments.org/bench](https://daaf.openaugments.org/bench/).
+
 The benchmark measures whether models acting as the DAAF orchestrator:
 
 - Classify user requests into the correct engagement mode and present a
@@ -25,28 +32,30 @@ and still score poorly here if it skips confirmation gates or dispatches
 free-form prompts. Conversely, a weaker model that faithfully follows protocol
 scores well.
 
-**Model matrix:** 26 registry entries across three explicit providers. The
+**Model matrix:** 34 registry entries across three explicit providers. The
 matrix is defined in `config/models.yaml`; provider labels describe the measured
 route, not interchangeable billing aliases.
 
 | Provider | Entries | Route and accounting basis |
 |----------|--------:|----------------------------|
-| `anthropic` | 8 | Claude Code subscription route for Haiku 4.5, Sonnet 4.6/5, Opus 4.5/4.6/4.7/4.8, and Fable 5 |
-| `openrouter` | 17 | OpenRouter's Anthropic-compatible endpoint; includes GLM, Kimi, Qwen, Gemma, DeepSeek, Gemini, Nemotron, and GPT entries |
-| `chatgpt-subscription` | 1 | Local provider shim to the deployed ChatGPT/Codex subscription backend; included-capacity billing and separate API-equivalent accounting |
-
-The two Luna entries are deliberately distinct. OpenRouter uses registry key
-`gpt-56-luna` and wire ID `openai/gpt-5.6-luna`; the ChatGPT-subscription route
-uses registry key `gpt-56-luna-chatgpt` and OpenAI's official bare wire ID
-`gpt-5.6-luna`. The latter pins `ANTHROPIC_DEFAULT_OPUS_MODEL`,
-`ANTHROPIC_DEFAULT_SONNET_MODEL`, and `CLAUDE_CODE_SUBAGENT_MODEL` to Luna and
-sets the 1,050,000-token context limit separately from the wire ID. That figure
-is the model's true window, not this lane's effective ceiling: the ChatGPT/Codex
-subscription backend is capped far lower — measured ~370,000 for `gpt-5.6-sol`
-(2026-07-16), and big-window GPT slugs on the subscription lane are assumed
-capped the same way until individually measured (Luna's own ceiling is
-unmeasured). Never retry the OpenRouter-prefixed slug automatically if the
-deployed-path probe rejects the bare slug.
+| `anthropic` | 9 | Claude Code subscription route for Haiku 4.5, Sonnet 4.6/5, Opus 4.5/4.6/4.7/4.8/5, and Fable 5 |
+| `openrouter` | 22 | OpenRouter's Anthropic-compatible endpoint; includes GLM, Kimi, Qwen, Gemma, DeepSeek, Gemini, Nemotron, and GPT entries |
+| `chatgpt-subscription` | 3 | Local provider shim to the deployed ChatGPT/Codex subscription backend for GPT-5.6 Luna, Terra, and Sol; included-capacity billing and separate API-equivalent accounting |
+
+GPT-5.6 Luna, Terra, and Sol each have deliberately distinct OpenRouter and
+ChatGPT-subscription entries. The OpenRouter keys are `gpt-56-luna`,
+`gpt-56-terra`, and `gpt-56-sol`, with `openai/gpt-5.6-*` routing IDs; the
+subscription keys append `-chatgpt` and use the corresponding bare `gpt-5.6-*`
+IDs. Each subscription entry sets a 370,000-token effective input ceiling for
+this ChatGPT/Codex lane. Sol's ceiling was measured on 2026-07-16; Luna and Terra
+remain conservatively inferred to share the lane cap until individually measured.
+Each subscription entry maps both `ANTHROPIC_DEFAULT_OPUS_MODEL` and
+`ANTHROPIC_DEFAULT_SONNET_MODEL` to its own bare parent ID and deliberately omits
+`CLAUDE_CODE_SUBAGENT_MODEL`, preserving semantic tier selection while keeping
+both tiers model-pure. The executor removes any ambient flatten selector before
+applying model-specific overrides, so entries that explicitly declare one still
+retain it. Never retry an OpenRouter-prefixed slug automatically if the
+deployed-path probe rejects a bare subscription slug.
 
 The GPT-5.6 -pro slugs and GPT-5.5 Pro were tested and REMOVED from the
 OpenRouter matrix (2026-07-10): the -pro variants hit hard "Prompt is too long"
@@ -60,6 +69,17 @@ document; the commands below are an authorized-style staged procedure.
 implemented as the phases above. The remaining designed-but-unbuilt
 categories are catalogued in the Design Backlog (§ 12).
 
+### Related suite: DAAFBench Analytics
+
+This suite measures **behavioral conformance to orchestrator protocol**. A sibling
+suite, **DAAFBench Analytics** (`analytics/`), measures an orthogonal construct:
+whether the analytical *work* is correct, whether the model notices when the data or
+code is deliberately wrong, and whether it discloses that to its caller — graded with
+and without the DAAF agent layer (a DAAF-vs-bare arm comparison). The two share harness
+machinery (executor, model pinning, fixture staging, viewer) but do not overlap in what
+they score. DAAFBench Analytics is at the specification stage; see
+[`analytics/SPEC.md`](analytics/SPEC.md) and [`analytics/README.md`](analytics/README.md).
+
 ## 2. The Four Phases
 
 | Phase | Dataset | Cases | Start State | What It Tests |
@@ -86,9 +106,11 @@ records exactly matches the requested wire ID; `failed` when any observed child
 ID differs; and `unverifiable` when no child transcript or no child model field
 is available. The comparison deliberately performs no alias normalization and
 retains raw IDs. This is Claude-CLI child-transcript evidence, not
-backend-confirmed identity. The ChatGPT Luna registry entry pins all child-model
-selectors, but pinning plus `verified` establishes only the observable CLI
-boundary; neither proves what alias resolution a private backend may perform.
+backend-confirmed identity. All three GPT-5.6 ChatGPT-subscription entries pin
+the operative Opus and Sonnet tier aliases to the parent ID and deliberately
+omit `CLAUDE_CODE_SUBAGENT_MODEL`; that configuration plus `verified` establishes
+only the observable CLI boundary and does not prove what alias resolution a
+private backend may perform.
 
 **Phase 4 disallows the Agent tool** (`RunConfig.disallowed_tools = ["Agent"]`),
 so subagent dispatch is impossible and all scoring is main-transcript-only —
@@ -174,12 +196,137 @@ cases.jsonl ──> phase runner (scripts/run_{phase}.py)
                   │    parse the session transcript JSONL, only lines AFTER
                   │    the golden checkpoint's line count
                   │
-                  └─ archive to results/{YYYYMMDD_HHMMSS}/
-                       manifest.json, summary.json,
+                  └─ archive to results/{YYYYMMDD_HHMMSS}/  (PROGRESSIVE)
+                       manifest.json + initial partial summary.json
+                       written BEFORE the pool starts; each run's
                        runs/{case}_{model}_{rep}/ (result.json,
-                       transcript.jsonl, subagents/)
+                       transcript.jsonl, subagents/) written as it
+                       completes, with summary.json/manifest.json
+                       re-rolled incrementally after every run
 ```
 
+**Progressive archiving (2026-07).** Persistence is no longer all-or-nothing. The
+runner creates `results/{timestamp}/` and seeds `manifest.json` plus an initial
+`summary.json` (`"partial": true`, `"runs_completed": 0`) *before* the run pool
+launches. Each worker writes its own `runs/{name}/result.json` (+ transcript +
+`subagents/`) the moment it finishes, and the runner then recomputes and
+atomically rewrites `summary.json` and `manifest.json` over the completed-so-far
+set. A `try/finally` finalizer performs a last rollup that flips
+`"partial": false` only when every expected run completed. Consequences: a killed
+or crashed pass leaves a self-describing partial archive (never an empty one),
+and the viewer can render a batch while it is still running. Rollup writes are
+serialized by a module-level lock and use write-`.tmp`-then-`os.replace()` atomic
+writes, so a reader never sees a half-written rollup. `--sequential` behaves
+identically. Per-run artifact writes are existence-guarded, so each run's files
+are written exactly once across the repeated rollups.
+
+**Concurrency cap.** The parallel pool is
+`ThreadPoolExecutor(max_workers=min(len(runs), --max-concurrent))`, capped at
+`MAX_CONCURRENT_RUNS = 5` by default (was previously uncapped at `len(runs)`).
+Per-run state (sandbox dir, uuid4 session ids, transcript dirs) is fully
+isolated, so the cap is a resource-pressure guard, not a correctness one.
+`--delay` still staggers submits independently of the cap.
+
+**Error-class counters.** Each `result.json` carries an additive
+`"error_counts": {"hook_blocks", "tool_failures", "tool_failures_unclassified"}`
+object, aggregated into `summary.json`. A run's error-bearing tool results are
+classified (see `scorers/deterministic/error_classification.py`) as `hook_block`
+(refused by a DAAF/benchmark PreToolUse hook, permission deny, or tool-availability
+policy — the framework acting as designed) vs `tool_failure` (a genuine
+tool/API/environment error). Signatures were derived empirically from archived
+transcripts; anything error-bearing that matches neither list is counted as
+`tool_failures_unclassified` rather than silently folded into `tool_failures`.
+
+Additionally, each entry in a run's `tool_failures` list carries a per-entry
+`tool_failure_class` tag assigning a finer operational CAUSE (additive and
+non-scoring; see `classify_tool_failure_class` in
+`scorers/deterministic/error_classification.py`). The taxonomy is precedence-
+ordered (first match wins): `policy_hook` (a DAAF/benchmark hook or permission
+block — the framework acting as designed), `infra_transient` (a dropped/stalled
+stream or empty-200 — a retry candidate), `capacity_limit` (prompt-too-long, a
+quota refusal, or a standalone HTTP 429), `infra_config` (a ChatGPT/Codex lane
+refusal of the CONFIGURED child model id), and `model_error` (everything else,
+including a lane refusal naming a DIFFERENT id than the configured child — the
+model mis-routing itself). The field is additive: archives written before it was
+introduced simply omit it.
+
+**Run-lifecycle watchdog.** `executor.execute_run()` no longer blocks in a single
+`communicate(timeout=timeout)` call. When a runner opts in, a watchdog thread
+polls the run every `--watchdog-poll` seconds (default **60s** — a longer interval
+avoids constant firing across the 5 concurrent runs) and can end a run before the
+900s wall-clock backstop for two reasons. Stdout is drained by a background reader
+thread the whole time, because `claude -p --output-format json` emits its JSON only
+at exit and a naive wait loop would deadlock once the pipe buffer fills. The 900s
+timeout remains the unconditional backstop. **Backward compatibility:** with neither
+watchdog feature enabled (the `RunConfig` defaults), `execute_run()` takes the
+original single blocking `communicate()` path, byte-identical to the pre-watchdog
+harness.
+
+- **Score-complete early stop** (`status: "completed_early"`) — **OFF by default
+  since 2026-07-29; opt-in via `--early-stop`, dispatch_compliance only.** When
+  enabled, every poll runs the *real* deterministic scorers against the live
+  transcripts; when every scored criterion has PASSED, the executor does **one
+  confirmation poll** on the next tick and, if still all-PASS, gracefully kills
+  the run (`_graceful_kill` SIGTERM→15s→SIGKILL ladder) and marks the run
+  `early_stopped`. The original design rationale was a *monotone-pass fairness
+  argument*: all ten dispatch criteria were believed to lock PASS at the Agent
+  call and the subagent-behavior criteria at the subagent's actions, so
+  terminating on all-PASS could not change the score. **That argument was
+  falsified in practice (2026-07-29):** an Agent call's success actually settles
+  at its *tool_result*, which lands only when the subagent finishes — the
+  graceful kill can abort an in-flight dispatch, flipping its tool_result to
+  `is_error=true`, causing archival scoring to fail the dispatch and (by design)
+  suppressing the dispatch-recovery fallback. Observed: 4 of 59 `completed_early`
+  runs scored as dispatch failures despite live all-PASS; all 59 were quarantined
+  (`results/_quarantine_2026-07-29_earlystop/`) and re-run. Early stop also
+  truncates usage capture (`output_tokens=None` — the kill precedes the CLI's
+  final usage summary), breaking cost comparability. Hence the default flip.
+  The other three phases each have a **monotone-FAIL negative criterion**
+  (`no_premature_execution`, `no_forbidden_skills`, `no_tool_calls_of_type`)
+  that starts PASS and can only flip to FAIL; early stop was never wired there.
+  When enabled, the confirmation poll protects the subagent-transcript flush
+  race (the check returns "not done" until the subagent transcript exists on
+  disk and its behavior criteria pass), and a scorer exception during polling is
+  swallowed as "not done" (never kills a run) and logged — but note the flush
+  race is distinct from the tool_result race above, which the confirmation poll
+  does NOT close. Historical `completed_early` runs count as completions for
+  parity/validity purposes, subject to the quarantine above. For duration/latency
+  aggregates they contribute an additive `score_complete_seconds`
+  (time-to-demonstrated-compliance: launch → first all-criteria-pass, excluding
+  the confirmation poll and kill tail) rather than their truncated wall clock
+  (see § 8).
+- **Hung-run / stall detection** (`status: "stalled"`, distinct from `timed_out`),
+  wired for **all four phases**. Staleness is computed as max-recency across the
+  parent transcript **and** all subagent transcripts (a parent-only monitor
+  false-alarms while the parent blocks on long subagent work). A single staleness
+  reading over `--stall-threshold` seconds (default **330s**) counts as one stalled
+  read; **two consecutive** stalled reads (≈120s of confirmation on top of the 330s
+  cutoff, at the 60s poll spacing) are required before the run is killed as
+  stalled. A *first-activity* rule additionally counts a stalled read when **no**
+  parent-or-subagent transcript exists at all past ~90s. The 330s threshold and the
+  never-act-on-a-single-reading rule are empirically grounded in the K3 rerun
+  campaign (`research/2026-07-18_FrameworkDev_DAAFBench_StaticAudit_Fable/2026-07-21_rerun-campaign_progress.md`):
+  **296s of legitimate dead air** was observed on a run that then passed
+  everything, so the former 240s threshold false-positives; ~330s-plus with
+  consecutive confirmations is the validated cutoff.
+- **Stall auto-relaunch.** A stalled rep is relaunched from a freshly wiped/staged
+  sandbox up to `--stall-retries` times (default **1**). The relaunch logs the
+  stall anatomy (staleness poll history, stalled-read count) and gets a new session
+  id and pristine sandbox. A rep that stalls **again** after its last retry is
+  recorded permanently with `status="stalled"` (no relaunch loops). Each run's
+  `result.json` carries an additive `stall_relaunch_count` and a `stall_attempts`
+  list (one `{attempt, stall_diagnostics}` entry per stalled attempt, including
+  those that were retried away) so a run that stalled once then passed is legible
+  from the archive alone rather than only in the console log. Per-run archiving and
+  the error-class counters (above) run for `completed_early` and `stalled` runs
+  exactly as for normal completions.
+- **Lookup-error accounting.** `stall_diagnostics` carries a `lookup_errors`
+  count — the number of transcript-recency lookup exceptions observed across a
+  run's staleness polls. A staleness lookup that throws is treated as
+  inconclusive (not as dead air), so a `lookup_errors > 0` signal marks a
+  monitoring/lookup regression to investigate rather than a genuine model stall,
+  keeping a lookup fault from masquerading as a stall.
+
 **Why the CLI and not the Agent SDK:** a deliberate design choice. Running
 `claude -p` inside the container exercises the full framework — settings.json
 hooks, permission rules, skill discovery, subagent dispatch — exactly as a real
@@ -264,7 +411,13 @@ All four runners share an identical CLI:
 | `--test-id a,b` | all | Specific case IDs (e.g., `mc-01,mc-05`) |
 | `--sequential` | off | Run one at a time instead of parallel |
 | `--delay S` | 2 | Seconds between parallel launches (ThreadPoolExecutor stagger). Parallel-mode only — the sequential loop has no sleep, so this flag is a no-op with `--sequential` |
-| `--timeout S` | phase-based | Per-run timeout in seconds. Defaults baked into each runner (2026-07-10): 120 (Phase 1), 180 (Phase 2), 300 (Phases 3 & 4). Pass explicitly to override; the old cost-tier fallback only fires if a caller passes `timeout_override=None` programmatically |
+| `--max-concurrent N` | 5 | Cap on simultaneously in-flight runs (`max_workers = min(len(runs), N)`). Parallel-mode only. Independent of `--delay`, which staggers submits |
+| `--timeout S` | 900 | Per-run timeout in seconds. Uniform 900s logistical cap baked into all four runners (2026-07-21 walltime redesign; formerly 120/180/300/300 per-phase). The cap is deliberately high so runs complete rather than censor — duration is now a measured axis. Pass explicitly to override; the uniform `DEFAULT_TIMEOUT_S` fallback only fires if a caller passes `timeout_override=None` programmatically |
+| `--watchdog-poll S` | 60 | Watchdog poll interval in seconds — how often the executor checks transcript staleness, plus score-complete early stop when enabled via `--early-stop` (§ 3, Run-lifecycle watchdog) |
+| `--stall-threshold S` | 330 | Staleness cutoff in seconds for one stalled read (K3-validated; 296s of legitimate dead air was observed on a passing run, so 240s false-positives). Two consecutive stalled reads trigger a stall kill |
+| `--stall-retries N` | 1 | Times to relaunch a stalled rep from a fresh sandbox. A rep that stalls again after its last retry is recorded permanently with `status="stalled"` |
+| `--early-stop` | off | **Opt IN** to score-complete early stop (`run_dispatch_compliance.py` only — the one phase where it is wired). **Default flipped OFF 2026-07-29:** the graceful kill can abort an in-flight Agent dispatch and corrupt the archived score, and it truncates usage capture (§ 3). Stall detection is independent and always runs |
+| `--no-early-stop` | off | **Deprecated no-op** since the 2026-07-29 default flip (early stop is already off). Kept for command-line compatibility; overrides `--early-stop` if both are given. Still accepted-but-inert on the other three runners, where early stop was never wired |
 | `--yes` / `-y` | off | Skip the runner's cost confirmation prompt |
 | `--preflight-only` | off | Select models/cases and validate applicable provider routes, then exit before estimates, checkpoints, sandboxes, model execution, or result artifacts |
 
@@ -278,7 +431,7 @@ Typical targeted invocation:
 
 ```bash
 python3 benchmarks/scripts/run_dispatch_compliance.py \
-    --models fable-5 --reps 1 --sequential --delay 20 --timeout 300 --yes
+    --models fable-5 --reps 1 --sequential --delay 20 --timeout 900 --yes
 ```
 
 See § 9 before launching Anthropic Phase 3 runs — they must be sequential.
@@ -455,17 +608,50 @@ critical.
 `agent_dispatched`, `correct_subagent_type`, `prompt_has_base_dir`,
 `prompt_has_mode_marker`, `prompt_has_project_dir`, `prompt_has_task_section`,
 `prompt_has_context_section`, `prompt_has_instructions`,
-`prompt_contains_required`, `prompt_contains_any`. The section-heading criteria
-accept semantically equivalent variants, not just one literal string — e.g.,
-`prompt_has_context_section` matches `## Context` plus six alternatives
-(`## Scope`, `## Background`, etc.), and `prompt_has_instructions` accepts
-`## Output Format`, `## Deliverables`, and similar (see `CONTEXT_HEADERS` /
-`INSTRUCTION_HEADERS` in the scorer).
+`prompt_contains_required`, `prompt_contains_any`. The three section-heading
+criteria (`prompt_has_task_section`, `prompt_has_context_section`,
+`prompt_has_instructions`) measure the **structural presence** of a task /
+context / instructions section — NOT the use of a canonical label. The scorer
+extracts markdown/bold section headings, normalizes them (strip `#`/whitespace,
+casefold), and passes when any heading expresses the relevant concept keyword
+(`TASK_KEYWORDS` / `CONTEXT_KEYWORDS` / `INSTRUCTION_KEYWORDS` in the scorer).
+This is intentionally forgiving: framework guidance
+(`ad-hoc-collaboration-mode.md`) calls the dispatch-prompt structure "a
+skeleton, not a rigid template", so legitimate synonyms all pass — e.g.
+`## Output format` (lowercase f), `## Return format`, `## Output requirements`,
+`## Review expectations`, `## Investigation requirements`, `## Your task`,
+`## User Request`, `## Known Symptoms`. The keyword sets are a strict
+**widening** of the earlier exact-label lists: every prompt that passed under
+the old case-sensitive literal matching still passes (regression-tested), plus
+the synonyms. This replaced the earlier case-sensitive substring matching (the
+`LEGACY_TASK_LABEL` / `LEGACY_CONTEXT_HEADERS` / `LEGACY_INSTRUCTION_HEADERS`
+lists, retained in the scorer only to guarantee the strict-widening property),
+which penalized valid variants such as `## Output format` and inflated a
+spurious cross-model gap (2026-07-28 heading-normalization). The `TASK_KEYWORDS`
+set also includes `request` (added 2026-07-28) so `## User Request` satisfies the
+task concept.
+
+**Zero-dispatch gate (Phase 3 caveat, 2026-07-29):** the eight `prompt_*`
+criteria all evaluate the CONTENT of a dispatch prompt, so they are only
+evaluable when a dispatch was ATTEMPTED. When a run has NO Agent call at all —
+none recorded (succeeded or failed) and none recovered from subagent transcripts
+— every `prompt_*` criterion FAILS with detail "No Agent dispatch attempt;
+prompt criteria not evaluable." This closes the vacuous-pass hole where
+`prompt_has_project_dir` (read-only agents), the 0-required
+`prompt_contains_required`, and the unspecified `prompt_contains_any` used to
+auto-pass on a zero-dispatch run. A recovered or a recorded-failed Agent call
+both count as attempts (so the gate does not fire). One bounded residual remains,
+analogous to the Phase 4 "Vacuous tier-2 passes" caveat below: on a
+FAILED-ONLY run the prompt content is never inspected (the scorer draws prompts
+only from successful/recovered calls), so those same three checks still pass
+vacuously — the gate closes the total-absence hole, not the attempted-but-failed
+one. The two tier1 criteria are unaffected.
 
 **Phase 3 dispatch-recovery fallback.** When a timed-out run's main
-transcript is missing the Agent tool_use record (lost to the timeout kill
-race) but subagent transcripts exist, `score_dispatch_compliance()`
-reconstructs the dispatch from that evidence — subagent_type from
+transcript lacks the Agent tool_use record but subagent transcripts exist,
+`score_dispatch_compliance()` reconstructs the dispatch from that evidence —
+without attributing the missing terminal parent-side record to a particular
+shutdown or write mechanism — using subagent_type from
 `agent-{id}.meta.json`, the prompt from the subagent transcript's first
 user record — and scores all ten criteria. The fallback is evidence-gated
 (it never consults the `timed_out` flag; a recorded FAILED dispatch
@@ -601,58 +787,157 @@ Sources: [OpenAI GPT-5.6 Luna model and API pricing](https://developers.openai.c
 folder:
 
 ```
-results/{YYYYMMDD_HHMMSS}/
+results/{YYYYMMDD_HHMMSS}_{token}/   # {token} = 6 hex of uuid4, per-batch (older sets are bare {YYYYMMDD_HHMMSS})
 ├── manifest.json          # benchmark name, timestamp, DAAF git SHA,
+│                          # batch_token + batch_pid (cross-batch forensics),
+│                          # dirty-worktree hash, golden SHA-256 checksums,
 │                          # run config (reps, parallelism, delays, timeout,
 │                          # model keys), model configs, case definitions
-├── summary.json           # aggregate scores
+├── summary.json           # aggregate scores + partial/runs_expected/
+│                          # runs_completed self-description + aggregate
+│                          # error_counts (hook_blocks/tool_failures/
+│                          # tool_failures_unclassified)
+│                          # + rescored_at (ISO ts, present only if rescored)
 └── runs/{case}_{model}_{rep}/
-    ├── result.json        # tokens, computed cost, duration, criteria results
+    ├── result.json        # tokens, computed cost, duration, criteria results,
+    │                      # error_counts (additive)
+    │                      # + rescored_at / rescore_reason (present only if
+    │                      #   rescored — see "Historical rescore" below)
     ├── transcript.jsonl   # full session transcript
     └── subagents/         # subagent transcripts (Phase 3)
 ```
 
+The archive is written **progressively** — see § 3 (Progressive archiving): the
+folder, `manifest.json`, and an initial `"partial": true` `summary.json` are
+seeded before the pool starts, per-run files are written as each run completes,
+and the rollups are re-rolled incrementally (atomically) after every run. All
+new fields are additive: `summary.json` gains `partial` (bool), `runs_expected`,
+`runs_completed`, and `error_counts`; `result.json` gains `error_counts`. Both
+consumers ignore unknown keys, so these additions are format-compatible with all
+existing archives.
+
 **Artifact schema and archive policy.** New phase-run and route-probe artifacts
 use additive `schema_version: 2` fields for route provenance, separated model
 identity, nullable observed usage, actual billing, API-equivalent accounting,
 and subscription capacity. Existing flat schema-v1 fields remain where their
 semantics are valid; subscription `computed_cost_usd` is null rather than a
-fabricated zero. Historical result sets are immutable: do not migrate,
-recompute, or rewrite old archives. Readers must feature-detect schema v2 and
+fabricated zero. Historical result sets are immutable as to their
+provenance and measurement fields: do not migrate, recompute, or rewrite the
+tokens, cost, timing, transcripts, route provenance, or schema-v1/v2 identity
+fields of old archives. Readers must feature-detect schema v2 and
 continue treating schema-v1 records as legacy, with absent new fields interpreted
 as unavailable rather than zero. Viewer support for these fields is a separate
 integration task; this policy does not claim that every current display surface
 already renders them.
 
+**Historical rescore (sanctioned criteria-correction exception).** The
+immutability policy above protects measurement and provenance, not scoring
+verdicts derived from an *incorrect* scorer. When a deterministic scoring bug is
+fixed, the archived transcripts (which ARE immutable) can be re-scored under the
+corrected criteria by `scripts/rescore_archives.py`. This rewrites ONLY the
+`criteria` / `subagent_criteria` pass fields of `result.json` and the
+criteria-derived rollups of `summary.json`, always additively stamped with
+provenance so the rescore is auditable and never silent:
+
+- `result.json`: `rescored_at` (ISO-8601 UTC timestamp) and `rescore_reason`
+  (e.g. `"heading-normalization-2026-07-28"`).
+- `summary.json`: `rescored_at` (ISO-8601 UTC timestamp).
+
+The `rescore_reason` value defaults to the current correction id but can be set
+per invocation with `--reason "<label>"` (e.g. when a later scoring fix is
+applied, stamp its own id). The reason must be non-blank — a blank or
+whitespace-only `--reason` is rejected up front so the provenance stamp is never
+empty.
+
+Transcripts, tokens, cost, timing, and all provenance/identity fields are never
+touched. The utility defaults to `--dry-run` (report would-change counts without
+writing) and only writes under `--apply`. It is scoped to dispatch_compliance
+result sets (identified by the `dispatch_compliance` manifest benchmark / `dc-*`
+case ids); other batteries, whose criteria are unchanged, are left untouched.
+Checkpoint-line and `expected` arguments are re-derived from each set's own
+golden checkpoint and manifest exactly as the runner's `score_run` does, so
+rescored values are comparable to a fresh run.
+
+In-place replacement of the archived verdicts (rather than dual legacy+v2
+reporting that would preserve both the pre- and post-correction scores side by
+side) was a deliberate user decision (2026-07-28): the rescored history is
+accepted as the single scoring record of the benchmark, since the pre-correction
+verdicts were produced by a scorer now known to be incorrect and retaining them
+as a parallel ledger would invite confusion over which numbers are canonical. The
+`rescored_at` / `rescore_reason` provenance stamps make the correction auditable
+without a second reporting track.
+
 **Viewer generation.** `scripts/generate_results_viewer_v2.py` produces the
 viewer. The official artifact is a **multi-file bundle directory**
-`daafbench_YYYY-MM-DD[suffix]/`; `--single-file` emits a self-contained
-monolith for offline `file://` auditing. Both are gitignored.
+`daafbench_YYYY-MM-DD[suffix]/` (the hosted website build, with lazy-loaded
+transcripts by default); `--single-file` emits a self-contained monolith for
+offline `file://` auditing, which as of generator v3.4.0 is **transcript-lite
+by default** (scores/runs/aggregates only — pass `--transcripts` for the full
+inline-transcript monolith). Both are gitignored.
 
 ```bash
-python3 benchmarks/scripts/generate_results_viewer_v2.py              # bundle, all result sets
+python3 benchmarks/scripts/generate_results_viewer_v2.py              # bundle, all result sets (lazy transcripts)
+python3 benchmarks/scripts/generate_results_viewer_v2.py --no-transcripts  # bundle, index.html only (no shards)
 python3 benchmarks/scripts/generate_results_viewer_v2.py \
     --results 20260609_214335 20260609_224824 --output /tmp/daafbench_view/
 python3 benchmarks/scripts/generate_results_viewer_v2.py \
     --exclude-results 20260608_181352                                  # all sets except these
-python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file # offline monolith
+python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file # transcript-lite offline monolith (default)
+python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file --transcripts  # full inline-transcript monolith
 ```
 
 The **bundle** contains `index.html` (~4 MB; all run-level data and
-precomputed metrics inline) plus `data/tx_{result_set}.json` transcript
-shards fetched on demand by the Run Explorer. The bundle requires http(s)
-serving — `fetch()` is CORS-blocked on `file://`, so a fallback message
+precomputed metrics inline) plus, by default, `data/tx_{result_set}.json`
+transcript shards fetched on demand by the Run Explorer. The bundle requires
+http(s) serving — `fetch()` is CORS-blocked on `file://`, so a fallback message
 with a `python3 -m http.server` hint appears instead. Output filenames
 auto-increment (`daafbench_2026-06-18/`, `daafbench_2026-06-18a/`, etc.)
 and never overwrite prior artifacts. `--exclude-results` drops named sets;
 exclusions are recorded in the embedded generation parameters.
 
+**Transcript inclusion (`--transcripts` / `--no-transcripts`, generator
+v3.4.0).** This mutually exclusive flag pair controls whether the build carries
+per-run transcripts at all, overriding the per-mode default in either
+direction. Defaults: **bundle includes** transcripts (lazy shards — they cost
+nothing until a run is opened, so the official hosted artifact keeps them);
+**single-file excludes** them (the offline monolith is transcript-lite unless
+you ask for the full payload). A transcript-less build embeds a `DATA` payload
+carrying **neither** `transcripts` nor `transcripts_index`; the Run Explorer
+feature-detects this and shows a "Transcripts not included in this build"
+notice in place of each run's transcript pane — it makes no fetch attempt, so
+there is no broken request or empty pane. Every other surface (scores, metrics,
+cost, provenance) is unaffected. The chosen state is recorded as
+`transcripts_included` in the embedded generation parameters.
+
+**Result-set discovery (quarantine exclusion, generator v3.4.0).** Discovery
+scans the children of `results/` and skips non-phase containers **explicitly**:
+any child named `probes` or `removed_runs`, or any child whose name **starts
+with `_`** (the operative quarantine convention is `_quarantine*`), is ignored
+up front rather than relying on the implicit "lacks a `summary.json`" filter.
+A kept result set may carry a `QUARANTINE_NOTE.md` at its root (added
+2026-07-29 to the 8 sets whose individual run dirs were relocated to
+`removed_runs`); this is inert — discovery recognizes a set solely by its
+`summary.json` (enriched from `manifest.json`/`runs/`), so a stray `.md` at the
+set root is never consulted.
+
+> **Stale-bundle caveat (2026-07-28).** Viewer bundles generated *before*
+> 2026-07-28 embed the pre-correction dispatch_compliance criteria (the
+> case-sensitive exact-label matching, and the `TASK_KEYWORDS` set without
+> `request`) inline in their precomputed metrics. They therefore display the
+> old, spuriously-low DC pass rates and will not reflect the heading-
+> normalization fix or the rescored archives. Regenerate any such bundle from
+> the current archives (after running `rescore_archives.py --apply`) before
+> using it for reporting.
+
 **Viewer content.** The output is a single scrolling document: intro/hero,
 key takeaways with a cost-performance preview, about, leaderboard, cost
 vs. performance, phase deep-dives, cases & consistency, run explorer, and
 provenance. The leaderboard composite is the unweighted mean of five
 per-phase Perfect rates (P1, P2, P3a, P3b, P4); tier bands are derived
-mechanically from gaps in composite score. Models lacking runs for a
+mechanically from gaps in composite score, with an equal-width range-quartile
+fallback when the gap rule degenerates — either too few tiers on a
+near-continuum, or (v3.5.0) a single tier holding more than half the ranked
+models. Models lacking runs for a
 component are scored on available components with a visible "partial"
 marker. Cost vs. Performance has a phase-basis selector. To add a new
 phase, follow the guide above `PHASE_MAP` in the generator.
@@ -706,6 +991,14 @@ disclosed on the leaderboard). Anthropic token mixes come from corpus
 `result.json`; OpenRouter from the reconciliation snapshot
 (`derived/openrouter_reconciliation_*.json`). A generation-time staleness
 guard compares corpus run counts to the snapshot and warns on drift.
+ChatGPT-subscription models (GPT-5.6 Luna/Terra/Sol) are priced on an
+explicit **`api-equivalent` counterfactual** (v3.5.0): never-invoiced GPT
+API list rates from `models.yaml` `api_equivalent_pricing.short_context`,
+same uncached basis, marked with an "api-equiv" badge on the leaderboard so
+counterfactual figures are never mistaken for invoiced spend. Note the basis
+labels (`corpus-live` / `billing-snapshot-*` / `api-equivalent`) name each
+model's **token-mix provenance** — the dollar normalization is always
+uncached list rates, never invoiced dollars.
 
 **Battery timeout-exclusion fix (2026-06-18, generator v3.1.2).** Prior
 to this fix, Anthropic token averages included timed-out runs (zeroed
@@ -723,8 +1016,28 @@ comparisons become ~4–9% more accurate).
 aggregates come from loaded runs, not `summary.json` totals. Timed-out runs
 are **graded** (zeroed turns/cost/tokens but fully scored criteria); the
 viewer grade taxonomy (perfect/partial/failed/ungraded) is orthogonal to the
-`timed_out` flag. Cost/duration averages exclude timeout-zeroed runs, with
-excluded counts disclosed.
+`timed_out` flag. **Cost** averages exclude timeout-zeroed runs, with excluded
+counts disclosed. **Duration/latency** aggregates apply per-status contribution
+rules rather than a blanket exclusion: a normal run contributes its full
+`duration_s` (timed-out runs are excluded from viewer aggregates entirely —
+they are filtered at load, consistent with the viewer's timeout-blindness, so
+their truncated wall time never enters the duration axis); a `completed_early`
+run (early-stop watchdog — § 3) contributes its
+`score_complete_seconds` when present (a *time-to-demonstrated-compliance*
+measure: launch → first all-criteria-pass, excluding the confirmation poll and
+kill tail — **not** full-task walltime), else is excluded; a `stalled` run is
+**always excluded** (its wall time is a watchdog-killed hang, not a
+task-completion measure). `completed_early` **scores count normally** in every
+other aggregate — though note the 2026-07-29 finding (§ 3): the early-stop kill
+can itself corrupt dispatch scores, so all 59 `completed_early` runs produced
+under the on-by-default era were quarantined and re-run; early stop is now
+opt-in. Runs carrying `status == "stalled"` are hung runs the watchdog
+killed after auto-relaunch (§ 3); they are distinct from `timed_out` and are
+selected for rerun by `build_rerun_queue.py` alongside timed-out runs (separate
+per-class counts). Partial result sets (`summary.json` `"partial": true`)
+are tolerated and disclosed: the generator prints each partial set with its
+`runs_completed/runs_expected`, and the per-set `partial`/`runs_expected`/
+`runs_completed`/`error_counts` fields flow into the provenance payload.
 
 ## 9. Operational Notes
 
@@ -773,8 +1086,14 @@ within a single run. This is inherent and not preventable by scheduling.
 **Fixture isolation (Phase 3).** `run_dispatch_compliance.py` wipes and
 recreates each run's sandbox, then copies any `datasets/test_fixtures/` paths
 referenced in the case prompt into it, rewrites the prompt, and creates a
-sandbox `workspace/` containing `scripts/run_with_capture.sh` so subagents
-treating the workspace as BASE_DIR find it. Staging happens after the wipe:
+sandbox `workspace/` (the PROJECT_DIR) alongside a BASE_DIR-level
+`scripts/run_with_capture.sh`. The sandbox is thereby isomorphic to the real
+repo layout, so the CLAUDE.md convention
+`bash {BASE_DIR}/scripts/run_with_capture.sh {PROJECT_DIR}/scripts/...`
+resolves: `sandbox_dir` plays BASE_DIR and `workspace/` plays PROJECT_DIR (the
+prior `workspace/scripts/` location drove models of every family to construct
+`{BASE_DIR}/scripts/run_with_capture.sh` → exit 127 + wasted recovery turns).
+Staging happens after the wipe:
 the runner passes `wipe_sandbox=False` through `RunConfig` so
 `prepare_sandbox()` does not re-wipe the staged fixtures (a prior ordering bug
 did exactly that — see Known Limitation 4).
@@ -793,6 +1112,45 @@ intentionally editing fixtures. After the batch drains, a contamination check
 re-runs and warns loudly if fixtures are dirty but does NOT restore — the next
 launch's pre-run restore covers it.
 
+**Concurrent batches (separate processes) are safe.** Running two runner
+invocations at once — e.g. one Anthropic-subscription terminal and one
+OpenRouter terminal — no longer races. Three mechanisms cooperate:
+
+1. **Fixture reader/writer lock (`_sandbox/.fixtures.lock`, DC runner only).**
+   `restore_fixtures()` takes an exclusive `flock` (`LOCK_EX`) for its entire
+   check-then-repair body, and `prepare_fixtures()` takes a shared lock
+   (`LOCK_SH`) around its fixture-copy loop only. So one batch's restore
+   (`git restore`/`rmtree`) can never run while another batch is mid-`copy2` of
+   the same source paths, and two restores can never overlap. Acquisition
+   blocks with a poll loop that warns every 30s and aborts only after 10 min.
+   Acquisition happens pre-launch (before the run pool starts), so a wedged or
+   oversubscribed lock that never frees within the 600s cap aborts the incoming
+   batch with a clear `RuntimeError` before any run is dispatched — fail-loud,
+   with no partial result set archived.
+   The lock needs no stale-cleanup: `flock` is released by the kernel when the
+   holding process dies (including `kill`/Ctrl-C), so a killed batch never
+   strands a lock. The other three runners have no fixtures and take no lock.
+2. **Read-only fixture source (DC runner only).** After each restore (or clean
+   early-return), the `datasets/test_fixtures/` tree is `chmod`ed read-only
+   (files `a-w`; directories keep `r-x`), lifted to writable only for the
+   duration of any repair. A subject that ignores its sandbox and writes into
+   `test_fixtures/` by name now fails with `EACCES` — a loud, harmless failure
+   in the subject's own sandboxed run rather than silent source contamination.
+   Per-run copies are `chmod u+w` after staging so runs still work with them.
+   This does not create git noise: git tracks only the executable bit, not the
+   write bit.
+3. **Per-batch uniqueness token (all four runners).** Each invocation mints one
+   short token (6 hex of `uuid4`); it is appended to both the results directory
+   name (`results/{YYYYMMDD_HHMMSS}_{token}/`) and every sandbox suffix
+   (`_sandbox/run_{case}_{model}_{rep}_{token}/`). Two batches starting the same
+   wall-clock second, even on the same model, no longer merge results dirs or
+   `rmtree` each other's live sandboxes. The token and launching PID are also
+   recorded additively in `manifest.json` (`batch_token`, `batch_pid`) for
+   cross-batch forensics. The **leading timestamp is preserved**, so the viewer
+   (lexicographic sort, opaque dir-name identifiers) and `build_rerun_queue.py`
+   (`results/*/runs/*/result.json` glob) tolerate both old (`{timestamp}`) and
+   new (`{timestamp}_{token}`) directory names — neither parses the name.
+
 **Benchmark git-blocking hook.** `harness/executor.py` sets
 `DAAF_BENCHMARK_RUN=1` on every run's subprocess environment, activating
 `harness/hooks/block-git-writes.sh` — an env-gated PreToolUse Bash hook that
@@ -824,7 +1182,10 @@ is in flight means those runs are scored with the pre-edit logic.
 `harness/executor.py` sends SIGTERM first, drains stdout/stderr through a
 `KILL_GRACE_SECONDS = 15` grace window (via `communicate(timeout=...)`, not
 `wait()` — `wait()` with full pipes can deadlock), and escalates to SIGKILL
-only if the CLI outlives the grace. Timeout semantics: `error = "Timed out
+only if the CLI outlives the grace. The grace is a precaution motivated by
+observed incomplete terminal timeout transcripts; it does not establish the
+CLI's transcript-write internals or prove that SIGKILL caused any missing tail.
+Timeout semantics: `error = "Timed out
 after {N}s"`, the `timed_out` flag, partial-stdout parsing. The subagent's
 transcript is a separate file and survives the kill, so `subagents/` is the
 forensic fallback; the § 6 dispatch-recovery fallback automates this for
@@ -906,17 +1267,18 @@ within 300s.
    model under test all share the DAAF container and filesystem. Low practical
    risk for internal behavioral scoring; a real gap if scores ever carry
    external weight.
-8. **Manifests pin the DAAF git SHA but not golden content hashes.** A run
-   against a worktree-modified golden is indistinguishable in provenance from
-   one against the committed version. Adding a golden content hash to
-   `manifest.json` is the designed improvement (§ 12).
-9. **Timeout kill can race the async transcript writer.** Claude Code's
-   main-session transcript writes are async/buffered, so a timed-out run can
-   lose unflushed records — including the Agent dispatch. Two mitigations
-   stack: the executor's graceful-kill ladder (SIGTERM → 15s grace → SIGKILL,
-   § 9) gives the CLI a flush opportunity; the scoring-side dispatch-recovery
-   fallback (§ 6) reconstructs lost dispatches from surviving subagent
-   transcripts.
+8. **Provenance pinning does not make changed inputs comparable.** Current
+   manifests pin the DAAF Git SHA, the dirty-worktree diff hash, and the SHA-256
+   checksum of each used golden checkpoint in `golden_checksums`. These fields
+   make input changes detectable, but result sets spanning a golden change still
+   require separate interpretation (§ 5).
+9. **Some timeout archives lack terminal parent-side evidence.** Observed
+   transcripts can end without the final parent-side Agent result or response,
+   which prevents stronger causal attribution. The executor's graceful-kill
+   ladder (SIGTERM → 15s grace → SIGKILL, § 9) is a precaution that allows an
+   orderly shutdown interval; it does not prove an asynchronous/buffered write
+   model or that SIGKILL caused any particular missing tail. The scoring-side
+   dispatch-recovery fallback (§ 6) can use surviving subagent evidence.
 
 ## 12. Future Work
 
@@ -1050,16 +1412,27 @@ timed-out runs, matching OpenRouter's natural exclusion.
 
 - **Harness gap (bookmarked): transcript-less timeout runs.** Original 4
   runs (`pc-03`/`pc-07` × Fable 5) moved to `removed_runs/` and replaced
-  in set `20260611_124829`. Root cause (timeout-kill before CLI emits
-  session metadata) is mitigated by the executor graceful-kill ladder
-  (§ 9, § 11 item 9) but the confirmation pass against
-  `executor.py`/`collector.py` transcript-resolution logic remains open.
+  in set `20260611_124829`. Those archives lacked terminal session metadata;
+  the missing evidence does not establish whether shutdown timing, CLI write
+  behavior, or another mechanism caused the absence. The executor's
+  graceful-kill ladder is a precaution (§ 9, § 11 item 9), while the
+  confirmation pass against `executor.py`/`collector.py` transcript-resolution
+  logic remains open.
 - **Gemma 4 31B kept IN by user decision:** silent stalls are
   model-attributable (18.5% rate for 31B, 9.3% for 26B — a Gemma-subfamily
-  defect, not Google-family). Stalls score as failed runs.
-- **Timeout stays 300s for mixed/OpenRouter batches** (p99=252s, max=271s).
-  Anthropic-only batches safe at 150s. Better stall remedy: harness
-  first-activity detector (~90s → kill).
+  defect, not Google-family). Stalls score as failed runs. **Now mitigated:** the
+  run-lifecycle watchdog (§ 3) detects hung runs (330s staleness across the
+  parent + subagent transcripts, two consecutive confirmations, plus a ~90s
+  first-activity rule) and auto-relaunches once (`--stall-retries`), recording a
+  repeat stall as `status="stalled"`.
+- **Timeout is now a uniform 900s logistical cap** across all four runners
+  (2026-07-21 walltime redesign), superseding the earlier per-batch tuning
+  guidance (300s mixed/OpenRouter, 150s Anthropic-only). The high cap lets
+  runs complete rather than censor at the cap, so duration becomes a measured
+  axis rather than a truncation threshold; historical batch percentiles
+  (p99=252s, max=271s under the old 300s cap) motivated retiring the tuned
+  values. The harness first-activity detector (~90s → stalled read) is now
+  implemented as part of the run-lifecycle watchdog (§ 3).
 - **Open follow-ups from Phase 4 routing-fix scoping:**
   (1) frontmatter description budget — svy/polars/marimo exceed the
   250-char limit documented in skill-authoring; verify which claim is
@@ -1068,9 +1441,8 @@ timed-out runs, matching OpenRouter's natural exclusion.
   executed. (3) Maintainer note: Phase 4 criterion *emission* is hardcoded
   in the scorer; the cases' `hard_/soft_requirements` lists drive viewer
   display only.
-- **Optional:** golden content hash in `manifest.json` (§ 11 item 8);
-  review of `data-scientist SKILL.md:353` "Tool-specific syntax" branch
-  label.
+- **Optional:** review of `data-scientist SKILL.md:353` "Tool-specific
+  syntax" branch label.
 
 ## 13. AI Disclosure
 
diff --git a/benchmarks/config/models.yaml b/benchmarks/config/models.yaml
index a1e1f7e7..a82856ce 100644
--- a/benchmarks/config/models.yaml
+++ b/benchmarks/config/models.yaml
@@ -8,6 +8,44 @@
 # env_overrides are passed as environment variables to the claude CLI;
 # provider-level overrides are injected automatically by model_loader.py.
 #
+# CHILD-MODEL PURITY PINNING (added 2026-07-24, updated 2026-07-27).
+# Model entries pin child-model selectors to their own ids so benchmark-dispatched
+# children remain on the model under test. Most entries use all three selectors:
+#     ANTHROPIC_DEFAULT_OPUS_MODEL / ANTHROPIC_DEFAULT_SONNET_MODEL /
+#     CLAUDE_CODE_SUBAGENT_MODEL
+# The three GPT 5.6 ChatGPT-subscription entries intentionally use ONLY the Opus
+# and Sonnet aliases. Both aliases resolve to that entry's own parent GPT id, while
+# CLAUDE_CODE_SUBAGENT_MODEL is absent because its higher-precedence flattening
+# would bypass the semantic tier selected by agent frontmatter. The executor
+# scrubs that selector from the ambient environment before applying model-specific
+# overrides, so omission here is effective while entries that explicitly declare
+# the selector retain it. This two-alias configuration preserves operative
+# opus/sonnet tier selection while remaining model-pure because both tiers resolve
+# to the same benchmarked GPT model.
+#
+# WHY: since commit a6cf8e2 (2026-07-16) DAAF agent frontmatter declares
+# model: opus/sonnet TIERS, so dispatched children no longer inherit the session
+# model — they resolve to whatever those tier aliases point at. The B2 purity gate
+# (harness/artifacts.py) then marks off-model runs validity: invalid and EXCLUDES
+# them from every score rollup (observed: the 2026-07-23 Fable dc pass, 6/6 runs
+# "Child model purity: failed"). Pinning the applicable selectors to the entry's
+# own id restores children == parent, which is both purity-valid and faithful to
+# the original June inheritance condition (VERIFIED: both June Fable dc sets'
+# archived child transcripts are 100% claude-fable-5, 312 + 322 assistant msgs).
+#
+# CONDITION NOTE: this makes "children = the benchmarked model" an explicit,
+# uniform condition. It is NOT DAAF's live two-tier production routing (where
+# the two tiers can resolve to different models). That is the deliberate
+# purity-gate tradeoff. Archived results predating this edit are unaffected.
+#
+# MERGE SEMANTICS (verified in harness/model_loader.py:106-114):
+#   openrouter/anthropic -> {**resolved, **config.env_overrides}  (YAML wins)
+#   chatgpt-subscription -> {**config.env_overrides, **resolved}  (resolved wins)
+# The chatgpt reversal is SAFE for these pins: build_chatgpt_child_env()
+# (harness/route_provenance.py:151-168) returns only ANTHROPIC_BASE_URL,
+# ANTHROPIC_AUTH_TOKEN, and ANTHROPIC_API_KEY — no *_MODEL selector — so the
+# YAML tier-alias pins survive the fail-closed route overlay intact.
+#
 # pricing: per-million-token rates for pre-run cost estimation.
 #   input:        $/M input tokens
 #   output:       $/M output tokens
@@ -31,6 +69,10 @@ models:
       input: 1.00
       output: 5.00
       cached_input: 0.10
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-haiku-4-5-20251001"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-haiku-4-5-20251001"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-haiku-4-5-20251001"
 
   - id: "claude-sonnet-4-6"
     name: "Sonnet 4.6"
@@ -40,15 +82,34 @@ models:
       input: 3.00
       output: 15.00
       cached_input: 0.30
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-sonnet-4-6"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-sonnet-4-6"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-sonnet-4-6"
 
   - id: "claude-opus-4-5"
     name: "Opus 4.5"
     provider: anthropic
     cost_tier: "high"
+    # wire_id OBSERVED 2026-07-29 (user-approved re-adjudication): the bare
+    # alias `claude-opus-4-5` resolves on the wire to its dated snapshot.
+    # Evidence: results/20260726_163821 + 20260726_171652 — all 11 substantive
+    # runs report exactly one distinct child-transcript model id,
+    # "claude-opus-4-5-20251101" (parent live records match; the 11
+    # claude-opus-4-6 parent records per run are the replayed
+    # golden/dispatch_compliance/ad_hoc_initialized.jsonl checkpoint prefix,
+    # which contains exactly 11 assistant records, all claude-opus-4-6).
+    # Without this declaration the purity gate false-failed authentic Opus 4.5
+    # runs under exact_string_equality_no_alias_normalization.
+    wire_id: "claude-opus-4-5-20251101"
     pricing:
       input: 5.00
       output: 25.00
       cached_input: 0.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-opus-4-5"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-opus-4-5"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-opus-4-5"
 
   - id: "claude-opus-4-6"
     name: "Opus 4.6"
@@ -58,6 +119,10 @@ models:
       input: 5.00
       output: 25.00
       cached_input: 0.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-opus-4-6"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-opus-4-6"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-opus-4-6"
 
   - id: "claude-opus-4-7"
     name: "Opus 4.7"
@@ -67,6 +132,10 @@ models:
       input: 5.00
       output: 25.00
       cached_input: 0.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-opus-4-7"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-opus-4-7"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-opus-4-7"
 
   - id: "claude-opus-4-8"
     name: "Opus 4.8"
@@ -76,6 +145,47 @@ models:
       input: 5.00
       output: 25.00
       cached_input: 0.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-opus-4-8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-opus-4-8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-opus-4-8"
+
+  # Added 2026-07-25 for the Opus 5 evaluation.
+  #
+  # ID EVIDENCE: "claude-opus-5" is the wire identity OBSERVED on this repo's
+  # live Opus 5 session transcript — every assistant record reports
+  # message.model == "claude-opus-5" (jq over
+  # ~/.claude/projects/-daaf/10a8253f-....jsonl returned exactly one distinct
+  # value). The Claude Code environment string renders it as
+  # "claude-opus-5[1m]"; the "[1m]" is a client-side context-window badge (cf.
+  # "claude-opus-4-8[1m]" in .claude/hooks/context-reporter.sh:76) and is NOT
+  # part of the API model id — it never appears on the wire. Not cross-checked
+  # against Anthropic's published model list (this authoring pass had no web
+  # access).
+  #
+  # wire_id: deliberately OMITTED. "claude-opus-5" was OBSERVED directly on
+  # the wire (above), so the wire form equals `id` and ModelConfig defaults
+  # comparison_model_id to `id` (harness/models.py:135-140). NOTE (2026-07-29):
+  # "bare slug means wire form equals id" is NOT a safe general rule for
+  # Anthropic entries — claude-opus-4-5 resolves on the wire to its dated
+  # snapshot claude-opus-4-5-20251101 and now declares wire_id (see that
+  # entry). Declare wire_id wherever the observed wire form differs from `id`.
+  #
+  # PRICING PROVENANCE: mirrors opus-4-8 per user statement 2026-07-25
+  # ("Opus 5 is the same price as Opus 4.8"). NOT independently verified
+  # against Anthropic's published price list.
+  - id: "claude-opus-5"
+    name: "Opus 5"
+    provider: anthropic
+    cost_tier: "high"
+    pricing:
+      input: 5.00
+      output: 25.00
+      cached_input: 0.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-opus-5"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-opus-5"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-opus-5"
 
   - id: "claude-fable-5"
     name: "Fable 5"
@@ -85,6 +195,10 @@ models:
       input: 10.00
       output: 50.00
       cached_input: 1.00
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-fable-5"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-fable-5"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-fable-5"
 
   - id: "claude-sonnet-5"
     name: "Sonnet 5"
@@ -100,16 +214,50 @@ models:
       input: 2.00
       output: 10.00
       cached_input: 0.20
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "claude-sonnet-5"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "claude-sonnet-5"
+      CLAUDE_CODE_SUBAGENT_MODEL: "claude-sonnet-5"
 
   # --- OpenRouter models ---
 
+  # --- wire_id (added 2026-07-24) ---
+  #
+  # `id` is the ROUTING selector, passed verbatim to `claude --model` and to the
+  # ANTHROPIC_DEFAULT_* / CLAUDE_CODE_SUBAGENT_MODEL env overrides. Entries below
+  # that carry a ":provider/quant" suffix are PINNED to that backend and
+  # quantization; the suffix must never be stripped from `id` (doing so unpins
+  # routing and invalidates price tables reconciled against the pinned provider).
+  #
+  # `wire_id` is the identity the model reports back on transcript assistant
+  # records (message.model). The CLI does NOT echo the provider/quant suffix, so
+  # for pinned entries the wire form is the bare slug. It is used ONLY as the
+  # child-model-purity comparison target (harness/artifacts.py), never for
+  # routing. Omit `wire_id` when the wire form equals `id` (all bare-slug
+  # entries) — the code defaults to `id`.
+  #
+  # EVIDENCE GRADE (updated 2026-07-26, user-approved batch): all 10 `wire_id`
+  # entries in this file are now OBSERVED — each bare wire form confirmed from
+  # child-transcript assistant records (observed_child_model_ids_raw) during the
+  # 2026-07 re-run campaign; per-entry citations below. The bare-slug rule held
+  # 9/9 where tested, across eight suffix shapes including provider-only
+  # (:google-vertex). Evidence boundary: CLI transcript-observed identity only —
+  # never backend-confirmed, never a check of the provider/quant pin itself.
+
   - id: "z-ai/glm-5.1:atlas-cloud/fp8"
+    # wire_id OBSERVED 2026-07-25 (results/20260725_201746, GLM 5.1 dc-02:
+    # purity verified, bare slug on the wire while routing id carried the pin)
+    wire_id: "z-ai/glm-5.1"
     name: "GLM 5.1"
     provider: openrouter
     cost_tier: "medium"
     pricing:
       input: 0.98
       output: 3.08
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "z-ai/glm-5.1:atlas-cloud/fp8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "z-ai/glm-5.1:atlas-cloud/fp8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "z-ai/glm-5.1:atlas-cloud/fp8"
 
   - id: "z-ai/glm-5.2"
     name: "GLM 5.2"
@@ -119,22 +267,40 @@ models:
       input: 1.40
       output: 4.40
       cached_input: 0.26
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "z-ai/glm-5.2"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "z-ai/glm-5.2"
+      CLAUDE_CODE_SUBAGENT_MODEL: "z-ai/glm-5.2"
 
   - id: "moonshotai/kimi-k2.6:siliconflow/fp8"
+    # wire_id OBSERVED 2026-07-25 (results/20260725_131940 and 20260725_140242:
+    # purity verified, bare slug on the wire while routing id carried the pin)
+    wire_id: "moonshotai/kimi-k2.6"
     name: "Kimi K2.6"
     provider: openrouter
     cost_tier: "medium"
     pricing:
       input: 0.68
       output: 3.41
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "moonshotai/kimi-k2.6:siliconflow/fp8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "moonshotai/kimi-k2.6:siliconflow/fp8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "moonshotai/kimi-k2.6:siliconflow/fp8"
 
   - id: "moonshotai/kimi-k2.7-code:novita"
+    # wire_id OBSERVED 2026-07-25 (Op G dc block; purity verified, bare slug on
+    # the wire while routing id carried the pin)
+    wire_id: "moonshotai/kimi-k2.7-code"
     name: "Kimi K2.7 Code"
     provider: openrouter
     cost_tier: "medium"
     pricing:
       input: 0.75
       output: 3.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "moonshotai/kimi-k2.7-code:novita"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "moonshotai/kimi-k2.7-code:novita"
+      CLAUDE_CODE_SUBAGENT_MODEL: "moonshotai/kimi-k2.7-code:novita"
 
   # Added 2026-07-17 (G1R Kimi K3 battery), mirroring the kimi-k26 field set
   # plus full purity-env pinning (all three selectors) so dispatched children
@@ -165,14 +331,24 @@ models:
       CLAUDE_CODE_SUBAGENT_MODEL: "moonshotai/kimi-k3"
 
   - id: "qwen/qwen3.6-27b:venice/fp8"
+    # wire_id OBSERVED 2026-07-25 (Op G dc block; purity verified, bare slug on
+    # the wire while routing id carried the pin)
+    wire_id: "qwen/qwen3.6-27b"
     name: "Qwen 3.6 27B"
     provider: openrouter
     cost_tier: "medium"
     pricing:
       input: 0.289
       output: 2.40
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "qwen/qwen3.6-27b:venice/fp8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "qwen/qwen3.6-27b:venice/fp8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "qwen/qwen3.6-27b:venice/fp8"
 
   - id: "google/gemma-4-31b-it:venice/bf16"
+    # wire_id OBSERVED 2026-07-26 (results/20260726_003234, 3 reps: purity
+    # verified, bare slug on the wire while routing id carried the pin)
+    wire_id: "google/gemma-4-31b-it"
     name: "Gemma 4 31B"
     provider: openrouter
     cost_tier: "low"
@@ -185,8 +361,15 @@ models:
     pricing:
       input: 0.151
       output: 0.454
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemma-4-31b-it:venice/bf16"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemma-4-31b-it:venice/bf16"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemma-4-31b-it:venice/bf16"
 
   - id: "google/gemma-4-26b-a4b-it:novita/bf16"
+    # wire_id OBSERVED 2026-07-26 (results/20260726_013918, 3 reps: purity
+    # verified, bare slug on the wire while routing id carried the pin)
+    wire_id: "google/gemma-4-26b-a4b-it"
     name: "Gemma 4 26B"
     provider: openrouter
     cost_tier: "low"
@@ -199,8 +382,16 @@ models:
     pricing:
       input: 0.127
       output: 0.700
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemma-4-26b-a4b-it:novita/bf16"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemma-4-26b-a4b-it:novita/bf16"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemma-4-26b-a4b-it:novita/bf16"
 
   - id: "deepseek/deepseek-v4-pro:atlas-cloud/fp8"
+    # wire_id OBSERVED 2026-07-25 (Op F dc block; purity verified, bare slug on
+    # the wire while routing id carried the pin — Pro now observed directly,
+    # no longer inferred from the V4 Flash analogue)
+    wire_id: "deepseek/deepseek-v4-pro"
     name: "DeepSeek V4 Pro"
     provider: openrouter
     cost_tier: "medium"
@@ -214,8 +405,18 @@ models:
     pricing:
       input: 1.44
       output: 2.88
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "deepseek/deepseek-v4-pro:atlas-cloud/fp8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "deepseek/deepseek-v4-pro:atlas-cloud/fp8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "deepseek/deepseek-v4-pro:atlas-cloud/fp8"
 
   - id: "deepseek/deepseek-v4-flash:atlas-cloud/fp8"
+    # wire_id OBSERVED 2026-07-24 (results/20260724_212503/runs/
+    # dc-01_DeepSeek_V4_Flash_0/result.json recorded
+    # observed_child_model_ids_raw = ["deepseek/deepseek-v4-flash"] while the
+    # routing id carried the :atlas-cloud/fp8 pin). This is the one wire form in
+    # this file established by direct observation rather than inference.
+    wire_id: "deepseek/deepseek-v4-flash"
     name: "DeepSeek V4 Flash"
     provider: openrouter
     cost_tier: "low"
@@ -229,30 +430,116 @@ models:
     pricing:
       input: 0.132
       output: 0.263
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "deepseek/deepseek-v4-flash:atlas-cloud/fp8"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "deepseek/deepseek-v4-flash:atlas-cloud/fp8"
+      CLAUDE_CODE_SUBAGENT_MODEL: "deepseek/deepseek-v4-flash:atlas-cloud/fp8"
 
   - id: "google/gemini-3.1-pro-preview:google-vertex"
+    # wire_id OBSERVED 2026-07-25 (results/20260725_200704/runs/
+    # dc-12_Gemini_3.1_Pro_0: purity verified, bare slug on the wire). This pin
+    # is a provider-only suffix (no quant segment); observation confirmed the
+    # bare-slug rule holds for that shape too — the suffix is dropped on the wire.
+    wire_id: "google/gemini-3.1-pro-preview"
     name: "Gemini 3.1 Pro"
     provider: openrouter
     cost_tier: "high"
     pricing:
       input: 2.00
       output: 12.00
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-3.1-pro-preview:google-vertex"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-3.1-pro-preview:google-vertex"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-3.1-pro-preview:google-vertex"
 
   - id: "nvidia/nemotron-3-ultra-550b-a55b:deepinfra/bf16"
+    # wire_id OBSERVED 2026-07-25 (Op G dc block; purity verified, bare slug on
+    # the wire while routing id carried the pin)
+    wire_id: "nvidia/nemotron-3-ultra-550b-a55b"
     name: "Nemotron 3 Ultra"
     provider: openrouter
     cost_tier: "low"
     pricing:
       input: 0.50
       output: 2.50
-
-#  - id: "google/gemini-3.5-flash"
-#    name: "Gemini 3.5 Flash"
-#    provider: openrouter
-#    cost_tier: "high"
-#    pricing:
-#      input: 1.50
-#      output: 9.00
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "nvidia/nemotron-3-ultra-550b-a55b:deepinfra/bf16"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "nvidia/nemotron-3-ultra-550b-a55b:deepinfra/bf16"
+      CLAUDE_CODE_SUBAGENT_MODEL: "nvidia/nemotron-3-ultra-550b-a55b:deepinfra/bf16"
+
+  # Added 2026-07-27 (Gemini Flash battery). Identity/pricing/context verified
+  # online 2026-07-27 from GET /api/v1/models/google/gemini-3.5-flash/endpoints:
+  # $1.50/M input, $9.00/M output, $0.15/M cache read; context 1,048,576.
+  # Two first-party providers (Google Vertex, Google AI Studio) at identical
+  # standard-tier rates (flex/priority are separately-tagged endpoints), so no
+  # ":provider" pin — bare slug, wire_id omitted (comparison defaults to id),
+  # matching the Gemini 3.1 Flash Lite precedent. (Replaces a pre-existing
+  # commented-out stub that carried the same 1.50/9.00 rates, no cache rate.)
+  - id: "google/gemini-3.5-flash"
+    name: "Gemini 3.5 Flash"
+    provider: openrouter
+    cost_tier: "low"
+    pricing:
+      input: 1.50
+      output: 9.00
+      cached_input: 0.15
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-3.5-flash"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-3.5-flash"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-3.5-flash"
+
+  # Added 2026-07-27. Verified 2026-07-27 from GET /api/v1/models/google/
+  # gemini-3.6-flash/endpoints: $1.50/M input, $7.50/M output, $0.15/M cache
+  # read; context 1,048,576. Same two first-party providers at identical
+  # standard-tier rates — bare slug, no pin, wire_id omitted (see 3.5 Flash note).
+  - id: "google/gemini-3.6-flash"
+    name: "Gemini 3.6 Flash"
+    provider: openrouter
+    cost_tier: "low"
+    pricing:
+      input: 1.50
+      output: 7.50
+      cached_input: 0.15
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-3.6-flash"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-3.6-flash"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-3.6-flash"
+
+  # Added 2026-07-27. Verified 2026-07-27 from GET /api/v1/models/google/
+  # gemini-3.5-flash-lite/endpoints: $0.30/M input, $2.50/M output, $0.03/M
+  # cache read; context 1,048,576. Same two first-party providers at identical
+  # standard-tier rates — bare slug, no pin, wire_id omitted (see 3.5 Flash note).
+  - id: "google/gemini-3.5-flash-lite"
+    name: "Gemini 3.5 Flash Lite"
+    provider: openrouter
+    cost_tier: "low"
+    pricing:
+      input: 0.30
+      output: 2.50
+      cached_input: 0.03
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-3.5-flash-lite"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-3.5-flash-lite"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-3.5-flash-lite"
+
+  # Added 2026-07-27 (run LAST in the battery, under close cost watch — user
+  # recalls a prior expensive campaign on this model). Verified 2026-07-27 from
+  # GET /api/v1/models/google/gemini-2.5-pro/endpoints: $1.25/M input, $10.00/M
+  # output, $0.125/M cache read; context 1,048,576. Two first-party providers at
+  # identical standard-tier rates (plus degraded google-vertex/eu and /us
+  # regional tags, status -5) — bare slug, no pin, wire_id omitted.
+  - id: "google/gemini-2.5-pro"
+    name: "Gemini 2.5 Pro"
+    provider: openrouter
+    cost_tier: "high"
+    pricing:
+      input: 1.25
+      output: 10.00
+      cached_input: 0.125
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-2.5-pro"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-2.5-pro"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-2.5-pro"
 
   - id: "google/gemini-3.1-flash-lite"
     name: "Gemini 3.1 Flash Lite"
@@ -261,6 +548,10 @@ models:
     pricing:
       input: 0.25
       output: 1.50
+    env_overrides:
+      ANTHROPIC_DEFAULT_OPUS_MODEL: "google/gemini-3.1-flash-lite"
+      ANTHROPIC_DEFAULT_SONNET_MODEL: "google/gemini-3.1-flash-lite"
+      CLAUDE_CODE_SUBAGENT_MODEL: "google/gemini-3.1-flash-lite"
 
   # --- OpenAI GPT models (via OpenRouter Anthropic-compatible endpoint) ---
   #
@@ -300,6 +591,7 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "openai/gpt-5.6-sol"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "openai/gpt-5.6-sol"
+      CLAUDE_CODE_SUBAGENT_MODEL: "openai/gpt-5.6-sol"
 
   - id: "openai/gpt-5.6-terra"
     name: "GPT-5.6 Terra"
@@ -312,6 +604,7 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "openai/gpt-5.6-terra"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "openai/gpt-5.6-terra"
+      CLAUDE_CODE_SUBAGENT_MODEL: "openai/gpt-5.6-terra"
 
   - id: "openai/gpt-5.6-luna"
     name: "GPT-5.6 Luna"
@@ -324,6 +617,7 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "openai/gpt-5.6-luna"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "openai/gpt-5.6-luna"
+      CLAUDE_CODE_SUBAGENT_MODEL: "openai/gpt-5.6-luna"
 
   # --- OpenAI GPT models (deployed ChatGPT-subscription shim path) ---
   # This is a system/deployment benchmark condition, not a raw-model lane:
@@ -361,12 +655,13 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "gpt-5.6-luna"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "gpt-5.6-luna"
-      CLAUDE_CODE_SUBAGENT_MODEL: "gpt-5.6-luna"
 
-  # Added 2026-07-17 (G1R battery) mirroring the gpt-56-luna-chatgpt entry
-  # byte-for-byte in structure: provider chatgpt-subscription, bare OpenAI wire
-  # ID, full purity-env pinning, the same dated api_equivalent_pricing schedule,
-  # and the 370,000-token subscription-lane ceiling.
+  # Added 2026-07-17 (G1R battery) mirroring the gpt-56-luna-chatgpt entry:
+  # provider chatgpt-subscription, bare OpenAI wire ID, tier-preserving two-alias
+  # purity pinning, and the 370,000-token subscription-lane ceiling. NOTE
+  # 2026-07-29: the original mirror wrongly copied Luna's api_equivalent_pricing
+  # schedule; corrected to Terra's own published tier (2.5x Luna) after the
+  # pricing audit (verified against developers.openai.com gpt-5.6-terra).
   - key: "gpt-56-terra-chatgpt"
     id: "gpt-5.6-terra"
     name: "GPT-5.6 Terra (ChatGPT Subscription)"
@@ -381,23 +676,22 @@ models:
     context_window_tokens: 370000
     actual_billing_treatment: "not_separately_billed"
     api_equivalent_pricing:
-      source_url: "https://developers.openai.com/api/docs/models/gpt-5.6-luna"
-      accessed_at: "2026-07-15"
+      source_url: "https://developers.openai.com/api/docs/models/gpt-5.6-terra"
+      accessed_at: "2026-07-29"
       threshold_input_tokens: 272000
       short_context:
-        input: 1.00
-        cached_input: 0.10
-        cache_write: 1.25
-        output: 6.00
+        input: 2.50
+        cached_input: 0.25
+        cache_write: 3.125
+        output: 15.00
       long_context:
-        input: 2.00
-        cached_input: 0.20
-        cache_write: 2.50
-        output: 9.00
+        input: 5.00
+        cached_input: 0.50
+        cache_write: 6.25
+        output: 22.50
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "gpt-5.6-terra"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "gpt-5.6-terra"
-      CLAUDE_CODE_SUBAGENT_MODEL: "gpt-5.6-terra"
 
   - key: "gpt-56-sol-chatgpt"
     id: "gpt-5.6-sol"
@@ -411,24 +705,26 @@ models:
     # scripts/provider_shim/probe_context_ceiling.py and raise if it proves higher.
     context_window_tokens: 370000
     actual_billing_treatment: "not_separately_billed"
+    # Pricing corrected 2026-07-29: the entry originally copied Luna's schedule
+    # (5x understatement); now Sol's own published tier, verified against
+    # developers.openai.com gpt-5.6-sol.
     api_equivalent_pricing:
-      source_url: "https://developers.openai.com/api/docs/models/gpt-5.6-luna"
-      accessed_at: "2026-07-15"
+      source_url: "https://developers.openai.com/api/docs/models/gpt-5.6-sol"
+      accessed_at: "2026-07-29"
       threshold_input_tokens: 272000
       short_context:
-        input: 1.00
-        cached_input: 0.10
-        cache_write: 1.25
-        output: 6.00
+        input: 5.00
+        cached_input: 0.50
+        cache_write: 6.25
+        output: 30.00
       long_context:
-        input: 2.00
-        cached_input: 0.20
-        cache_write: 2.50
-        output: 9.00
+        input: 10.00
+        cached_input: 1.00
+        cache_write: 12.50
+        output: 45.00
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "gpt-5.6-sol"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "gpt-5.6-sol"
-      CLAUDE_CODE_SUBAGENT_MODEL: "gpt-5.6-sol"
 
   - id: "openai/gpt-5.5"
     name: "GPT-5.5"
@@ -441,6 +737,7 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "openai/gpt-5.5"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "openai/gpt-5.5"
+      CLAUDE_CODE_SUBAGENT_MODEL: "openai/gpt-5.5"
 
   # REMOVED 2026-07-10 (user decision after the GPT smoke battery):
   #   gpt-5.6-sol-pro, gpt-5.6-terra-pro, gpt-5.6-luna-pro — all three hit
@@ -474,6 +771,7 @@ models:
     env_overrides:
       ANTHROPIC_DEFAULT_OPUS_MODEL: "openai/gpt-5.4-mini"
       ANTHROPIC_DEFAULT_SONNET_MODEL: "openai/gpt-5.4-mini"
+      CLAUDE_CODE_SUBAGENT_MODEL: "openai/gpt-5.4-mini"
 
 # Thinking level variants (uncomment to include in benchmark runs)
 #
diff --git a/benchmarks/harness/artifacts.py b/benchmarks/harness/artifacts.py
index afd1879a..65581db4 100644
--- a/benchmarks/harness/artifacts.py
+++ b/benchmarks/harness/artifacts.py
@@ -11,6 +11,7 @@
 import argparse
 import hashlib
 import json
+import re
 import subprocess
 import sys
 from dataclasses import asdict
@@ -37,6 +38,15 @@
 )
 PURITY_STATUSES = ("verified", "failed", "unverifiable")
 
+# Display-only relabel for accounting coverage console output. The internal
+# accounting KEYS (ACCOUNTING_CATEGORIES) are a persisted summary.json contract
+# read by generate_results_viewer_v2.py and asserted in tests, so they must not
+# change. This map only rewrites how a category is LABELED in format_coverage()
+# console text; keys not present pass through unchanged.
+ACCOUNTING_CATEGORY_LABELS = {
+    "legacy_numeric": "numeric_computed_cost",
+}
+
 # --- B2: child-model purity as an infrastructure validity gate ---
 # Non-scoring. A purity-failed run is marked invalid and excluded from score
 # rollups (never deleted); an unverifiable run stays valid but is disclosed via
@@ -65,6 +75,46 @@ def attach_schema_version(payload: Mapping) -> dict:
     return artifact
 
 
+def sandbox_slug(model_name: str) -> str:
+    """Return a shell-safe sandbox-suffix slug for a model display name.
+
+    The `_sandbox/run_<suffix>` directory name is interpolated into shell
+    command lines by the harness; display names carry characters that are
+    hostile to the shell — notably parentheses (e.g. "GPT-5.6 Luna (ChatGPT
+    Subscription)"), which produce `syntax error near unexpected token '('`.
+    Collapse every character outside the safe set [A-Za-z0-9._-] to a single
+    underscore, coalescing runs, and trim leading/trailing underscores.
+
+    Slugging affects ONLY the sandbox directory name (new runs). The display
+    name is preserved verbatim everywhere else (manifests, result.json `model`
+    field, results-dir naming), so this is not an identity change.
+    """
+    slug = re.sub(r"[^A-Za-z0-9._-]+", "_", model_name)
+    return slug.strip("_")
+
+
+def assert_unique_sandbox_slugs(models) -> None:
+    """Fail fast if any two selected models slug to the same sandbox suffix.
+
+    ``sandbox_slug`` collapses shell-hostile characters to underscores, so two
+    distinct display names can collide onto one slug (e.g. "GPT-5.6 (A)" and
+    "GPT-5.6 [A]" both → "GPT-5.6_A_"). Colliding slugs share a ``_sandbox/run_*``
+    directory, cross-contaminating fixtures and transcripts between runs. Called
+    once at batch start (after model selection) so the collision surfaces as a
+    clear, named error instead of silent data corruption downstream.
+    """
+    seen = {}
+    for m in models:
+        slug = sandbox_slug(m.name)
+        if slug in seen:
+            raise SystemExit(
+                f"ERROR: sandbox_slug collision — models {seen[slug]!r} and "
+                f"{m.name!r} both slug to {slug!r}. Rename one display name so "
+                f"their _sandbox/run_* directories do not collide."
+            )
+        seen[slug] = m.name
+
+
 def _model_key(model: ModelConfig) -> str:
     """Resolve the selectable key using the registry's compatibility rule."""
     return model.key or model.name.lower().replace(" ", "-").replace(".", "")
@@ -81,6 +131,11 @@ def model_manifest_entry(model: ModelConfig) -> dict:
     return {
         "key": _model_key(model),
         "id": model.id,
+        # The declared wire identity (purity comparison target). Recorded
+        # alongside the routing id so a result set is self-documenting about
+        # which string the child-model purity gate compared against. None for
+        # entries whose wire form equals their routing id.
+        "wire_id": model.wire_id,
         "name": model.name,
         "display_name": model.name,
         "provider": model.provider,
@@ -137,6 +192,26 @@ def computed_cost_for_run(model: ModelConfig, result: RunResult) -> Optional[flo
     return compute_cost(model, result)
 
 
+def _run_status(result: RunResult) -> str:
+    """Derive the single run-lifecycle status string for a result.json record.
+
+    Precedence (most specific first): an early stop and a stall are terminal
+    watchdog outcomes and win over the generic error/timeout classification. The
+    exact strings "completed_early" and "stalled" are contract with the viewer
+    (which substitutes score_complete_seconds for completed_early runs in duration
+    aggregates when present, else excludes them) and the README.
+    """
+    if getattr(result, "early_stopped", False):
+        return "completed_early"
+    if getattr(result, "stalled", False):
+        return "stalled"
+    if result.error and "Timed out" in result.error:
+        return "timed_out"
+    if result.error:
+        return "error"
+    return "completed"
+
+
 def build_run_artifact(
     model: ModelConfig,
     result: RunResult,
@@ -164,6 +239,20 @@ def build_run_artifact(
         ),
         "error": result.error,
         "timed_out": bool(result.error and "Timed out" in result.error),
+        # Run-lifecycle flags + a single derived status string (Dispatch B). The
+        # viewer keys duration/latency handling on status == "completed_early",
+        # substituting score_complete_seconds when present (else excluding the run);
+        # None-safe getattr keeps this working for any RunResult built before the
+        # watchdog fields existed (e.g. legacy callers, error artifacts).
+        "early_stopped": bool(getattr(result, "early_stopped", False)),
+        "stalled": bool(getattr(result, "stalled", False)),
+        "stall_diagnostics": dict(getattr(result, "stall_diagnostics", {}) or {}),
+        # Comparable duration for early-stopped runs (time-to-demonstrated-
+        # compliance; None otherwise). The viewer substitutes this for duration_s
+        # on completed_early runs in duration/latency aggregates (README § 8).
+        # getattr keeps this None-safe for RunResults built before the field existed.
+        "score_complete_seconds": getattr(result, "score_complete_seconds", None),
+        "status": _run_status(result),
         "tool_failures": list(result.tool_failures),
     }
     if phase_fields:
@@ -333,26 +422,93 @@ def console_billing_label(record: Mapping, precision: int = 3) -> str:
 
 
 def format_coverage(coverage: Mapping[str, int]) -> str:
-    """Format stable accounting coverage counts for console output."""
+    """Format stable accounting coverage counts for console output.
+
+    Display-only: the persisted accounting keys are unchanged; only the
+    human-facing label is rewritten via ACCOUNTING_CATEGORY_LABELS.
+    """
     return ", ".join(
-        f"{category}={coverage.get(category, 0)}"
+        f"{ACCOUNTING_CATEGORY_LABELS.get(category, category)}"
+        f"={coverage.get(category, 0)}"
         for category in ACCOUNTING_CATEGORIES
     )
 
 
+def _is_non_model_marker(value: str) -> bool:
+    """True for CLI placeholder markers that are not model identities.
+
+    # INTENT: keep non-model strings out of the model-identity tally.
+    # REASONING: the Claude CLI writes ``"<synthetic>"`` into
+    #   ``message.model`` on locally fabricated assistant records — most
+    #   commonly usage-limit / spend-cap error stubs ("You've hit your org's
+    #   monthly spend limit."). That is a stub marker, not a routing outcome,
+    #   so counting it as an observed model id turns a genuinely on-model run
+    #   into a purity failure and silently discards the run from all rollups.
+    # ASSUMES: the CLI's angle-bracket convention (``<...>``) marks placeholders
+    #   and no real model slug is ever angle-bracketed. The rule is deliberately
+    #   kept to that one narrow shape rather than a broader heuristic: a real
+    #   slug that somehow arrived bracketed would be surfaced verbatim in
+    #   ``observed_non_model_markers``, never dropped from the artifact.
+    """
+    return len(value) > 2 and value.startswith("<") and value.endswith(">")
+
+
 def child_model_purity(
     transcript_paths: Iterable,
     requested_model_id: str,
+    wire_model_id: Optional[str] = None,
 ) -> dict:
     """Evaluate child-model purity from safely observable transcript identity.
 
     The Claude CLI writes the model ID on child transcript assistant records at
-    ``record.message.model``. This helper reads JSONL incrementally, observes only
-    that identity field, and compares exact strings. No aliases are collapsed:
-    the raw IDs are also the comparison IDs, which keeps the evidence auditable
-    and avoids inventing a canonicalization rule that the backend has not
-    confirmed.
+    ``record.message.model``. This helper reads JSONL incrementally, observes
+    only that identity field, and compares exact strings. No aliases are
+    collapsed and no observed string is rewritten, which keeps the evidence
+    auditable and avoids inventing a canonicalization rule that the backend has
+    not confirmed.
+
+    Comparison target
+    -----------------
+    ``requested_model_id`` is the ROUTING SELECTOR handed to ``claude --model``.
+    ``wire_model_id`` is the identity that model is *declared* (in models.yaml)
+    to report on the wire; when omitted it defaults to ``requested_model_id``.
+    The comparison runs against the wire id, because several registry entries
+    pin a provider/quantization in the routing selector (e.g.
+    ``deepseek/deepseek-v4-flash:atlas-cloud/fp8``) while the CLI writes only
+    the bare slug into transcripts. Comparing the routing selector against the
+    wire form failed on the string mismatch alone, even for perfectly on-model
+    children. Declaring the expected wire form per model — rather than deriving
+    it by stripping the suffix — keeps the "no invented canonicalization" rule
+    intact, and ``normalization_applied`` stays truthfully ``False``.
+
+    EVIDENCE BOUNDARY — what this can and cannot establish
+    ------------------------------------------------------
+    The wire form carries **no provider/quant suffix at all**. Transcript-
+    observed purity can therefore verify the **model** only; it can NEVER verify
+    the **provider pin** or the **quantization** a pinned entry routes to. A run
+    whose ``purity_status`` is ``verified`` asserts "the child reported the
+    expected model slug", not "the child was served by the pinned
+    provider/quant". No quant-level or provider-level purity is being checked
+    here, and none should be inferred from this artifact. Confirming a provider
+    pin would require backend-side evidence this observer does not have.
+
+    Non-model markers
+    -----------------
+    Strings matching the CLI's angle-bracket placeholder shape (see
+    ``_is_non_model_marker``; ``<synthetic>`` is the known instance) are not
+    model identities and are excluded from the comparison tally. They are never
+    discarded: they remain in ``observed_child_model_ids_raw`` and are listed
+    separately in ``observed_non_model_markers``. If real model ids remain after
+    filtering and all of them match, the run is ``verified`` — positive
+    on-model evidence is not thrown away because a billing stub shared the
+    transcript. If nothing but markers was observed, the result is
+    ``unverifiable`` (no evidence either way), never ``failed``.
     """
+    # INTENT: compare against the declared wire identity, not the routing id.
+    # ASSUMES: callers that pass only two arguments have a model whose wire
+    #   identity equals its routing id (every bare-slug registry entry).
+    comparison_target_id = wire_model_id or requested_model_id
+
     paths = [Path(path) for path in transcript_paths]
     existing_paths = [path for path in paths if path.is_file()]
     observed_ids = []
@@ -382,23 +538,58 @@ def child_model_purity(
         except OSError:
             continue
 
+    # INTENT: partition raw observations into model identities vs. placeholders.
+    # REASONING: both partitions are reported. The raw list stays complete so a
+    #   reader can always reconstruct what the transcript actually contained;
+    #   only the comparison tally is narrowed.
+    non_model_markers = [
+        model_id for model_id in observed_ids if _is_non_model_marker(model_id)
+    ]
+    comparison_ids = [
+        model_id for model_id in observed_ids if not _is_non_model_marker(model_id)
+    ]
+
     if not existing_paths:
         purity_status = "unverifiable"
         incompleteness_reason = "no_child_transcript_exists"
     elif not observed_ids:
         purity_status = "unverifiable"
         incompleteness_reason = "child_transcripts_expose_no_model_id"
-    elif all(model_id == requested_model_id for model_id in observed_ids):
+    elif not comparison_ids:
+        # Only placeholders were observed: no model-identity evidence exists in
+        # either direction, so this is an absence of evidence (unverifiable),
+        # not evidence of an off-model child (failed). The validity gate treats
+        # unverifiable as valid, which is the correct outcome here.
+        purity_status = "unverifiable"
+        incompleteness_reason = (
+            "child_transcripts_expose_only_non_model_markers:"
+            + ",".join(non_model_markers)
+        )
+    elif all(model_id == comparison_target_id for model_id in comparison_ids):
+        # At least one real model id remains and every one of them matches.
+        # Markers, if any, are recorded but do not gate the run invalid.
         purity_status = "verified"
         incompleteness_reason = None
     else:
+        # A genuine mismatch among real model ids. The gate is unchanged.
         purity_status = "failed"
         incompleteness_reason = None
 
     return {
+        # The routing selector actually handed to `claude --model`.
         "requested_child_model_id": requested_model_id,
+        # The declared wire identity the observations were compared against.
+        # Equal to requested_child_model_id unless models.yaml declares wire_id.
+        "comparison_target_child_model_id": comparison_target_id,
+        "wire_id_declared": comparison_target_id != requested_model_id,
+        # Every distinct string observed, markers included — never pruned.
         "observed_child_model_ids_raw": observed_ids,
-        "comparison_child_model_ids": list(observed_ids),
+        # The subset actually compared (raw minus non-model markers).
+        "comparison_child_model_ids": comparison_ids,
+        "observed_non_model_markers": non_model_markers,
+        "non_model_marker_rule": "angle_bracketed_cli_placeholder_excluded_from_tally",
+        # Still truthfully False: no observed string is rewritten or collapsed.
+        # The expected wire form is declared per model, not derived.
         "normalization_applied": False,
         "comparison_rule": "exact_string_equality_no_alias_normalization",
         "purity_status": purity_status,
diff --git a/benchmarks/harness/executor.py b/benchmarks/harness/executor.py
index 6e413147..760b86a9 100644
--- a/benchmarks/harness/executor.py
+++ b/benchmarks/harness/executor.py
@@ -8,6 +8,7 @@
 import json
 import os
 import subprocess
+import threading
 import time
 import uuid
 from datetime import datetime, timezone
@@ -21,20 +22,29 @@
 )
 from benchmarks.harness.checkpoint_manager import prepare_sandbox, cleanup_sandbox
 from benchmarks.harness.cost_estimator import compute_accounting
+from benchmarks.scorers.deterministic.checkpoint_adherence import (
+    find_benchmark_transcript,
+)
+from benchmarks.scorers.deterministic.subagent_behavior import (
+    find_subagent_transcripts,
+)
+from benchmarks.scorers.deterministic.error_classification import (
+    classify_tool_failure_class,
+)
 
 
-# Timeout per cost tier (seconds)
-TIMEOUT_BY_TIER = {
-    "low": 120,      # 2 minutes for simple classification
-    "medium": 300,   # 5 minutes for multi-turn protocol tests
-    "high": 600,     # 10 minutes for code generation tests
-}
+# Uniform fallback timeout (seconds). Only fires if a caller passes
+# timeout_override=None explicitly; the phase runners always pass their
+# argparse default, so this is off the normal path. Set to match the runners'
+# uniform 900s logistical cap (2026-07-21 walltime redesign, replacing the
+# former per-cost-tier dict of 120/300/600).
+DEFAULT_TIMEOUT_S = 900
 
 # Grace window between SIGTERM and SIGKILL for timed-out runs (seconds).
-# Claude Code's main-session transcript writes are async/buffered; a hard
-# SIGKILL races the writer and can truncate the transcript tail (lost Agent
-# tool_use records — see README § 11 item 9). SIGTERM first gives the CLI a
-# chance to flush before the hard kill lands.
+# Observed timeout archives sometimes lack terminal parent-side evidence. As a
+# precaution, SIGTERM first gives the CLI an orderly shutdown interval before
+# escalation. This does not establish Claude Code's write internals or prove
+# that SIGKILL caused any particular missing transcript tail (README § 11).
 KILL_GRACE_SECONDS = 15
 
 
@@ -103,6 +113,10 @@ def execute_run(config: RunConfig) -> RunResult:
     # Explicitly set CLAUDE_CODE_EFFORT_LEVEL to match --effort flag so it
     # overrides the settings.json env value (which defaults to "high").
     env = os.environ.copy()
+    # Model configuration, not an unrelated parent shell, owns the flatten
+    # selector. Scrub ambient leakage first; an explicit per-model override below
+    # is intentionally re-applied by env.update().
+    env.pop("CLAUDE_CODE_SUBAGENT_MODEL", None)
     # Activates the benchmark-scoped git-blocking hook (block-git-writes.sh)
     # for this run and all subagent sessions it spawns; inert in normal sessions.
     env["DAAF_BENCHMARK_RUN"] = "1"
@@ -112,11 +126,11 @@ def execute_run(config: RunConfig) -> RunResult:
     if model.context_window_tokens is not None:
         env["CLAUDE_CODE_MAX_CONTEXT_TOKENS"] = str(model.context_window_tokens)
 
-    # Since 2026-07-10 the phase runners set per-phase --timeout defaults
-    # (120/180/300/300), so timeout_override is always truthy on the default
-    # path and the cost-tier fallback below only fires if a caller passes
-    # timeout_override=None explicitly.
-    timeout = config.timeout_override or TIMEOUT_BY_TIER.get(test_case.cost_tier, 300)
+    # Since 2026-07-21 the phase runners set a uniform --timeout default (900s
+    # logistical cap; formerly 120/180/300/300 per-phase), so timeout_override
+    # is always truthy on the default path and the uniform fallback below only
+    # fires if a caller passes timeout_override=None explicitly.
+    timeout = config.timeout_override or DEFAULT_TIMEOUT_S
 
     result = RunResult(
         test_case_id=test_case.id,
@@ -158,16 +172,65 @@ def execute_run(config: RunConfig) -> RunResult:
             env=env,
         )
 
+        # The session id is knowable pre-launch (golden checkpoint resume or the
+        # pre-assigned cold-start uuid), so the watchdog can locate the live
+        # parent/subagent transcripts while the run is still in flight.
+        watchdog_session_id = checkpoint_session_id or cold_start_session_id or ""
+
         timed_out = False
-        try:
-            stdout, stderr = proc.communicate(timeout=timeout)
-        except subprocess.TimeoutExpired:
-            # Graceful shutdown ladder: SIGTERM -> grace window -> SIGKILL.
-            stdout, stderr = _graceful_kill(proc)
-            timed_out = True
+        # Watchdog engages only when a caller opts in (stall detection and/or an
+        # early-stop callback). With neither, the path below is byte-identical to
+        # the pre-watchdog harness: a single blocking communicate() with the
+        # SIGTERM->grace->SIGKILL ladder on timeout.
+        watchdog_active = (
+            config.stall_detection or config.early_stop_check is not None
+        )
+        if not watchdog_active:
+            try:
+                stdout, stderr = proc.communicate(timeout=timeout)
+            except subprocess.TimeoutExpired:
+                # Graceful shutdown ladder: SIGTERM -> grace window -> SIGKILL.
+                stdout, stderr = _graceful_kill(proc)
+                timed_out = True
+        else:
+            stdout, stderr, reason, stall_diag = _watchdog_wait(
+                proc, config, watchdog_session_id, start_time, timeout
+            )
+            if reason == "timeout":
+                timed_out = True
+            elif reason == "early_stop":
+                result.early_stopped = True
+                # Comparable "time-to-demonstrated-compliance" duration: launch ->
+                # first early-stop-check pass of the confirmed episode, excluding
+                # the confirmation poll and kill tail (README § 8). May be None if
+                # the executor cannot attribute it (defensive).
+                result.score_complete_seconds = stall_diag.get(
+                    "score_complete_seconds"
+                )
+            elif reason == "stalled":
+                result.stalled = True
+                result.stall_diagnostics = stall_diag
 
         result.duration_seconds = time.time() - start_time
 
+        # Early-stop and stall are terminal, non-timeout outcomes. Scoring is
+        # done downstream from the live/archived transcript (not from stdout), so
+        # the known session id is all the runner needs. An early stop is
+        # score-neutral by construction (all monotone-pass criteria already
+        # settled), so we deliberately do NOT set result.error for it; a stall is
+        # a run-health failure and carries a distinct, non-"Timed out" message.
+        if result.early_stopped or result.stalled:
+            if not result.session_id:
+                result.session_id = watchdog_session_id
+            if result.stalled:
+                result.error = (
+                    f"Stalled: transcript inactive beyond "
+                    f"{config.stall_threshold_seconds}s across "
+                    f"{config.stall_consecutive_reads} consecutive watchdog polls"
+                )
+            _finalize_result(result, model, start_time)
+            return result
+
         if timed_out:
             # Try parsing partial stdout captured through the kill sequence
             # (everything the CLI emitted before SIGTERM plus anything it
@@ -226,20 +289,21 @@ def execute_run(config: RunConfig) -> RunResult:
 def _graceful_kill(proc: subprocess.Popen) -> tuple[str, str]:
     """Terminate a timed-out CLI process via a graceful shutdown ladder.
 
-    SIGTERM -> wait up to KILL_GRACE_SECONDS -> SIGKILL. The grace window
-    lets Claude Code flush its async/buffered main-session transcript writes
-    before dying (README § 11 item 9 — a hard SIGKILL truncates the
-    transcript tail, losing records like the Agent tool_use block).
+    SIGTERM -> wait up to KILL_GRACE_SECONDS -> SIGKILL. Observed timeout
+    archives sometimes lack terminal parent-side evidence, so the grace window
+    is a precaution that permits orderly CLI shutdown before escalation. It
+    does not establish the CLI's transcript-write internals or attribute any
+    particular missing tail to SIGKILL (README § 11).
 
     Uses communicate() rather than wait() for the grace wait: the CLI may
-    keep writing to stdout/stderr while flushing, and wait() with full pipes
+    keep writing to stdout/stderr during shutdown, and wait() with full pipes
     deadlocks. communicate() keeps draining the pipes, and per the subprocess
     docs a retried communicate() after TimeoutExpired loses no output.
 
     Returns (stdout, stderr) accumulated across the entire process lifetime,
     including anything emitted during the grace window.
     """
-    proc.terminate()  # SIGTERM — request shutdown, allow transcript flush
+    proc.terminate()  # SIGTERM — request orderly shutdown before escalation
     try:
         stdout, stderr = proc.communicate(timeout=KILL_GRACE_SECONDS)
     except subprocess.TimeoutExpired:
@@ -248,6 +312,242 @@ def _graceful_kill(proc: subprocess.Popen) -> tuple[str, str]:
     return stdout or "", stderr or ""
 
 
+def _transcript_recency(session_id, find_parent, find_subs):
+    """Aggregate the most-recent activity time across parent AND subagent
+    transcripts for a live run.
+
+    Returns (latest_mtime_or_None, parent_exists_bool, lookup_errors_int).
+    Staleness must aggregate max-recency across BOTH the parent and every
+    subagent transcript: a parent-only monitor false-alarms while the parent
+    blocks on long subagent work (validated in the K3 rerun campaign). File mtime
+    is used as the activity signal because the CLI appends records as it works, so
+    mtime advances with real progress; it is read defensively (a transcript may
+    not exist yet, or may vanish between the find and the stat).
+
+    A lookup FUNCTION raising (find_parent/find_subs) is distinct from a
+    transcript legitimately not existing yet: the former is a monitoring
+    regression that would silently masquerade as a model stall (no mtime -> looks
+    like dead air). Such exceptions are counted in ``lookup_errors`` and printed
+    as WARNINGs (parallel to the early-stop path's warning style) so the caller
+    can surface them in stall_diagnostics rather than misattributing them. The
+    stall DECISION logic is intentionally unchanged: a lookup error still yields
+    no mtime for this poll, exactly as a genuinely absent transcript does.
+    """
+    mtimes = []
+    parent_exists = False
+    lookup_errors = 0
+    try:
+        parent = find_parent(session_id)
+    except Exception as e:
+        parent = None
+        lookup_errors += 1
+        print(
+            f"WARNING: transcript parent lookup raised {type(e).__name__}: {e}; "
+            f"treating as no parent activity this poll (not a model stall)."
+        )
+    if parent is not None:
+        parent_exists = True
+        try:
+            mtimes.append(Path(parent).stat().st_mtime)
+        except OSError:
+            pass
+    try:
+        subs = find_subs(session_id)
+    except Exception as e:
+        subs = []
+        lookup_errors += 1
+        print(
+            f"WARNING: transcript subagent lookup raised {type(e).__name__}: {e}; "
+            f"treating as no subagent activity this poll (not a model stall)."
+        )
+    for sub in subs or []:
+        try:
+            mtimes.append(Path(sub).stat().st_mtime)
+        except OSError:
+            pass
+    latest = max(mtimes) if mtimes else None
+    return latest, parent_exists, lookup_errors
+
+
+def _graceful_kill_threaded(proc, reader_threads):
+    """SIGTERM -> grace -> SIGKILL for the watchdog path, then join the pipe
+    reader threads so all buffered stdout/stderr is collected.
+
+    The watchdog drains stdout/stderr via background reader threads (a naive wait
+    loop would deadlock once ``claude -p --output-format json`` fills the pipe
+    buffer, because that format emits its JSON only at exit). Those threads own
+    the pipe file objects, so this kill path must NOT call proc.communicate()
+    (which would race the readers); it waits on the process and then joins the
+    readers, which return when the pipes close on process death.
+    """
+    proc.terminate()  # SIGTERM
+    try:
+        proc.wait(timeout=KILL_GRACE_SECONDS)
+    except subprocess.TimeoutExpired:
+        proc.kill()  # SIGKILL — grace window expired
+        try:
+            proc.wait(timeout=KILL_GRACE_SECONDS)
+        except subprocess.TimeoutExpired:
+            pass
+    for t in reader_threads:
+        t.join(timeout=KILL_GRACE_SECONDS)
+
+
+def _watchdog_wait(
+    proc,
+    config,
+    session_id,
+    start_time,
+    timeout,
+    find_parent=find_benchmark_transcript,
+    find_subs=find_subagent_transcripts,
+    now_fn=time.time,
+):
+    """Poll a running ``claude -p`` process, draining stdout/stderr on background
+    reader threads, and terminate early on score-complete or stall.
+
+    Returns ``(stdout, stderr, reason, diagnostics)`` where ``reason`` is one of:
+      - ``None``  — the process exited on its own before any watchdog action.
+      - ``"timeout"``    — the 900s wall-clock backstop fired (unchanged policy).
+      - ``"early_stop"`` — ``early_stop_check`` returned True on two consecutive
+                           polls (an initial hit plus one confirmation poll that
+                           protects the subagent-transcript flush race).
+      - ``"stalled"``    — ``stall_consecutive_reads`` consecutive stalled
+                           readings (>``stall_threshold_seconds`` staleness, or
+                           no transcript at all past
+                           ``stall_first_activity_seconds``).
+
+    The lookup functions and clock are injectable so the decision logic can be
+    unit-tested against a synthetic subprocess (e.g. ``sleep``) and transcript
+    files with controlled mtimes, without launching the CLI.
+    """
+    stdout_box = []
+    stderr_box = []
+
+    def _drain(pipe, box):
+        try:
+            box.append(pipe.read())
+        except Exception:
+            box.append("")
+
+    reader_threads = [
+        threading.Thread(target=_drain, args=(proc.stdout, stdout_box), daemon=True),
+        threading.Thread(target=_drain, args=(proc.stderr, stderr_box), daemon=True),
+    ]
+    for t in reader_threads:
+        t.start()
+
+    poll = config.watchdog_poll_seconds or 60
+    deadline = start_time + timeout
+    early_stop_pending = False  # True after an initial hit, awaiting confirmation
+    # Elapsed wall time (launch -> the poll at which early_stop_check first
+    # returned True for the episode that ultimately confirms). This is a
+    # "time-to-demonstrated-compliance" measure: it deliberately EXCLUDES the
+    # confirmation poll and the SIGTERM/SIGKILL tail, so the viewer can use it as
+    # a comparable duration contribution for completed_early runs (README § 8).
+    # Reset alongside early_stop_pending on an intermittent False so it always
+    # reflects the first hit of the winning episode.
+    score_complete_at = None
+    stall_reads = 0
+    lookup_errors_total = 0
+    poll_history = []
+    reason = None
+
+    while True:
+        try:
+            proc.wait(timeout=poll)
+            reason = None  # exited on its own
+            break
+        except subprocess.TimeoutExpired:
+            pass
+
+        now = now_fn()
+
+        # Wall-clock backstop is unchanged: the 900s cap still governs.
+        if now >= deadline:
+            reason = "timeout"
+            break
+
+        # --- Score-complete early stop (with confirmation poll) ---
+        if config.early_stop_check is not None:
+            try:
+                done = bool(config.early_stop_check(session_id))
+            except Exception as e:
+                # Never kill on a scorer crash — treat as "not done" but log it.
+                done = False
+                print(
+                    f"WARNING: early_stop_check raised {type(e).__name__}: {e}; "
+                    f"not early-stopping this poll."
+                )
+            if done:
+                if early_stop_pending:
+                    reason = "early_stop"
+                    break
+                # First hit: require one more confirming poll before killing.
+                # This also gives the subagent-transcript flush a poll-width
+                # grace so the dispatch-recovery fallback has records on disk.
+                early_stop_pending = True
+                score_complete_at = now - start_time
+            else:
+                early_stop_pending = False
+                score_complete_at = None
+
+        # --- Stall detection ---
+        if config.stall_detection:
+            latest, parent_exists, lookup_errors = _transcript_recency(
+                session_id, find_parent, find_subs
+            )
+            lookup_errors_total += lookup_errors
+            elapsed = now - start_time
+            if latest is None:
+                # No parent OR subagent transcript activity exists at all yet.
+                staleness = elapsed
+                is_stalled_read = elapsed > config.stall_first_activity_seconds
+            else:
+                staleness = now - latest
+                is_stalled_read = staleness > config.stall_threshold_seconds
+            poll_history.append(round(staleness, 1))
+            if is_stalled_read:
+                stall_reads += 1
+                if stall_reads >= config.stall_consecutive_reads:
+                    reason = "stalled"
+                    break
+            else:
+                stall_reads = 0
+
+    if reason is not None:
+        _graceful_kill_threaded(proc, reader_threads)
+    else:
+        for t in reader_threads:
+            t.join()
+
+    stdout = stdout_box[0] if stdout_box else ""
+    stderr = stderr_box[0] if stderr_box else ""
+    # The reader threads own the pipe file objects and have now joined (either via
+    # _graceful_kill_threaded or the plain join above), so no reader can race a
+    # close here. Explicitly close the pipes to release the fds promptly rather
+    # than leaning on GC/finalizer timing.
+    for pipe in (proc.stdout, proc.stderr):
+        try:
+            if pipe is not None:
+                pipe.close()
+        except Exception:
+            pass
+    diagnostics = {
+        "reason": reason,
+        "stall_reads": stall_reads,
+        "staleness_poll_history": poll_history,
+        "stall_threshold_seconds": config.stall_threshold_seconds,
+        "stall_consecutive_reads": config.stall_consecutive_reads,
+        # Count of transcript-lookup-function exceptions across all polls. >0
+        # signals a monitoring regression (not a model stall) worth investigating.
+        "lookup_errors": lookup_errors_total,
+        # Time-to-demonstrated-compliance for an early stop (None otherwise).
+        "score_complete_seconds": score_complete_at,
+    }
+    return stdout or "", stderr or "", reason, diagnostics
+
+
 def _parse_json_output(stdout_raw: str, result: RunResult) -> None:
     """Parse claude -p JSON output into a RunResult.
 
@@ -518,10 +818,22 @@ def _extract_tool_failures(result: RunResult) -> None:
                 continue
 
             tool_use_id = block.get("tool_use_id", "")
+            content = _extract_tool_content(block.get("content", ""))
+            # C4 (additive): tag each failure with a finer operational cause.
+            # The configured child model id is the run's routing selector, which
+            # the lane-refusal branch compares against the rejected id named in
+            # the error string. It is reachable here on the result identity, so
+            # no invasive plumbing is needed.
+            configured_child_model_id = getattr(
+                result.model_identity, "requested_model_id", None
+            )
             result.tool_failures.append({
                 "tool_use_id": tool_use_id,
                 "tool_name": tool_names.get(tool_use_id, "unknown"),
-                "content": _extract_tool_content(block.get("content", "")),
+                "content": content,
+                "tool_failure_class": classify_tool_failure_class(
+                    content, configured_child_model_id
+                ),
             })
 
 
diff --git a/benchmarks/harness/models.py b/benchmarks/harness/models.py
index 7070373d..385b51d0 100644
--- a/benchmarks/harness/models.py
+++ b/benchmarks/harness/models.py
@@ -5,7 +5,7 @@
 """
 
 from dataclasses import asdict, dataclass, field
-from typing import Optional
+from typing import Callable, Optional
 import json
 from pathlib import Path
 
@@ -90,6 +90,24 @@ class ModelConfig:
     selectable keys. ``context_window_tokens`` is route metadata and is applied
     to the child process by the executor; it is deliberately not encoded in the
     wire model identifier.
+
+    ``id`` vs. ``wire_id`` are two different things and must not be conflated:
+
+    - ``id`` is the ROUTING SELECTOR. It is passed verbatim to ``claude
+      --model`` (executor.py) and to the ``ANTHROPIC_DEFAULT_*`` /
+      ``CLAUDE_CODE_SUBAGENT_MODEL`` env overrides. For OpenRouter entries it
+      may carry a ``:provider/quant`` pin (e.g.
+      ``deepseek/deepseek-v4-flash:atlas-cloud/fp8``) that pins which backend
+      and quantization serves the request. Stripping it would silently unpin
+      routing and invalidate price tables reconciled against that provider.
+    - ``wire_id`` is the WIRE IDENTITY: the model id that model is expected to
+      report back on assistant records (``message.model``) in a transcript.
+      Observed wire forms carry no provider/quant suffix, so for pinned entries
+      the wire id is the bare slug. It is used ONLY as the comparison target for
+      child-model purity (artifacts.child_model_purity) and never for routing.
+
+    ``wire_id`` is optional and defaults to ``id`` via ``comparison_model_id``,
+    so every bare-slug entry keeps its pre-existing behavior untouched.
     """
 
     id: str
@@ -107,6 +125,19 @@ class ModelConfig:
     context_window_tokens: Optional[int] = None
     actual_billing_treatment: Optional[str] = None
     api_equivalent_pricing: dict = field(default_factory=dict)
+    # INTENT: declare, per model, the identity that model reports on the wire.
+    # REASONING: the routing selector (`id`) and the wire identity can differ
+    #   (provider/quant pins are routing-only). Declaring the expected wire form
+    #   per model avoids inventing a derived canonicalization rule (e.g.
+    #   split(":")) that the backend has never confirmed.
+    # ASSUMES: absent means "wire identity equals routing id" — true for every
+    #   bare-slug registry entry.
+    wire_id: Optional[str] = None
+
+    @property
+    def comparison_model_id(self) -> str:
+        """The id a child transcript is expected to report; defaults to ``id``."""
+        return self.wire_id or self.id
 
     @classmethod
     def from_dict(cls, data: dict) -> "ModelConfig":
@@ -138,6 +169,34 @@ class RunConfig:
     # Default True preserves the original behavior for all other runners.
     wipe_sandbox: bool = True
     timeout_override: Optional[int] = None
+    # --- Run-lifecycle watchdog controls (Dispatch B) ---
+    # All optional with backward-compatible defaults: when stall_detection is
+    # False AND early_stop_check is None (the constructor defaults), execute_run()
+    # takes the original single blocking communicate(timeout=timeout) path, so
+    # behavior is byte-identical to the pre-watchdog harness for any caller that
+    # sets none of these fields. The phase runners opt in explicitly.
+    #
+    # early_stop_check: callable (session_id) -> bool. Polled every
+    #   watchdog_poll_seconds; when it returns True the executor does ONE
+    #   confirmation poll on the next tick and, if still True, gracefully kills
+    #   the run and marks result.early_stopped. Must be exception-safe (the
+    #   runner-side closure catches its own errors and returns False); the
+    #   executor additionally guards against exceptions. None disables early stop.
+    early_stop_check: Optional[Callable[[str], bool]] = None
+    watchdog_poll_seconds: int = 60
+    # stall_detection: enable the hung-run detector (transcript-recency based).
+    stall_detection: bool = False
+    # A single staleness reading over this many seconds counts as one stalled
+    # read (330s validated in the K3 rerun campaign: 296s of LEGITIMATE dead air
+    # was observed on a run that then passed everything, so 240s false-positives).
+    stall_threshold_seconds: int = 330
+    # If NO parent-or-subagent transcript activity exists at all by this elapsed
+    # time, count a stalled read (first-activity rule).
+    stall_first_activity_seconds: int = 90
+    # Number of consecutive stalled reads required before killing as stalled.
+    # At the 60s poll spacing, 2 reads add ~120s of confirmation on top of the
+    # 330s staleness cutoff — never act on a single stalled reading.
+    stall_consecutive_reads: int = 2
 
 
 @dataclass
@@ -156,6 +215,15 @@ class RouteProvenance:
     reasoning_effort: Optional[str] = None
     text_verbosity: Optional[str] = None
     captured_at: Optional[str] = None
+    # Appended fields preserve the historical positional constructor surface.
+    # These describe requested policy only; no terminal served-tier observation is
+    # stored here because the shim health terminal is process-global history.
+    gpt_requested_tier_vocabulary: Optional[str] = None
+    gpt_policy_status: Optional[str] = None
+    gpt_policy_backend_mode: Optional[str] = None
+    gpt_policy_enabled: Optional[bool] = None
+    gpt_policy_effective: Optional[bool] = None
+    native_fast_disabled: Optional[bool] = None
 
 
 @dataclass
@@ -261,6 +329,21 @@ class RunResult:
     actual_billing: ActualBilling = field(default_factory=ActualBilling)
     api_equivalent: ApiEquivalentAccounting = field(default_factory=ApiEquivalentAccounting)
     subscription_capacity: SubscriptionCapacity = field(default_factory=SubscriptionCapacity)
+    # --- Run-lifecycle watchdog outcomes (Dispatch B) ---
+    # Set by execute_run()'s watchdog. early_stopped and stalled are mutually
+    # exclusive with each other and with the timeout path. stall_diagnostics
+    # carries the staleness poll history and read count for post-hoc anatomy.
+    early_stopped: bool = False
+    stalled: bool = False
+    stall_diagnostics: dict = field(default_factory=dict)
+    # Time-to-demonstrated-compliance for an early-stopped run (seconds): elapsed
+    # wall time from launch to the poll at which the score-complete check first
+    # passed for the confirmed episode, EXCLUDING the confirmation poll and the
+    # SIGTERM/SIGKILL tail. None for every non-early-stop outcome. The viewer uses
+    # it as the duration contribution for completed_early runs (README § 8) so the
+    # duration axis stays populated with a meaningful measure instead of dropping
+    # early-stopped runs.
+    score_complete_seconds: Optional[float] = None
 
     def to_dict(self) -> dict:
         return {
@@ -294,6 +377,10 @@ def to_dict(self) -> dict:
             "tool_failures": self.tool_failures,
             "error": self.error,
             "exit_code": self.exit_code,
+            "early_stopped": self.early_stopped,
+            "stalled": self.stalled,
+            "stall_diagnostics": self.stall_diagnostics,
+            "score_complete_seconds": self.score_complete_seconds,
         }
 
 
diff --git a/benchmarks/harness/route_provenance.py b/benchmarks/harness/route_provenance.py
index 22697b33..de9a31f7 100644
--- a/benchmarks/harness/route_provenance.py
+++ b/benchmarks/harness/route_provenance.py
@@ -16,15 +16,37 @@
 from typing import Callable, Iterable, Mapping, Optional
 from urllib.error import HTTPError, URLError
 from urllib.parse import urlsplit
-from urllib.request import urlopen
+from urllib.request import HTTPRedirectHandler, ProxyHandler, Request, build_opener
 
 from benchmarks.harness.models import ModelConfig, RouteProvenance
 
 
 DEFAULT_SHIM_PORT = 4141
+HEALTH_BODY_LIMIT = 16_384
 CHATGPT_PROVIDER = "chatgpt-subscription"
 EXPECTED_CODEX_BACKEND = "https://chatgpt.com/backend-api/codex"
+EXPECTED_SHIM_SERVICE = "daaf-anthropic-openai-shim"
 LOCAL_AUTH_PLACEHOLDER = "daaf-shim-local"
+GPT_REQUEST_TIERS = {"chatgpt": "priority", "openai": "priority"}
+GPT_POLICY_STATUSES = frozenset({"ok", "missing", "invalid", "unreadable", "unsafe"})
+GPT_REQUEST_SOURCES = frozenset({"none", "anthropic", "shim_global", "both"})
+GPT_SERVED_TIERS = frozenset({"fast", "priority", "default", "flex", "scale", "auto"})
+GPT_UTC_SECOND_RE = re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z")
+GPT_SERVICE_TIER_KEYS = frozenset({
+    "backend_mode",
+    "requested_tier_vocabulary",
+    "policy",
+    "native_fast_disabled",
+    "latest_terminal",
+})
+GPT_POLICY_KEYS = frozenset({"status", "backend_mode", "enabled", "effective"})
+GPT_LATEST_TERMINAL_KEYS = frozenset({
+    "model",
+    "requested_service_tier",
+    "requested_source",
+    "served_service_tier",
+    "completed_at",
+})
 # Deliberately explicit rather than derived from the dataclass: adding an
 # internal field must not silently widen the serialization boundary.
 PROVENANCE_ALLOWLIST = frozenset({
@@ -40,6 +62,12 @@
     "reasoning_effort",
     "text_verbosity",
     "captured_at",
+    "gpt_requested_tier_vocabulary",
+    "gpt_policy_status",
+    "gpt_policy_backend_mode",
+    "gpt_policy_enabled",
+    "gpt_policy_effective",
+    "native_fast_disabled",
 })
 
 
@@ -47,6 +75,32 @@ class RouteContractError(RuntimeError):
     """Raised when the declared ChatGPT-subscription route is not coherent."""
 
 
+class _DuplicateHealthKeyError(ValueError):
+    pass
+
+
+class _RejectRedirects(HTTPRedirectHandler):
+    """Turn loopback redirects into HTTP errors instead of following them."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def _default_health_opener(url: str, *, timeout: float):
+    request = Request(url, method="GET")
+    opener = build_opener(ProxyHandler({}), _RejectRedirects())
+    return opener.open(request, timeout=timeout)
+
+
+def _reject_duplicate_health_keys(pairs: list[tuple[str, object]]) -> dict:
+    value = {}
+    for key, item in pairs:
+        if key in value:
+            raise _DuplicateHealthKeyError(key)
+        value[key] = item
+    return value
+
+
 def _canonical_port(raw_port: object) -> int:
     try:
         port = int(str(raw_port))
@@ -122,10 +176,17 @@ def validate_ambient_route(
     env = os.environ if environ is None else environ
     canonical = canonicalize_local_endpoint(endpoint=endpoint, environ=env)
 
-    if (env.get("DAAF_PROVIDER_SHIM") or "").strip().lower() != "openai":
-        raise RouteContractError("DAAF_PROVIDER_SHIM must equal 'openai'")
-    if (env.get("SHIM_BACKEND_MODE") or "").strip().lower() != "chatgpt":
-        raise RouteContractError("SHIM_BACKEND_MODE must equal 'chatgpt'")
+    # This is the benchmark/provider execution boundary, not a user-input parser.
+    # Exact ambient controls are required so case, whitespace, or an omitted backend
+    # cannot be normalized into a privileged GPT provider-shim route.
+    if env.get("DAAF_PROVIDER_SHIM") != "openai":
+        raise RouteContractError("DAAF_PROVIDER_SHIM must be exactly 'openai'")
+    if env.get("SHIM_BACKEND_MODE") != "chatgpt":
+        raise RouteContractError("SHIM_BACKEND_MODE must be exactly 'chatgpt'")
+    if env.get("CLAUDE_CODE_DISABLE_FAST_MODE") != "1":
+        raise RouteContractError(
+            "CLAUDE_CODE_DISABLE_FAST_MODE must be exactly '1' for GPT provider-shim benchmarking"
+        )
 
     ambient_base = env.get("ANTHROPIC_BASE_URL")
     if ambient_base:
@@ -146,18 +207,158 @@ def _read_health_response(response) -> dict:
         status = response.getcode()
     if status is not None and status != 200:
         raise RouteContractError(f"Shim /health returned HTTP {status}")
-    body = response.read().decode("utf-8", "replace")
+    raw = response.read(HEALTH_BODY_LIMIT + 1)
+    if len(raw) > HEALTH_BODY_LIMIT:
+        raise RouteContractError("Shim /health response exceeded the 16 KiB limit")
+    body = raw.decode("utf-8", "replace")
     try:
-        payload = json.loads(body)
-    except json.JSONDecodeError as exc:
+        payload = json.loads(body, object_pairs_hook=_reject_duplicate_health_keys)
+    except (json.JSONDecodeError, _DuplicateHealthKeyError) as exc:
         raise RouteContractError("Shim /health returned invalid JSON") from exc
     if not isinstance(payload, dict):
         raise RouteContractError("Shim /health JSON must be an object")
     return payload
 
 
+def _bounded_terminal_model(value: object) -> bool:
+    return (
+        isinstance(value, str)
+        and re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}", value) is not None
+    )
+
+
+def _canonical_utc_second(value: object) -> bool:
+    if not isinstance(value, str) or GPT_UTC_SECOND_RE.fullmatch(value) is None:
+        return False
+    try:
+        datetime.strptime(value, "%Y-%m-%dT%H:%M:%SZ")
+    except (OverflowError, ValueError):
+        return False
+    return True
+
+
+def _validate_latest_terminal(value: object, backend: str) -> None:
+    if not isinstance(value, dict) or set(value) != GPT_LATEST_TERMINAL_KEYS:
+        raise RouteContractError(
+            "Shim /health latest_terminal must have the exact v1.3.9 key set"
+        )
+    model = value.get("model")
+    if model is not None and not _bounded_terminal_model(model):
+        raise RouteContractError("Shim /health latest_terminal model is invalid")
+    requested = value.get("requested_service_tier")
+    source = value.get("requested_source")
+    served = value.get("served_service_tier")
+    if requested is not None and requested != GPT_REQUEST_TIERS[backend]:
+        raise RouteContractError(
+            "Shim /health latest_terminal requested tier is invalid for the route"
+        )
+    if type(source) is not str or source not in GPT_REQUEST_SOURCES:
+        raise RouteContractError(
+            "Shim /health latest_terminal requested source is invalid"
+        )
+    if (source == "none") is not (requested is None):
+        raise RouteContractError(
+            "Shim /health latest_terminal requested source and tier are incoherent"
+        )
+    if served is not None and (
+        type(served) is not str or served not in GPT_SERVED_TIERS
+    ):
+        raise RouteContractError("Shim /health latest_terminal served tier is invalid")
+    if not _canonical_utc_second(value.get("completed_at")):
+        raise RouteContractError(
+            "Shim /health latest_terminal completion time is invalid"
+        )
+
+
+def _validate_gpt_service_tier_block(
+    block: object,
+    expected_backend_mode: str,
+) -> dict[str, object]:
+    """Validate the exact v1.3.9 tier block and return its safe projection.
+
+    ``latest_terminal`` is validated because malformed shim-global history makes
+    the health contract untrustworthy, but it is intentionally not returned. A
+    prior process-global terminal cannot establish what served a benchmark run.
+    """
+    if expected_backend_mode not in GPT_REQUEST_TIERS:
+        raise RouteContractError("Unsupported GPT service-tier backend mode")
+    if not isinstance(block, dict) or set(block) != GPT_SERVICE_TIER_KEYS:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier must have the exact v1.3.9 key set"
+        )
+
+    backend_mode = block.get("backend_mode")
+    if backend_mode != expected_backend_mode:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier backend_mode must match the route"
+        )
+    requested_vocabulary = block.get("requested_tier_vocabulary")
+    if requested_vocabulary != GPT_REQUEST_TIERS[expected_backend_mode]:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier requested vocabulary is invalid for the route"
+        )
+    native_fast_disabled = block.get("native_fast_disabled")
+    if native_fast_disabled is not True:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier native_fast_disabled must be JSON boolean true"
+        )
+
+    policy = block.get("policy")
+    if not isinstance(policy, dict) or set(policy) != GPT_POLICY_KEYS:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier policy must have the exact v1.3.9 key set"
+        )
+    policy_status = policy.get("status")
+    policy_backend = policy.get("backend_mode")
+    policy_enabled = policy.get("enabled")
+    policy_effective = policy.get("effective")
+    if type(policy_status) is not str or policy_status not in GPT_POLICY_STATUSES:
+        raise RouteContractError("Shim /health gpt_service_tier policy status is invalid")
+    if policy_backend is not None and (
+        type(policy_backend) is not str
+        or policy_backend not in GPT_REQUEST_TIERS
+    ):
+        raise RouteContractError("Shim /health gpt_service_tier policy backend is invalid")
+    if type(policy_enabled) is not bool or type(policy_effective) is not bool:
+        raise RouteContractError(
+            "Shim /health gpt_service_tier policy flags must be booleans"
+        )
+    if policy_status != "ok":
+        if policy_backend is not None or policy_enabled or policy_effective:
+            raise RouteContractError(
+                "Shim /health non-ok GPT tier policy must fail safely off"
+            )
+    else:
+        if policy_backend is None:
+            raise RouteContractError(
+                "Shim /health ok GPT tier policy must name its bound backend"
+            )
+        expected_effective = bool(
+            policy_enabled and policy_backend == expected_backend_mode
+        )
+        if policy_effective is not expected_effective:
+            raise RouteContractError(
+                "Shim /health GPT tier policy effective flag is incoherent"
+            )
+
+    latest = block.get("latest_terminal")
+    if latest is not None:
+        _validate_latest_terminal(latest, expected_backend_mode)
+
+    return {
+        "gpt_requested_tier_vocabulary": requested_vocabulary,
+        "gpt_policy_status": policy_status,
+        "gpt_policy_backend_mode": policy_backend,
+        "gpt_policy_enabled": policy_enabled,
+        "gpt_policy_effective": policy_effective,
+        "native_fast_disabled": native_fast_disabled,
+    }
+
+
 def _validate_health_payload(health: Mapping[str, object], endpoint: str) -> RouteProvenance:
     problems = []
+    if health.get("service") != EXPECTED_SHIM_SERVICE:
+        problems.append(f"service must equal '{EXPECTED_SHIM_SERVICE}'")
     if health.get("status") != "ok":
         problems.append("status must equal 'ok'")
     if health.get("backend_mode") != "chatgpt":
@@ -179,6 +380,9 @@ def _validate_health_payload(health: Mapping[str, object], endpoint: str) -> Rou
     if problems:
         raise RouteContractError("Shim /health contract failed: " + "; ".join(problems))
 
+    tier_provenance = _validate_gpt_service_tier_block(
+        health.get("gpt_service_tier"), "chatgpt"
+    )
     reasoning = health.get("reasoning_effort")
     if reasoning not in {"none", "minimal", "low", "medium", "high", "xhigh", "max"}:
         reasoning = None
@@ -198,6 +402,7 @@ def _validate_health_payload(health: Mapping[str, object], endpoint: str) -> Rou
         reasoning_effort=reasoning if isinstance(reasoning, str) else None,
         text_verbosity=verbosity if isinstance(verbosity, str) else None,
         captured_at=datetime.now(timezone.utc).isoformat(),
+        **tier_provenance,
     )
 
 
@@ -209,7 +414,7 @@ def fetch_route_provenance(
     """Validate ambient state and live health, returning allowlisted provenance."""
     endpoint = validate_ambient_route(environ=environ)
     health_url = endpoint + "/health"
-    network_opener = opener or urlopen
+    network_opener = opener or _default_health_opener
     try:
         response = network_opener(health_url, timeout=timeout)
         if hasattr(response, "__enter__"):
diff --git a/benchmarks/scorers/deterministic/dispatch_compliance.py b/benchmarks/scorers/deterministic/dispatch_compliance.py
index 58eede87..ab1b35c9 100644
--- a/benchmarks/scorers/deterministic/dispatch_compliance.py
+++ b/benchmarks/scorers/deterministic/dispatch_compliance.py
@@ -13,12 +13,39 @@
   - prompt_has_base_dir (tier2): Agent prompt contains "BASE_DIR"
   - prompt_has_mode_marker (tier2): Agent prompt contains "Ad Hoc" (case-insensitive)
   - prompt_has_project_dir (tier2): Agent prompt contains "PROJECT_DIR"
-  - prompt_has_task_section (tier2): Agent prompt contains "## Task"
-  - prompt_has_context_section (tier2): Agent prompt contains "## Context"
-  - prompt_has_instructions (tier2): Agent prompt contains "## Instructions"
+  - prompt_has_task_section (tier2): Agent prompt has a heading expressing the
+    TASK concept (structural, not a canonical "## Task" label)
+  - prompt_has_context_section (tier2): Agent prompt has a heading expressing a
+    CONTEXT concept (context/scope/background/dataset/symptom/... — structural)
+  - prompt_has_instructions (tier2): Agent prompt has a heading expressing an
+    INSTRUCTIONS concept (instruction/output/deliverable/return/... — structural)
+
+Section-heading matching (criteria 6-8) is STRUCTURAL, not label-canonical: it
+extracts markdown/bold section headings, normalizes them (strip #/whitespace,
+casefold), and passes when any heading expresses the relevant concept keyword.
+Framework guidance (ad-hoc-collaboration-mode.md) calls the dispatch-prompt
+structure "a skeleton, not a rigid template"; case-sensitive exact-label
+matching penalized legitimate synonyms ("## Output format" with a lowercase f,
+"## Return format", "## Review expectations", "## Output requirements", ...)
+and inflated a spurious cross-model gap. The keyword sets are a strict WIDENING
+of the legacy accepted-label lists — every prompt that passed under the old
+exact-match lists still passes (asserted by unit tests) — plus observed
+synonyms.
   - prompt_contains_required (tier2): All expected strings appear in Agent prompt
   - prompt_contains_any (tier2): At least one of the optional strings appears
 
+Dispatch-attempt gate (2026-07-29): the eight prompt_* criteria above all
+evaluate the CONTENT of a dispatch prompt, so they are only evaluable when a
+dispatch was ATTEMPTED. When the run has NO Agent call at all — none recorded
+(succeeded or failed) and none recovered from subagent transcripts — every
+prompt_* criterion FAILS with detail "No Agent dispatch attempt; prompt criteria
+not evaluable." This closes the vacuous-pass hole where prompt_has_project_dir
+(read-only), the 0-required prompt_contains_required, and the unspecified
+prompt_contains_any auto-passed on a zero-dispatch run. A recorded FAILED Agent
+call is still an attempt (its prompt is real), so its prompt_* criteria are
+evaluated under their normal semantics; the gate fires only on total absence.
+The two tier1 criteria are unaffected.
+
 Dispatch-recovery fallback (2026-06-11): the harness runs ``claude -p`` under
 ``subprocess.run(timeout=...)``, which SIGKILLs on timeout. Claude Code's
 main-session transcript writes are async/buffered, so a timed-out run can lose
@@ -42,6 +69,7 @@
 """
 
 import json
+import re
 from pathlib import Path
 
 from benchmarks.harness.models import CriterionResult
@@ -50,6 +78,93 @@
 )
 
 
+# --- Structural section-heading matching (Fix 1, 2026-07-28) ---
+# ATX markdown heading: up to 3 leading spaces, 1-4 '#', a space, then text
+# (optional trailing '#'s stripped). Bold-label heading: a line that is only
+# **Label** with an optional trailing colon. Both are normalized to their
+# casefolded inner text for concept-keyword matching.
+_HEADING_RE = re.compile(r"^\s{0,3}#{1,4}\s+(.+?)\s*#*\s*$")
+_BOLD_LABEL_RE = re.compile(r"^\s*\*\*(.+?)\*\*\s*:?\s*$")
+
+# Concept keyword sets. Each is a strict WIDENING of the legacy accepted-label
+# lists (so every legacy-passing prompt still passes) plus archived-observed
+# synonyms. TASK matches on a word boundary; CONTEXT/INSTRUCTIONS match as
+# substrings of the normalized heading text.
+# "request" added 2026-07-28: the GPT diagnostic cited "## User Request" as a
+# near-miss that failed the task check under the "task"-only set. It matches on a
+# LEFT word boundary just like "task", so "request", "user request", and
+# "requests" all pass while an embedding like "prerequest" does not.
+TASK_KEYWORDS = ("task", "request")
+CONTEXT_KEYWORDS = (
+    "context", "scope", "background", "specification", "dataset",
+    "symptom", "boundary", "known", "what to search",
+)
+INSTRUCTION_KEYWORDS = (
+    "instruction", "output", "deliverable", "return", "expected",
+    "report", "what to look", "what to report", "where to look",
+    "validation requirement", "requirement", "expectation",
+)
+
+# Legacy exact-label lists (the pre-2026-07-28 matcher). Retained ONLY to
+# guarantee the strict-widening property by construction: criteria 6-8 pass on
+# (structural concept match) OR (any legacy label present as a substring). The
+# OR with the legacy substring check means every prompt that passed under the
+# old matcher — including edge cases where a label appeared somewhere other
+# than a line-start heading — still passes, while the structural matcher adds
+# the observed synonyms. Without this OR, moving from substring-anywhere to
+# heading-position matching would narrow the position axis and could regress a
+# small number of archived passes (verified: 1 such case in the archives).
+LEGACY_TASK_LABEL = "## Task"
+LEGACY_CONTEXT_HEADERS = (
+    "## Context", "## Scope", "## Background", "## Specifications",
+    "## Dataset Specifications", "## Known Symptoms", "## What to Search",
+)
+LEGACY_INSTRUCTION_HEADERS = (
+    "## Instructions", "## What to Report", "## What to Look For",
+    "## Where to Look", "## Validation Requirements", "## Output Format",
+    "## Expected Output", "## Deliverables",
+)
+
+
+def extract_normalized_headings(text: str) -> list[str]:
+    """Return casefolded heading texts from a dispatch prompt.
+
+    Recognizes ATX markdown headings (``#``..``####``) and trivial bold-label
+    section headers (``**Section**`` with an optional trailing colon on their
+    own line). Each returned string is stripped and casefolded for
+    concept-keyword matching.
+    """
+    headings = []
+    for line in text.splitlines():
+        m = _HEADING_RE.match(line)
+        if not m:
+            m = _BOLD_LABEL_RE.match(line)
+        if m:
+            headings.append(m.group(1).strip().casefold())
+    return headings
+
+
+def match_section_heading(headings, keywords, word_boundary=False):
+    """Return the first heading expressing any concept keyword, else None.
+
+    ``word_boundary`` anchors the keyword at a LEFT word boundary (used for
+    TASK): "task", "tasks", "task description", and "your task" all match,
+    while an unrelated embedding like "multitask" does not (the keyword is not
+    at a word boundary there). A trailing boundary is deliberately NOT required
+    so morphological suffixes (the plural "tasks") still pass. Without
+    ``word_boundary`` the keyword must appear as a plain substring of the
+    normalized heading text.
+    """
+    for h in headings:
+        for kw in keywords:
+            if word_boundary:
+                if re.search(r"\b" + re.escape(kw), h):
+                    return h
+            elif kw in h:
+                return h
+    return None
+
+
 def extract_agent_calls(tool_calls: list[dict]) -> list[dict]:
     """Extract Agent tool calls and parse their input fields.
 
@@ -304,6 +419,51 @@ def score_dispatch_compliance(
         detail=type_detail,
     ))
 
+    # --- Gate: prompt criteria require a dispatch ATTEMPT (2026-07-29) ---
+    # Every criterion below (3-10) is the prompt_* family — it evaluates the
+    # CONTENT of a dispatch prompt. With NO Agent dispatch attempt at all there is
+    # no prompt to evaluate, yet three of them auto-passed on vacuous truth:
+    # prompt_has_project_dir (read-only agents: "not required"), the 0-required
+    # prompt_contains_required ("all 0 found"), and the unspecified
+    # prompt_contains_any ("auto-pass"). A zero-dispatch run therefore banked
+    # tier2 points it never earned (observed: 2 GPT-5.6 Sol dc-06 runs scored
+    # 3/10 with zero Agent calls). The gate keys on ATTEMPT existence, NOT
+    # success: a RECORDED failed Agent call (is_error) counts as a real dispatch
+    # ATTEMPT, so the gate does not fire. Its prompt CONTENT is not inspected by
+    # the prompt criteria, though: prompt_source below (L462) draws only from
+    # SUCCESSFUL/recovered calls, so for a FAILED-ONLY run all_prompts is empty
+    # and the same three checks that auto-passed on a zero-dispatch run
+    # (prompt_has_project_dir for read-only agents, the 0-required
+    # prompt_contains_required, and the unspecified prompt_contains_any) still
+    # pass vacuously. This residual failed-only vacuous-pass is a known, accepted
+    # bound of the gate — the gate closes the total-absence hole, not the
+    # attempted-but-failed one. A recovered call, by contrast, DOES carry an
+    # inspectable prompt (reconstructed from the subagent transcript). Only the
+    # total absence of any Agent call — none recorded, none recovered — makes the
+    # prompt criteria non-evaluable, in which case all eight FAIL uniformly.
+    # tier1 criteria (agent_dispatched, correct_subagent_type) are untouched:
+    # they are already correct for the zero-dispatch case.
+    PROMPT_CRITERIA = (
+        "prompt_has_base_dir",
+        "prompt_has_mode_marker",
+        "prompt_has_project_dir",
+        "prompt_has_task_section",
+        "prompt_has_context_section",
+        "prompt_has_instructions",
+        "prompt_contains_required",
+        "prompt_contains_any",
+    )
+    dispatch_attempted = bool(agent_calls) or bool(recovered_calls)
+    if not dispatch_attempted:
+        for name in PROMPT_CRITERIA:
+            results.append(CriterionResult(
+                name=name,
+                passed=False,
+                tier="tier2",
+                detail="No Agent dispatch attempt; prompt criteria not evaluable.",
+            ))
+        return results
+
     # For prompt-level criteria, examine prompts from SUCCESSFUL Agent calls
     # that match the expected subagent_type. If none match, fall back to all
     # successful calls so we still report what was found.
@@ -366,69 +526,74 @@ def score_dispatch_compliance(
             ),
         ))
 
+    # --- Structural section headings across the candidate prompt(s) ---
+    # Criteria 6-8 match section headings STRUCTURALLY (see module docstring):
+    # extract headings, normalize, and pass when any expresses the relevant
+    # concept. This is a strict widening of the old exact-label matching.
+    all_headings = []
+    for p in all_prompts:
+        all_headings.extend(extract_normalized_headings(p))
+
     # --- Criterion 6: prompt_has_task_section (tier2) ---
-    has_task = any("## Task" in p for p in all_prompts)
+    # Structural concept match OR legacy exact-label substring (strict-widening
+    # guarantee — see LEGACY_* lists above).
+    matched_task = match_section_heading(
+        all_headings, TASK_KEYWORDS, word_boundary=True
+    )
+    legacy_task = LEGACY_TASK_LABEL if any(
+        LEGACY_TASK_LABEL in p for p in all_prompts
+    ) else None
+    task_hit = matched_task or legacy_task
     results.append(CriterionResult(
         name="prompt_has_task_section",
-        passed=has_task,
+        passed=task_hit is not None,
         tier="tier2",
         detail=(
-            "Found '## Task' section in agent prompt."
-            if has_task
-            else "Missing '## Task' section in agent prompt."
+            f"Found task section (heading: '{task_hit}')."
+            if task_hit
+            else f"Missing task section. Headings found: {all_headings or 'none'}"
         ),
     ))
 
     # --- Criterion 7: prompt_has_context_section (tier2) ---
-    # Accept semantically equivalent headers for context information.
-    CONTEXT_HEADERS = [
-        "## Context", "## Scope", "## Background", "## Specifications",
-        "## Dataset Specifications", "## Known Symptoms", "## What to Search",
-    ]
-    matched_context = None
-    for p in all_prompts:
-        for header in CONTEXT_HEADERS:
-            if header in p:
-                matched_context = header
-                break
-        if matched_context:
-            break
-
+    matched_context = match_section_heading(all_headings, CONTEXT_KEYWORDS)
+    legacy_context = next(
+        (h for h in LEGACY_CONTEXT_HEADERS if any(h in p for p in all_prompts)),
+        None,
+    )
+    context_hit = matched_context or legacy_context
     results.append(CriterionResult(
         name="prompt_has_context_section",
-        passed=matched_context is not None,
+        passed=context_hit is not None,
         tier="tier2",
         detail=(
-            f"Found '{matched_context}' section in agent prompt."
-            if matched_context
-            else f"Missing context section in agent prompt. Accepted: {CONTEXT_HEADERS}"
+            f"Found context section (heading: '{context_hit}')."
+            if context_hit
+            else f"Missing context section. Accepted concepts: "
+                 f"{list(CONTEXT_KEYWORDS)}. Headings found: "
+                 f"{all_headings or 'none'}"
         ),
     ))
 
     # --- Criterion 8: prompt_has_instructions (tier2) ---
-    # Accept semantically equivalent headers for instruction content.
-    INSTRUCTION_HEADERS = [
-        "## Instructions", "## What to Report", "## What to Look For",
-        "## Where to Look", "## Validation Requirements", "## Output Format",
-        "## Expected Output", "## Deliverables",
-    ]
-    matched_instructions = None
-    for p in all_prompts:
-        for header in INSTRUCTION_HEADERS:
-            if header in p:
-                matched_instructions = header
-                break
-        if matched_instructions:
-            break
-
+    matched_instructions = match_section_heading(
+        all_headings, INSTRUCTION_KEYWORDS
+    )
+    legacy_instructions = next(
+        (h for h in LEGACY_INSTRUCTION_HEADERS if any(h in p for p in all_prompts)),
+        None,
+    )
+    instructions_hit = matched_instructions or legacy_instructions
     results.append(CriterionResult(
         name="prompt_has_instructions",
-        passed=matched_instructions is not None,
+        passed=instructions_hit is not None,
         tier="tier2",
         detail=(
-            f"Found '{matched_instructions}' section in agent prompt."
-            if matched_instructions
-            else f"Missing instructions section in agent prompt. Accepted: {INSTRUCTION_HEADERS}"
+            f"Found instructions section (heading: '{instructions_hit}')."
+            if instructions_hit
+            else f"Missing instructions section. Accepted concepts: "
+                 f"{list(INSTRUCTION_KEYWORDS)}. Headings found: "
+                 f"{all_headings or 'none'}"
         ),
     ))
 
diff --git a/benchmarks/scorers/deterministic/error_classification.py b/benchmarks/scorers/deterministic/error_classification.py
new file mode 100644
index 00000000..746de275
--- /dev/null
+++ b/benchmarks/scorers/deterministic/error_classification.py
@@ -0,0 +1,332 @@
+"""Classify error-bearing tool results as hook/policy blocks vs genuine failures.
+
+DAAFBench runs surface two very different kinds of ``is_error`` tool results, and
+conflating them corrupts any read of model behavior:
+
+* **hook_block** — the tool call was refused by a DAAF or benchmark PreToolUse
+  hook, a permission deny, or a project tool-availability policy. This is the
+  harness/framework acting AS DESIGNED (e.g. ``enforce-single-command`` refusing
+  a chained command). It reflects the model attempting a disallowed action, not a
+  broken environment.
+* **tool_failure** — a genuine tool / API / environment error (file not found,
+  input-validation error, API stall, non-zero exit, oversize file, etc.).
+
+The discrimination patterns below were derived EMPIRICALLY from ~830 real
+``is_error`` tool results across archived transcripts under
+``benchmarks/results/*/runs/*/`` (catalogued 2026-07-28). Hook/permission
+signatures observed include the ``PreToolUse:...hook error:``/``BLOCKED by``
+family (enforce-single-command, bash-safety, block-git-writes), the
+``Explore subagents are blocked in this project`` policy block, and permission
+denials (``requested permissions to ... but you haven't granted``,
+``Permission to use ... has been denied``).
+
+Anything error-bearing that matches NEITHER a hook signature NOR a known
+genuine-failure signature is counted as ``tool_failures_unclassified`` — it is
+never silently folded into ``tool_failures``, so an unrecognized signature stays
+visible for future pattern curation rather than inflating the failure count.
+
+Import-light by design: stdlib ``json`` only, so the four runner scripts can
+import it without pulling in scoring machinery.
+"""
+
+import json
+import re
+from pathlib import Path
+
+# Substrings (matched case-insensitively) that mark a hook / permission / policy
+# block. Checked FIRST — a blocked call is never also a genuine tool failure.
+HOOK_BLOCK_SIGNATURES = (
+    "blocked by",              # bash-safety.sh / enforce-single-command / block-git-writes
+    "hook error:",            # PreToolUse:/PostToolUse: hook stderr prefix
+    "pretooluse:",
+    "posttooluse:",
+    "blocked in this project",  # Explore-subagent / policy blocks
+    "requested permissions to",  # permission-deny (grant not yet given)
+    "haven't granted",
+    "has been denied",         # "Permission to use ... has been denied"
+    "permissiondecision",      # deny-shaped hook JSON leaked into content
+    "not permitted in this environment",  # bash-safety phrasing
+)
+
+# Substrings (case-insensitive) that mark a genuine tool / API / environment
+# error. Checked SECOND (after hook signatures). Anything error-bearing that
+# matches neither list is 'unclassified' and surfaced separately.
+TOOL_FAILURE_SIGNATURES = (
+    "does not exist",
+    "no such file or directory",
+    "exceeds maximum",
+    "tool_use_error",
+    "inputvalidationerror",
+    "is missing",              # "The required parameter `x` is missing"
+    "unexpected parameter",
+    "api error",
+    "terminated early",
+    "prompt is too long",
+    "backend server error",
+    "stalled",
+    "exit code",
+    "no such tool available",
+    "has not been read yet",
+    "command not found",
+    "directory does not exist",
+    "traceback",
+    "request interrupted",
+    "syntax error",
+    "too_small",
+)
+
+
+# --- C4: additive tool-failure sub-classification -------------------------
+# classify_tool_failure_class() assigns an already-observed tool failure a finer
+# operational CAUSE so failures can be triaged (transient infra vs capacity vs
+# config vs model behavior) without changing any scoring. It is additive and
+# non-scoring, operates on the stored (truncated) error string, and is
+# precedence-ordered: the FIRST matching rule wins.
+
+# Transient infrastructure signatures: the backend dropped or stalled the
+# stream, or returned an empty HTTP 200. These are the candidates for a bounded
+# retry (the retry itself is DEFERRED — not implemented here).
+INFRA_TRANSIENT_SIGNATURES = (
+    "stream closed",
+    "stalled mid-stream",
+    "empty response body",   # empty-200: HTTP 200 with no content
+    "empty 200",
+    "200 with no body",
+)
+
+# Backend capacity refusal: the request context exceeded the model's window.
+CAPACITY_PROMPT_SIGNATURES = (
+    "prompt is too long",
+)
+
+# ChatGPT / Codex lane routing refusal. Only an infra_config cause when the
+# rejected model id equals the run's configured child model id; a refusal naming
+# a DIFFERENT model id means the model tried to route elsewhere → model_error.
+LANE_CONFIG_SIGNATURES = (
+    "not available via the chatgpt",
+    "(codex) lane",
+)
+
+# Quota / rate-limit capacity signatures (plain substrings).
+CAPACITY_QUOTA_SIGNATURES = (
+    "quota",
+    "rate limit",
+    "too many requests",
+    "http 429",
+    "status 429",
+    "error 429",
+    "429 too many requests",
+)
+
+# Standalone HTTP 429 status code. A bare "429" substring false-matches trace
+# ids ("trace-84290fae") and token counts ("4293 tokens"), so the code is only
+# a capacity signal when it stands alone as a number — a "429" not glued to an
+# adjacent digit or word character. \b429\b requires non-word boundaries on both
+# sides, so "84290" (surrounded by digits) and "4293" (trailing digit) do not
+# match, while "HTTP 429 Too Many Requests" / "error: 429" / "code 429." do.
+_STANDALONE_429_RE = re.compile(r"\b429\b")
+
+
+# Characters that can continue a model id (letters, digits, and the id
+# punctuation ``. _ - [ ]``). A configured id counts as "named by the error"
+# only when it is NOT immediately preceded or followed by one of these — so an
+# extension like ``[1m]`` glued to the id (``gpt-5.6-terra[1m]``) is treated as a
+# DIFFERENT id, never a match for the bare ``gpt-5.6-terra``.
+_ID_CONTINUATION = r"[A-Za-z0-9._\[\]-]"
+
+
+def _error_names_model_id(low_error_text: str, configured_child_model_id) -> bool:
+    """True when the (lowercased) error text names EXACTLY the configured id.
+
+    Delimiter-aware, not bare-substring: the configured id matches only when it
+    is not immediately adjacent to an id-continuation character on either side.
+    This distinguishes ``gpt-5.6-terra`` (configured) from a rejected
+    ``gpt-5.6-terra[1m]`` (a different id → NOT a match → model_error) and,
+    symmetrically, a configured ``gpt-5.6-terra[1m]`` from a rejected bare
+    ``gpt-5.6-terra``. An exact-id occurrence still matches.
+    """
+    esc = re.escape(str(configured_child_model_id).lower())
+    pattern = rf"(?<!{_ID_CONTINUATION}){esc}(?!{_ID_CONTINUATION})"
+    return re.search(pattern, low_error_text) is not None
+
+
+def classify_tool_failure_class(error_text, configured_child_model_id=None) -> str:
+    """Assign a tool failure a finer operational cause (additive, non-scoring).
+
+    Returns one of:
+      ``policy_hook``      — a DAAF/benchmark hook or permission block
+      ``infra_transient``  — dropped/stalled stream or empty-200 (retry candidate)
+      ``capacity_limit``   — prompt-too-long, or a quota / 429 refusal
+      ``infra_config``     — ChatGPT/Codex lane refusal of the CONFIGURED child model
+      ``model_error``      — everything else, including a lane refusal naming a
+                             DIFFERENT model id than the configured child (the
+                             model mis-routing itself, e.g. a model-authored
+                             ``claude-fable-5`` on a Terra run)
+
+    Precedence is first-match-wins in the order above. One consequence is
+    intentional: when a quota / 429 capacity signal CO-OCCURS with a transient
+    signal (e.g. ``"HTTP 429 rate limit; stream closed"``), the transient rule
+    (2) is reached before the capacity rule (5), so the failure classifies
+    ``infra_transient`` — a dropped/stalled stream is the actionable, retryable
+    cause and takes priority over the co-reported rate-limit note.
+
+    ``error_text`` is the stored error string passed by the caller (the executor
+    supplies the extracted tool-result content). ``configured_child_model_id`` is
+    the run's configured child model id
+    (``result.model_identity.requested_model_id``); when it is None and the lane
+    pattern matches, the cause falls back to ``infra_config`` because the
+    mismatch branch cannot be evaluated without it.
+    """
+    if not error_text:
+        return "model_error"
+    low = str(error_text).lower()
+
+    # 1. policy_hook — a blocked call is the framework acting as designed.
+    for sig in HOOK_BLOCK_SIGNATURES:
+        if sig in low:
+            return "policy_hook"
+
+    # 2. infra_transient — dropped/stalled stream or empty-200.
+    for sig in INFRA_TRANSIENT_SIGNATURES:
+        if sig in low:
+            return "infra_transient"
+
+    # 3. capacity_limit — prompt exceeds the model window.
+    for sig in CAPACITY_PROMPT_SIGNATURES:
+        if sig in low:
+            return "capacity_limit"
+
+    # 4. ChatGPT / Codex lane refusal. infra_config only when the rejected model
+    #    id equals the configured child id; a refusal naming a DIFFERENT model is
+    #    the model mis-routing itself → model_error. With no configured id to
+    #    compare against, fall back to infra_config.
+    if any(sig in low for sig in LANE_CONFIG_SIGNATURES):
+        if configured_child_model_id is None:
+            return "infra_config"
+        if _error_names_model_id(low, configured_child_model_id):
+            return "infra_config"
+        return "model_error"
+
+    # 5. capacity_limit — quota / rate-limit refusal, or a standalone HTTP 429.
+    for sig in CAPACITY_QUOTA_SIGNATURES:
+        if sig in low:
+            return "capacity_limit"
+    if _STANDALONE_429_RE.search(low):
+        return "capacity_limit"
+
+    # 6. default.
+    return "model_error"
+
+
+def classify_error_content(content: str) -> str:
+    """Classify one error-bearing tool-result content string.
+
+    Returns one of ``"hook_block"``, ``"tool_failure"``, or
+    ``"tool_failure_unclassified"``. Hook/permission signatures win over
+    genuine-failure signatures because a blocked call reports as an error but is
+    the framework acting as designed.
+    """
+    if not content:
+        return "tool_failure_unclassified"
+    low = str(content).lower()
+    for sig in HOOK_BLOCK_SIGNATURES:
+        if sig in low:
+            return "hook_block"
+    for sig in TOOL_FAILURE_SIGNATURES:
+        if sig in low:
+            return "tool_failure"
+    return "tool_failure_unclassified"
+
+
+def _iter_transcript_error_contents(transcript_path, skip_lines=0):
+    """Yield the content string of every ``is_error`` tool_result in a .jsonl
+    transcript. Best-effort: malformed lines and unreadable files are skipped.
+
+    ``skip_lines`` drops the first N physical lines before scanning, mirroring
+    ``extract_new_tool_calls``'s ``lines[checkpoint_line_count:]`` slice. For a
+    parent transcript that carries a prepended golden-checkpoint prefix, pass the
+    golden line count so only the post-checkpoint benchmark run is classified;
+    the prefix's tool_results (framework setup, not model behavior) are excluded.
+    Subagent transcripts have no such prefix and are scanned in full (skip=0)."""
+    p = Path(transcript_path)
+    if not p.exists():
+        return
+    try:
+        with open(p, "r") as f:
+            for lineno, line in enumerate(f):
+                if lineno < skip_lines:
+                    continue
+                line = line.strip()
+                if not line or '"is_error"' not in line:
+                    continue
+                try:
+                    obj = json.loads(line)
+                except (ValueError, TypeError):
+                    continue
+                if not isinstance(obj, dict):
+                    continue
+                msg = obj.get("message", {})
+                content = msg.get("content") if isinstance(msg, dict) else None
+                if not isinstance(content, list):
+                    continue
+                for block in content:
+                    if not isinstance(block, dict):
+                        continue
+                    if block.get("type") != "tool_result" or not block.get("is_error"):
+                        continue
+                    c = block.get("content", "")
+                    if isinstance(c, list):
+                        c = " ".join(
+                            x.get("text", "") for x in c if isinstance(x, dict)
+                        )
+                    yield str(c)
+    except OSError:
+        return
+
+
+def compute_error_counts(
+    tool_failures,
+    subagent_transcripts=None,
+    parent_transcript=None,
+    parent_skip_lines=0,
+) -> dict:
+    """Aggregate error-bearing tool results into the three diagnostic buckets.
+
+    ``tool_failures`` is the parent-transcript failure list already extracted by
+    the harness (``executor._extract_tool_failures`` → each entry a dict with a
+    ``content`` string). ``subagent_transcripts``, when given, is an iterable of
+    transcript file paths whose ``is_error`` tool_results are scanned and
+    classified too, so a run's counts cover its dispatched subagents as well as
+    the parent. ``parent_transcript`` (single path) is scanned skipping its first
+    ``parent_skip_lines`` lines — pass the run's golden-checkpoint line count so
+    only post-checkpoint content is classified (the golden prefix is framework
+    setup, not model behavior). Cold-start phases pass ``parent_skip_lines=0``.
+
+    NOTE (2026-07-28, W1/I2): these transcript scans see the FULL, untruncated
+    tool_result content and the WHOLE post-checkpoint transcript, unlike the
+    legacy ``result.tool_failures`` path (executor-extracted, truncated to the
+    first 500 chars). Bucket classifications can therefore differ from
+    pre-2026-07-28 runs — a signature past char 500 that the legacy path missed
+    is now seen, so a run may reclassify from ``unclassified`` to a named bucket.
+
+    Returns ``{"hook_blocks": n, "tool_failures": n,
+    "tool_failures_unclassified": n}`` — additive fields for result.json.
+    """
+    counts = {"hook_blocks": 0, "tool_failures": 0, "tool_failures_unclassified": 0}
+    _bucket = {
+        "hook_block": "hook_blocks",
+        "tool_failure": "tool_failures",
+        "tool_failure_unclassified": "tool_failures_unclassified",
+    }
+    for tf in tool_failures or []:
+        content = tf.get("content", "") if isinstance(tf, dict) else str(tf)
+        counts[_bucket[classify_error_content(content)]] += 1
+    if parent_transcript:
+        for content in _iter_transcript_error_contents(
+            parent_transcript, skip_lines=parent_skip_lines
+        ):
+            counts[_bucket[classify_error_content(content)]] += 1
+    for tp in subagent_transcripts or []:
+        for content in _iter_transcript_error_contents(tp):
+            counts[_bucket[classify_error_content(content)]] += 1
+    return counts
diff --git a/benchmarks/scripts/build_rerun_queue.py b/benchmarks/scripts/build_rerun_queue.py
new file mode 100644
index 00000000..334d8231
--- /dev/null
+++ b/benchmarks/scripts/build_rerun_queue.py
@@ -0,0 +1,363 @@
+"""build_rerun_queue.py — read-only scanner emitting the DAAFBench re-run queue.
+
+Scans benchmarks/results/*/runs/*/result.json (excluding _quarantine* result
+sets, the top-level probes/ dir, and removed_runs/ provenance sidecars), tallies
+every timed-out run AND every permanently-stalled run (status == "stalled" — a
+watchdog-killed hang that exhausted auto-relaunch; § 3), and emits an ordered
+re-run queue: models sorted by descending timeout rate, with one ready-to-run
+command per failing (model, battery, case). Each command's --reps is the number
+of censored reps for that (model, battery, case) across the corpus — timed-out
+plus stalled — i.e. the number of fresh completions needed to replace them. The
+two failure classes are counted separately in the report and JSON output
+(``timed_out``/``stalled`` per model, ``timed_out_reps``/``stalled_reps`` per
+queue entry) so they stay distinguishable; recovery semantics are identical (both
+produced no usable completion and are eligible for rerun).
+
+Backburnered models (default: Gemma 4 31B, Gemma 4 26B, GPT-5.6 Luna
+(ChatGPT Subscription)) are listed in a separate deferred section, not the
+active queue.
+
+Criterion-invalid cases (default: dc-11, dc-12) are excluded from the queue
+entirely: the 2026-07-18 static criteria audit ruled their evaluated criteria
+NEEDS REWORK (invalid at birth), and they were excluded from the G1R run set
+on the same grounds — re-running them would produce runs whose scoring
+criteria are known-bad. Their timed-out reps still count in the corpus
+baseline tally (the scan reports ground truth); they are omitted only from
+the emitted commands, with an explicit exclusion line in the summary.
+
+This tool is READ-ONLY: it opens result.json files and models.yaml and writes
+nothing under benchmarks/results/. The only write path is the optional --out
+JSON dump for downstream tooling.
+
+Self-check: pre-campaign totals should be 401 timed-out across 3187 runs.
+Per-model timeout counts should match the corpus-enumeration note
+(Gemma 4 31B 70, Kimi K3 41, DeepSeek V4 Pro 41, Nemotron 3 Ultra 37, ...).
+
+Usage:
+    python3 benchmarks/scripts/build_rerun_queue.py
+    python3 benchmarks/scripts/build_rerun_queue.py --out /daaf/.../scratch/queue.json
+    python3 benchmarks/scripts/build_rerun_queue.py --backburner "Gemma 4 31B,Gemma 4 26B"
+"""
+
+import argparse
+import json
+from collections import Counter, defaultdict
+from pathlib import Path
+
+import yaml
+
+# --- Config ---
+# INTENT: anchor all paths on the repo root two levels up from this script
+#         (benchmarks/scripts/build_rerun_queue.py -> /daaf).
+# ASSUMES: this file lives at {BASE_DIR}/benchmarks/scripts/.
+BASE_DIR = Path(__file__).resolve().parents[2]
+RESULTS_DIR = BASE_DIR / "benchmarks" / "results"
+MODELS_FILE = BASE_DIR / "benchmarks" / "config" / "models.yaml"
+
+# Uniform logistical cap emitted in every re-run command (2026-07-21 walltime
+# redesign). Kept in lockstep with the runners' argparse default and
+# executor.DEFAULT_TIMEOUT_S.
+RERUN_TIMEOUT_S = 900
+
+# Case-id prefix -> (battery label, runner script). The prefix is the reliable
+# battery discriminant and is present on every schema version (case_id is
+# populated in 3187/3187 corpus runs; benchmark_key is not, so we do not rely
+# on it).
+BATTERY_BY_PREFIX = {
+    "dc": ("dispatch_compliance", "run_dispatch_compliance.py"),
+    "pc": ("post_confirmation", "run_post_confirmation.py"),
+    "sr": ("skill_routing", "run_skill_routing.py"),
+    "mc": ("mode_classification", "run_mode_classification.py"),
+}
+
+# Expected pre-campaign baseline (from the 2026-07-21 corpus-enumeration note).
+EXPECTED_TOTAL_RUNS = 3187
+EXPECTED_TIMED_OUT = 401
+
+DEFAULT_BACKBURNER = "Gemma 4 31B,Gemma 4 26B,GPT-5.6 Luna (ChatGPT Subscription)"
+
+# Cases whose evaluated criteria the 2026-07-18 static audit ruled invalid
+# (NEEDS REWORK; excluded from the G1R run set). Re-running them would spend
+# tokens on runs whose scoring criteria are known-bad, so they are excluded
+# from the emitted queue by default (override with --exclude-cases "").
+DEFAULT_EXCLUDED_CASES = "dc-11,dc-12"
+
+parser = argparse.ArgumentParser(
+    description="Emit the DAAFBench timed-out re-run queue (read-only scanner). "
+                "Pre-campaign baseline self-check: 401 timed-out / 3187 runs.")
+parser.add_argument("--backburner", type=str, default=DEFAULT_BACKBURNER,
+                    help="Comma-separated model DISPLAY names to defer to a "
+                         "separate deferred section instead of the active queue "
+                         f"(default: {DEFAULT_BACKBURNER!r}).")
+parser.add_argument("--exclude-cases", type=str, default=DEFAULT_EXCLUDED_CASES,
+                    help="Comma-separated case ids to EXCLUDE from the emitted "
+                         "queue (still counted in the baseline tally). Default "
+                         f"{DEFAULT_EXCLUDED_CASES!r}: criterion-invalid per the "
+                         "2026-07-18 static criteria audit (NEEDS REWORK; "
+                         "excluded from the G1R run set). Pass an empty string "
+                         "to disable.")
+parser.add_argument("--out", type=str, default=None,
+                    help="Optional path to write the queue as JSON for tooling. "
+                         "This is the only write path; the scan is read-only.")
+args = parser.parse_args()
+
+backburner_names = [n.strip() for n in args.backburner.split(",") if n.strip()]
+excluded_cases = {c.strip() for c in args.exclude_cases.split(",") if c.strip()}
+
+# --- Load ---
+# INTENT: build a model DISPLAY-name -> selectable runner key map and a registry
+#         order index, mirroring model_loader.load_models():
+#         key = entry.get("key") or name.lower().replace(" ","-").replace(".","")
+# REASONING: 2952/3187 corpus result.json files predate schema_version 2 and
+#            carry no benchmark_key, so the registry (models.yaml) is the only
+#            corpus-wide source for the --models key.
+with open(MODELS_FILE) as fh:
+    _registry = yaml.safe_load(fh)
+
+name_to_key = {}
+name_to_registry_index = {}
+for _idx, _entry in enumerate(_registry.get("models", [])):
+    _name = _entry.get("name")
+    if _name is None:
+        continue
+    _derived = _name.lower().replace(" ", "-").replace(".", "")
+    name_to_key[_name] = _entry.get("key") or _derived
+    # First occurrence wins for the ordering index (registry declaration order).
+    if _name not in name_to_registry_index:
+        name_to_registry_index[_name] = _idx
+
+# INTENT: enumerate every corpus result.json under a result set's runs/ subtree.
+# ASSUMES: removed_runs/ is a SIBLING of runs/ (not under it), probes/ is a
+#          top-level results/ dir, and _quarantine* is a result-set-level dir —
+#          so the */runs/* glob plus the explicit exclusions reproduce the
+#          viewer's runs/-only scope (verified: 3187 files).
+result_files = [
+    p for p in RESULTS_DIR.glob("*/runs/*/result.json")
+    if "_quarantine" not in str(p)
+    and "/removed_runs/" not in str(p)
+    and "/probes/" not in str(p)
+]
+
+# --- Scan ---
+total_by_model = Counter()
+timed_by_model = Counter()
+# Permanently-stalled runs (status == "stalled") — the watchdog killed a hung run
+# after exhausting auto-relaunch (§ 3). Recovery semantics are equivalent to a
+# timeout (the run produced no usable completion and is eligible for rerun), so
+# these are ALSO selected for the queue, but tracked in a SEPARATE counter so the
+# two failure classes stay distinguishable in the report and JSON output.
+stalled_by_model = Counter()
+# (model_name, battery, runner, case_id) -> rep counts needed, split by failure
+# class. reps_needed for a triple is the SUM (each censored run needs one fresh
+# completion regardless of which class censored it).
+timed_rerun_counts = defaultdict(int)
+stalled_rerun_counts = defaultdict(int)
+unknown_names = set()
+skipped_unmapped_case = 0
+# case_id -> reps (either class) omitted from the queue as criterion-invalid.
+excluded_case_reps = Counter()
+
+for path in result_files:
+    with open(path) as fh:
+        rec = json.load(fh)
+    model_name = rec.get("model") or rec.get("model_name")
+    case_id = rec.get("case_id") or rec.get("test_case_id")
+    total_by_model[model_name] += 1
+    is_timed_out = bool(rec.get("timed_out"))
+    # status == "stalled" is mutually exclusive with the timed_out flag
+    # (artifacts._run_status returns "stalled" before the timed_out branch).
+    is_stalled = rec.get("status") == "stalled"
+    if not (is_timed_out or is_stalled):
+        continue
+    if is_timed_out:
+        timed_by_model[model_name] += 1
+    if is_stalled:
+        stalled_by_model[model_name] += 1
+    # Map case-id prefix -> battery/runner.
+    prefix = (case_id or "")[:2]
+    battery_runner = BATTERY_BY_PREFIX.get(prefix)
+    if battery_runner is None:
+        skipped_unmapped_case += 1
+        continue
+    battery, runner = battery_runner
+    # INTENT: keep criterion-invalid cases out of the emitted queue while the
+    #         baseline tally above stays raw (scan reports ground truth).
+    if case_id in excluded_cases:
+        excluded_case_reps[case_id] += 1
+        continue
+    if is_timed_out:
+        timed_rerun_counts[(model_name, battery, runner, case_id)] += 1
+    if is_stalled:
+        stalled_rerun_counts[(model_name, battery, runner, case_id)] += 1
+
+# --- Build ordering ---
+# INTENT: rank models with >=1 timeout by descending timeout RATE (per the
+#         user's "descending timeout rate" campaign spec), breaking ties by
+#         descending absolute timeout count, then registry declaration order
+#         (which yields Kimi K3 before DeepSeek V4 Pro on their 41/41 tie).
+# Any model with >=1 timeout OR >=1 stall needs rerun work. Stalled-only models
+# (timeout rate 0) sort after timed-out models but still get emitted.
+models_needing_rerun = [
+    m for m in (set(timed_by_model) | set(stalled_by_model))
+    if timed_by_model[m] > 0 or stalled_by_model[m] > 0
+]
+
+
+def _rate(m):
+    total = total_by_model[m]
+    return (timed_by_model[m] / total) if total else 0.0
+
+
+def _sort_key(m):
+    # Primary ordering stays timeout-rate descending (the campaign spec); stalled
+    # count is a tertiary tiebreak so stalled-only models order deterministically.
+    return (
+        -_rate(m), -timed_by_model[m], -stalled_by_model[m],
+        name_to_registry_index.get(m, 10_000), m,
+    )
+
+
+ranked = sorted(models_needing_rerun, key=_sort_key)
+active_models = [m for m in ranked if m not in backburner_names]
+deferred_models = [m for m in ranked if m in backburner_names]
+
+# INTENT: assemble the per-model command lists once, reused for stdout + JSON.
+queue = {}  # model_name -> list of entry dicts
+for m in ranked:
+    key = name_to_key.get(m)
+    if key is None:
+        unknown_names.add(m)
+        key = m.lower().replace(" ", "-").replace(".", "")  # best-effort fallback
+    entries = []
+    # Case triples for this model (union of both failure classes), sorted by
+    # battery then case_id for stable output. reps_needed = timed + stalled.
+    triple_keys = {
+        (b, r, c)
+        for (mm, b, r, c) in set(timed_rerun_counts) | set(stalled_rerun_counts)
+        if mm == m
+    }
+    triples = sorted(triple_keys, key=lambda t: (t[0], t[2]))
+    for battery, runner, case_id in triples:
+        timed_reps = timed_rerun_counts[(m, battery, runner, case_id)]
+        stalled_reps = stalled_rerun_counts[(m, battery, runner, case_id)]
+        reps = timed_reps + stalled_reps
+        cmd = (f"python3 benchmarks/scripts/{runner} "
+               f"--models {key} --test-id {case_id} --reps {reps} "
+               f"--timeout {RERUN_TIMEOUT_S} --sequential")
+        entries.append({
+            "battery": battery,
+            "case_id": case_id,
+            "reps_needed": reps,
+            "timed_out_reps": timed_reps,
+            "stalled_reps": stalled_reps,
+            "runner": runner,
+            "command": cmd,
+        })
+    queue[m] = entries
+
+# --- Summary (stdout) ---
+grand_total_runs = sum(total_by_model.values())
+grand_timed_out = sum(timed_by_model.values())
+grand_stalled = sum(stalled_by_model.values())
+
+print("=" * 78)
+print("DAAFBench re-run queue (timed-out + permanently-stalled runs)")
+print("=" * 78)
+print(f"Corpus scanned : {RESULTS_DIR}")
+print(f"Result files   : {grand_total_runs} runs "
+      f"(runs/ scope; excludes _quarantine*, probes/, removed_runs/)")
+print(f"Timed-out runs : {grand_timed_out}")
+print(f"Stalled runs   : {grand_stalled} (status==\"stalled\"; watchdog-killed "
+      f"hangs, distinct from timeouts — also queued for rerun)")
+_baseline_match = (grand_total_runs == EXPECTED_TOTAL_RUNS
+                   and grand_timed_out == EXPECTED_TIMED_OUT)
+print(f"Self-check     : expected pre-campaign baseline "
+      f"{EXPECTED_TIMED_OUT} timed-out / {EXPECTED_TOTAL_RUNS} runs -> "
+      f"{'MATCH' if _baseline_match else 'DIFFERS (campaign in progress or scope drift)'}")
+if excluded_case_reps:
+    _excl_detail = ", ".join(f"{c} ({n})" for c, n in sorted(excluded_case_reps.items()))
+    print(f"Excluded cases : {sum(excluded_case_reps.values())} timed-out rep(s) "
+          f"omitted from the queue — criterion-invalid per the 2026-07-18 "
+          f"static audit: {_excl_detail}")
+if skipped_unmapped_case:
+    print(f"WARNING        : {skipped_unmapped_case} timed-out run(s) had an "
+          f"unmapped case-id prefix and were omitted from the queue")
+if unknown_names:
+    print(f"WARNING        : model name(s) not in models.yaml (fallback key "
+          f"derived): {sorted(unknown_names)}")
+print()
+
+print("Per-model failure tally (all models needing rerun, descending timeout rate):")
+print(f"  {'model':<40} {'timed':>6} {'stall':>6} {'total':>6} {'rate':>7}  section")
+for m in ranked:
+    section = "DEFERRED" if m in backburner_names else "active"
+    print(f"  {m:<40} {timed_by_model[m]:>6} {stalled_by_model[m]:>6} "
+          f"{total_by_model[m]:>6} {_rate(m) * 100:>6.1f}%  {section}")
+print()
+
+print("-" * 78)
+print(f"ACTIVE QUEUE ({len(active_models)} models, "
+      f"descending timeout rate; --timeout {RERUN_TIMEOUT_S})")
+print("-" * 78)
+for rank, m in enumerate(active_models, start=1):
+    entries = queue[m]
+    reps_sum = sum(e["reps_needed"] for e in entries)
+    print(f"\n[{rank}] {m}  (key: {name_to_key.get(m, '?')}) — "
+          f"{timed_by_model[m]} timed-out + {stalled_by_model[m]} stalled / "
+          f"{total_by_model[m]} runs ({_rate(m) * 100:.1f}% timeout), "
+          f"{len(entries)} case(s), {reps_sum} rep(s) to re-run")
+    if not entries:
+        print("    (all failed reps are excluded cases — nothing to re-run)")
+    for e in entries:
+        print(f"    {e['command']}")
+
+print()
+print("-" * 78)
+print(f"DEFERRED (backburnered models — NOT in active queue): "
+      f"{', '.join(backburner_names) if backburner_names else '(none)'}")
+print("-" * 78)
+for m in deferred_models:
+    entries = queue[m]
+    reps_sum = sum(e["reps_needed"] for e in entries)
+    print(f"\n[deferred] {m}  (key: {name_to_key.get(m, '?')}) — "
+          f"{timed_by_model[m]} timed-out + {stalled_by_model[m]} stalled / "
+          f"{total_by_model[m]} runs ({_rate(m) * 100:.1f}% timeout), "
+          f"{len(entries)} case(s), {reps_sum} rep(s) to re-run")
+    if not entries:
+        print("    (all failed reps are excluded cases — nothing to re-run)")
+    for e in entries:
+        print(f"    {e['command']}")
+
+# --- Optional JSON out ---
+if args.out:
+    out_payload = {
+        "corpus_dir": str(RESULTS_DIR),
+        "total_runs": grand_total_runs,
+        "timed_out": grand_timed_out,
+        "stalled": grand_stalled,
+        "baseline_expected": {"total_runs": EXPECTED_TOTAL_RUNS,
+                              "timed_out": EXPECTED_TIMED_OUT},
+        "baseline_match": _baseline_match,
+        "rerun_timeout_s": RERUN_TIMEOUT_S,
+        "backburner": backburner_names,
+        "excluded_cases": sorted(excluded_cases),
+        "excluded_case_reps": dict(sorted(excluded_case_reps.items())),
+        "active_order": active_models,
+        "deferred_order": deferred_models,
+        "models": {
+            m: {
+                "timed_out": timed_by_model[m],
+                "stalled": stalled_by_model[m],
+                "total": total_by_model[m],
+                "rate": _rate(m),
+                "key": name_to_key.get(m),
+                "section": "deferred" if m in backburner_names else "active",
+                "entries": queue[m],
+            }
+            for m in ranked
+        },
+    }
+    out_path = Path(args.out)
+    with open(out_path, "w") as fh:
+        json.dump(out_payload, fh, indent=2)
+    print(f"\nWrote JSON queue to {out_path}")
diff --git a/benchmarks/scripts/generate_results_viewer_v2.py b/benchmarks/scripts/generate_results_viewer_v2.py
index e4b32278..974da181 100644
--- a/benchmarks/scripts/generate_results_viewer_v2.py
+++ b/benchmarks/scripts/generate_results_viewer_v2.py
@@ -8,8 +8,11 @@
 the Perfect and Critical-only metrics, consistency, per-case difficulty,
 callouts, published-pricing formulations with per-basis/per-metric
 efficiency frontiers, estimated battery costs from observed token mixes
-(see the "Battery-cost metric" dev guide above PHASE_MAP), per-model
-timeout rates, provenance), and produces the viewer artifact.
+(see the "Battery-cost metric" dev guide above PHASE_MAP), estimated
+battery durations from observed per-run latencies, provenance), and
+produces the viewer artifact. Timed-out runs are excluded at load (they
+carry no gradeable signal — see the load_runs chokepoint), so every metric
+and the embedded run payload reflect completed runs only.
 
 Two output modes (v3.0.0 — see the "Bundle architecture" dev guide above
 PHASE_MAP):
@@ -17,36 +20,218 @@
   Bundle (DEFAULT) — a multi-file directory, benchmarks/
   daafbench_YYYY-MM-DD[suffix]/, containing index.html (the full report
   with all run-level data + precomputed metrics inline, ~4 MB on the
-  2026-06 corpus) plus data/tx_{result_set}.json transcript shards fetched
-  on demand by the Run Explorer. This is the official artifact for website
+  2026-06 corpus). By default it ALSO writes data/tx_{result_set}.json
+  transcript shards fetched on demand by the Run Explorer (lazy-loaded, so
+  index.html stays small). This is the official artifact for website
   hosting. Bundles REQUIRE http(s) serving — fetch() of sibling files is
   CORS-blocked on file:// (the viewer shows a fallback message with a
   `python3 -m http.server` hint).
 
-  Single-file (--single-file) — the pre-3.0 self-contained monolith with
-  full inline transcripts (~25 MB on the 2026-06 corpus), named
-  viewer_YYYY-MM-DD{letter}.html. Works opened directly from disk
-  (file://); kept for offline auditing.
+  Single-file (--single-file) — a self-contained monolith named
+  viewer_YYYY-MM-DD{letter}.html that works opened directly from disk
+  (file://); kept for offline auditing. As of v3.4.0 the DEFAULT single-file
+  artifact is transcript-LITE (scores/runs/aggregates only) so it stays
+  small; pass --transcripts to restore the full inline-transcript monolith
+  (~25 MB on the 2026-06 corpus).
+
+Transcript-inclusion control (v3.4.0 — see the "Transcript-inclusion
+control" dev guide above PHASE_MAP): --transcripts / --no-transcripts are a
+mutually exclusive pair that overrides the per-mode default in either
+direction. Mode defaults: bundle INCLUDES transcripts (lazy shards),
+single-file EXCLUDES them. A transcript-less build carries neither
+DATA.transcripts nor DATA.transcripts_index and the Run Explorer shows a
+"transcripts not included in this build" notice (no broken fetch, no empty
+pane).
 
 The HTML/CSS/JS lives in the sibling template file viewer_template.html;
 this script is data preparation + placeholder substitution. v1
 The v1 generator has been retired.
 
 Usage:
-    python3 benchmarks/scripts/generate_results_viewer_v2.py [--results TIMESTAMP...] [--exclude-results TIMESTAMP...] [--output PATH] [--single-file [PATH]]
+    python3 benchmarks/scripts/generate_results_viewer_v2.py [--results TIMESTAMP...] [--exclude-results TIMESTAMP...] [--output PATH] [--single-file [PATH]] [--transcripts | --no-transcripts]
 
 Examples:
     # Generate the bundle for all result sets (benchmarks/daafbench_YYYY-MM-DD[suffix]/)
+    # — includes lazy transcript shards by default
     python3 benchmarks/scripts/generate_results_viewer_v2.py
 
+    # Bundle with NO transcript shards (index.html only, smallest official build)
+    python3 benchmarks/scripts/generate_results_viewer_v2.py --no-transcripts
+
     # Generate for specific result sets, bundle at an explicit directory
     python3 benchmarks/scripts/generate_results_viewer_v2.py --results 20260608_181352 20260608_181751 --output /tmp/daafbench_view/
 
-    # Single-file monolith for offline auditing (auto-named viewer_YYYY-MM-DD{letter}.html)
+    # Transcript-lite single-file monolith for offline auditing (DEFAULT single-file)
     python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file
 
+    # Full inline-transcript single-file monolith (pre-3.4 behavior)
+    python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file --transcripts
+
     # Single-file monolith at an explicit path
     python3 benchmarks/scripts/generate_results_viewer_v2.py --single-file /tmp/my_viewer.html
+
+Changelog:
+    v3.7.2 (2026-07-29):
+      - User intensive-pass hand edits over the five Key Takeaways items
+        (viewer_template.html), typed directly by the user — the strongest
+        ratification tier, superseding the v3.7.1 anchors for those passages
+        (anchor comments restamped accordingly; hero bottom-line + About
+        intro anchors untouched). Prose-only: no schema, PRECOMPUTED, kt-*
+        span inventory, or JS change; the 28-span contract and every
+        fillTakeaways setter are intact. Highlights: T1 "top tier is
+        increasingly crowded" headline + "no monopoly on frontier compute"
+        closer; T2 "model creators" headline + Gemma home-computer aside;
+        T3 "in terms of cost" headline; T4 mechanism sentence reworded
+        ("every test here runs three times" / "scores equally well");
+        T5 "next crossover" closing sentence removed.
+      - Corpus (not viewer-code) changes shipped alongside this version:
+        3 ledger-adjudicated-unusable Sol runs quarantined
+        (_quarantine_2026-07-29_solunusable), the Opus 4.5 spend-limit dc-08
+        run quarantined (_quarantine_2026-07-29_opus45spendlimit), the 11
+        Opus 4.5 dated-snapshot purity false negatives re-adjudicated to
+        verified/valid (wire_id "claude-opus-4-5-20251101" declared in
+        models.yaml; summaries rebuilt via the sanctioned rescore path, which
+        also resolves 20260726_171652's phase-"unknown" classification), and
+        a 1-rep Opus 4.5 dc-08 top-up.
+    v3.7.1 (2026-07-29):
+      - Prose-only voice pass over the Key Takeaways / hero narrative
+        (viewer_template.html), applying the user's 2026-07-29 edit slate. No
+        schema, PRECOMPUTED, kt-* span inventory, or JS change — the 28-span
+        contract and every fillTakeaways setter are untouched; only prose around
+        the injected spans was reworded:
+        - Hero bottom-line paragraph rewritten (top-performer framing; "economical
+          choices"; slash-joined self-host clause).
+        - T1 headline -> "Fable 5 still leads, but the top tier now spans three
+          providers"; body "dominates it outright" -> "simply dominates it" plus a
+          sample-noise/cost-gap parenthetical.
+        - T2 frontier definition recast with a "(basically: ...)" gloss; closer
+          ends at the budget-point clause + a small-denominator caveat pointer,
+          dropping "not on brand loyalty".
+        - T3 closer -> "All to say: it's worth figuring out...".
+        - T4 headline -> "What budget models actually give up: reliability and
+          predictability"; first sentence contraction+colon; "merely" -> "just".
+          Mechanism sentence and "wobble" phrasing preserved verbatim.
+        - T5 headline -> "Open-weight models are no longer the compromise option";
+          closer rewritten to the provider-flexibility / "next crossover" line
+          (optional sun-setting sentence deliberately omitted).
+        - Cost-vs-Performance lead: frontier sentence ends at "...hundredfold in
+          cost", dropping the Takeaway-2-duplicating clause.
+        - Mechanical: GPT-5.6 cost caveat "api-equivalent" -> "API-equivalent";
+          trailing whitespace removed in the cvp-preview lead.
+        All voice-passed passages flagged with anchor comments as user-ratified
+        2026-07-29; the two prior voice anchors (hero TLDR, About intro paragraphs)
+        remain byte-identical.
+    v3.7.0 (2026-07-29):
+      - Key Takeaways narrative overhaul (viewer_template.html) + one
+        schema-additive PRECOMPUTED field:
+        - Rewrote the five Key Takeaways items for the July 2026 corpus (the
+          top tier now spans three providers — Fable 5, Opus 5, GPT-5.6 Sol,
+          and the open-weights Kimi K3), retitled the section "Key Takeaways
+          (July 2026)", and reworked the hero bottom-line paragraph, the
+          Cost-vs-Performance section lead (six-point / four-provider battery
+          frontier), the cost-estimate caveat (GPT rate verification), and the
+          Phase 3a dispatch explainer (GPT alias-dispatch temptation). The two
+          voice anchors (hero TLDR, the four About intro paragraphs) are
+          untouched.
+        - fillTakeaways() kt-* span inventory rebuilt to match the new prose;
+          every numeric figure is live-injected from PRECOMPUTED so future
+          regenerations track the data (frontier scores/costs, diminishing-
+          returns ratios, per-model agreement rates).
+        - PRECOMPUTED.consistency gains two schema-additive fields per model:
+          cells_all_agree and rate_agree — the share of repeated (phase, case)
+          cells where every rep lands on the identical grade (an agreement /
+          predictability measure decoupled from score level, distinct from the
+          existing all-perfect `rate`). Powers the Key Takeaways reliability
+          claim. No existing field renamed or removed.
+        - Removed the "Relative Duration" leaderboard column (header, cells,
+          sort hooks, its footnote sentence, and the lb-th-duration CSS). The
+          PRECOMPUTED.duration pipeline and the Cost-vs-Performance duration
+          scatter axis are unchanged; only the leaderboard column is gone.
+    v3.6.1 (2026-07-29):
+      - Load-time behavior change: the no-signal exclusion chokepoint now also
+        drops legacy instant-exit stub runs. For legacy-schema records
+        (schema_version < 2, so status predates the field and is null) it
+        additionally excludes a run when top-level output_tokens is null AND
+        error is null — the instant-exit signature (status null, not timed out,
+        no error, null output, 0/N criteria) surfaced by the 2026-07-29
+        instant-exit corpus audit (7 stubs, since quarantined on disk). Mirrors
+        the corpus parity scan's legacy screen. Errored legacy null-output runs
+        are unaffected (kept, as before). New-taxonomy (schema-v2) records are
+        unchanged — their tokens live nested under usage_observed and the audit
+        found zero stub divergences there. Each excluded stub emits a stderr
+        NOTE and is folded into the No-signal excluded count.
+    v3.6.0 (2026-07-29):
+      - Display-layer cleanup pass (viewer_template.html + this generator's
+        version constant only; no payload keys, model-name keys, or persisted
+        fields renamed — model display names remain the cross-payload join
+        keys, so every rename below is applied at RENDER time):
+        - Removed the rendered Provenance section (section markup, TOC link,
+          renderProvenance renderer, sectionRenderers/SECTION_IDS entries, and
+          the content-visibility selectors that named #provenance). The
+          PRECOMPUTED.provenance data pipeline is intact (still built and
+          embedded); only the rendered section is gone. The generated-timestamp
+          still shows in the hero and DAAF/Open Augments attribution remains in
+          the site footer.
+        - GPT model display names strip the "(ChatGPT Subscription)" suffix at
+          render time via the displayModelName() JS helper; payload "model"
+          keys are unchanged.
+        - Leaderboard provider badge renders "chatgpt-subscription" as
+          "chatgpt" (badge text only).
+        - Removed the per-cell "api-equiv" leaderboard badge; the api-equivalent
+          basis disclosure moved to Methods/battery-cost prose. The payload
+          `basis` field is retained.
+        - Cost-vs-performance scatter legend: "Anthropic API" -> "Anthropic";
+          added a "ChatGPT" legend entry for the chatgpt-lane GPT points. Same
+          legend on the #cvp-preview intro plot.
+        - Composite-score bar hollow-circle component markers: stroke width
+          +1px.
+    v3.5.0 (2026-07-29):
+      - Fix 2 — GPT ChatGPT-subscription (provider chatgpt-subscription)
+        battery estimates on an api-equivalent counterfactual basis. These
+        models were excluded three ways (load_model_pricing skip,
+        _cost_compatibility force-omit, anthropic-only token gate); now priced
+        from models.yaml api_equivalent_pricing.short_context list rates,
+        aggregated into the live-token battery block (None cache fields -> 0,
+        uncached basis), and tagged basis="api-equivalent" so the leaderboard
+        marks them "api-equiv" (vs Anthropic "corpus-live"). The run/set-level
+        billing_grade_cost_eligible flag is intentionally NOT flipped, so the
+        run-detail not-invoiced disclosures stay accurate — only the explicitly
+        counterfactual battery estimate includes them.
+      - Fix 3 — degenerate leaderboard-column suppression in build_eval_groups
+        (and the lockstep template buildEvalGroups): skip phase "unknown", skip
+        result sets with zero loaded runs, and fold a subagent-less
+        dispatch_compliance set into the 3a dispatch group rather than emitting
+        a bare `dispatch_compliance` column. Column-derivation-scoped — runs
+        still count in the all-runs aggregates.
+      - Fix 4 — tier-banding share cap: the range-quartile fallback now also
+        fires when the gap rule's largest tier holds > TIER_MAX_TIER_SHARE
+        (50%) of ranked models, even with >= 3 tiers. tier_rule records the
+        fallback_trigger.
+      - Fix 5 — composite-bar component markers rendered as small hollow white
+        circles instead of vertical tick marks (viewer_template.html CSS only;
+        renderer positioning unchanged).
+      - Fix 1 (OpenRouter reconciliation glob) NOT applied — reported
+        BLOCKED-on-schema: the current derived/*_openrouter_reconciliation.parquet
+        artifacts carry billed-vs-computed DOLLAR reconciliation columns keyed
+        by base_slug, with NO per-run prompt/completion token mix, so they
+        cannot feed the uncached-basis battery consumer (which needs
+        openrouter_models[name].billed_tokens.{prompt,completion} + n_covered_runs
+        from the reconcile_openrouter_costs.py JSON). load_reconciliation left
+        unchanged (legacy .json glob retained).
+    v3.4.0 (2026-07-29):
+      - Transcript-inclusion control (--transcripts / --no-transcripts) with
+        per-mode defaults: bundle includes (lazy shards), single-file now
+        defaults to a transcript-lite monolith. Transcript-less builds emit a
+        DATA payload with neither transcripts nor transcripts_index; the Run
+        Explorer feature-detects this and shows a "not included" notice.
+      - Explicit non-phase discovery skip: results-root children named in
+        RESERVED_RESULT_CONTAINERS (probes, removed_runs) OR prefixed with `_`
+        (the `_quarantine*` convention) are skipped up front rather than
+        relying on the implicit "no summary.json" filter. A QUARANTINE_NOTE.md
+        at a kept set's root is inert (discovery keys only off summary.json).
+      - Extended the load-time no-signal exclusion chokepoint to drop
+        new-taxonomy status=="stalled"/"timed_out" runs alongside the legacy
+        timed_out flag.
 """
 
 import argparse
@@ -97,12 +282,40 @@ def parse_args():
         const=True,
         default=None,
         metavar="PATH",
-        help="Emit the pre-3.0 self-contained monolith (full inline "
-             "transcripts, ~25 MB) instead of the multi-file bundle — the "
-             "offline/file:// audit path. Optional PATH names the output "
-             "HTML file (equivalent to --output in this mode; PATH given "
+        help="Emit the self-contained single-file monolith instead of the "
+             "multi-file bundle — the offline/file:// audit path. By DEFAULT "
+             "this is now a transcript-lite monolith (scores/runs/aggregates "
+             "only); pass --transcripts to restore the full inline-transcript "
+             "monolith (the pre-3.4 behavior, ~25 MB). Optional PATH names the "
+             "output HTML file (equivalent to --output in this mode; PATH given "
              "here wins if both are supplied).",
     )
+    # Transcript-inclusion control (v3.4.0). Tri-state: the flag pair is
+    # optional and mutually exclusive; when neither is given the mode default
+    # applies (bundle: INCLUDED via lazy shards; single-file: EXCLUDED). Either
+    # default is overridable in either direction.
+    tx_group = parser.add_mutually_exclusive_group()
+    tx_group.add_argument(
+        "--transcripts",
+        dest="transcripts",
+        action="store_true",
+        default=None,
+        help="Force transcripts INTO the build, overriding the mode default. "
+             "In bundle mode this is already the default (writes data/"
+             "tx_*.json shards); in single-file mode it restores the full "
+             "inline-transcript monolith.",
+    )
+    tx_group.add_argument(
+        "--no-transcripts",
+        dest="transcripts",
+        action="store_false",
+        default=None,
+        help="Force transcripts OUT of the build, overriding the mode default. "
+             "In bundle mode this writes index.html only (no shards); in "
+             "single-file mode it is already the default. Transcript-less "
+             "builds carry neither DATA.transcripts nor DATA.transcripts_index, "
+             "and the Run Explorer shows a 'transcripts not included' notice.",
+    )
     return parser.parse_args()
 
 
@@ -210,6 +423,17 @@ def resolve_paths(args):
 #      load_cases() attaches case definitions (it falls back to the dirname).
 #   6. Regenerate and spot-check the new eval group's k/n in the sanity
 #      report and the deep-dive heatmap before publishing.
+#   Eval-group derivation note (degenerate-column suppression, v3.5.0 Fix 3):
+#   build_eval_groups() (and the lockstep template buildEvalGroups()) emit a
+#   column group per distinct rs["phase"], but suppress three degenerate cases
+#   so aborted/partial/mid-write sets do not spawn junk columns: (a) phase
+#   "unknown" (detect_phase fallback) is skipped; (b) a set with zero loaded
+#   runs is skipped; (c) a dispatch_compliance set lacking subagent criterion
+#   names is FOLDED into the 3a dispatch group instead of emitting a bare
+#   `dispatch_compliance` column. Suppression is column-derivation-scoped: the
+#   runs themselves still count in the all-runs aggregates (consistency,
+#   per_case, cost, duration). A genuinely new phase whose marker is wired per
+#   step 1 will NOT be classified "unknown", so it is unaffected.
 #
 # Public-prose registries in the template (maintenance guide, added v2.6.0
 # with the public-audience evolution of the viewer):
@@ -224,15 +448,22 @@ def resolve_paths(args):
 #     replaced by spaces (critLabel()).
 #   - Key Takeaways (#takeaways section in the template): DATED hand-written
 #     editorial prose whose figures are injected into kt-* spans by
-#     fillTakeaways() at init from PRECOMPUTED (composite, composite_hard,
-#     per_model_phase, consistency, cost.battery — relative ratios only
-#     since v2.8.1, and the page-wide headline cost figure since v3.1.0 —
-#     and timeout_by_model built below). Span contract:
-#     23 kt-* spans — 22 in the #takeaways section + kt-foot-bat, which
+#     fillTakeaways() at init from PRECOMPUTED (composite, consistency —
+#     including the v3.7.0 rate_agree agreement field — and cost.battery, with
+#     relative ratios/multipliers only since v2.8.1). The July-2026 overhaul
+#     (v3.7.0) rewrote all five items; fillTakeaways no longer reads
+#     composite_hard or per_model_phase.
+#     Span contract:
+#     28 kt-* spans — 27 in the #takeaways section + kt-foot-bat, which
 #     since the 2026-06-12 user fine-tuning round lives in the About Key
 #     Caveats cost caveat (the kt-foot paragraph itself was removed; its
-#     content was folded into the About caveats). History: 29 before the
-#     2026-06-12 e099982 repair pass, 31 originally. Every kt-* span must
+#     content was folded into the About caveats). The 27 #takeaways spans
+#     (v3.7.0): T1 kt-t1-{fable,opus5,opus5cost,sol,kimi} (5); T2 the six
+#     frontier points kt-fr-{gemma,dsflash,luna,sonnet5,sol,fable}-{s,c}
+#     (12); T3 kt-t3-{lunapct,lunacost,solpct,solcost,lastmult} (5); T4
+#     kt-t4-{topagree,budgetagree} (2); T5 kt-t5-{glm,glmcost,kimi} (3).
+#     History: 22 (21 + kt-foot-bat) from 2026-06-12 through v3.6.x, 29 before
+#     the 2026-06-12 e099982 repair pass, 31 originally. Every kt-* span must
 #     have a fillTakeaways() setter and every setter a live span; verify
 #     both directions when editing either side. Injected numbers track the data
 #     automatically; the qualitative claims do NOT — when the corpus changes
@@ -320,6 +551,26 @@ def resolve_paths(args):
 #     distinct case_ids across the loaded corpus (51 on the 2026-06-11
 #     corpus: 15 mc + 9 pc + 12 dc + 15 sr — NOT runs/reps, which are uneven
 #     across providers).
+#   - Cost bases (basis tag on each cost.battery.models entry):
+#       * "corpus-live"          — Anthropic, live token mix from result.json
+#                                  priced at models.yaml list rates.
+#       * "billing-snapshot-DATE" — OpenRouter, billed token mix from the
+#                                  reconciliation JSON.
+#       * "api-equivalent"       — chatgpt-subscription GPT-5.6 lane (v3.5.0,
+#                                  Fix 2). These are NEVER invoiced per token
+#                                  (flat subscription), so they carry no
+#                                  `pricing:` block; they are priced from
+#                                  models.yaml api_equivalent_pricing.
+#                                  short_context as an explicit COUNTERFACTUAL
+#                                  — the same uncached full-input basis, using
+#                                  their live token mix (cache fields absent ->
+#                                  0). load_model_pricing tags them
+#                                  pricing_basis="api-equivalent"; they clear
+#                                  the cost-loop omission via that tag WITHOUT
+#                                  flipping billing_grade_cost_eligible (their
+#                                  not-invoiced run-detail disclosures stay
+#                                  truthful). The leaderboard marks the cost
+#                                  cell "api-equiv".
 #   - Staleness guard: the reconciliation JSON is a dated billing snapshot.
 #     At generation time each OpenRouter model's current corpus run count is
 #     compared against the JSON's recorded n_runs; mismatches print a console
@@ -335,10 +586,9 @@ def resolve_paths(args):
 #     removed 2026-06-12 — the canonical definition + disclosures now render
 #     as the CvP battery-disclosure footnote, batteryDisclosureHtml(), and
 #     the published list-price table survives as a collapsible under the
-#     same chart, pricingDetailsHtml()). Per-model timed-out shares are NOT
-#     duplicated here — the template reads them from
-#     PRECOMPUTED.timeout_by_model (which since 2026-06-12 also feeds the
-#     leaderboard's Timed-out column).
+#     same chart, pricingDetailsHtml()). Timeout data is NOT computed: as of
+#     v3.3.0 the viewer is timeout-blind — timed-out runs are excluded at load
+#     and never presented (no per-model timeout share, no leaderboard column).
 #   - Headline promotion (v3.1.0, user decision): the battery multiplier is
 #     THE headline cost figure page-wide — the leaderboard cost column, the
 #     Cost vs. Performance default axis, the Costs Detail headline table
@@ -407,6 +657,75 @@ def resolve_paths(args):
 #     (53 on the 2026-06 corpus), and total shard bytes ≈ the old monolith
 #     minus index.html (~21 MB). A ballooning index.html means transcript
 #     data leaked back inline.
+#
+# Transcript-inclusion control (added v3.4.0, dev guide):
+#   - Three DATA shapes now exist, along a single "does this build carry
+#     transcripts, and how" axis (build_data_bundle):
+#       (a) inline   — DATA.transcripts + DATA.subagent_transcripts embedded
+#                      in full (full single-file monolith).
+#       (b) lazy     — DATA.transcripts_index only; per-set shards on disk
+#                      (bundle default).
+#       (c) none     — NEITHER key present (transcript-lite build).
+#     The three are mutually exclusive and the client feature-detects in this
+#     exact priority: DATA.transcripts -> inline render; else
+#     DATA.transcripts_index -> placeholder + lazy shard fetch; else -> a
+#     static "Transcripts not included in this build" notice (renderRunDetail
+#     in viewer_template.html). Shape (c) makes NO fetch attempt — there is no
+#     index to fetch from — so a transcript-less build cannot 404 or hang.
+#   - Per-mode defaults + overrides (parse_args, main):
+#       bundle      default INCLUDE (lazy shards)   | --no-transcripts -> none
+#       single-file default EXCLUDE (none, v3.4.0)  | --transcripts    -> inline
+#     --transcripts / --no-transcripts are a mutually exclusive pair; absent
+#     both, the mode default applies. Rationale: the bundle is the official
+#     hosted artifact where lazy transcripts cost nothing until a run is
+#     opened, so it keeps them; the single-file monolith is the offline/
+#     file:// convenience artifact where inlining every transcript is what
+#     bloated it to ~25 MB, so it now ships transcript-lite unless explicitly
+#     asked for the full monolith. Either default is overridable in either
+#     direction in either mode.
+#   - When transcripts are excluded, main() SKIPS load_transcripts() entirely
+#     (the dominant load-time cost), passes empty dicts, and — in bundle mode —
+#     writes no data/ shards. generation_params records transcripts_included
+#     for provenance.
+#
+# Timeout-blindness + duration metric (added v3.3.0, dev guide):
+#   - Timeout-blindness (user decision): timed-out runs carry NO gradeable
+#     signal, so they are removed entirely — from the data, every metric, and
+#     all presentation. The exclusion is a SINGLE chokepoint in load_runs():
+#     the harness's explicit timed_out flag is read as a filter key and
+#     matching runs are dropped before any run record enters the embedded DATA
+#     payload or any precomputed aggregate. Consequences by design:
+#       * per_model_phase / composite / consistency / per_case / cost /
+#         duration / counts see completed runs only; the existing
+#         `if not gruns/cruns` guards naturally skip cells that go empty after
+#         exclusion (a set x model pair whose every run timed out simply drops
+#         that component and renders via the existing em-dash / rs-na /
+#         composite `partial` idioms — no ZeroDivisionError, no new guard).
+#       * The disk_run_count census (load_result_sets) stays RAW so the
+#         provenance run_count_discrepancy audit still compares on-disk dirs
+#         vs summary totals unchanged.
+#       * PRECOMPUTED no longer carries timeout_by_model or totals.n_timed_out
+#         (their consumers — the leaderboard Timed-out column, the About
+#         "Timeouts are still graded" caveat, the Key Takeaways timeout figure
+#         — were all removed from the template). The per-load excluded count is
+#         a console-only maintainer diagnostic (print_summary), not embedded.
+#   - Duration multiplier: a real-world LATENCY proxy mirroring the cost
+#     machinery by direct analogy (PRECOMPUTED.duration, shaped like
+#     cost.battery): per model, est_duration_per_run = mean duration_s over
+#     completed runs; est_battery_duration = per-run x battery_size (the same
+#     distinct-case count the cost block uses); duration_multiplier_vs_ref vs
+#     BATTERY_REFERENCE_MODEL (Opus 4.8). Built from SUMMED per-run duration_s,
+#     which is parallelization-INVARIANT (independent of config.parallel) —
+#     never summary.json wall_time_s, a batch clock that depends on run mode.
+#     Duration needs no pricing, so it covers ALL models including OpenRouter
+#     and the cost-omitted subscription lane (not gated on provider). The
+#     template exposes it as a "Relative Duration" leaderboard column and a
+#     duration axis on the Cost vs. Performance scatter with its own Pareto
+#     frontier (durScale clone of batScale; PRECOMPUTED.duration.frontiers is a
+#     SEPARATE block, not a cost.frontiers form, because it covers models the
+#     cost block omits). Caveat (folded into the CvP methodology footnote):
+#     duration folds in provider routing/congestion — mitigated but not
+#     eliminated by multi-rep averaging.
 # ---------------------------------------------------------------------------
 
 PHASE_MAP = {
@@ -463,11 +782,28 @@ def normalize_criteria(criteria_raw):
 # Result set loading
 # ---------------------------------------------------------------------------
 
-# ``results/probes`` is a separately shaped artifact container owned by the
-# bounded route-probe CLI. It deliberately has probe.json files rather than the
-# manifest.json/summary.json/runs contract of a phase result set. Keep reserved
-# containers explicit until a dedicated probe collection is designed.
-RESERVED_RESULT_CONTAINERS = frozenset({"probes"})
+# Non-phase results-root children that discovery must skip EXPLICITLY rather
+# than relying on the implicit "lacks a summary.json" filter below. Two forms
+# are excluded (behaviorally equivalent to the corpus-scan idiom used across
+# the campaign workspace for the operative `_quarantine*` convention; the exact
+# predicates here are `startswith("_")` + the reserved names below):
+#   1. Named containers in RESERVED_RESULT_CONTAINERS (exact match):
+#        - ``results/probes``      — bounded route-probe CLI output; carries
+#          probe.json files, not the manifest.json/summary.json/runs contract.
+#        - ``results/removed_runs`` — a holding area for run dirs pulled out of
+#          otherwise-kept sets; not a phase result set itself.
+#   2. Any child whose name STARTS WITH ``_`` — the operative quarantine
+#      convention is ``_quarantine*`` (e.g. ``_quarantine_2026-07-29``), and the
+#      leading underscore also covers any other maintainer scratch/staging dir
+#      parked at the results root. Underscore-prefixed dirs sort ahead of the
+#      ``YYYYMMDD_*`` timestamps and are never valid result-set timestamps, so
+#      the prefix test cannot suppress a real set.
+# NB: a KEPT result set may contain a ``QUARANTINE_NOTE.md`` at its root (added
+# 2026-07-29 to the 8 sets whose individual run dirs were relocated to
+# ``removed_runs``). This does NOT affect discovery: a set is recognized solely
+# by its ``summary.json`` (and enriched from ``manifest.json``/``runs/``); a
+# stray ``.md`` at the set root is simply never consulted. The note is inert.
+RESERVED_RESULT_CONTAINERS = frozenset({"probes", "removed_runs"})
 
 PROVENANCE_FIELDS = (
     "route_type", "provider", "endpoint_origin", "backend_mode", "backend",
@@ -505,6 +841,12 @@ def normalize_criteria(criteria_raw):
     "purity_status", "evidence_source", "evidence_boundary",
     "child_transcript_count", "readable_child_transcript_count",
     "incompleteness_reason",
+    # Added with the wire_id / non-model-marker purity fix. Archived result.json
+    # files are never rewritten, so these read as None for every pre-fix run —
+    # _safe_known_mapping already fills missing keys with None and the JS
+    # renderer reads named fields, so older payloads render exactly as before.
+    "comparison_target_child_model_id", "wire_id_declared",
+    "observed_non_model_markers", "non_model_marker_rule",
 )
 
 
@@ -587,7 +929,7 @@ def _safe_known_mapping(raw, fields):
     for field in (
         "claude_cli_model_usage_ids", "incompleteness_reasons",
         "scenario_assumptions", "observed_child_model_ids_raw",
-        "comparison_child_model_ids",
+        "comparison_child_model_ids", "observed_non_model_markers",
     ):
         if field in safe and safe[field] is not None:
             safe[field] = _string_list(safe[field])
@@ -606,6 +948,8 @@ def _safe_manifest_models(manifest):
         safe_models.append({
             "key": entry.get("key"),
             "id": entry.get("id"),
+            # Additive: None for archived manifests written before wire_id.
+            "wire_id": entry.get("wire_id"),
             "name": entry.get("name"),
             "display_name": entry.get("display_name"),
             "provider": entry.get("provider"),
@@ -667,11 +1011,25 @@ def load_result_sets(results_dir, filter_timestamps=None, exclude_timestamps=Non
         d for d in os.listdir(results_dir)
         if os.path.isdir(os.path.join(results_dir, d)) and not d.startswith(".")
     ])
-    reserved_present = [d for d in discovered_dirs if d in RESERVED_RESULT_CONTAINERS]
-    for dirname in reserved_present:
-        print(f"NOTE: Ignoring reserved non-phase results container: {dirname}",
+    # Explicit non-phase skip (see RESERVED_RESULT_CONTAINERS comment): named
+    # reserved containers OR any underscore-prefixed dir (the `_quarantine*`
+    # convention plus other maintainer scratch/staging). Both are excluded up
+    # front rather than left to the implicit "no summary.json" filter, so a
+    # quarantine container that happens to acquire a summary-shaped file can
+    # never leak into the corpus.
+    skipped_present = [
+        d for d in discovered_dirs
+        if d in RESERVED_RESULT_CONTAINERS or d.startswith("_")
+    ]
+    for dirname in skipped_present:
+        kind = ("reserved container" if dirname in RESERVED_RESULT_CONTAINERS
+                else "quarantine/underscore container")
+        print(f"NOTE: Ignoring non-phase results {kind}: {dirname}",
               file=sys.stderr)
-    all_timestamps = [d for d in discovered_dirs if d not in RESERVED_RESULT_CONTAINERS]
+    all_timestamps = [
+        d for d in discovered_dirs
+        if d not in RESERVED_RESULT_CONTAINERS and not d.startswith("_")
+    ]
 
     if filter_timestamps:
         timestamps = [t for t in all_timestamps if t in filter_timestamps]
@@ -811,6 +1169,18 @@ def load_result_sets(results_dir, filter_timestamps=None, exclude_timestamps=Non
             "config": manifest_config,
             "disk_run_count": disk_run_count,
             "summary_total_runs": summary.get("total_runs", 0),
+            # Partial-pass disclosure (progressive-archiving redesign, 2026-07).
+            # A summary is `partial` while a pass is mid-flight or was killed
+            # before completing; runs_expected/runs_completed make the shortfall
+            # legible. Fields absent on pre-redesign archives default to complete.
+            "partial": bool(summary.get("partial", False)),
+            "runs_expected": summary.get("runs_expected"),
+            "runs_completed": summary.get(
+                "runs_completed", summary.get("total_runs", 0)
+            ),
+            # Aggregate hook-block vs tool-failure diagnostic counters (additive;
+            # None on archives predating the field).
+            "error_counts": summary.get("error_counts"),
         }
         result_sets.append(result_set)
 
@@ -923,7 +1293,15 @@ def compute_grade(criteria):
 def load_runs(results_dir, result_sets, cases):
     """Load all result.json files for each result set.
 
-    Returns (runs, anth_token_totals). anth_token_totals aggregates raw
+    Timed-out runs (the harness's explicit timed_out flag) are excluded at a
+    single chokepoint as each result.json is read: they carry no gradeable
+    signal, so they never enter the returned runs list, the embedded DATA
+    payload, or any precomputed aggregate. The on-disk disk_run_count census
+    (load_result_sets) is a separate earlier pass and stays raw for the
+    provenance discrepancy audit.
+
+    Returns (runs, anth_token_totals, n_timed_out_excluded).
+    anth_token_totals aggregates raw
     token counts per Anthropic-provider model — {model: {n, input, output,
     cache_read, cache_creation}} — for the battery-cost metric (see the
     "Battery-cost metric" dev guide above PHASE_MAP). Aggregated here, in
@@ -937,6 +1315,7 @@ def load_runs(results_dir, result_sets, cases):
     """
     runs = []
     anth_token_totals = {}
+    n_timed_out_excluded = 0
 
     for rs in result_sets:
         ts = rs["timestamp"]
@@ -1036,18 +1415,32 @@ def load_runs(results_dir, result_sets, cases):
                 "billing_grade_cost_eligible": billing_eligible,
                 "billing_grade_cost_exclusion_reason": billing_reason,
                 "duration_s": _optional_rounded_number(result.get("duration_s"), 3),
+                # Time-to-demonstrated-compliance for early-stopped runs (launch
+                # -> first score-complete pass, excluding the confirmation/kill
+                # tail). Substituted for duration_s in duration/latency aggregates
+                # when a completed_early run carries it; None (excluded) otherwise.
+                # None on archives predating the field.
+                "score_complete_seconds": _optional_rounded_number(
+                    result.get("score_complete_seconds"), 3
+                ),
                 "error": result.get("error", None),
-                # Explicit flag from the harness — never string-match `error`
-                # to detect timeouts. Timed-out runs are usually still graded.
-                "timed_out": bool(result.get("timed_out", False)),
+                # Run lifecycle status. Dispatch B (executor-side watchdog) will
+                # emit "completed_early" for early-stopped runs; these substitute
+                # score_complete_seconds into duration/latency aggregates when
+                # present (else are excluded, as their wall time is truncated and
+                # not comparable) while their scores count normally. None on
+                # archives predating the field.
+                "status": result.get("status"),
+                # Additive hook-block vs tool-failure diagnostic counters
+                # (None on archives predating the error_counts field).
+                "error_counts": result.get("error_counts"),
                 # Phase 1 only (None elsewhere)
                 "expected_mode": result.get("expected_mode"),
                 # Phase 2/3 only (None elsewhere)
                 "subcategory": result.get("subcategory"),
                 # Phase 2/3 only (None on Phase 1 result.json)
                 "tool_call_count": result.get("tool_call_count"),
-                # Grade status computed from main criteria; orthogonal to
-                # timed_out (see compute_grade)
+                # Grade status computed from main criteria (see compute_grade)
                 "grade": compute_grade(criteria),
                 "criteria": criteria,
                 "subagent_criteria": subagent_criteria,
@@ -1063,15 +1456,94 @@ def load_runs(results_dir, result_sets, cases):
                 "tool_failures": result.get("tool_failures", []),
                 "run_dir": run_dirname,
             }
+            # --- No-gradeable-signal exclusion chokepoint (v3.3.0; status
+            #     taxonomy extended v3.4.0) ---
+            # Runs that carry no gradeable signal are dropped HERE — before any
+            # run record enters the embedded DATA payload or ANY precomputed
+            # aggregate (per_model_phase, composite, consistency, per_case,
+            # cost/duration, counts). Two exclusion keys, both watchdog/harness
+            # facts (never a string-match on `error`):
+            #   1. `timed_out` — the harness's explicit legacy timeout flag.
+            #   2. `status` in the run-lifecycle taxonomy (README § 3, post
+            #      2026-07-28): "stalled" (watchdog-killed hang — wall time is a
+            #      kill artifact, scores are truncated/absent) and "timed_out"
+            #      (the new-taxonomy spelling of the same terminal timeout).
+            #      Both are excluded exactly like a legacy timed-out run; without
+            #      this a `status="stalled"`/`"timed_out"` record whose legacy
+            #      `timed_out` flag is unset (newer archives) would slip past
+            #      leg 1 and pollute the metrics. "completed" and
+            #      "completed_early" are normal completions and are KEPT
+            #      (completed_early is score-neutral — README § 3); None status
+            #      (archives predating the field) is also kept and governed by
+            #      leg 1 alone.
+            # These keys are read ONLY as filter keys; the exclusion count is a
+            # console-only maintainer diagnostic. The disk census that feeds the
+            # provenance run_count_discrepancy check (load_result_sets ->
+            # disk_run_count) runs in a separate earlier pass and is left RAW, so
+            # the discrepancy audit still sees every on-disk run. Because runs
+            # are filtered here, the downstream `if not gruns/cruns` guards
+            # naturally skip cells that are empty after exclusion — no extra
+            # empty-cell guard is needed.
+            run_status = result.get("status")
+            if bool(result.get("timed_out", False)) or run_status in ("stalled", "timed_out"):
+                n_timed_out_excluded += 1
+                continue
+            # --- Legacy instant-exit stub exclusion (v3.6.1; 2026-07-29
+            #     instant-exit corpus audit) ---
+            # A legacy-schema record (schema_version < 2, so status predates the
+            # field and is null) with BOTH top-level output_tokens null AND error
+            # null is an instant-exit stub: it exited in ~2s having produced no
+            # model output and locked 0/N criteria, yet its unset legacy
+            # timed_out flag lets it slip past leg 1 above and pollute rep counts
+            # and score averages. This mirrors the corpus parity scan's legacy
+            # screen (research 2026-07-18 StaticAudit,
+            # scratch/11_corpus-parity-scan_a.py L62-65), narrowed to the pure
+            # stub signature. Three deliberate narrowings:
+            #   - The `legacy_schema` gate scopes this to schema-v1 records,
+            #     whose token counts live in TOP-LEVEL flat fields. Schema-v2
+            #     records carry tokens nested under usage_observed (top-level
+            #     output_tokens is legitimately null for them, e.g. the
+            #     chatgpt-subscription lane), so they must NOT be screened here —
+            #     the audit found zero stub divergences in new-taxonomy records.
+            #   - The `error` clause keeps an errored legacy null-output run
+            #     (a real failure signal), unchanged from prior behavior.
+            #   - `status is None` is faithful to the "legacy record" definition
+            #     and is implied by legacy_schema, but stated for clarity.
+            # A per-run stderr NOTE keeps exclusions visible.
+            if (
+                run["legacy_schema"]
+                and run_status is None
+                and result.get("output_tokens") is None
+                and not result.get("error")
+            ):
+                n_timed_out_excluded += 1
+                print(
+                    f"NOTE: excluding legacy instant-exit stub "
+                    f"({run['model']} / {case_id} / rep {result.get('rep', 0)} / "
+                    f"{ts}/{run_dirname}): status null, not timed out, no error, "
+                    f"output_tokens null. See 2026-07-29 instant-exit audit.",
+                    file=sys.stderr,
+                )
+                continue
             runs.append(run)
 
             # Battery-cost token aggregation (Anthropic provider only; see
-            # docstring). Timed-out runs are excluded (v3.1.2). Schema-v1 keeps
-            # its historical flat-field zero fallback byte-for-byte in effect so
-            # published battery calculations do not change. For schema-v2,
-            # missing categories make the run ineligible for this billing-grade
-            # token mix; explicit source zero remains valid evidence.
-            if run["provider"] == "anthropic" and not run["timed_out"]:
+            # docstring). Timed-out runs never reach this point (excluded at the
+            # chokepoint above, v3.3.0; the metric already excluded them since
+            # v3.1.2). Schema-v1 keeps its historical flat-field zero fallback
+            # byte-for-byte so published battery calculations do not change. For
+            # schema-v2, missing categories make the run ineligible for this
+            # billing-grade token mix; explicit source zero remains valid
+            # evidence.
+            # Providers whose per-run token mix feeds the battery-cost block.
+            # "anthropic" mixes are priced corpus-live at list rates; the
+            # "chatgpt-subscription" GPT-5.6 lane (v3.5.0, Fix 2) is priced on
+            # the api-equivalent counterfactual basis (load_model_pricing). The
+            # subscription lane carries no cache accounting, so its result.json
+            # records input_tokens/output_tokens with cache fields None —
+            # coerced to 0 below so the run stays eligible under the same
+            # uncached (full input rate) basis used everywhere.
+            if run["provider"] in ("anthropic", "chatgpt-subscription"):
                 if run["legacy_schema"]:
                     token_values = {
                         "input": result.get("input_tokens", 0) or 0,
@@ -1086,6 +1558,12 @@ def load_runs(results_dir, result_sets, cases):
                         "cache_read": result.get("cache_read_tokens"),
                         "cache_creation": result.get("cache_creation_tokens"),
                     }
+                if run["provider"] == "chatgpt-subscription":
+                    # None-tolerant cache fields: the subscription lane reports
+                    # no cache read/creation, so treat missing as explicit 0.
+                    for _cache_field in ("cache_read", "cache_creation"):
+                        if token_values[_cache_field] is None:
+                            token_values[_cache_field] = 0
                 if all(
                     isinstance(value, (int, float)) and not isinstance(value, bool)
                     for value in token_values.values()
@@ -1114,7 +1592,7 @@ def load_runs(results_dir, result_sets, cases):
         rs["billing_grade_cost_eligible"] = eligible
         rs["billing_grade_cost_exclusion_reason"] = reason
 
-    return runs, anth_token_totals
+    return runs, anth_token_totals, n_timed_out_excluded
 
 
 # ---------------------------------------------------------------------------
@@ -1386,7 +1864,44 @@ def load_model_pricing(base_dir):
     pricing = {}
     for entry in config.get("models", []):
         name = entry.get("name")
-        if not name or entry.get("provider", "anthropic") == "chatgpt-subscription":
+        if not name:
+            continue
+        provider = entry.get("provider", "anthropic")
+        if provider == "chatgpt-subscription":
+            # API-equivalent counterfactual pricing (v3.5.0, Fix 2). These
+            # GPT-5.6 models are accessed under a flat ChatGPT subscription and
+            # are NEVER invoiced per token, so no `pricing:` block exists.
+            # Price them at the published api_equivalent_pricing.short_context
+            # list rates as an explicit counterfactual — mirroring how the
+            # Anthropic subscription models are already priced at list rates.
+            # These entries carry pricing_basis="api-equivalent" so the battery
+            # block tags them a distinct basis and the leaderboard marks them
+            # api-equiv (vs the Anthropic corpus-live basis). NB: the schedule
+            # lives at entry["api_equivalent_pricing"]["short_context"], NOT
+            # under a `billing:` wrapper.
+            aep = entry.get("api_equivalent_pricing", {})
+            sc = aep.get("short_context", {}) if isinstance(aep, dict) else {}
+            if not isinstance(sc, dict):
+                continue
+            input_rate = sc.get("input")
+            output_rate = sc.get("output")
+            cached_rate = sc.get("cached_input")
+            if any(
+                isinstance(value, bool) or not isinstance(value, (int, float))
+                for value in (input_rate, output_rate)
+            ):
+                continue
+            pricing[name] = {
+                "input_per_million": round(input_rate, 4),
+                "output_per_million": round(output_rate, 4),
+                "cached_input_per_million": (
+                    round(cached_rate, 4)
+                    if isinstance(cached_rate, (int, float))
+                    and not isinstance(cached_rate, bool)
+                    else None
+                ),
+                "pricing_basis": "api-equivalent",
+            }
             continue
         p = entry.get("pricing", {})
         if not isinstance(p, dict):
@@ -1408,6 +1923,7 @@ def load_model_pricing(base_dir):
                 and not isinstance(cached_rate, bool)
                 else None
             ),
+            "pricing_basis": "list",
         }
     return pricing
 
@@ -1434,8 +1950,11 @@ def load_reconciliation(base_dir):
     candidates = sorted(_glob.glob(pattern))
     if not candidates:
         print("WARNING: no derived/openrouter_reconciliation_*.json found; "
-              "OpenRouter battery costs will be omitted "
-              "(run scripts/reconcile_openrouter_costs.py to produce one)",
+              "OpenRouter battery costs will be omitted (produce one from the "
+              "v2 classified billing parquet — precedent: the campaign "
+              "workspace's scripts/scratch/22_billing-tokenmix-json.py; the "
+              "legacy scripts/reconcile_openrouter_costs.py emitter is stale "
+              "for post-2026-07-27 data)",
               file=sys.stderr)
         return None
     path = candidates[-1]
@@ -1504,20 +2023,31 @@ def build_transcripts_index(result_sets, transcripts, subagent_transcripts):
 
 
 def build_data_bundle(result_sets, cases, runs, transcripts, subagent_transcripts,
-                      model_pricing=None, inline_transcripts=True):
+                      model_pricing=None, inline_transcripts=True,
+                      include_transcripts=True):
     """Assemble the DATA bundle for embedding in HTML.
 
-    Two artifact shapes (v3.0.0 — "Bundle architecture" dev guide above
-    PHASE_MAP):
-      inline_transcripts=True  (single-file monolith): transcripts and
-        subagent_transcripts embedded in full — the pre-3.0 shape.
-      inline_transcripts=False (bundle index.html): both transcript dicts
-        are DROPPED and replaced by transcripts_index pointing at the
-        per-result-set shard files written next to index.html.
+    Three artifact shapes, selected by (include_transcripts, inline_transcripts)
+    (v3.0.0 introduced the first two; v3.4.0 added the transcript-less shape —
+    see "Bundle architecture" and "Transcript-inclusion control" dev guides
+    above PHASE_MAP):
+      include_transcripts=True, inline_transcripts=True (full single-file
+        monolith): transcripts and subagent_transcripts embedded in full — the
+        pre-3.0 shape (single-file only under --transcripts as of v3.4.0).
+      include_transcripts=True, inline_transcripts=False (bundle index.html):
+        both transcript dicts are DROPPED from DATA and replaced by
+        transcripts_index pointing at the per-result-set shard files written
+        next to index.html. The v3.0.0 bundle default.
+      include_transcripts=False (transcript-less, either mode): DATA carries
+        NEITHER transcripts/subagent_transcripts NOR transcripts_index. This is
+        the v3.4.0 single-file default (transcript-lite offline monolith) and
+        the bundle behavior under --no-transcripts. The client feature-detects
+        the absence of both keys and shows a "transcripts not included in this
+        build" notice instead of attempting any shard fetch.
     The transcripts/subagent_transcripts and transcripts_index keys are
     mutually exclusive BY DESIGN: the template feature-detects the artifact
-    shape on DATA.transcripts presence, and a single-file artifact carrying
-    an index (or vice versa) would make the mode ambiguous.
+    shape on DATA.transcripts / DATA.transcripts_index presence, so the three
+    shapes (inline / lazy-index / neither) are each unambiguous.
     """
     # Sort result_sets by phase order so they always appear Phase 1, 2, 3, 4
     sorted_result_sets = sorted(
@@ -1525,14 +2055,19 @@ def build_data_bundle(result_sets, cases, runs, transcripts, subagent_transcript
     )
     bundle = {
         "generated_at": datetime.now(timezone.utc).isoformat(),
-        "generator_version": "3.2.0",
+        "generator_version": "3.7.2",
         "embedded_schema_contract_version": 2,
         "result_sets": sorted_result_sets,
         "cases": cases,
         "runs": runs,
         "model_pricing": model_pricing or {},
     }
-    if inline_transcripts:
+    if not include_transcripts:
+        # Transcript-less shape: emit neither key. The client's three-way
+        # feature detect (DATA.transcripts -> inline; DATA.transcripts_index ->
+        # lazy; neither -> "not included" notice) covers this.
+        pass
+    elif inline_transcripts:
         bundle["transcripts"] = transcripts
         bundle["subagent_transcripts"] = subagent_transcripts
     else:
@@ -1588,23 +2123,32 @@ def build_data_bundle(result_sets, cases, runs, transcripts, subagent_transcript
 #   new tier starts wherever the gap to the previous model's composite is
 #   >= TIER_GAP_THRESHOLD (5 percentage points).
 #
-#   Fallback (range quartiles): if the gap rule yields fewer than
-#   TIER_MIN_TIERS tiers across a corpus of >= TIER_FALLBACK_MIN_MODELS
-#   models — which happens on the real corpus, where the largest observed
-#   composite gap is ~6.8 points at the original 8-point threshold and the
-#   scores form a near-continuum — models are instead banded by which
-#   quarter of the composite range [min, max] their score falls in
-#   (equal-width bands; empty bands are skipped so tier labels stay
-#   contiguous T1, T2, ...).
+#   Fallback (range quartiles): on a corpus of >= TIER_FALLBACK_MIN_MODELS
+#   models, the gap rule is overridden by equal-width range-quartile banding
+#   when EITHER degeneracy appears:
+#     (a) it yields fewer than TIER_MIN_TIERS tiers — the near-continuum case,
+#         where the largest observed composite gap is ~6.8 points at the
+#         original 8-point threshold; OR
+#     (b) its largest tier holds more than TIER_MAX_TIER_SHARE of the ranked
+#         models (v3.5.0, Fix 4 — the "share cap"). Post-rescore score
+#         compression can leave >= 3 tiers while dumping the vast majority into
+#         one band (observed T1=25/T2=2/T3=2, largest interior gap 0.0428 <
+#         threshold), which is just as uninformative as a single band. The
+#         share cap catches that even though the tier-count test (a) passes.
+#   Both trigger the same range-quartile rebanding: models are banded by which
+#   quarter of the composite range [min, max] their score falls in (equal-width
+#   bands; empty bands are skipped so tier labels stay contiguous T1, T2, ...).
 #
 # The applied method is recorded in PRECOMPUTED["tier_rule"] so the viewer's
 # leaderboard prose can disclose which rule produced the bands on this corpus.
 TIER_GAP_THRESHOLD = 0.05
 TIER_MIN_TIERS = 3
 TIER_FALLBACK_MIN_MODELS = 12
+TIER_MAX_TIER_SHARE = 0.5  # Fix 4: gap rule is overridden if its largest tier
+                           # exceeds this share of ranked models (share cap).
 
 
-def build_eval_groups(result_sets):
+def build_eval_groups(result_sets, active_timestamps=None):
     """Build eval groups, mirroring the viewer JS buildEvalGroups() split.
 
     Phase 1 and Phase 2 are single groups. Phase 3 result sets that carry
@@ -1612,9 +2156,34 @@ def build_eval_groups(result_sets):
     (3a — scored on run['criteria']) and a subagent group (3b — scored on
     run['subagent_criteria']). The eval-group semantics here must stay in
     lockstep with the template JS so precomputed and JS-derived numbers agree.
+
+    Degenerate-column suppression (v3.5.0, Fix 3): a result set contributes a
+    leaderboard column group only if it clears three gates. These skips are
+    COLUMN-DERIVATION-SCOPED — the underlying runs still count in the all-runs
+    aggregates (consistency, per_case, cost, duration), which iterate DATA.runs
+    directly rather than through eval groups:
+      1. phase != "unknown" — detect_phase() falls back to "unknown" on
+         empty/aborted/mid-write summary.json sets whose criteria match no
+         known phase marker; such a set must not spawn an "Unknown Phase"
+         column.
+      2. the set has >= 1 completed (loaded) run — `active_timestamps` is the
+         set of result_set timestamps present in the loaded runs (post
+         load-time no-signal exclusion). A set with zero loaded runs produces
+         only an empty column. When active_timestamps is None the gate is
+         disabled (back-compat).
+      3. a dispatch_compliance set lacking subagent criterion names is FOLDED
+         into the dispatch group (3a) rather than emitting a bare, second
+         `dispatch_compliance` column — its main criteria are scored exactly
+         like any other 3a set.
     """
     gmap = {}
     for rs in result_sets:
+        # Gate 1: skip the Unknown-Phase fallback bucket.
+        if rs["phase"] == "unknown":
+            continue
+        # Gate 2: skip sets with no loaded/completed runs (empty column).
+        if active_timestamps is not None and rs["timestamp"] not in active_timestamps:
+            continue
         if rs["phase"] == "dispatch_compliance" and rs.get("subagent_criterion_names"):
             gid = "dispatch_compliance_dispatch"
             if gid not in gmap:
@@ -1634,6 +2203,18 @@ def build_eval_groups(result_sets):
                     "criterion_names": list(rs["subagent_criterion_names"]),
                 }
             gmap[gid]["timestamps"].append(rs["timestamp"])
+        elif rs["phase"] == "dispatch_compliance":
+            # Gate 3: subagent-less dc set — fold into the 3a dispatch group
+            # instead of emitting a bare `dispatch_compliance` column.
+            gid = "dispatch_compliance_dispatch"
+            if gid not in gmap:
+                gmap[gid] = {
+                    "id": gid, "phase": rs["phase"],
+                    "label": "Phase 3a — Dispatch Compliance",
+                    "timestamps": [], "is_subagent": False,
+                    "criterion_names": list(rs["criterion_names"]),
+                }
+            gmap[gid]["timestamps"].append(rs["timestamp"])
         else:
             gid = rs["phase"]
             if gid not in gmap:
@@ -1661,7 +2242,10 @@ def build_precomputed(result_sets, cases, runs, generation_params,
                       model_pricing=None, anth_token_totals=None,
                       reconciliation=None):
     """Compute the derived-metrics bundle embedded as PRECOMPUTED."""
-    groups = build_eval_groups(result_sets)
+    # active_timestamps drives Fix 3 Gate 2: only result sets with >= 1 loaded
+    # (completed, post-exclusion) run may spawn a leaderboard column.
+    active_timestamps = {r["result_set"] for r in runs}
+    groups = build_eval_groups(result_sets, active_timestamps)
     group_ts = {g["id"]: set(g["timestamps"]) for g in groups}
     models = sorted({r["model"] for r in runs})
     phase_lookup = {rs["timestamp"]: rs["phase"] for rs in result_sets}
@@ -1805,15 +2389,24 @@ def compute_tiers_for(composite_dict):
             entry["tier"] = tiers[-1]["label"]
             prev_score = entry["score"]
         tier_rule = {"method": "gap", "gap_threshold": TIER_GAP_THRESHOLD}
-        # Stage 2 (fallback): on a large corpus whose composites form a
-        # near-continuum, the gap rule degenerates to a single band. If it
-        # produced fewer than TIER_MIN_TIERS tiers across >=
-        # TIER_FALLBACK_MIN_MODELS models, band instead by which quarter of
-        # the composite range [min, max] each score falls in. Walking the
-        # descending ranking, band indices are non-decreasing, so a band
-        # change starts a new tier; empty bands are skipped and labels stay
-        # contiguous.
-        if len(ranked) >= TIER_FALLBACK_MIN_MODELS and len(tiers) < TIER_MIN_TIERS:
+        # Stage 2 (fallback): on a large corpus (>= TIER_FALLBACK_MIN_MODELS)
+        # the gap rule is overridden by range-quartile banding when it
+        # degenerates in either of two ways — too few tiers (near-continuum),
+        # or a single tier dominating the field (v3.5.0, Fix 4 share cap:
+        # largest tier > TIER_MAX_TIER_SHARE of ranked models, even with >= 3
+        # tiers). Both cases band by which quarter of the composite range
+        # [min, max] each score falls in. Walking the descending ranking, band
+        # indices are non-decreasing, so a band change starts a new tier; empty
+        # bands are skipped and labels stay contiguous.
+        largest_tier_share = (
+            max((len(t["models"]) for t in tiers), default=0) / len(ranked)
+            if ranked else 0
+        )
+        share_cap_exceeded = largest_tier_share > TIER_MAX_TIER_SHARE
+        too_few_tiers = len(tiers) < TIER_MIN_TIERS
+        if len(ranked) >= TIER_FALLBACK_MIN_MODELS and (
+            too_few_tiers or share_cap_exceeded
+        ):
             hi = ranked[0][1]["score"]
             lo = ranked[-1][1]["score"]
             span = hi - lo
@@ -1829,8 +2422,15 @@ def compute_tiers_for(composite_dict):
                         prev_band = band
                     tiers[-1]["models"].append(model)
                     entry["tier"] = tiers[-1]["label"]
-                tier_rule = {"method": "range_quartiles",
-                             "gap_threshold": TIER_GAP_THRESHOLD}
+                tier_rule = {
+                    "method": "range_quartiles",
+                    "gap_threshold": TIER_GAP_THRESHOLD,
+                    # Which degeneracy forced the fallback (Fix 4 disclosure).
+                    "fallback_trigger": (
+                        "min_tiers" if too_few_tiers else "share_cap"
+                    ),
+                    "max_tier_share": TIER_MAX_TIER_SHARE,
+                }
         return tiers, tier_rule
 
     tiers, tier_rule = compute_tiers_for(composite)
@@ -1855,10 +2455,25 @@ def compute_tiers_for(composite_dict):
             1 for grades in multi.values()
             if all(gr == "perfect" for gr in grades)
         )
+        # Agreement/predictability (v3.7.0): a cell "agrees" when every rep
+        # lands on the IDENTICAL grade (all perfect, OR all partial, OR all
+        # failed, OR all ungraded) — i.e., the model produces the same verdict
+        # on repeat attempts. Distinct from cells_all_perfect: that measures
+        # capability (all reps clean), whereas agreement measures reliability
+        # decoupled from score level (a model that fails identically every time
+        # is predictable, if not good). Powers the Key Takeaways "reliability
+        # and predictability" claim (fillTakeaways T4), which contrasts a
+        # top-tier model's agreement rate against a budget-tier one.
+        all_agree = sum(
+            1 for grades in multi.values()
+            if len(set(grades)) == 1
+        )
         consistency[model] = {
             "cells_total": len(multi),
             "cells_all_perfect": all_perfect,
             "rate": rnd(all_perfect / len(multi)) if multi else None,
+            "cells_all_agree": all_agree,
+            "rate_agree": rnd(all_agree / len(multi)) if multi else None,
         }
 
     # --- per_case: cross-model difficulty ---
@@ -1967,21 +2582,41 @@ def compute_tiers_for(composite_dict):
             if run.get("billing_grade_cost_eligible") is False
         ]
         if incompatible:
-            reasons = sorted({
-                run.get("billing_grade_cost_exclusion_reason")
-                for run in incompatible
-                if run.get("billing_grade_cost_exclusion_reason")
-            })
-            cost["omitted_models"].append({
-                "model": model,
-                "providers": providers,
-                "reason": (
-                    reasons[0] if len(reasons) == 1
-                    else "mixed_incompatible_billing_treatments"
-                ),
-                "behavioral_scores_retained": True,
-            })
-            continue
+            # A model flagged not-billing-grade (e.g. chatgpt-subscription:
+            # subscription access, never invoiced per token). v3.5.0 (Fix 2):
+            # if an api-equivalent counterfactual price schedule exists for the
+            # model, price it on that explicit basis instead of omitting it —
+            # the battery figure is already a counterfactual (uncached list
+            # rates) for every provider, so an api-equivalent GPT estimate is
+            # directly comparable. We deliberately do NOT flip the run/set-level
+            # billing_grade_cost_eligible flag: these models remain correctly
+            # disclosed as not-invoiced in the run-detail ledger, and only the
+            # counterfactual battery estimate includes them (tagged api-equiv).
+            # Models with no api-equivalent schedule are omitted exactly as
+            # before.
+            p_api = pricing.get(model)
+            has_api_equiv = (
+                isinstance(p_api, dict)
+                and p_api.get("pricing_basis") == "api-equivalent"
+                and p_api.get("input_per_million") is not None
+                and p_api.get("output_per_million") is not None
+            )
+            if not has_api_equiv:
+                reasons = sorted({
+                    run.get("billing_grade_cost_exclusion_reason")
+                    for run in incompatible
+                    if run.get("billing_grade_cost_exclusion_reason")
+                })
+                cost["omitted_models"].append({
+                    "model": model,
+                    "providers": providers,
+                    "reason": (
+                        reasons[0] if len(reasons) == 1
+                        else "mixed_incompatible_billing_treatments"
+                    ),
+                    "behavioral_scores_retained": True,
+                })
+                continue
         p = pricing.get(model)
         if not p:
             continue
@@ -2013,8 +2648,8 @@ def compute_tiers_for(composite_dict):
     # completion per covered run; the harness's OpenRouter token counts are
     # tokenizer approximations and are never used for dollars). Full metric
     # definition + staleness-guard rationale: "Battery-cost metric" dev guide
-    # above PHASE_MAP. Per-model timed-out shares live in timeout_by_model —
-    # referenced by the template, not duplicated here.
+    # above PHASE_MAP. Timed-out runs are excluded upstream at load (v3.3.0),
+    # so these token averages already reflect completed runs only.
     BATTERY_REFERENCE_MODEL = "Opus 4.8"
     battery_size = len(case_runs)  # distinct case_ids in the loaded corpus
     snapshot_date = (reconciliation or {}).get("_snapshot_date")
@@ -2029,12 +2664,19 @@ def compute_tiers_for(composite_dict):
                       + agg["cache_creation"]) / n
         output_side = agg["output"] / n
         per_run = (input_side * pm["input"] + output_side * pm["output"]) / 1e6
+        # Basis tag distinguishes the two live-token lanes sharing this loop:
+        # Anthropic mixes are "corpus-live" (billing-grade usage meter);
+        # chatgpt-subscription GPT mixes are "api-equivalent" (v3.5.0, Fix 2 —
+        # counterfactual list price, not invoiced). The template surfaces the
+        # distinction as an "api-equiv" marker on the leaderboard cost cell.
+        model_basis = (pricing.get(model, {}) or {}).get("pricing_basis")
         battery_models[model] = {
             "est_cost_per_run": rnd(per_run),
             "est_battery_cost": rnd(per_run * battery_size, 2),
             "tokens_per_run": round(input_side + output_side),
             "n_runs": n,
-            "basis": "corpus-live",
+            "basis": ("api-equivalent" if model_basis == "api-equivalent"
+                      else "corpus-live"),
         }
 
     if reconciliation:
@@ -2183,6 +2825,108 @@ def compute_tiers_for(composite_dict):
                         best_score = score
                 cost["frontiers"][form][basis][metric] = frontier
 
+    # --- duration.battery: estimated wall-clock latency per battery (v3.3.0) ---
+    # A real-world LATENCY proxy, mirroring cost.battery but needing no pricing
+    # — so it covers EVERY model (Anthropic, OpenRouter, AND the cost-omitted
+    # subscription lane), never gated on provider or billing eligibility. Built
+    # from SUMMED per-run duration_s: est_duration_per_run = mean duration_s
+    # over that model's completed runs (timed-out runs never reach `runs`),
+    # est_battery_duration = per-run x battery_size (the SAME distinct-case
+    # count the cost block uses). Per-run durations are parallelization-
+    # INVARIANT (independent of config.parallel), unlike summary wall_time_s
+    # (a batch clock that depends on run mode) — so the figure is comparable
+    # across sets fetched serially vs in parallel. duration_multiplier_vs_ref
+    # is vs BATTERY_REFERENCE_MODEL (Opus 4.8), derived from the stored per-run
+    # figure exactly as cost_multiplier_vs_ref is.
+    DURATION_REFERENCE_MODEL = BATTERY_REFERENCE_MODEL
+    duration_models = {}
+    for model in models:
+        # Duration/latency aggregate contribution rules (Dispatch B + review fix):
+        #   - stalled runs are ALWAYS excluded: their wall time is a
+        #     watchdog-killed hang, not a task-completion measure, and never
+        #     comparable to a real duration.
+        #   - completed_early runs contribute score_complete_seconds when present
+        #     (time-to-demonstrated-compliance: launch -> first score-complete
+        #     pass, excluding the confirmation/kill tail), else are excluded. This
+        #     keeps the duration axis populated with a meaningful "time to all
+        #     criteria pass" measure instead of dropping early-stopped runs — but
+        #     note it is NOT full-task walltime (see README § 8; label accordingly).
+        #   - every other run contributes its full duration_s.
+        # Keyed on the exact "completed_early"/"stalled" status strings.
+        durs = []
+        for r in runs:
+            if r["model"] != model:
+                continue
+            status = r.get("status")
+            if status == "stalled":
+                continue
+            if status == "completed_early":
+                val = r.get("score_complete_seconds")
+            else:
+                val = r["duration_s"]
+            if isinstance(val, (int, float)) and not isinstance(val, bool):
+                durs.append(val)
+        if not durs:
+            continue
+        n = len(durs)
+        per_run = sum(durs) / n
+        duration_models[model] = {
+            "est_duration_per_run": rnd(per_run),
+            "est_battery_duration": rnd(per_run * battery_size, 1),
+            "n_runs": n,
+            "basis": "corpus-live",
+        }
+    dref_entry = duration_models.get(DURATION_REFERENCE_MODEL)
+    for model, d in duration_models.items():
+        if dref_entry and dref_entry["est_duration_per_run"]:
+            d["duration_multiplier_vs_ref"] = rnd(
+                d["est_duration_per_run"] / dref_entry["est_duration_per_run"], 3)
+        else:
+            d["duration_multiplier_vs_ref"] = None
+
+    # duration.frontiers[basis][metric]: Pareto staircase on
+    # (duration asc, score desc), reusing perf_values (already built over
+    # completed runs) for the y-values. A SEPARATE block (not a parallel
+    # cost.frontiers "form") because duration covers models the cost block
+    # omits — folding it into cost.frontiers[form] would silently restrict it
+    # to priced models. Identical staircase walk to the cost frontier. The
+    # template divides every plotted duration by the reference model's
+    # est_battery_duration (durScale, a clone of batScale) to render a relative
+    # multiplier, exactly as the battery axis does.
+    duration_frontiers = {}
+    for basis in perf_bases:
+        duration_frontiers[basis] = {}
+        for metric in ("perfect", "hard"):
+            frontier_pts = []
+            for model, score_val in perf_values[basis][metric].items():
+                dm = duration_models.get(model)
+                if dm is None:
+                    continue
+                price = dm["est_battery_duration"]
+                if price is None or price <= 0:
+                    continue
+                frontier_pts.append((price, -score_val, model))
+            frontier_pts.sort()
+            frontier = []
+            best_score = None
+            for price, neg_score, model in frontier_pts:
+                score = -neg_score
+                if best_score is None or score > best_score:
+                    frontier.append({
+                        "model": model,
+                        "price": price,
+                        "score": score,
+                    })
+                    best_score = score
+            duration_frontiers[basis][metric] = frontier
+
+    duration = {
+        "battery_size": battery_size,
+        "reference_model": DURATION_REFERENCE_MODEL,
+        "models": duration_models,
+        "frontiers": duration_frontiers,
+    }
+
     # --- provenance: per result set, manifest + disk-vs-summary disclosure ---
     provenance = []
     for rs in sorted(result_sets,
@@ -2209,33 +2953,23 @@ def compute_tiers_for(composite_dict):
             "summary_total_runs": rs.get("summary_total_runs", 0),
             "run_count_discrepancy":
                 rs.get("disk_run_count", 0) != rs.get("summary_total_runs", 0),
+            # Partial-pass disclosure (progressive-archiving redesign, 2026-07).
+            "partial": rs.get("partial", False),
+            "runs_expected": rs.get("runs_expected"),
+            "runs_completed": rs.get("runs_completed"),
+            "error_counts": rs.get("error_counts"),
         })
 
-    # --- timeout_by_model: per-model timed-out run rates ---
-    # Basis: the harness's explicit timed_out flag over ALL of a model's
-    # loaded runs (all phases pooled). This flag covers genuine wall-clock
-    # timeouts AND silent stalls that ran out the clock — a broader measure
-    # than any transcript-level stall forensics (e.g., README's silent-stall
-    # figures); prose citing these rates must name this basis. Precomputed
-    # here (not hand-copied) so the Key Takeaways section's reliability
-    # claims cannot drift from the data.
-    timeout_by_model = {}
-    for model in models:
-        mruns = [r for r in runs if r["model"] == model]
-        n_to = sum(1 for r in mruns if r["timed_out"])
-        timeout_by_model[model] = {
-            "n_runs": len(mruns),
-            "n_timed_out": n_to,
-            "rate": rnd(n_to / len(mruns)) if mruns else None,
-        }
-
     # --- totals ---
+    # Timeout-blind (v3.3.0): timed-out runs were excluded at load, so
+    # total_runs counts completed runs only and there is no per-corpus timeout
+    # count here. The per-load excluded count is a console-only maintainer
+    # diagnostic (print_summary), never embedded in the payload.
     totals = {
         "total_runs": len(runs),
         "n_models": len(models),
         "n_cases": len(case_runs),
         "n_result_sets": len(result_sets),
-        "n_timed_out": sum(1 for r in runs if r["timed_out"]),
         "generation_params": generation_params,
     }
 
@@ -2256,7 +2990,7 @@ def compute_tiers_for(composite_dict):
         "per_case": per_case,
         "callouts": callouts,
         "cost": cost,
-        "timeout_by_model": timeout_by_model,
+        "duration": duration,
         "provenance": provenance,
         "totals": totals,
     }
@@ -2376,7 +3110,8 @@ def write_transcript_shards(bundle_dir, index, transcripts, subagent_transcripts
 # Print summary
 # ---------------------------------------------------------------------------
 
-def print_summary(data_bundle, transcripts, subagent_transcripts):
+def print_summary(data_bundle, transcripts, subagent_transcripts,
+                  n_timed_out_excluded=0):
     """Print a summary of what was loaded.
 
     Takes the loaded transcript dicts directly (not from data_bundle):
@@ -2410,6 +3145,7 @@ def print_summary(data_bundle, transcripts, subagent_transcripts):
     total_transcripts = len(transcripts)
     total_subagent = sum(len(v) for v in subagent_transcripts.values())
     total_cases = len(data_bundle["cases"])
+    transcripts_included = "transcripts" in data_bundle or "transcripts_index" in data_bundle
     observed_set_costs = [
         rs["total_cost_usd"] for rs in data_bundle["result_sets"]
         if isinstance(rs.get("total_cost_usd"), (int, float))
@@ -2419,10 +3155,19 @@ def print_summary(data_bundle, transcripts, subagent_transcripts):
 
     print(f"  Totals:")
     print(f"    Result sets:           {len(data_bundle['result_sets'])}")
-    print(f"    Runs loaded:           {total_runs}")
+    print(f"    Runs loaded:           {total_runs} completed")
+    print(f"    No-signal excluded:    {n_timed_out_excluded} "
+          f"(timed_out flag, status stalled/timed_out, or legacy instant-exit "
+          f"stub; dropped at load, absent from all metrics and the embedded "
+          f"data)")
     print(f"    Cases loaded:          {total_cases}")
-    print(f"    Transcripts condensed: {total_transcripts}")
-    print(f"    Subagent transcripts:  {total_subagent}")
+    if transcripts_included:
+        print(f"    Transcripts condensed: {total_transcripts}")
+        print(f"    Subagent transcripts:  {total_subagent}")
+    else:
+        print(f"    Transcripts:           EXCLUDED from this build "
+              f"(--no-transcripts / single-file default; DATA carries neither "
+              f"transcripts nor transcripts_index)")
     total_cost_label = f"${total_cost:.2f}" if total_cost is not None else "unavailable"
     print(f"    Total cost:            {total_cost_label}")
     print()
@@ -2491,10 +3236,23 @@ def print_precomputed_report(precomputed):
     totals = precomputed["totals"]
     n_disc = sum(1 for p in precomputed["provenance"] if p["run_count_discrepancy"])
     gw = precomputed["callouts"]["global_weakest"]
-    print(f"  Total runs: {totals['total_runs']} "
-          f"({totals['n_timed_out']} timed out) | "
+    # Timed-out runs were excluded at load (v3.3.0); total_runs already counts
+    # completed runs only. The per-load excluded count is reported by
+    # print_summary (which receives it) — it is not in this function's scope.
+    print(f"  Total runs: {totals['total_runs']} completed | "
           f"models: {totals['n_models']} | cases: {totals['n_cases']} | "
           f"sets: {totals['n_result_sets']} ({n_disc} with run-count discrepancy)")
+    # Partial-pass disclosure: a partial summary is mid-flight or was killed
+    # before completing all expected runs (progressive-archiving redesign).
+    partial_sets = [p for p in precomputed["provenance"] if p.get("partial")]
+    if partial_sets:
+        print(f"  PARTIAL result sets ({len(partial_sets)} — incomplete passes):")
+        for p in partial_sets:
+            done = p.get("runs_completed")
+            exp = p.get("runs_expected")
+            frac = f"{done}/{exp}" if done is not None and exp is not None else "?"
+            print(f"    {p['timestamp']} ({p['phase_label']}): "
+                  f"{frac} runs completed")
     print(f"  Pricing loaded for {len(precomputed['cost'].get('models', []))} models "
           f"(published list rates; observed spend tracking removed)")
     excluded = (totals.get("generation_params") or {}).get("results_excluded") or []
@@ -2516,9 +3274,21 @@ def main():
     base_dir, results_dir, datasets_dir, output_path = resolve_paths(args)
     single_file = args.single_file is not None
 
+    # Transcript inclusion (v3.4.0). Tri-state: an explicit --transcripts/
+    # --no-transcripts wins; otherwise the mode default applies — bundle
+    # INCLUDES (lazy shards, the official website artifact), single-file
+    # EXCLUDES (transcript-lite offline monolith). See parse_args and the
+    # "Transcript-inclusion control" dev guide above PHASE_MAP.
+    if args.transcripts is None:
+        include_transcripts = not single_file
+    else:
+        include_transcripts = args.transcripts
+
+    tx_state = "included" if include_transcripts else "EXCLUDED"
     print(f"Results dir: {results_dir}")
     print(f"Datasets dir: {datasets_dir}")
-    print(f"Output ({'single-file' if single_file else 'bundle'}): {output_path}")
+    print(f"Output ({'single-file' if single_file else 'bundle'}, "
+          f"transcripts {tx_state}): {output_path}")
 
     # Load data
     result_sets = load_result_sets(results_dir, args.results, args.exclude_results)
@@ -2527,7 +3297,8 @@ def main():
         sys.exit(1)
 
     cases = load_cases(datasets_dir)
-    runs, anth_token_totals = load_runs(results_dir, result_sets, cases)
+    runs, anth_token_totals, n_timed_out_excluded = load_runs(
+        results_dir, result_sets, cases)
 
     # Renumber reps globally: runs from different result sets for the same
     # (phase, model, case_id) all have rep=0. Assign sequential rep numbers
@@ -2541,7 +3312,13 @@ def main():
         run["rep"] = rep_counters[key]
         rep_counters[key] += 1
 
-    transcripts, subagent_transcripts = load_transcripts(results_dir, runs)
+    # Transcript condensation is the expensive load step and the dominant byte
+    # source; skip it entirely when the build excludes transcripts (v3.4.0
+    # single-file default and bundle --no-transcripts).
+    if include_transcripts:
+        transcripts, subagent_transcripts = load_transcripts(results_dir, runs)
+    else:
+        transcripts, subagent_transcripts = {}, {}
     model_pricing = load_model_pricing(base_dir)
     reconciliation = load_reconciliation(base_dir)
 
@@ -2551,6 +3328,7 @@ def main():
         result_sets, cases, runs, transcripts, subagent_transcripts,
         model_pricing=model_pricing,
         inline_transcripts=single_file,
+        include_transcripts=include_transcripts,
     )
 
     # Precomputed metrics (embedded as PRECOMPUTED alongside DATA)
@@ -2558,6 +3336,7 @@ def main():
         "results_filter": args.results if args.results else "all",
         "results_excluded": args.exclude_results if args.exclude_results else [],
         "output_mode": "single-file" if single_file else "bundle",
+        "transcripts_included": include_transcripts,
         "generated_at": data_bundle["generated_at"],
         "generator_version": data_bundle["generator_version"],
     }
@@ -2567,7 +3346,8 @@ def main():
                                     reconciliation=reconciliation)
 
     # Print summaries
-    print_summary(data_bundle, transcripts, subagent_transcripts)
+    print_summary(data_bundle, transcripts, subagent_transcripts,
+                  n_timed_out_excluded)
     print_precomputed_report(precomputed)
 
     # Generate HTML
@@ -2586,20 +3366,27 @@ def main():
         index_path = os.path.join(output_path, "index.html")
         with open(index_path, "w", encoding="utf-8") as f:
             f.write(html)
-        n_shards, shard_bytes, largest = write_transcript_shards(
-            output_path, data_bundle["transcripts_index"],
-            transcripts, subagent_transcripts)
         index_mb = os.path.getsize(index_path) / (1024 * 1024)
         print(f"  Bundle written: {output_path}/")
         print(f"    index.html:  {index_mb:.2f} MB")
-        print(f"    Shards:      {n_shards} files, "
-              f"{shard_bytes / (1024 * 1024):.2f} MB total in data/")
-        if largest[0]:
-            print(f"    Largest:     {shard_filename(largest[0])} "
-                  f"({largest[1] / (1024 * 1024):.2f} MB)")
-        print(f"  Serve over http(s) — transcripts are fetched on demand "
-              f"(e.g. `python3 -m http.server` from the bundle dir); on "
-              f"file:// the Run Explorer shows a fetch-fallback message.")
+        if include_transcripts:
+            # transcripts_index is present on DATA only when transcripts are
+            # included; shards are written next to index.html.
+            n_shards, shard_bytes, largest = write_transcript_shards(
+                output_path, data_bundle["transcripts_index"],
+                transcripts, subagent_transcripts)
+            print(f"    Shards:      {n_shards} files, "
+                  f"{shard_bytes / (1024 * 1024):.2f} MB total in data/")
+            if largest[0]:
+                print(f"    Largest:     {shard_filename(largest[0])} "
+                      f"({largest[1] / (1024 * 1024):.2f} MB)")
+            print(f"  Serve over http(s) — transcripts are fetched on demand "
+                  f"(e.g. `python3 -m http.server` from the bundle dir); on "
+                  f"file:// the Run Explorer shows a fetch-fallback message.")
+        else:
+            print(f"    Shards:      none (--no-transcripts; index.html only)")
+            print(f"  Transcript-less bundle — the Run Explorer shows a "
+                  f"'transcripts not included in this build' notice.")
     print(f"  Done.\n")
 
 
diff --git a/benchmarks/scripts/reconcile_openrouter_costs.py b/benchmarks/scripts/reconcile_openrouter_costs.py
index 02efdb10..043dc299 100644
--- a/benchmarks/scripts/reconcile_openrouter_costs.py
+++ b/benchmarks/scripts/reconcile_openrouter_costs.py
@@ -42,6 +42,12 @@
 DEFAULT_OUT = os.path.join(BASE_DIR, "derived",
                            "openrouter_reconciliation_2026-06-11.json")
 
+# ⚠ STALE EXCLUSION (2026-07-29): gemini-3.5-flash became a REGISTERED campaign
+# model on 2026-07-27; the blanket exclusion below is only valid for the June
+# 2026 export this script was written against. For any reconciliation touching
+# post-2026-07-27 data, use the v2 pipeline instead (campaign workspace
+# scripts/scratch/19-21_billing-*-v2.py), which replaces this static exclusion
+# with empirical per-slug registration-date boundaries.
 # Known non-benchmark spend on this API key (user-confirmed):
 #   - all gemini-3.5-flash rows (preliminary testing; zero corpus runs)
 #   - anthropic/* rows (probe tests)
diff --git a/benchmarks/scripts/rescore_archives.py b/benchmarks/scripts/rescore_archives.py
new file mode 100644
index 00000000..1e3d3d4a
--- /dev/null
+++ b/benchmarks/scripts/rescore_archives.py
@@ -0,0 +1,492 @@
+#!/usr/bin/env python3
+"""Re-score archived dispatch_compliance result sets under the CURRENT scorer.
+
+Motivation
+----------
+DAAFBench archives are immutable as to their MEASUREMENT and PROVENANCE fields
+(tokens, cost, timing, transcripts, route identity — see README § 8). They are
+NOT frozen against correction of a scoring VERDICT that was produced by an
+incorrect scorer. When a deterministic scoring bug is fixed, the archived
+transcripts (which stay untouched) can be re-scored under the corrected
+criteria. This is that sanctioned, provenance-stamped rescore path.
+
+Concretely this addresses the 2026-07-28 heading-normalization fix in
+``score_dispatch_compliance`` (criteria ``prompt_has_task_section`` /
+``prompt_has_context_section`` / ``prompt_has_instructions``), which replaced
+case-sensitive exact-label matching with structural concept matching. The number
+of archived criterion FAILs this flips to PASS is archive-dependent — it varies
+with how many stored dispatch prompts used synonym headings (e.g. GPT prompts
+using ``## Output format``), and may be large or small for any given result set.
+
+What it does
+------------
+For every ``results/*/`` set whose manifest identifies it as
+``dispatch_compliance`` (or whose cases are ``dc-*``), for every
+``runs/*/`` directory with a ``transcript.jsonl``:
+
+  * Re-derive ``checkpoint_line_count`` and the case ``expected`` dict from the
+    set's OWN golden checkpoint + manifest, exactly as the runner's
+    ``score_run`` does, so rescored values are comparable to a fresh run.
+  * Re-run the CURRENT ``score_dispatch_compliance`` (with the run dir's
+    archived ``subagents/`` as recovery evidence) and, where a ``subagents/``
+    directory exists, ``score_subagent_behavior_from_transcripts``.
+  * Rewrite ONLY the ``criteria`` / ``subagent_criteria`` pass fields of
+    ``result.json``, preserving every other field, and additively stamp
+    ``rescored_at`` (ISO-8601 UTC) + ``rescore_reason``.
+  * Recompute the criteria-derived rollups of ``summary.json`` (criterion
+    names, per-model + per-case pass rates, subagent-behavior rollup),
+    preserving cost / coverage / error_counts / tool_failures untouched, and
+    stamp ``rescored_at``.
+
+Transcripts are NEVER modified. Non-dispatch batteries are NEVER touched.
+
+Usage
+-----
+  python3 benchmarks/scripts/rescore_archives.py            # dry-run (default)
+  python3 benchmarks/scripts/rescore_archives.py --apply    # write changes
+
+Import-light and function-structured (a benchmark utility, not a DAAF research
+pipeline script): sequential-inline style does not apply here.
+"""
+
+import argparse
+import json
+import os
+import sys
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+
+# --- Config ---
+# Make the repo root importable so `benchmarks.*` resolves when this script is
+# run directly (python3 benchmarks/scripts/rescore_archives.py).
+REPO_ROOT = Path(__file__).resolve().parents[2]
+if str(REPO_ROOT) not in sys.path:
+    sys.path.insert(0, str(REPO_ROOT))
+
+from benchmarks.scorers.deterministic.checkpoint_adherence import (
+    get_checkpoint_line_count,
+)
+from benchmarks.scorers.deterministic.dispatch_compliance import (
+    score_dispatch_compliance,
+)
+from benchmarks.scorers.deterministic.subagent_behavior import (
+    score_subagent_behavior_from_transcripts,
+)
+from benchmarks.harness.artifacts import is_scorable
+
+BASE_DIR = Path("/daaf")
+RESCORE_REASON = "heading-normalization-2026-07-28"
+
+
+def load_json(path: Path):
+    """Load a JSON file, returning None on any read/parse error."""
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except (OSError, ValueError):
+        return None
+
+
+def atomic_write_json(path: Path, obj) -> None:
+    """Write JSON to ``path`` atomically (temp file in the same dir + replace)."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=str(path.parent), suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(obj, f, indent=2)
+            f.write("\n")
+        os.replace(tmp, path)
+    finally:
+        if os.path.exists(tmp):
+            os.remove(tmp)
+
+
+def is_dispatch_set(manifest: dict) -> bool:
+    """True when a result set is a dispatch_compliance battery.
+
+    Primary signal: manifest ``benchmark`` == "dispatch_compliance". Fallback:
+    any case id begins with "dc-" (covers older manifests lacking the field).
+    """
+    if not isinstance(manifest, dict):
+        return False
+    if manifest.get("benchmark") == "dispatch_compliance":
+        return True
+    for case in manifest.get("cases", []) or []:
+        if isinstance(case, dict) and str(case.get("id", "")).startswith("dc-"):
+            return True
+    return False
+
+
+def criteria_to_dicts(results) -> list:
+    """Convert CriterionResult objects to the result.json dict shape."""
+    return [
+        {"name": cr.name, "passed": cr.passed, "tier": cr.tier, "detail": cr.detail}
+        for cr in results
+    ]
+
+
+def case_index(manifest: dict) -> dict:
+    """Map case id -> its manifest entry (carries golden_checkpoint + expected)."""
+    idx = {}
+    for case in manifest.get("cases", []) or []:
+        if isinstance(case, dict) and "id" in case:
+            idx[case["id"]] = case
+    return idx
+
+
+def rescore_run(run_dir: Path, case: dict) -> dict | None:
+    """Rescore one run directory. Returns a dict describing the outcome or None.
+
+    Replicates score_run's argument derivation: checkpoint line count from the
+    case's OWN golden checkpoint, expected dict from the manifest case. Returns
+    ``None`` when the run cannot be rescored (no transcript / no golden), so the
+    caller can leave it untouched.
+    """
+    transcript = run_dir / "transcript.jsonl"
+    if not transcript.exists():
+        return None
+    result = load_json(run_dir / "result.json")
+    if result is None:
+        return None
+
+    golden_checkpoint = case.get("golden_checkpoint")
+    if not golden_checkpoint:
+        return None
+    golden_path = BASE_DIR / golden_checkpoint
+    if not golden_path.exists():
+        return {"status": "skipped_no_golden", "golden": str(golden_path)}
+    checkpoint_lines = get_checkpoint_line_count(golden_path)
+
+    expected = case.get("expected", {}) or {}
+
+    # Archived subagent transcripts (recovery evidence + Phase 3b behavior).
+    sub_dir = run_dir / "subagents"
+    subagent_transcripts = (
+        sorted(sub_dir.rglob("*.jsonl")) if sub_dir.exists() else []
+    )
+
+    new_criteria = criteria_to_dicts(
+        score_dispatch_compliance(
+            str(transcript), checkpoint_lines, expected,
+            subagent_transcripts=subagent_transcripts,
+        )
+    )
+
+    # Subagent behavior: re-run only where subagent transcripts exist, matching
+    # score_run's gate (agent_dispatched + expected type). Criteria semantics
+    # are unchanged by this fix, but re-running keeps the archive internally
+    # consistent with the current scorer.
+    expected_type = expected.get("subagent_dispatched", "")
+    agent_dispatched = any(
+        c["name"] == "agent_dispatched" and c["passed"] for c in new_criteria
+    )
+    new_sub_criteria = None
+    if agent_dispatched and expected_type and subagent_transcripts:
+        new_sub_criteria = criteria_to_dicts(
+            score_subagent_behavior_from_transcripts(
+                subagent_transcripts, expected_type
+            )
+        )
+
+    old_criteria = result.get("criteria", [])
+    old_sub_criteria = result.get("subagent_criteria", [])
+
+    criteria_changed = _criteria_pass_map(old_criteria) != _criteria_pass_map(
+        new_criteria
+    )
+    sub_changed = new_sub_criteria is not None and (
+        _criteria_pass_map(old_sub_criteria) != _criteria_pass_map(new_sub_criteria)
+    )
+
+    return {
+        "status": "rescored",
+        "result": result,
+        "new_criteria": new_criteria,
+        "new_sub_criteria": new_sub_criteria,
+        "old_criteria": old_criteria,
+        "changed": criteria_changed or sub_changed,
+        "criteria_changed": criteria_changed,
+        "sub_changed": sub_changed,
+    }
+
+
+def _criteria_pass_map(criteria) -> dict:
+    """Map criterion name -> passed bool (order-independent change detection)."""
+    return {c["name"]: bool(c["passed"]) for c in criteria or []}
+
+
+def _rates_for_rows(scored_rows, criterion_names, key) -> dict:
+    """Recompute the criteria-rate sub-dict for a group of rows.
+
+    Faithful reimplementation of the runner's per-model / per-case aggregation
+    (run_dispatch_compliance.py): per-criterion passed/total/rate over scorable
+    rows, plus the ``all_criteria`` all-pass rate. ``key`` is the result field
+    holding the criteria list ("criteria" or "subagent_criteria").
+    """
+    rates = {}
+    for crit_name in criterion_names:
+        passed = sum(
+            1 for r in scored_rows
+            if any(c["name"] == crit_name and c["passed"] for c in r.get(key, []))
+        )
+        total = sum(
+            1 for r in scored_rows
+            if any(c["name"] == crit_name for c in r.get(key, []))
+        )
+        if total > 0:
+            rates[crit_name] = {
+                "passed": passed, "total": total, "rate": passed / total,
+            }
+    return rates
+
+
+def recompute_summary(summary: dict, rows: list, manifest: dict) -> dict:
+    """Recompute ONLY the criteria-derived rollups of summary.json.
+
+    Cost, coverage, error_counts, tool_failures, and all provenance fields are
+    preserved verbatim — the rescore changes only criterion pass/fail, so those
+    fields are unchanged by construction. Adds an additive ``rescored_at`` stamp.
+    """
+    # First-seen order of criterion names across all runs (matches runner).
+    all_criterion_names = []
+    seen = set()
+    for r in rows:
+        for crit in r.get("criteria", []):
+            if crit["name"] not in seen:
+                all_criterion_names.append(crit["name"])
+                seen.add(crit["name"])
+    summary["criterion_names"] = all_criterion_names
+
+    # Per-model criteria rates (preserve every other by_model field).
+    for model_name, model_entry in (summary.get("by_model") or {}).items():
+        model_rows = [r for r in rows if r.get("model") == model_name]
+        scored_rows = [r for r in model_rows if is_scorable(r)]
+        rates = _rates_for_rows(scored_rows, all_criterion_names, "criteria")
+        all_pass = sum(
+            1 for r in scored_rows
+            if r.get("criteria") and all(c["passed"] for c in r["criteria"])
+        )
+        scored_n = len(scored_rows)
+        rates["all_criteria"] = {
+            "passed": all_pass,
+            "total": scored_n,
+            "rate": all_pass / scored_n if scored_n else 0.0,
+        }
+        model_entry["criteria"] = rates
+
+    # Per-case criteria rates (preserve every other by_case field).
+    for case_id, case_entry in (summary.get("by_case") or {}).items():
+        case_rows = [r for r in rows if r.get("case_id") == case_id]
+        scored_rows = [r for r in case_rows if is_scorable(r)]
+        rates = _rates_for_rows(scored_rows, all_criterion_names, "criteria")
+        all_pass = sum(
+            1 for r in scored_rows
+            if r.get("criteria") and all(c["passed"] for c in r["criteria"])
+        )
+        scored_n = len(scored_rows)
+        rates["all_criteria"] = {
+            "passed": all_pass,
+            "total": scored_n,
+            "rate": all_pass / scored_n if scored_n else 0.0,
+        }
+        case_entry["criteria"] = rates
+
+    # Subagent-behavior rollup (criteria only; skip info-tier, matching runner).
+    sub_block = summary.get("subagent_behavior") or {}
+    all_sub_names = []
+    seen_sub = set()
+    for r in rows:
+        for sc in r.get("subagent_criteria", []):
+            if sc.get("tier") == "info":
+                continue
+            if sc["name"] not in seen_sub:
+                all_sub_names.append(sc["name"])
+                seen_sub.add(sc["name"])
+    sub_block["criterion_names"] = all_sub_names
+    for model_name, sub_entry in (sub_block.get("by_model") or {}).items():
+        model_rows = [
+            r for r in rows
+            if r.get("model") == model_name and r.get("subagent_criteria")
+        ]
+        sub_entry["criteria"] = _rates_for_rows(
+            model_rows, all_sub_names, "subagent_criteria"
+        )
+        sub_entry["runs_with_subagent"] = len(model_rows)
+    summary["subagent_behavior"] = sub_block
+
+    summary["rescored_at"] = datetime.now(timezone.utc).isoformat()
+    return summary
+
+
+def process_set(set_dir: Path, apply: bool, reason: str = RESCORE_REASON) -> dict:
+    """Rescore one result set. Returns a stats dict for reporting.
+
+    ``reason`` is stamped into each rescored row's ``rescore_reason`` field;
+    it defaults to the module constant so existing behavior is unchanged.
+    """
+    manifest = load_json(set_dir / "manifest.json")
+    if not is_dispatch_set(manifest or {}):
+        return {"set": set_dir.name, "skipped": "not_dispatch"}
+
+    cases = case_index(manifest)
+    runs_dir = set_dir / "runs"
+    if not runs_dir.exists():
+        return {"set": set_dir.name, "skipped": "no_runs"}
+
+    stats = {
+        "set": set_dir.name,
+        "runs_seen": 0,
+        "runs_rescored": 0,
+        "runs_changed": 0,
+        "criterion_flips": {},   # criterion name -> {"F->P": n, "P->F": n}
+        "no_golden": 0,
+    }
+    updated_rows = []
+
+    for run_dir in sorted(runs_dir.iterdir()):
+        if not run_dir.is_dir():
+            continue
+        result = load_json(run_dir / "result.json")
+        if result is None:
+            continue
+        stats["runs_seen"] += 1
+        case_id = result.get("case_id", "")
+        case = cases.get(case_id)
+        if case is None:
+            updated_rows.append(result)
+            continue
+
+        outcome = rescore_run(run_dir, case)
+        if outcome is None:
+            updated_rows.append(result)
+            continue
+        if outcome.get("status") == "skipped_no_golden":
+            stats["no_golden"] += 1
+            updated_rows.append(result)
+            continue
+
+        stats["runs_rescored"] += 1
+
+        # Tally criterion flips for the report.
+        old_map = _criteria_pass_map(outcome["old_criteria"])
+        new_map = _criteria_pass_map(outcome["new_criteria"])
+        for name, new_pass in new_map.items():
+            old_pass = old_map.get(name)
+            if old_pass is None or old_pass == new_pass:
+                continue
+            bucket = stats["criterion_flips"].setdefault(name, {"F->P": 0, "P->F": 0})
+            bucket["F->P" if new_pass else "P->F"] += 1
+
+        if outcome["changed"]:
+            stats["runs_changed"] += 1
+
+        # Build the updated result row (used for summary recompute + write).
+        new_result = dict(result)
+        new_result["criteria"] = outcome["new_criteria"]
+        if outcome["new_sub_criteria"] is not None:
+            new_result["subagent_criteria"] = outcome["new_sub_criteria"]
+        new_result["rescored_at"] = datetime.now(timezone.utc).isoformat()
+        new_result["rescore_reason"] = reason
+        updated_rows.append(new_result)
+
+        if apply:
+            atomic_write_json(run_dir / "result.json", new_result)
+
+    # Recompute + write summary.json from the updated rows.
+    summary = load_json(set_dir / "summary.json")
+    if summary is not None:
+        new_summary = recompute_summary(summary, updated_rows, manifest)
+        if apply:
+            atomic_write_json(set_dir / "summary.json", new_summary)
+
+    return stats
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Re-score archived dispatch_compliance result sets under the "
+                    "current scorer (heading-normalization correction).",
+    )
+    parser.add_argument(
+        "--results-root", default="benchmarks/results",
+        help="Root directory of result sets (default: benchmarks/results).",
+    )
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument(
+        "--dry-run", action="store_true", default=True,
+        help="Report would-change counts without writing (default).",
+    )
+    group.add_argument(
+        "--apply", action="store_true",
+        help="Write the rescored result.json / summary.json files.",
+    )
+    parser.add_argument(
+        "--reason", default=RESCORE_REASON,
+        help="Provenance reason stamped into each rescored row's "
+             f"rescore_reason field (default: {RESCORE_REASON}).",
+    )
+    args = parser.parse_args()
+
+    # A blank/whitespace-only reason would stamp an empty provenance marker into
+    # every rescored row, defeating the auditability the stamp exists for.
+    if not args.reason or not args.reason.strip():
+        parser.error("--reason must not be blank or whitespace-only")
+
+    apply = bool(args.apply)
+    reason = args.reason
+    root = Path(args.results_root)
+    if not root.is_absolute():
+        root = BASE_DIR / root
+    if not root.exists():
+        print(f"ERROR: results root not found: {root}", file=sys.stderr)
+        return 2
+
+    mode = "APPLY" if apply else "DRY-RUN"
+    print(f"=== rescore_archives.py [{mode}] root={root} reason={reason} ===")
+
+    set_dirs = sorted(d for d in root.iterdir() if d.is_dir())
+    totals = {
+        "sets_dispatch": 0, "sets_skipped": 0,
+        "runs_rescored": 0, "runs_changed": 0, "no_golden": 0,
+    }
+    flip_totals = {}
+
+    for set_dir in set_dirs:
+        stats = process_set(set_dir, apply, reason=reason)
+        if "skipped" in stats:
+            totals["sets_skipped"] += 1
+            continue
+        totals["sets_dispatch"] += 1
+        totals["runs_rescored"] += stats["runs_rescored"]
+        totals["runs_changed"] += stats["runs_changed"]
+        totals["no_golden"] += stats["no_golden"]
+        for name, buckets in stats["criterion_flips"].items():
+            agg = flip_totals.setdefault(name, {"F->P": 0, "P->F": 0})
+            agg["F->P"] += buckets["F->P"]
+            agg["P->F"] += buckets["P->F"]
+        if stats["runs_changed"] or stats["no_golden"]:
+            print(
+                f"  {stats['set']}: rescored={stats['runs_rescored']} "
+                f"changed={stats['runs_changed']} no_golden={stats['no_golden']}"
+            )
+
+    print("--- Totals ---")
+    print(f"  dispatch sets: {totals['sets_dispatch']}  "
+          f"(skipped non-dispatch: {totals['sets_skipped']})")
+    print(f"  runs rescored: {totals['runs_rescored']}  "
+          f"runs changed: {totals['runs_changed']}  "
+          f"no-golden skips: {totals['no_golden']}")
+    print("  criterion flips (would-change):" if not apply
+          else "  criterion flips (applied):")
+    for name in sorted(flip_totals):
+        b = flip_totals[name]
+        if b["F->P"] or b["P->F"]:
+            print(f"    {name}: FAIL->PASS={b['F->P']}  PASS->FAIL={b['P->F']}")
+    if not apply:
+        print("  (dry-run; no files written — re-run with --apply to persist)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/benchmarks/scripts/run_dispatch_compliance.py b/benchmarks/scripts/run_dispatch_compliance.py
index 972d14e2..99852f7d 100644
--- a/benchmarks/scripts/run_dispatch_compliance.py
+++ b/benchmarks/scripts/run_dispatch_compliance.py
@@ -23,12 +23,17 @@
 
 import argparse
 import concurrent.futures
+import fcntl
 import json
 import os
 import shutil
+import stat
 import subprocess
 import sys
+import threading
 import time
+import uuid
+from contextlib import contextmanager
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -41,6 +46,7 @@
 from benchmarks.harness.cost_estimator import estimate_batch_cost, format_estimate
 from benchmarks.harness.artifacts import (
     add_preflight_arg,
+    assert_unique_sandbox_slugs,
     attach_schema_version,
     build_error_artifact,
     build_run_artifact,
@@ -55,6 +61,7 @@
     purity_coverage,
     run_preflight,
     run_validity,
+    sandbox_slug,
     validity_coverage,
 )
 from benchmarks.scorers.deterministic.checkpoint_adherence import (
@@ -68,7 +75,9 @@
 from benchmarks.scorers.deterministic.subagent_behavior import (
     find_subagent_transcripts,
     score_subagent_behavior,
+    score_subagent_behavior_from_transcripts,
 )
+from benchmarks.scorers.deterministic.error_classification import compute_error_counts
 
 # --- Config ---
 
@@ -77,6 +86,16 @@
 MODELS_FILE = BASE_DIR / "benchmarks" / "config" / "models.yaml"
 
 LAUNCH_DELAY_SECONDS = 2
+# Cap on simultaneously in-flight runs. Per-run state (sandbox dir, uuid4 session
+# ids, transcript dirs) is fully isolated, so the cap is purely a resource-
+# pressure guard, not a correctness one. --delay staggers submits independently.
+MAX_CONCURRENT_RUNS = 5
+
+# Serializes the progressive rollup (per-run archive write + summary/manifest
+# rewrite). In the parallel path the as_completed loop already collects results
+# on the main thread one at a time, but the lock makes the invariant explicit and
+# keeps the finalizer safe against any future concurrent caller.
+_ARCHIVE_LOCK = threading.Lock()
 
 
 # --- Load config ---
@@ -92,17 +111,26 @@ def score_run(
     session_id: str,
     test_case: TestCase,
     requested_child_model_id: str,
+    wire_child_model_id: str = None,
 ) -> dict:
     """Score dispatch behavior and collect CLI-observed child-model evidence.
 
     Returns phase criteria, transcript diagnostics, and a non-scoring purity
     record. Purity is infrastructure evidence only; it does not alter any
     deterministic behavioral criterion.
+
+    ``requested_child_model_id`` is the routing selector (``ModelConfig.id``);
+    ``wire_child_model_id`` is the declared wire identity
+    (``ModelConfig.comparison_model_id``) that transcript observations are
+    compared against. Omitting the latter falls back to the routing selector,
+    which is correct for every model whose wire form equals its routing id.
     """
     # Locate child transcripts even when the parent transcript is absent: their
     # independent CLI records may still establish dispatch and model identity.
     subagent_transcripts = find_subagent_transcripts(session_id)
-    purity = child_model_purity(subagent_transcripts, requested_child_model_id)
+    purity = child_model_purity(
+        subagent_transcripts, requested_child_model_id, wire_child_model_id
+    )
 
     transcript_path = find_benchmark_transcript(session_id)
     if not transcript_path:
@@ -187,6 +215,10 @@ def score_run(
         "child_model_purity": purity,
         "transcript_path": str(transcript_path),
         "tool_call_count": len(tool_calls),
+        # W1 (2026-07-28): expose the golden line count so the error scan can
+        # skip the checkpoint prefix on the parent transcript, exactly as
+        # extract_new_tool_calls does. Derived here so there is one source.
+        "checkpoint_lines": checkpoint_lines,
     }
 
 
@@ -199,6 +231,101 @@ def score_run(
 # project directory under /daaf/research/ or the repo root (B1 safety).
 SANDBOX_ROOT = "/daaf/benchmarks/_sandbox"
 
+# Cross-process reader/writer lock on the fixture surface. Deliberately lives
+# under SANDBOX_ROOT (NOT inside datasets/test_fixtures/) so the lockfile is
+# never itself a fixture path that restore/contamination checks would see.
+FIXTURE_LOCK_PATH = f"{SANDBOX_ROOT}/.fixtures.lock"
+_FIXTURE_LOCK_TIMEOUT_S = 600          # hard cap: abort a wait longer than 10 min
+_FIXTURE_LOCK_WARN_EVERY_S = 30        # warn on the console every 30s while waiting
+
+
+@contextmanager
+def _fixture_lock(lock_type, label):
+    """Hold an flock() reader/writer lock on the fixture surface for the block.
+
+    ``lock_type`` is ``fcntl.LOCK_EX`` (restore = writer: excludes all other
+    holders) or ``fcntl.LOCK_SH`` (prepare-copy = reader: coexists with other
+    readers, excludes the writer). This is what makes concurrent runner
+    PROCESSES safe: the in-process guarantee that restore runs strictly
+    pre-pool does nothing across two separate `python run_dispatch_compliance.py`
+    invocations, so batch B's restore (git restore / rmtree) could otherwise
+    race batch A's in-flight shutil.copy2 reads of the same source paths.
+
+    Blocking acquire via a non-blocking poll loop: warns every 30s while another
+    batch holds the lock and aborts (RuntimeError) only after 10 minutes, so a
+    genuinely wedged peer surfaces instead of hanging forever.
+
+    No stale-lock cleanup exists BY DESIGN: flock() locks are released by the
+    kernel automatically when the holding fd is closed OR the holding process
+    dies (including SIGKILL). Users routinely Ctrl-C / kill batches, so any
+    manual lockfile-reaping scheme would risk deleting a live lock; relying on
+    kernel release is both simpler and correct.
+    """
+    Path(FIXTURE_LOCK_PATH).parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(FIXTURE_LOCK_PATH, os.O_RDWR | os.O_CREAT, 0o644)
+    try:
+        start = time.time()
+        last_warn = 0.0
+        while True:
+            try:
+                fcntl.flock(fd, lock_type | fcntl.LOCK_NB)
+                break
+            except BlockingIOError:
+                waited = time.time() - start
+                if waited > _FIXTURE_LOCK_TIMEOUT_S:
+                    raise RuntimeError(
+                        f"Timed out after {_FIXTURE_LOCK_TIMEOUT_S}s waiting for the "
+                        f"fixture {label} lock ({FIXTURE_LOCK_PATH}); another batch "
+                        f"appears wedged. Aborting this operation."
+                    )
+                if waited - last_warn >= _FIXTURE_LOCK_WARN_EVERY_S:
+                    print(f"Waiting for fixture {label} lock "
+                          f"({int(waited)}s elapsed; another batch holds it)...")
+                    sys.stdout.flush()
+                    last_warn = waited
+                time.sleep(1.0)
+        yield
+    finally:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+
+
+def _set_fixture_tree_writable(writable: bool) -> None:
+    """Toggle write permission across the fixture SOURCE tree (defense-in-depth).
+
+    Read-only (``writable=False``) is the resting state asserted after every
+    successful restore (or clean early-return): files lose all write bits (a-w)
+    and directories lose write while keeping r-x — traversable but refusing new
+    entries. A benchmark subject that ignores its sandbox and writes into
+    datasets/test_fixtures/ BY NAME now fails with EACCES rather than silently
+    contaminating the source (the two historical incident classes this hardens
+    against). restore_fixtures() flips the tree writable only for the duration
+    of any actual repair work, then re-asserts read-only.
+
+    Note this does NOT create git contamination: git tracks only the executable
+    bit, not the write bit, so `git status` never sees an a-w chmod on a regular
+    file. Best-effort: chmod failures are warned, not raised, so a hardening
+    hiccup never aborts a batch.
+    """
+    root = Path(FIXTURE_PREFIX)
+    if not root.exists():
+        return
+    targets = [root]
+    for dirpath, dirnames, filenames in os.walk(root):
+        for name in dirnames + filenames:
+            targets.append(Path(dirpath) / name)
+    for p in targets:
+        try:
+            mode = p.stat().st_mode
+            if writable:
+                p.chmod(mode | stat.S_IWUSR)
+            else:
+                p.chmod(mode & ~(stat.S_IWUSR | stat.S_IWGRP | stat.S_IWOTH))
+        except OSError as e:
+            print(f"  WARNING: could not chmod fixture path {p} ({e}).")
+
 
 def prepare_run_sandbox(sandbox_dir: str) -> Path:
     """Wipe and recreate a per-run sandbox so no prior-run artifacts survive (B1).
@@ -262,14 +389,38 @@ def restore_fixtures() -> None:
     Must be called per-batch, BEFORE the run pool launches: all parallel run
     threads read the shared originals at launch, so a mid-batch restore would
     race with their shutil.copy2 reads.
+
+    The ENTIRE body runs under an exclusive (LOCK_EX) fixture lock so the
+    check-then-repair is atomic across concurrent runner processes: a peer
+    batch's shared-lock copy loop cannot read a source path mid-repair, and two
+    batches cannot repair simultaneously. On completion the source tree is left
+    read-only (defense-in-depth); any repair work temporarily re-enables writes.
     """
+    with _fixture_lock(fcntl.LOCK_EX, "restore"):
+        _restore_fixtures_locked()
+
+
+def _restore_fixtures_locked() -> None:
     entries = _fixture_status_entries()
     if entries is None:
         return
     if not entries:
         print(f"Fixtures clean: {FIXTURE_PREFIX} matches git HEAD — no restore needed.")
+        # Re-assert the read-only resting state even on the clean path so a tree
+        # left writable by an older harness (or a fresh checkout) gets hardened.
+        _set_fixture_tree_writable(False)
         return
 
+    # Repair mutates the source tree (git restore writes, untracked deletes need
+    # writable parent dirs), so lift the read-only hardening for the repair only.
+    _set_fixture_tree_writable(True)
+    try:
+        _restore_fixtures_repair(entries)
+    finally:
+        _set_fixture_tree_writable(False)
+
+
+def _restore_fixtures_repair(entries: list[str]) -> None:
     print(f"Restoring {len(entries)} contaminated fixture path(s) to git HEAD:")
     for entry in entries:
         status = entry[:2]
@@ -365,9 +516,11 @@ def prepare_fixtures(test_case: TestCase, sandbox_dir: str) -> TestCase:
        test_fixtures/, each is copied to {sandbox_dir}/fixtures/{subdir}/{file}
        and the prompt is rewritten so originals are never touched by subagents.
     2. Workspace containment (unconditional): every case — fixture-bearing or not
-       — gets a {sandbox_dir}/workspace/ (seeded with run_with_capture.sh) and a
-       prompt instruction directing all model/subagent writes into the per-run
-       sandbox. Previously non-fixture cases (dc-01..dc-06) received no
+       — gets a {sandbox_dir}/workspace/ (the PROJECT_DIR) plus a BASE_DIR-level
+       {sandbox_dir}/scripts/run_with_capture.sh (isomorphic to the real repo, so
+       the CLAUDE.md `{BASE_DIR}/scripts/run_with_capture.sh` convention resolves)
+       and a prompt instruction directing all model/subagent writes into the
+       per-run sandbox. Previously non-fixture cases (dc-01..dc-06) received no
        containment instruction, so a dispatched subagent could write a real
        /daaf/research/ project (the 2026-07-16 dc-01 MonteCarlo leak). Applying
        the same instruction fixture cases already carried closes that vector for
@@ -386,29 +539,54 @@ def prepare_fixtures(test_case: TestCase, sandbox_dir: str) -> TestCase:
     fixtures_dir = Path(sandbox_dir) / "fixtures"
     modified_prompt = test_case.prompt
 
-    for orig_path in matches:
-        src = Path(orig_path)
-        if not src.exists():
-            continue
-        rel = src.relative_to(Path(FIXTURE_PREFIX).parent)
-        dest = fixtures_dir / rel
-        dest.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(src, dest)
-        modified_prompt = modified_prompt.replace(orig_path, str(dest))
+    # Hold a SHARED (reader) lock around the fixture-copy portion ONLY: it must
+    # exclude a peer batch's exclusive restore (git restore / rmtree) from
+    # mutating a source path mid-copy, but must coexist with other batches'
+    # copy loops. The lock is scoped to the copies, not the whole run, so live
+    # runs never serialize on it. Non-fixture cases (no matches) skip it.
+    if matches:
+        with _fixture_lock(fcntl.LOCK_SH, "copy"):
+            for orig_path in matches:
+                src = Path(orig_path)
+                if not src.exists():
+                    continue
+                rel = src.relative_to(Path(FIXTURE_PREFIX).parent)
+                dest = fixtures_dir / rel
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copy2(src, dest)
+                # copy2 preserves mode, so a read-only source yields a read-only
+                # copy; restore u+w so the run can work with its own copy.
+                try:
+                    dest.chmod(dest.stat().st_mode | stat.S_IWUSR)
+                except OSError as e:
+                    print(f"  WARNING: could not chmod fixture copy {dest} ({e}).")
+                modified_prompt = modified_prompt.replace(orig_path, str(dest))
 
     workspace_dir = Path(sandbox_dir) / "workspace"
     workspace_dir.mkdir(parents=True, exist_ok=True)
 
-    # Copy run_with_capture.sh so subagents find it at the expected relative path.
-    # Subagents treat the workspace as BASE_DIR and look for scripts/run_with_capture.sh there.
+    # Copy run_with_capture.sh to the BASE_DIR-level scripts/ dir so the sandbox
+    # is isomorphic to the real repo layout: CLAUDE.md's canonical invocation is
+    # `bash {BASE_DIR}/scripts/run_with_capture.sh {PROJECT_DIR}/scripts/...`, so
+    # sandbox_dir plays BASE_DIR and workspace_dir plays PROJECT_DIR. Models of
+    # every family read that convention and construct {BASE_DIR}/scripts/... — the
+    # prior workspace/scripts/ location produced exit 127 + wasted recovery turns.
     rwc_src = Path("/daaf/scripts/run_with_capture.sh")
     if rwc_src.exists():
-        rwc_dest = workspace_dir / "scripts" / "run_with_capture.sh"
+        rwc_dest = Path(sandbox_dir) / "scripts" / "run_with_capture.sh"
         rwc_dest.parent.mkdir(parents=True, exist_ok=True)
         shutil.copy2(rwc_src, rwc_dest)
+        # copy2 preserves mode; ensure the sandbox copy is writable + executable
+        # (the source may be tracked read-only, and the wrapper must run).
+        try:
+            rwc_dest.chmod(rwc_dest.stat().st_mode | stat.S_IWUSR | stat.S_IXUSR)
+        except OSError as e:
+            print(f"  WARNING: could not chmod wrapper copy {rwc_dest} ({e}).")
 
     modified_prompt += (
-        f" Use {workspace_dir} as the project workspace: every file or folder you"
+        f" Use {workspace_dir} as the project workspace and {sandbox_dir} as the"
+        f" base directory (the script-execution wrapper is at"
+        f" {sandbox_dir}/scripts/run_with_capture.sh): every file or folder you"
         f" or your subagents create must live under {sandbox_dir} — do not create"
         f" scripts, outputs, or research project folders anywhere else in the"
         f" repository."
@@ -419,43 +597,175 @@ def prepare_fixtures(test_case: TestCase, sandbox_dir: str) -> TestCase:
     return tc
 
 
+# --- Early-stop scoring callback ---
+
+def _build_early_stop_check(test_case: TestCase):
+    """Build the executor's early_stop_check closure for one dispatch case.
+
+    Returns a callable (session_id) -> bool that runs the REAL deterministic
+    scorers against the live transcripts and returns True only when every scored
+    criterion — the 10 dispatch criteria AND, when a subagent dispatch is
+    expected, the subagent-behavior criteria — has PASSED.
+
+    CAVEAT (2026-07-29): the monotone-pass argument below was FALSIFIED in
+    practice — an Agent call's success settles at its tool_result (i.e. when the
+    subagent finishes), not at the call, so the graceful kill can abort an
+    in-flight dispatch, flip its tool_result to is_error=true, and corrupt the
+    archived score (observed on 4 of 59 completed_early runs; all 59 quarantined
+    2026-07-29). Early stop is therefore OFF by default (opt-in --early-stop);
+    see the argparse comment. The original rationale is preserved below as
+    design history.
+
+    Original (falsified) rationale — the monotone-pass fairness argument:
+    every dispatch criterion locks PASS on first observation (it settles at the
+    Agent call) and the subagent-behavior criteria settle at the subagent's
+    actions; none can be voided by later activity. So killing the run the moment
+    all criteria pass cannot change the score — it only reclaims the dead wall
+    time a model would otherwise spend continuing after the gradeable behavior
+    is already on disk. (This is NOT true of the other three phases, whose
+    negative criteria — no_premature_execution / no_forbidden_skills /
+    no_tool_calls_of_type — start PASS and can only flip to FAIL; early-stopping
+    those would unfairly lock in a not-yet-violated negative, so they get stall
+    detection only.)
+
+    Flush-race protection: when a subagent dispatch is expected, the check
+    returns False until the subagent transcript exists on disk AND its behavior
+    criteria pass. Combined with the executor's one-poll confirmation grace, this
+    guarantees the dispatch-recovery fallback has the subagent's records before
+    any truncation.
+
+    Exception safety: any scorer error is swallowed and reported as "not done"
+    (return False) — a scorer crash must never kill a run mid-flight. The
+    executor also guards this, so protection is belt-and-suspenders.
+    """
+    expected_agent_type = test_case.expected.get("subagent_dispatched", "")
+    golden_path = BASE_DIR / test_case.golden_checkpoint
+
+    def _check(session_id: str) -> bool:
+        try:
+            transcript_path = find_benchmark_transcript(session_id)
+            if not transcript_path:
+                return False
+            checkpoint_lines = get_checkpoint_line_count(golden_path)
+            subagent_transcripts = find_subagent_transcripts(session_id)
+
+            dispatch_results = score_dispatch_compliance(
+                str(transcript_path), checkpoint_lines, test_case.expected,
+                subagent_transcripts=subagent_transcripts,
+            )
+            if not dispatch_results or not all(cr.passed for cr in dispatch_results):
+                return False
+
+            # When a subagent dispatch is expected, require the subagent
+            # transcript on disk and all its behavior criteria passing before
+            # declaring done (protects the flush race + Phase 3b fairness).
+            if expected_agent_type:
+                if not subagent_transcripts:
+                    return False
+                behavior = score_subagent_behavior_from_transcripts(
+                    subagent_transcripts, expected_agent_type
+                )
+                if not behavior or not all(cr.passed for cr in behavior):
+                    return False
+            return True
+        except Exception as e:
+            print(
+                f"WARNING: [{test_case.id}] early_stop_check raised "
+                f"{type(e).__name__}: {e}; not early-stopping."
+            )
+            return False
+
+    return _check
+
+
 # --- Run + diagnose ---
 
 def run_one(test_case: TestCase, model: ModelConfig, rep: int,
-            sandbox_suffix: str, timeout_override=None):
-    """Execute a single benchmark run with checkpoint scoring."""
+            sandbox_suffix: str, timeout_override=None,
+            watchdog_poll=60, stall_threshold=330, stall_retries=1,
+            enable_early_stop=False):
+    """Execute a single benchmark run with checkpoint scoring.
+
+    Run-lifecycle watchdog (Dispatch B): the executor polls every
+    ``watchdog_poll`` seconds, killing a hung run whose transcripts go quiet for
+    >``stall_threshold`` seconds across consecutive polls. A stalled run is
+    relaunched from a fresh sandbox up to ``stall_retries`` times (default 1); a
+    run that stalls again after its last retry is recorded permanently as
+    ``status="stalled"``. Score-complete early stop is OFF by default
+    (2026-07-29 — the kill can abort an in-flight dispatch and corrupt the
+    archived score; see _build_early_stop_check's caveat); pass
+    ``enable_early_stop=True`` to opt in.
+    """
     sandbox_dir = f"{SANDBOX_ROOT}/run_{sandbox_suffix}"
+    early_stop_check = _build_early_stop_check(test_case) if enable_early_stop else None
+
+    attempt = 0
+    # Accumulate each stalled attempt's diagnostics so a run that stalled once
+    # then passed is legible from the archive alone (previously console-only).
+    # Carried onto the FINAL result.json as an additive stall_attempts field.
+    stall_attempts = []
+    while True:
+        # Wipe and recreate the sandbox BEFORE staging fixtures, and tell
+        # execute_run() -> prepare_sandbox() not to wipe it again
+        # (wipe_sandbox=False). Previously fixtures were staged first and
+        # prepare_sandbox()'s rmtree deleted them — at model launch the rewritten
+        # prompt pointed at nonexistent sandbox paths, so models hunted the files
+        # by name and contaminated the originals under datasets/test_fixtures/.
+        # The wipe is hard-guarded to SANDBOX_ROOT (B1 repetition safety); a fresh
+        # sandbox per run means a repeated run never sees a prior run's artifacts.
+        # On a stall relaunch this also gives the retry a pristine sandbox.
+        prepare_run_sandbox(sandbox_dir)
+
+        sandboxed_case = prepare_fixtures(test_case, sandbox_dir)
+
+        config = RunConfig(
+            test_case=sandboxed_case,
+            model=model,
+            run_index=rep,
+            sandbox_dir=sandbox_dir,
+            wipe_sandbox=False,
+            timeout_override=timeout_override,
+            early_stop_check=early_stop_check,
+            watchdog_poll_seconds=watchdog_poll,
+            stall_detection=True,
+            stall_threshold_seconds=stall_threshold,
+        )
 
-    # Wipe and recreate the sandbox BEFORE staging fixtures, and tell
-    # execute_run() -> prepare_sandbox() not to wipe it again
-    # (wipe_sandbox=False). Previously fixtures were staged first and
-    # prepare_sandbox()'s rmtree deleted them — at model launch the rewritten
-    # prompt pointed at nonexistent sandbox paths, so models hunted the files
-    # by name and contaminated the originals under datasets/test_fixtures/.
-    # The wipe is hard-guarded to SANDBOX_ROOT (B1 repetition safety); a fresh
-    # sandbox per run means a repeated run never sees a prior run's artifacts.
-    prepare_run_sandbox(sandbox_dir)
-
-    sandboxed_case = prepare_fixtures(test_case, sandbox_dir)
-
-    config = RunConfig(
-        test_case=sandboxed_case,
-        model=model,
-        run_index=rep,
-        sandbox_dir=sandbox_dir,
-        wipe_sandbox=False,
-        timeout_override=timeout_override,
-    )
+        start = time.time()
+        result = execute_run(config)
+        elapsed = time.time() - start
+
+        if getattr(result, "stalled", False):
+            stall_attempts.append({
+                "attempt": attempt,
+                "stall_diagnostics": dict(result.stall_diagnostics or {}),
+            })
+        if getattr(result, "stalled", False) and attempt < stall_retries:
+            print(
+                f"STALL [{test_case.id} | {model.name} | rep {rep}] attempt "
+                f"{attempt + 1}: {result.stall_diagnostics}; wiping sandbox and "
+                f"relaunching (retry {attempt + 1}/{stall_retries})."
+            )
+            # Release the checkpoint sandbox from the stalled attempt before the
+            # relaunch stages a fresh one under the same session bookkeeping.
+            if test_case.golden_checkpoint and result.session_id:
+                cleanup_sandbox(result.session_id)
+            attempt += 1
+            continue
+        break
 
-    start = time.time()
-    result = execute_run(config)
-    elapsed = time.time() - start
+    stall_relaunch_count = attempt
 
     # Always attempt scoring if we have a session_id — even for timed-out runs,
     # the live session file may contain partial but scorable transcript data.
     if result.session_id:
         time.sleep(1)
-        scored = score_run(result.session_id, test_case, model.id)
+        # Routing stays pinned to model.id (executor.py passes it to
+        # `claude --model`); only the purity COMPARISON target uses the
+        # declared wire identity.
+        scored = score_run(
+            result.session_id, test_case, model.id, model.comparison_model_id
+        )
     else:
         scored = {
             "criteria": [
@@ -468,7 +778,9 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             ],
             "subagent_criteria": [],
             "subagent_transcript_missing": True,
-            "child_model_purity": child_model_purity([], model.id),
+            "child_model_purity": child_model_purity(
+                [], model.id, model.comparison_model_id
+            ),
             "transcript_path": None,
             "tool_call_count": 0,
         }
@@ -486,6 +798,38 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             if subagent_dir.exists():
                 shutil.copytree(subagent_dir, archive_dir / "subagents", dirs_exist_ok=True)
 
+    # Classify error-bearing tool results (parent + archived subagent
+    # transcripts) into hook-block vs genuine-failure buckets before cleanup
+    # removes the live transcripts. Additive diagnostic only.
+    subagent_transcripts = []
+    if archived_transcript:
+        sub_dir = Path(archived_transcript).parent / "subagents"
+        if sub_dir.exists():
+            subagent_transcripts = list(sub_dir.rglob("*.jsonl"))
+    # Fix 4 (2026-07-28): scan the parent transcript directly instead of
+    # relying on result.tool_failures. The executor extracts tool_failures
+    # only on the normal completion path — timeout/stalled/early-stopped runs
+    # return before that extraction (executor.py :229/:249), leaving the
+    # parent side undercounted. Scanning the archived parent transcript with
+    # the same _iter_transcript_error_contents used for subagents closes the
+    # gap. tool_failures is passed empty so parent errors are counted once:
+    # the transcript scan REPLACES, not augments, the tool_failures-derived
+    # counts (no double-count).
+    # W1 (2026-07-28): the parent transcript carries the prepended golden
+    # checkpoint prefix, so its scan skips the first checkpoint_lines lines
+    # (mirroring extract_new_tool_calls); subagent transcripts have no prefix
+    # and are scanned in full. Note: this scan sees FULL untruncated content
+    # over the WHOLE post-checkpoint transcript, unlike the legacy 500-char-
+    # truncated result.tool_failures path, so bucket classifications can differ
+    # from pre-2026-07-28 runs.
+    parent_skip_lines = scored.get("checkpoint_lines", 0)
+    error_counts = compute_error_counts(
+        [],
+        subagent_transcripts=subagent_transcripts,
+        parent_transcript=archived_transcript,
+        parent_skip_lines=parent_skip_lines,
+    )
+
     # Clean up checkpoint sandbox AFTER archiving
     if test_case.golden_checkpoint:
         cleanup_sandbox(result.session_id)
@@ -498,6 +842,7 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             "subcategory": test_case.subcategory,
             "rep": rep,
             "criteria": scored["criteria"],
+            "error_counts": error_counts,
             "subagent_criteria": scored.get("subagent_criteria", []),
             "subagent_transcript_missing": scored.get(
                 "subagent_transcript_missing", False
@@ -510,6 +855,8 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             ),
             "transcript_path": archived_transcript or scored.get("transcript_path"),
             "tool_call_count": scored.get("tool_call_count", 0),
+            "stall_relaunch_count": stall_relaunch_count,
+            "stall_attempts": stall_attempts,
         },
         duration_s=elapsed,
     )
@@ -533,12 +880,23 @@ def _error_result(test_case: TestCase, model: ModelConfig, rep: int, error_msg:
         phase_fields={
             "subcategory": test_case.subcategory,
             "criteria": criteria,
+            "error_counts": {
+                "hook_blocks": 0,
+                "tool_failures": 0,
+                "tool_failures_unclassified": 0,
+            },
             "subagent_criteria": [],
             "subagent_transcript_missing": True,
-            "child_model_purity": child_model_purity([], model.id),
+            "child_model_purity": child_model_purity(
+                [], model.id, model.comparison_model_id
+            ),
             # An unverifiable-purity error run stays valid (scored) per B2.
             "validity": run_validity(
-                {"child_model_purity": child_model_purity([], model.id)}
+                {
+                    "child_model_purity": child_model_purity(
+                        [], model.id, model.comparison_model_id
+                    )
+                }
             ),
             "transcript_path": None,
             "tool_call_count": 0,
@@ -565,22 +923,70 @@ def get_git_sha() -> str:
     return "unknown"
 
 
+def _write_json_atomic(path: Path, obj) -> None:
+    """Write JSON to a sibling .tmp then os.replace() over the target.
+
+    Atomicity matters for the progressive rollup: a reader (or a kill) never sees
+    a half-written summary.json/manifest.json — the file either holds the prior
+    complete rollup or the new complete one.
+    """
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    with open(tmp, "w") as f:
+        json.dump(obj, f, indent=2)
+    os.replace(tmp, path)
+
+
 def archive_results(all_results: list[dict], models: list[ModelConfig],
-                    test_cases: list[TestCase], args, wall_time: float) -> Path:
-    """Archive all run results, transcripts, and summary to a timestamped folder."""
-    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
-    output_dir = BASE_DIR / "benchmarks" / "results" / timestamp
+                    test_cases: list[TestCase], args, wall_time: float,
+                    output_dir: Path = None, partial: bool = False,
+                    expected_n: int = None, git_sha: str = None,
+                    batch_token: str = None, batch_pid: int = None) -> Path:
+    """Archive run results, transcripts, and rollups to a timestamped folder.
+
+    Progressive by design (2026-07 redesign): called once before the pool with
+    ``all_results=[]`` to create the folder and seed manifest.json + an initial
+    ``partial`` summary.json, then re-invoked after every completed run over the
+    completed-so-far set, and finally once more with ``partial=False`` when all
+    runs finished. Per-run artifact writes are existence-guarded so re-invocation
+    is cheap (each run's files are written exactly once); manifest/summary are
+    recomputed and atomically rewritten each call. The whole body runs under
+    ``_ARCHIVE_LOCK`` so concurrent callers cannot interleave writes.
+    """
+    with _ARCHIVE_LOCK:
+        return _archive_results_locked(
+            all_results, models, test_cases, args, wall_time,
+            output_dir, partial, expected_n, git_sha, batch_token, batch_pid,
+        )
+
+
+def _archive_results_locked(all_results, models, test_cases, args, wall_time,
+                            output_dir, partial, expected_n, git_sha,
+                            batch_token=None, batch_pid=None) -> Path:
+    if output_dir is None:
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+        # Cross-process uniqueness: two batches starting the same wall-clock
+        # second would otherwise collide on results/{timestamp} and cross-write
+        # each other's manifest/summary. The short token disambiguates while the
+        # LEADING timestamp stays intact so viewer/rerun-queue lexicographic
+        # ordering and glob discovery are unaffected.
+        tok = batch_token or uuid.uuid4().hex[:6]
+        output_dir = BASE_DIR / "benchmarks" / "results" / f"{timestamp}_{tok}"
     output_dir.mkdir(parents=True, exist_ok=True)
     runs_dir = output_dir / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
 
-    git_sha = get_git_sha()
+    if git_sha is None:
+        git_sha = get_git_sha()
 
     # --- Write manifest.json ---
     manifest = attach_schema_version({
         "benchmark": "dispatch_compliance",
         "timestamp": datetime.now(timezone.utc).isoformat(),
         "daaf_git_sha": git_sha,
+        # Cross-batch forensics: the per-batch uniqueness token (also the results
+        # dir-name suffix and sandbox-suffix tail) and the launching process PID.
+        "batch_token": batch_token or output_dir.name.rsplit("_", 1)[-1],
+        "batch_pid": batch_pid if batch_pid is not None else os.getpid(),
         **manifest_provenance(
             golden_checkpoints=[tc.golden_checkpoint for tc in test_cases],
             run_records=all_results,
@@ -604,13 +1010,16 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             for tc in test_cases
         ],
     })
-    with open(output_dir / "manifest.json", "w") as f:
-        json.dump(manifest, f, indent=2)
+    _write_json_atomic(output_dir / "manifest.json", manifest)
 
-    # --- Write per-run results and copy transcripts ---
+    # --- Write per-run results and copy transcripts (existence-guarded) ---
+    # Each run's artifacts are immutable once written, so re-invocation across
+    # progressive rollups writes each run exactly once (the result.json guard).
     for r in all_results:
         run_name = f"{r['case_id']}_{r['model'].replace(' ', '_')}_{r['rep']}"
         run_dir = runs_dir / run_name
+        if (run_dir / "result.json").exists():
+            continue
         run_dir.mkdir(parents=True, exist_ok=True)
 
         # Write every flat, Phase-3/3b, purity, and schema-v2 field. Transcript
@@ -619,8 +1028,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             key: value for key, value in r.items()
             if key != "transcript_path"
         }
-        with open(run_dir / "result.json", "w") as f:
-            json.dump(result_data, f, indent=2)
+        _write_json_atomic(run_dir / "result.json", result_data)
 
         # Copy subagent transcripts if available
         if r.get("session_id"):
@@ -765,8 +1173,25 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             name = tf.get("tool_name", "unknown")
             tool_failure_by_name[name] = tool_failure_by_name.get(name, 0) + 1
 
+    # Aggregate the per-run hook-block vs tool-failure diagnostic counters.
+    error_counts_total = {
+        "hook_blocks": 0,
+        "tool_failures": 0,
+        "tool_failures_unclassified": 0,
+    }
+    for r in all_results:
+        ec = r.get("error_counts") or {}
+        for key in error_counts_total:
+            error_counts_total[key] += ec.get(key, 0)
+
+    runs_completed = len(all_results)
     summary = attach_schema_version({
-        "total_runs": len(all_results),
+        "total_runs": runs_completed,
+        # Additive self-description so a crashed/partial pass is legible without
+        # re-deriving from the runs/ directory.
+        "partial": partial,
+        "runs_expected": expected_n if expected_n is not None else runs_completed,
+        "runs_completed": runs_completed,
         "total_cost_usd": total_cost,
         "accounting_coverage": batch_cost["accounting_coverage"],
         "purity_coverage": purity_coverage(all_results),
@@ -778,6 +1203,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             "runs_affected": runs_with_failures,
             "by_tool": tool_failure_by_name,
         },
+        "error_counts": error_counts_total,
         "criterion_names": all_criterion_names,
         "by_model": model_summaries,
         "by_case": case_summaries,
@@ -786,8 +1212,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             "by_model": subagent_by_model,
         },
     })
-    with open(output_dir / "summary.json", "w") as f:
-        json.dump(summary, f, indent=2)
+    _write_json_atomic(output_dir / "summary.json", summary)
 
     return output_dir
 
@@ -815,8 +1240,17 @@ def print_run_result(r: dict):
     purity = r.get("child_model_purity", {})
     print(
         f"  Child model purity: {purity.get('purity_status', 'unverifiable')} "
-        f"(CLI transcript-observed; not backend-confirmed)"
+        f"(CLI transcript-observed model slug only; not backend-confirmed, "
+        f"and never a provider/quant pin check)"
     )
+    # Surface filtered placeholders live: they are excluded from the tally, so
+    # the console is the only place an operator would otherwise not see them.
+    markers = purity.get("observed_non_model_markers") or []
+    if markers:
+        print(
+            f"  Non-model markers observed (excluded from purity tally): "
+            f"{', '.join(markers)}"
+        )
 
     if r.get("error"):
         print(f"  ERROR: {r['error']}")
@@ -1035,9 +1469,45 @@ def main():
                         help="Run sequentially instead of parallel")
     parser.add_argument("--delay", type=float, default=LAUNCH_DELAY_SECONDS,
                         help="Seconds between parallel launches (default: 2)")
-    parser.add_argument("--timeout", type=int, default=300,
-                        help="Per-run timeout in seconds (Phase 3 default: 300; "
-                             "standardized 2026-07-10, replacing cost-tier defaults)")
+    parser.add_argument("--max-concurrent", type=int, default=MAX_CONCURRENT_RUNS,
+                        help=f"Max simultaneously in-flight runs "
+                             f"(default: {MAX_CONCURRENT_RUNS}). Caps the thread "
+                             f"pool; --delay still staggers submits")
+    parser.add_argument("--timeout", type=int, default=900,
+                        help="Per-run timeout in seconds. Uniform 900s logistical "
+                             "cap (2026-07-21 walltime redesign; formerly "
+                             "120/180/300/300 per-phase). High cap so runs complete "
+                             "rather than censor; duration is now the measured axis")
+    parser.add_argument("--watchdog-poll", type=int, default=60,
+                        help="Watchdog poll interval in seconds (default: 60). "
+                             "How often the executor checks for score-complete "
+                             "early stop and transcript staleness")
+    parser.add_argument("--stall-threshold", type=int, default=330,
+                        help="Staleness cutoff in seconds for one stalled read "
+                             "(default: 330; K3-validated — 296s of legitimate "
+                             "dead air was observed on a passing run, so 240s "
+                             "false-positives). Two consecutive stalled reads "
+                             "trigger a stall kill")
+    parser.add_argument("--stall-retries", type=int, default=1,
+                        help="Times to relaunch a stalled rep from a fresh "
+                             "sandbox (default: 1). A rep that stalls again after "
+                             "its last retry is recorded permanently as stalled")
+    # Early stop is OFF by default as of 2026-07-29: the graceful kill can abort
+    # an in-flight Agent dispatch, flipping its tool_result to is_error=true and
+    # corrupting the archived score (observed: 4 completed_early runs scored as
+    # dispatch failures despite live all-PASS — the monotone-pass argument fails
+    # because an Agent call's success settles at its tool_result, not the call).
+    # It also truncates usage capture (output_tokens=None on early-stopped runs).
+    parser.add_argument("--early-stop", action="store_true",
+                        help="OPT IN to score-complete early stop (DEFAULT OFF "
+                             "since 2026-07-29: the kill can abort an in-flight "
+                             "Agent dispatch and corrupt the archived score, and "
+                             "it truncates usage capture). Stall detection is "
+                             "independent and always runs")
+    parser.add_argument("--no-early-stop", action="store_true",
+                        help="Deprecated no-op (early stop is now off by default; "
+                             "kept for command-line compatibility). Overrides "
+                             "--early-stop if both are given")
     parser.add_argument("--yes", "-y", action="store_true",
                         help="Skip cost confirmation prompt")
     parser.add_argument("--no-fixture-restore", action="store_true",
@@ -1055,6 +1525,11 @@ def main():
         print("ERROR: No valid models selected.")
         sys.exit(1)
 
+    # W2 (2026-07-28): fail fast on any sandbox-slug collision across the
+    # selected models before any run launches — colliding slugs would share a
+    # _sandbox/run_* directory and cross-contaminate fixtures/transcripts.
+    assert_unique_sandbox_slugs(models)
+
     # Load test cases
     all_cases = load_test_cases(CASES_FILE)
 
@@ -1128,46 +1603,104 @@ def main():
     print(f"{'='*100}")
     sys.stdout.flush()
 
+    # Per-batch uniqueness token (cross-process safety): one short token per
+    # runner invocation, reused for BOTH the results dir-name suffix and every
+    # sandbox suffix so concurrent batches never collide on results/ dirs or
+    # _sandbox/run_ dirs, even when running the same model at the same second.
+    batch_token = uuid.uuid4().hex[:6]
+    batch_pid = os.getpid()
+
     # Build run list: case x model x rep
     runs = []
     for tc in test_cases:
         for model in models:
             for rep in range(args.reps):
-                suffix = f"{tc.id}_{model.name.replace(' ', '_')}_{rep}"
+                suffix = f"{tc.id}_{sandbox_slug(model.name)}_{rep}_{batch_token}"
                 runs.append((tc, model, rep, suffix))
 
     all_results = []
+    expected_n = len(runs)
+    git_sha = get_git_sha()
     start_time = time.time()
 
-    if args.sequential:
-        for tc, model, rep, suffix in runs:
-            try:
-                r = run_one(tc, model, rep, suffix, timeout_override=args.timeout)
-            except Exception as e:
-                r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
-            all_results.append(r)
-            print_run_result(r)
-            sys.stdout.flush()
-    else:
-        with concurrent.futures.ThreadPoolExecutor(max_workers=len(runs)) as pool:
-            futures = {}
-            for i, (tc, model, rep, suffix) in enumerate(runs):
-                future = pool.submit(run_one, tc, model, rep, suffix, timeout_override=args.timeout)
-                futures[future] = (tc, model, rep)
-                if i < len(runs) - 1:
-                    time.sleep(args.delay)
-
-            for future in concurrent.futures.as_completed(futures):
-                tc, model, rep = futures[future]
+    # Create the results folder and seed manifest.json + an initial partial
+    # summary.json BEFORE any run launches, so a killed pass still leaves a
+    # self-describing (partial) archive.
+    output_dir = archive_results(
+        [], models, test_cases, args, 0.0,
+        output_dir=None, partial=True, expected_n=expected_n, git_sha=git_sha,
+        batch_token=batch_token, batch_pid=batch_pid,
+    )
+    print(f"Progressive archive: {output_dir}")
+    sys.stdout.flush()
+
+    try:
+        if args.sequential:
+            for tc, model, rep, suffix in runs:
                 try:
-                    r = future.result()
+                    r = run_one(
+                        tc, model, rep, suffix, timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                        enable_early_stop=args.early_stop and not args.no_early_stop,
+                    )
                 except Exception as e:
                     r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
                 all_results.append(r)
                 print_run_result(r)
+                # Progressive per-run archive + incremental rollup.
+                archive_results(
+                    all_results, models, test_cases, args,
+                    time.time() - start_time, output_dir=output_dir,
+                    partial=True, expected_n=expected_n, git_sha=git_sha,
+                    batch_token=batch_token, batch_pid=batch_pid,
+                )
                 sys.stdout.flush()
-
-    wall_time = time.time() - start_time
+        else:
+            max_workers = min(len(runs), args.max_concurrent)
+            with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as pool:
+                futures = {}
+                for i, (tc, model, rep, suffix) in enumerate(runs):
+                    future = pool.submit(
+                        run_one, tc, model, rep, suffix,
+                        timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                        enable_early_stop=args.early_stop and not args.no_early_stop,
+                    )
+                    futures[future] = (tc, model, rep)
+                    if i < len(runs) - 1:
+                        time.sleep(args.delay)
+
+                for future in concurrent.futures.as_completed(futures):
+                    tc, model, rep = futures[future]
+                    try:
+                        r = future.result()
+                    except Exception as e:
+                        r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
+                    all_results.append(r)
+                    print_run_result(r)
+                    # Progressive per-run archive + incremental rollup.
+                    archive_results(
+                        all_results, models, test_cases, args,
+                        time.time() - start_time, output_dir=output_dir,
+                        partial=True, expected_n=expected_n, git_sha=git_sha,
+                        batch_token=batch_token, batch_pid=batch_pid,
+                    )
+                    sys.stdout.flush()
+    finally:
+        # Final rollup runs even on KeyboardInterrupt/exception: partial=False
+        # only when every expected run completed.
+        wall_time = time.time() - start_time
+        all_done = len(all_results) == expected_n
+        archive_results(
+            all_results, models, test_cases, args, wall_time,
+            output_dir=output_dir, partial=not all_done,
+            expected_n=expected_n, git_sha=git_sha,
+            batch_token=batch_token, batch_pid=batch_pid,
+        )
 
     # Sort results by case order, then model order, then rep
     case_order = {tc.id: i for i, tc in enumerate(test_cases)}
@@ -1177,8 +1710,6 @@ def main():
     # Print summary
     print_summary(all_results, models, test_cases, wall_time)
 
-    # Archive results
-    output_dir = archive_results(all_results, models, test_cases, args, wall_time)
     print(f"\nResults archived to: {output_dir}")
 
     # Post-batch contamination check (detect + warn only — never restores).
diff --git a/benchmarks/scripts/run_mode_classification.py b/benchmarks/scripts/run_mode_classification.py
index fddc2e8b..7d4d0acd 100644
--- a/benchmarks/scripts/run_mode_classification.py
+++ b/benchmarks/scripts/run_mode_classification.py
@@ -20,11 +20,14 @@
 import argparse
 import concurrent.futures
 import json
+import os
 import re
 import shutil
 import subprocess
 import sys
+import threading
 import time
+import uuid
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -36,6 +39,7 @@
 from benchmarks.harness.cost_estimator import estimate_batch_cost, format_estimate
 from benchmarks.harness.artifacts import (
     add_preflight_arg,
+    assert_unique_sandbox_slugs,
     attach_schema_version,
     build_error_artifact,
     build_run_artifact,
@@ -46,12 +50,14 @@
     model_manifest_entry,
     nullable_mean,
     run_preflight,
+    sandbox_slug,
 )
 from benchmarks.scorers.deterministic.checkpoint_adherence import (
     extract_new_tool_calls,
     find_benchmark_transcript,
     get_checkpoint_line_count,
 )
+from benchmarks.scorers.deterministic.error_classification import compute_error_counts
 
 # --- Config ---
 
@@ -60,6 +66,16 @@
 MODELS_FILE = BASE_DIR / "benchmarks" / "config" / "models.yaml"
 
 LAUNCH_DELAY_SECONDS = 2
+# Cap on simultaneously in-flight runs. Per-run state (sandbox dir, uuid4 session
+# ids, transcript dirs) is fully isolated, so the cap is purely a resource-
+# pressure guard, not a correctness one. --delay staggers submits independently.
+MAX_CONCURRENT_RUNS = 5
+
+# Serializes the progressive rollup (per-run archive write + summary/manifest
+# rewrite). In the parallel path the as_completed loop already collects results
+# on the main thread one at a time, but the lock makes the invariant explicit and
+# keeps the finalizer safe against any future concurrent caller.
+_ARCHIVE_LOCK = threading.Lock()
 
 # Mode-specific reference files that should NOT be read before confirmation
 MODE_REF_FILES = [
@@ -388,20 +404,63 @@ def score_run(session_id: str, expected_mode: str, checkpoint_lines: int) -> dic
 
 # --- Run + diagnose ---
 
-def run_one(test_case: TestCase, model: ModelConfig, rep: int, sandbox_suffix: str, timeout_override=None):
-    """Execute a single benchmark run with multi-dimensional scoring."""
+def run_one(test_case: TestCase, model: ModelConfig, rep: int, sandbox_suffix: str,
+            timeout_override=None, watchdog_poll=60, stall_threshold=330,
+            stall_retries=1):
+    """Execute a single benchmark run with multi-dimensional scoring.
+
+    Run-lifecycle watchdog (Dispatch B): STALL DETECTION ONLY — no score-complete
+    early stop. This phase's ``no_premature_execution`` criterion is a monotone-
+    FAIL negative (it starts PASS and can only flip to FAIL when the model later
+    dispatches an Agent / reads a mode ref / loads a non-orchestrator skill).
+    Early-stopping the moment all criteria pass would lock in that not-yet-
+    violated negative and mask exactly the premature execution the phase tests
+    for — so early stop is deliberately NOT wired here. Stall detection is safe
+    (it only reclaims genuinely hung runs) and is enabled. A stalled run is
+    relaunched from a fresh sandbox up to ``stall_retries`` times.
+    """
     sandbox_dir = f"/daaf/benchmarks/_sandbox/run_{sandbox_suffix}"
-    config = RunConfig(
-        test_case=test_case,
-        model=model,
-        run_index=rep,
-        sandbox_dir=sandbox_dir,
-        timeout_override=timeout_override,
-    )
 
-    start = time.time()
-    result = execute_run(config)
-    elapsed = time.time() - start
+    attempt = 0
+    # Accumulate each stalled attempt's diagnostics so a run that stalled once
+    # then passed is legible from the archive alone (previously console-only).
+    # Carried onto the FINAL result.json as an additive stall_attempts field.
+    stall_attempts = []
+    while True:
+        config = RunConfig(
+            test_case=test_case,
+            model=model,
+            run_index=rep,
+            sandbox_dir=sandbox_dir,
+            timeout_override=timeout_override,
+            stall_detection=True,
+            watchdog_poll_seconds=watchdog_poll,
+            stall_threshold_seconds=stall_threshold,
+        )
+
+        start = time.time()
+        result = execute_run(config)
+        elapsed = time.time() - start
+
+        if getattr(result, "stalled", False):
+            stall_attempts.append({
+                "attempt": attempt,
+                "stall_diagnostics": dict(result.stall_diagnostics or {}),
+            })
+        if getattr(result, "stalled", False) and attempt < stall_retries:
+            print(
+                f"STALL [{test_case.id} | {model.name} | rep {rep}] attempt "
+                f"{attempt + 1}: {result.stall_diagnostics}; relaunching from a "
+                f"fresh sandbox (retry {attempt + 1}/{stall_retries})."
+            )
+            # Cold-start phase: no golden checkpoint, so execute_run() never calls
+            # prepare_sandbox(); sandbox_dir is simply unused for this phase and
+            # there is nothing to release before the relaunch.
+            attempt += 1
+            continue
+        break
+
+    stall_relaunch_count = attempt
 
     # Always attempt scoring if we have a session_id — even for timed-out runs
     if result.session_id:
@@ -419,6 +478,29 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int, sandbox_suffix: s
             "transcript_path": None,
         }
 
+    # Classify error-bearing tool results into hook-block vs genuine-failure
+    # buckets (parent transcript only in this benchmark). Additive diagnostic.
+    # Fix 4 (2026-07-28): scan the parent transcript directly instead of
+    # relying on result.tool_failures. The executor extracts tool_failures
+    # only on the normal completion path — timeout/stalled/early-stopped runs
+    # return before that extraction (executor.py :229/:249), leaving the
+    # parent side undercounted. This benchmark is single-agent (no subagents),
+    # so the parent transcript is the sole error source. tool_failures is
+    # passed empty so parent errors are counted once (the scan REPLACES, not
+    # augments, the tool_failures-derived counts — no double-count).
+    # W1 (2026-07-28): this is a cold-start phase (CHECKPOINT_LINES = 0), so
+    # there is no golden prefix to skip and parent_skip_lines stays 0. The
+    # goldens-error-free invariant test (tests/test_error_classification.py)
+    # covers the general prefix-contamination guard. Note: this scan sees FULL
+    # untruncated content over the WHOLE transcript, unlike the legacy 500-char-
+    # truncated result.tool_failures path, so bucket classifications can differ
+    # from pre-2026-07-28 runs.
+    parent_transcript = scored.get("transcript_path")
+    error_counts = compute_error_counts(
+        [],
+        parent_transcript=parent_transcript,
+    )
+
     return build_run_artifact(
         model,
         result,
@@ -427,7 +509,10 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int, sandbox_suffix: s
             "expected_mode": test_case.expected.get("mode", ""),
             "rep": rep,
             "criteria": scored["criteria"],
+            "error_counts": error_counts,
             "transcript_path": scored.get("transcript_path"),
+            "stall_relaunch_count": stall_relaunch_count,
+            "stall_attempts": stall_attempts,
         },
         duration_s=elapsed,
     )
@@ -449,6 +534,11 @@ def _error_result(test_case: TestCase, model: ModelConfig, rep: int, error_msg:
         phase_fields={
             "expected_mode": test_case.expected.get("mode", ""),
             "criteria": criteria,
+            "error_counts": {
+                "hook_blocks": 0,
+                "tool_failures": 0,
+                "tool_failures_unclassified": 0,
+            },
             "transcript_path": None,
         },
     )
@@ -473,22 +563,70 @@ def get_git_sha() -> str:
     return "unknown"
 
 
+def _write_json_atomic(path: Path, obj) -> None:
+    """Write JSON to a sibling .tmp then os.replace() over the target.
+
+    Atomicity matters for the progressive rollup: a reader (or a kill) never sees
+    a half-written summary.json/manifest.json — the file either holds the prior
+    complete rollup or the new complete one.
+    """
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    with open(tmp, "w") as f:
+        json.dump(obj, f, indent=2)
+    os.replace(tmp, path)
+
+
 def archive_results(all_results: list[dict], models: list[ModelConfig],
-                    test_cases: list[TestCase], args, wall_time: float) -> Path:
-    """Archive all run results, transcripts, and summary to a timestamped folder."""
-    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
-    output_dir = BASE_DIR / "benchmarks" / "results" / timestamp
+                    test_cases: list[TestCase], args, wall_time: float,
+                    output_dir: Path = None, partial: bool = False,
+                    expected_n: int = None, git_sha: str = None,
+                    batch_token: str = None, batch_pid: int = None) -> Path:
+    """Archive run results, transcripts, and rollups to a timestamped folder.
+
+    Progressive by design (2026-07 redesign): called once before the pool with
+    ``all_results=[]`` to create the folder and seed manifest.json + an initial
+    ``partial`` summary.json, then re-invoked after every completed run over the
+    completed-so-far set, and finally once more with ``partial=False`` when all
+    runs finished. Per-run artifact writes are existence-guarded so re-invocation
+    is cheap (each run's files are written exactly once); manifest/summary are
+    recomputed and atomically rewritten each call. The whole body runs under
+    ``_ARCHIVE_LOCK`` so concurrent callers cannot interleave writes.
+    """
+    with _ARCHIVE_LOCK:
+        return _archive_results_locked(
+            all_results, models, test_cases, args, wall_time,
+            output_dir, partial, expected_n, git_sha, batch_token, batch_pid,
+        )
+
+
+def _archive_results_locked(all_results, models, test_cases, args, wall_time,
+                            output_dir, partial, expected_n, git_sha,
+                            batch_token=None, batch_pid=None) -> Path:
+    if output_dir is None:
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+        # Cross-process uniqueness: two batches starting the same wall-clock
+        # second would otherwise collide on results/{timestamp} and cross-write
+        # each other's manifest/summary. The short token disambiguates while the
+        # LEADING timestamp stays intact so viewer/rerun-queue lexicographic
+        # ordering and glob discovery are unaffected.
+        tok = batch_token or uuid.uuid4().hex[:6]
+        output_dir = BASE_DIR / "benchmarks" / "results" / f"{timestamp}_{tok}"
     output_dir.mkdir(parents=True, exist_ok=True)
     runs_dir = output_dir / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
 
-    git_sha = get_git_sha()
+    if git_sha is None:
+        git_sha = get_git_sha()
 
     # --- Write manifest.json ---
     manifest = attach_schema_version({
         "benchmark": "mode_classification",
         "timestamp": datetime.now(timezone.utc).isoformat(),
         "daaf_git_sha": git_sha,
+        # Cross-batch forensics: the per-batch uniqueness token (also the results
+        # dir-name suffix and sandbox-suffix tail) and the launching process PID.
+        "batch_token": batch_token or output_dir.name.rsplit("_", 1)[-1],
+        "batch_pid": batch_pid if batch_pid is not None else os.getpid(),
         **manifest_provenance(
             golden_checkpoints=[
                 getattr(tc, "golden_checkpoint", None) for tc in test_cases
@@ -513,13 +651,16 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             for tc in test_cases
         ],
     })
-    with open(output_dir / "manifest.json", "w") as f:
-        json.dump(manifest, f, indent=2)
+    _write_json_atomic(output_dir / "manifest.json", manifest)
 
-    # --- Write per-run results and copy transcripts ---
+    # --- Write per-run results and copy transcripts (existence-guarded) ---
+    # Each run's artifacts are immutable once written, so re-invocation across
+    # progressive rollups writes each run exactly once (the result.json guard).
     for r in all_results:
         run_name = f"{r['case_id']}_{r['model'].replace(' ', '_')}_{r['rep']}"
         run_dir = runs_dir / run_name
+        if (run_dir / "result.json").exists():
+            continue
         run_dir.mkdir(parents=True, exist_ok=True)
 
         # Write result.json for this run. The transcript is copied separately;
@@ -528,8 +669,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             key: value for key, value in r.items()
             if key != "transcript_path"
         }
-        with open(run_dir / "result.json", "w") as f:
-            json.dump(result_data, f, indent=2)
+        _write_json_atomic(run_dir / "result.json", result_data)
 
         # Copy transcript if available
         transcript_src = r.get("transcript_path")
@@ -591,8 +731,25 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             name = tf.get("tool_name", "unknown")
             tool_failure_by_name[name] = tool_failure_by_name.get(name, 0) + 1
 
+    # Aggregate the per-run hook-block vs tool-failure diagnostic counters.
+    error_counts_total = {
+        "hook_blocks": 0,
+        "tool_failures": 0,
+        "tool_failures_unclassified": 0,
+    }
+    for r in all_results:
+        ec = r.get("error_counts") or {}
+        for key in error_counts_total:
+            error_counts_total[key] += ec.get(key, 0)
+
+    runs_completed = len(all_results)
     summary = attach_schema_version({
-        "total_runs": len(all_results),
+        "total_runs": runs_completed,
+        # Additive self-description so a crashed/partial pass is legible without
+        # re-deriving from the runs/ directory.
+        "partial": partial,
+        "runs_expected": expected_n if expected_n is not None else runs_completed,
+        "runs_completed": runs_completed,
         "total_cost_usd": total_cost,
         "accounting_coverage": batch_cost["accounting_coverage"],
         "wall_time_s": round(wall_time, 1),
@@ -602,11 +759,11 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             "runs_affected": runs_with_failures,
             "by_tool": tool_failure_by_name,
         },
+        "error_counts": error_counts_total,
         "by_model": model_summaries,
         "by_case": case_summaries,
     })
-    with open(output_dir / "summary.json", "w") as f:
-        json.dump(summary, f, indent=2)
+    _write_json_atomic(output_dir / "summary.json", summary)
 
     return output_dir
 
@@ -747,9 +904,30 @@ def main():
                         help="Run sequentially instead of parallel")
     parser.add_argument("--delay", type=float, default=LAUNCH_DELAY_SECONDS,
                         help="Seconds between parallel launches (default: 2)")
-    parser.add_argument("--timeout", type=int, default=120,
-                        help="Per-run timeout in seconds (Phase 1 default: 120; "
-                             "standardized 2026-07-10, replacing cost-tier defaults)")
+    parser.add_argument("--max-concurrent", type=int, default=MAX_CONCURRENT_RUNS,
+                        help=f"Max simultaneously in-flight runs "
+                             f"(default: {MAX_CONCURRENT_RUNS}). Caps the thread "
+                             f"pool; --delay still staggers submits")
+    parser.add_argument("--timeout", type=int, default=900,
+                        help="Per-run timeout in seconds. Uniform 900s logistical "
+                             "cap (2026-07-21 walltime redesign; formerly "
+                             "120/180/300/300 per-phase). High cap so runs complete "
+                             "rather than censor; duration is now the measured axis")
+    parser.add_argument("--watchdog-poll", type=int, default=60,
+                        help="Watchdog poll interval in seconds (default: 60)")
+    parser.add_argument("--stall-threshold", type=int, default=330,
+                        help="Staleness cutoff in seconds for one stalled read "
+                             "(default: 330; K3-validated). Two consecutive "
+                             "stalled reads trigger a stall kill")
+    parser.add_argument("--stall-retries", type=int, default=1,
+                        help="Times to relaunch a stalled rep from a fresh "
+                             "sandbox (default: 1)")
+    parser.add_argument("--no-early-stop", action="store_true",
+                        help="Accepted for CLI uniformity but INERT for this "
+                             "phase: score-complete early stop is intentionally "
+                             "not wired here (the no_premature_execution negative "
+                             "criterion makes it unfair). Stall detection always "
+                             "runs")
     parser.add_argument("--yes", "-y", action="store_true",
                         help="Skip cost confirmation prompt")
     add_preflight_arg(parser)
@@ -763,6 +941,11 @@ def main():
         print("ERROR: No valid models selected.")
         sys.exit(1)
 
+    # W2 (2026-07-28): fail fast on any sandbox-slug collision across the
+    # selected models before any run launches — colliding slugs would share a
+    # _sandbox/run_* directory and cross-contaminate fixtures/transcripts.
+    assert_unique_sandbox_slugs(models)
+
     # Load test cases
     all_cases = load_test_cases(CASES_FILE)
 
@@ -808,46 +991,102 @@ def main():
     print(f"{'='*90}")
     sys.stdout.flush()
 
+    # Per-batch uniqueness token (cross-process safety): one short token per
+    # runner invocation, reused for BOTH the results dir-name suffix and every
+    # sandbox suffix so concurrent batches never collide on results/ dirs or
+    # _sandbox/run_ dirs, even when running the same model at the same second.
+    batch_token = uuid.uuid4().hex[:6]
+    batch_pid = os.getpid()
+
     # Build run list: case x model x rep
     runs = []
     for tc in test_cases:
         for model in models:
             for rep in range(args.reps):
-                suffix = f"{tc.id}_{model.name.replace(' ', '_')}_{rep}"
+                suffix = f"{tc.id}_{sandbox_slug(model.name)}_{rep}_{batch_token}"
                 runs.append((tc, model, rep, suffix))
 
     all_results = []
+    expected_n = len(runs)
+    git_sha = get_git_sha()
     start_time = time.time()
 
-    if args.sequential:
-        for tc, model, rep, suffix in runs:
-            try:
-                r = run_one(tc, model, rep, suffix, timeout_override=args.timeout)
-            except Exception as e:
-                r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
-            all_results.append(r)
-            print_run_result(r)
-            sys.stdout.flush()
-    else:
-        with concurrent.futures.ThreadPoolExecutor(max_workers=len(runs)) as pool:
-            futures = {}
-            for i, (tc, model, rep, suffix) in enumerate(runs):
-                future = pool.submit(run_one, tc, model, rep, suffix, timeout_override=args.timeout)
-                futures[future] = (tc, model, rep)
-                if i < len(runs) - 1:
-                    time.sleep(args.delay)
-
-            for future in concurrent.futures.as_completed(futures):
-                tc, model, rep = futures[future]
+    # Create the results folder and seed manifest.json + an initial partial
+    # summary.json BEFORE any run launches, so a killed pass still leaves a
+    # self-describing (partial) archive.
+    output_dir = archive_results(
+        [], models, test_cases, args, 0.0,
+        output_dir=None, partial=True, expected_n=expected_n, git_sha=git_sha,
+        batch_token=batch_token, batch_pid=batch_pid,
+    )
+    print(f"Progressive archive: {output_dir}")
+    sys.stdout.flush()
+
+    try:
+        if args.sequential:
+            for tc, model, rep, suffix in runs:
                 try:
-                    r = future.result()
+                    r = run_one(
+                        tc, model, rep, suffix, timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
                 except Exception as e:
                     r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
                 all_results.append(r)
                 print_run_result(r)
+                # Progressive per-run archive + incremental rollup.
+                archive_results(
+                    all_results, models, test_cases, args,
+                    time.time() - start_time, output_dir=output_dir,
+                    partial=True, expected_n=expected_n, git_sha=git_sha,
+                    batch_token=batch_token, batch_pid=batch_pid,
+                )
                 sys.stdout.flush()
-
-    wall_time = time.time() - start_time
+        else:
+            max_workers = min(len(runs), args.max_concurrent)
+            with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as pool:
+                futures = {}
+                for i, (tc, model, rep, suffix) in enumerate(runs):
+                    future = pool.submit(
+                        run_one, tc, model, rep, suffix,
+                        timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
+                    futures[future] = (tc, model, rep)
+                    if i < len(runs) - 1:
+                        time.sleep(args.delay)
+
+                for future in concurrent.futures.as_completed(futures):
+                    tc, model, rep = futures[future]
+                    try:
+                        r = future.result()
+                    except Exception as e:
+                        r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
+                    all_results.append(r)
+                    print_run_result(r)
+                    # Progressive per-run archive + incremental rollup.
+                    archive_results(
+                        all_results, models, test_cases, args,
+                        time.time() - start_time, output_dir=output_dir,
+                        partial=True, expected_n=expected_n, git_sha=git_sha,
+                        batch_token=batch_token, batch_pid=batch_pid,
+                    )
+                    sys.stdout.flush()
+    finally:
+        # Final rollup runs even on KeyboardInterrupt/exception: partial=False
+        # only when every expected run completed.
+        wall_time = time.time() - start_time
+        all_done = len(all_results) == expected_n
+        archive_results(
+            all_results, models, test_cases, args, wall_time,
+            output_dir=output_dir, partial=not all_done,
+            expected_n=expected_n, git_sha=git_sha,
+            batch_token=batch_token, batch_pid=batch_pid,
+        )
 
     # Sort results by case order, then model order, then rep
     case_order = {tc.id: i for i, tc in enumerate(test_cases)}
@@ -857,8 +1096,6 @@ def main():
     # Print summary
     print_summary(all_results, models, test_cases, wall_time)
 
-    # Archive results
-    output_dir = archive_results(all_results, models, test_cases, args, wall_time)
     print(f"\nResults archived to: {output_dir}")
 
 
diff --git a/benchmarks/scripts/run_post_confirmation.py b/benchmarks/scripts/run_post_confirmation.py
index d1d72fd6..c5a3bb2c 100644
--- a/benchmarks/scripts/run_post_confirmation.py
+++ b/benchmarks/scripts/run_post_confirmation.py
@@ -21,10 +21,13 @@
 import argparse
 import concurrent.futures
 import json
+import os
 import shutil
 import subprocess
 import sys
+import threading
 import time
+import uuid
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -37,6 +40,7 @@
 from benchmarks.harness.cost_estimator import estimate_batch_cost, format_estimate
 from benchmarks.harness.artifacts import (
     add_preflight_arg,
+    assert_unique_sandbox_slugs,
     attach_schema_version,
     build_error_artifact,
     build_run_artifact,
@@ -47,6 +51,7 @@
     model_manifest_entry,
     nullable_mean,
     run_preflight,
+    sandbox_slug,
 )
 from benchmarks.scorers.deterministic.checkpoint_adherence import (
     extract_new_tool_calls,
@@ -54,6 +59,7 @@
     get_checkpoint_line_count,
     score_checkpoint,
 )
+from benchmarks.scorers.deterministic.error_classification import compute_error_counts
 
 # --- Config ---
 
@@ -62,6 +68,16 @@
 MODELS_FILE = BASE_DIR / "benchmarks" / "config" / "models.yaml"
 
 LAUNCH_DELAY_SECONDS = 2
+# Cap on simultaneously in-flight runs. Per-run state (sandbox dir, uuid4 session
+# ids, transcript dirs) is fully isolated, so the cap is purely a resource-
+# pressure guard, not a correctness one. --delay staggers submits independently.
+MAX_CONCURRENT_RUNS = 5
+
+# Serializes the progressive rollup (per-run archive write + summary/manifest
+# rewrite). In the parallel path the as_completed loop already collects results
+# on the main thread one at a time, but the lock makes the invariant explicit and
+# keeps the finalizer safe against any future concurrent caller.
+_ARCHIVE_LOCK = threading.Lock()
 
 
 # --- Load config ---
@@ -125,20 +141,60 @@ def score_run(session_id: str, test_case: TestCase) -> dict:
 # --- Run + diagnose ---
 
 def run_one(test_case: TestCase, model: ModelConfig, rep: int,
-            sandbox_suffix: str, timeout_override=None):
-    """Execute a single benchmark run with checkpoint scoring."""
+            sandbox_suffix: str, timeout_override=None, watchdog_poll=60,
+            stall_threshold=330, stall_retries=1):
+    """Execute a single benchmark run with checkpoint scoring.
+
+    Run-lifecycle watchdog (Dispatch B): STALL DETECTION ONLY — no score-complete
+    early stop. This phase's ``no_tool_calls_of_type`` criterion is a monotone-
+    FAIL negative (it starts PASS and can only flip to FAIL when the model later
+    makes a forbidden tool call past the confirmation gate). Early-stopping the
+    moment all criteria pass would lock in that not-yet-violated negative and
+    mask a later gate violation, so early stop is deliberately NOT wired here.
+    Stall detection is safe and enabled; a stalled run is relaunched from a fresh
+    sandbox up to ``stall_retries`` times.
+    """
     sandbox_dir = f"/daaf/benchmarks/_sandbox/run_{sandbox_suffix}"
-    config = RunConfig(
-        test_case=test_case,
-        model=model,
-        run_index=rep,
-        sandbox_dir=sandbox_dir,
-        timeout_override=timeout_override,
-    )
 
-    start = time.time()
-    result = execute_run(config)
-    elapsed = time.time() - start
+    attempt = 0
+    # Accumulate each stalled attempt's diagnostics so a run that stalled once
+    # then passed is legible from the archive alone (previously console-only).
+    # Carried onto the FINAL result.json as an additive stall_attempts field.
+    stall_attempts = []
+    while True:
+        config = RunConfig(
+            test_case=test_case,
+            model=model,
+            run_index=rep,
+            sandbox_dir=sandbox_dir,
+            timeout_override=timeout_override,
+            stall_detection=True,
+            watchdog_poll_seconds=watchdog_poll,
+            stall_threshold_seconds=stall_threshold,
+        )
+
+        start = time.time()
+        result = execute_run(config)
+        elapsed = time.time() - start
+
+        if getattr(result, "stalled", False):
+            stall_attempts.append({
+                "attempt": attempt,
+                "stall_diagnostics": dict(result.stall_diagnostics or {}),
+            })
+        if getattr(result, "stalled", False) and attempt < stall_retries:
+            print(
+                f"STALL [{test_case.id} | {model.name} | rep {rep}] attempt "
+                f"{attempt + 1}: {result.stall_diagnostics}; relaunching from a "
+                f"fresh sandbox (retry {attempt + 1}/{stall_retries})."
+            )
+            if test_case.golden_checkpoint and result.session_id:
+                cleanup_sandbox(result.session_id)
+            attempt += 1
+            continue
+        break
+
+    stall_relaunch_count = attempt
 
     # Always attempt scoring if we have a session_id — even for timed-out runs,
     # the live session file may contain partial but scorable transcript data.
@@ -159,6 +215,31 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             "tool_call_count": 0,
         }
 
+    # Classify error-bearing tool results into hook-block vs genuine-failure
+    # buckets (parent transcript only in this benchmark). Additive diagnostic.
+    # Fix 4 (2026-07-28): scan the parent transcript directly instead of
+    # relying on result.tool_failures. The executor extracts tool_failures
+    # only on the normal completion path — timeout/stalled/early-stopped runs
+    # return before that extraction (executor.py :229/:249), leaving the
+    # parent side undercounted. This benchmark is single-agent (no subagents),
+    # so the parent transcript is the sole error source. tool_failures is
+    # passed empty so parent errors are counted once (the scan REPLACES, not
+    # augments, the tool_failures-derived counts — no double-count). Runs
+    # before cleanup_sandbox below so the live transcript still exists.
+    # W1 (2026-07-28): parent_skip_lines is left at 0 here (no golden-prefix
+    # trimming). The checkpoint-prefix contamination this would guard against is
+    # instead covered by the goldens-error-free invariant test
+    # (tests/test_error_classification.py), which asserts every file under
+    # benchmarks/golden/ carries zero is_error tool_results. Note: this scan
+    # sees FULL untruncated content over the WHOLE transcript, unlike the legacy
+    # 500-char-truncated result.tool_failures path, so bucket classifications
+    # can differ from pre-2026-07-28 runs.
+    parent_transcript = scored.get("transcript_path")
+    error_counts = compute_error_counts(
+        [],
+        parent_transcript=parent_transcript,
+    )
+
     # Clean up checkpoint sandbox AFTER scoring (transcript may live there)
     if test_case.golden_checkpoint:
         cleanup_sandbox(result.session_id)
@@ -171,8 +252,11 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             "subcategory": test_case.subcategory,
             "rep": rep,
             "criteria": scored["criteria"],
+            "error_counts": error_counts,
             "transcript_path": scored.get("transcript_path"),
             "tool_call_count": scored.get("tool_call_count", 0),
+            "stall_relaunch_count": stall_relaunch_count,
+            "stall_attempts": stall_attempts,
         },
         duration_s=elapsed,
     )
@@ -196,6 +280,11 @@ def _error_result(test_case: TestCase, model: ModelConfig, rep: int, error_msg:
         phase_fields={
             "subcategory": test_case.subcategory,
             "criteria": criteria,
+            "error_counts": {
+                "hook_blocks": 0,
+                "tool_failures": 0,
+                "tool_failures_unclassified": 0,
+            },
             "transcript_path": None,
             "tool_call_count": 0,
         },
@@ -221,22 +310,70 @@ def get_git_sha() -> str:
     return "unknown"
 
 
+def _write_json_atomic(path: Path, obj) -> None:
+    """Write JSON to a sibling .tmp then os.replace() over the target.
+
+    Atomicity matters for the progressive rollup: a reader (or a kill) never sees
+    a half-written summary.json/manifest.json — the file either holds the prior
+    complete rollup or the new complete one.
+    """
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    with open(tmp, "w") as f:
+        json.dump(obj, f, indent=2)
+    os.replace(tmp, path)
+
+
 def archive_results(all_results: list[dict], models: list[ModelConfig],
-                    test_cases: list[TestCase], args, wall_time: float) -> Path:
-    """Archive all run results, transcripts, and summary to a timestamped folder."""
-    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
-    output_dir = BASE_DIR / "benchmarks" / "results" / timestamp
+                    test_cases: list[TestCase], args, wall_time: float,
+                    output_dir: Path = None, partial: bool = False,
+                    expected_n: int = None, git_sha: str = None,
+                    batch_token: str = None, batch_pid: int = None) -> Path:
+    """Archive run results, transcripts, and rollups to a timestamped folder.
+
+    Progressive by design (2026-07 redesign): called once before the pool with
+    ``all_results=[]`` to create the folder and seed manifest.json + an initial
+    ``partial`` summary.json, then re-invoked after every completed run over the
+    completed-so-far set, and finally once more with ``partial=False`` when all
+    runs finished. Per-run artifact writes are existence-guarded so re-invocation
+    is cheap (each run's files are written exactly once); manifest/summary are
+    recomputed and atomically rewritten each call. The whole body runs under
+    ``_ARCHIVE_LOCK`` so concurrent callers cannot interleave writes.
+    """
+    with _ARCHIVE_LOCK:
+        return _archive_results_locked(
+            all_results, models, test_cases, args, wall_time,
+            output_dir, partial, expected_n, git_sha, batch_token, batch_pid,
+        )
+
+
+def _archive_results_locked(all_results, models, test_cases, args, wall_time,
+                            output_dir, partial, expected_n, git_sha,
+                            batch_token=None, batch_pid=None) -> Path:
+    if output_dir is None:
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+        # Cross-process uniqueness: two batches starting the same wall-clock
+        # second would otherwise collide on results/{timestamp} and cross-write
+        # each other's manifest/summary. The short token disambiguates while the
+        # LEADING timestamp stays intact so viewer/rerun-queue lexicographic
+        # ordering and glob discovery are unaffected.
+        tok = batch_token or uuid.uuid4().hex[:6]
+        output_dir = BASE_DIR / "benchmarks" / "results" / f"{timestamp}_{tok}"
     output_dir.mkdir(parents=True, exist_ok=True)
     runs_dir = output_dir / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
 
-    git_sha = get_git_sha()
+    if git_sha is None:
+        git_sha = get_git_sha()
 
     # --- Write manifest.json ---
     manifest = attach_schema_version({
         "benchmark": "post_confirmation",
         "timestamp": datetime.now(timezone.utc).isoformat(),
         "daaf_git_sha": git_sha,
+        # Cross-batch forensics: the per-batch uniqueness token (also the results
+        # dir-name suffix and sandbox-suffix tail) and the launching process PID.
+        "batch_token": batch_token or output_dir.name.rsplit("_", 1)[-1],
+        "batch_pid": batch_pid if batch_pid is not None else os.getpid(),
         **manifest_provenance(
             golden_checkpoints=[tc.golden_checkpoint for tc in test_cases],
             run_records=all_results,
@@ -260,13 +397,16 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             for tc in test_cases
         ],
     })
-    with open(output_dir / "manifest.json", "w") as f:
-        json.dump(manifest, f, indent=2)
+    _write_json_atomic(output_dir / "manifest.json", manifest)
 
-    # --- Write per-run results and copy transcripts ---
+    # --- Write per-run results and copy transcripts (existence-guarded) ---
+    # Each run's artifacts are immutable once written, so re-invocation across
+    # progressive rollups writes each run exactly once (the result.json guard).
     for r in all_results:
         run_name = f"{r['case_id']}_{r['model'].replace(' ', '_')}_{r['rep']}"
         run_dir = runs_dir / run_name
+        if (run_dir / "result.json").exists():
+            continue
         run_dir.mkdir(parents=True, exist_ok=True)
 
         # Write result.json for this run. The transcript is copied separately;
@@ -275,8 +415,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             key: value for key, value in r.items()
             if key != "transcript_path"
         }
-        with open(run_dir / "result.json", "w") as f:
-            json.dump(result_data, f, indent=2)
+        _write_json_atomic(run_dir / "result.json", result_data)
 
         # Copy transcript if available
         transcript_src = r.get("transcript_path")
@@ -367,8 +506,25 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             name = tf.get("tool_name", "unknown")
             tool_failure_by_name[name] = tool_failure_by_name.get(name, 0) + 1
 
+    # Aggregate the per-run hook-block vs tool-failure diagnostic counters.
+    error_counts_total = {
+        "hook_blocks": 0,
+        "tool_failures": 0,
+        "tool_failures_unclassified": 0,
+    }
+    for r in all_results:
+        ec = r.get("error_counts") or {}
+        for key in error_counts_total:
+            error_counts_total[key] += ec.get(key, 0)
+
+    runs_completed = len(all_results)
     summary = attach_schema_version({
-        "total_runs": len(all_results),
+        "total_runs": runs_completed,
+        # Additive self-description so a crashed/partial pass is legible without
+        # re-deriving from the runs/ directory.
+        "partial": partial,
+        "runs_expected": expected_n if expected_n is not None else runs_completed,
+        "runs_completed": runs_completed,
         "total_cost_usd": total_cost,
         "accounting_coverage": batch_cost["accounting_coverage"],
         "wall_time_s": round(wall_time, 1),
@@ -378,12 +534,12 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             "runs_affected": runs_with_failures,
             "by_tool": tool_failure_by_name,
         },
+        "error_counts": error_counts_total,
         "criterion_names": all_criterion_names,
         "by_model": model_summaries,
         "by_case": case_summaries,
     })
-    with open(output_dir / "summary.json", "w") as f:
-        json.dump(summary, f, indent=2)
+    _write_json_atomic(output_dir / "summary.json", summary)
 
     return output_dir
 
@@ -549,9 +705,30 @@ def main():
                         help="Run sequentially instead of parallel")
     parser.add_argument("--delay", type=float, default=LAUNCH_DELAY_SECONDS,
                         help="Seconds between parallel launches (default: 2)")
-    parser.add_argument("--timeout", type=int, default=180,
-                        help="Per-run timeout in seconds (Phase 2 default: 180; "
-                             "standardized 2026-07-10, replacing cost-tier defaults)")
+    parser.add_argument("--max-concurrent", type=int, default=MAX_CONCURRENT_RUNS,
+                        help=f"Max simultaneously in-flight runs "
+                             f"(default: {MAX_CONCURRENT_RUNS}). Caps the thread "
+                             f"pool; --delay still staggers submits")
+    parser.add_argument("--timeout", type=int, default=900,
+                        help="Per-run timeout in seconds. Uniform 900s logistical "
+                             "cap (2026-07-21 walltime redesign; formerly "
+                             "120/180/300/300 per-phase). High cap so runs complete "
+                             "rather than censor; duration is now the measured axis")
+    parser.add_argument("--watchdog-poll", type=int, default=60,
+                        help="Watchdog poll interval in seconds (default: 60)")
+    parser.add_argument("--stall-threshold", type=int, default=330,
+                        help="Staleness cutoff in seconds for one stalled read "
+                             "(default: 330; K3-validated). Two consecutive "
+                             "stalled reads trigger a stall kill")
+    parser.add_argument("--stall-retries", type=int, default=1,
+                        help="Times to relaunch a stalled rep from a fresh "
+                             "sandbox (default: 1)")
+    parser.add_argument("--no-early-stop", action="store_true",
+                        help="Accepted for CLI uniformity but INERT for this "
+                             "phase: score-complete early stop is intentionally "
+                             "not wired here (the no_tool_calls_of_type negative "
+                             "criterion makes it unfair). Stall detection always "
+                             "runs")
     parser.add_argument("--yes", "-y", action="store_true",
                         help="Skip cost confirmation prompt")
     add_preflight_arg(parser)
@@ -565,6 +742,11 @@ def main():
         print("ERROR: No valid models selected.")
         sys.exit(1)
 
+    # W2 (2026-07-28): fail fast on any sandbox-slug collision across the
+    # selected models before any run launches — colliding slugs would share a
+    # _sandbox/run_* directory and cross-contaminate fixtures/transcripts.
+    assert_unique_sandbox_slugs(models)
+
     # Load test cases
     all_cases = load_test_cases(CASES_FILE)
 
@@ -632,46 +814,102 @@ def main():
     print(f"{'='*100}")
     sys.stdout.flush()
 
+    # Per-batch uniqueness token (cross-process safety): one short token per
+    # runner invocation, reused for BOTH the results dir-name suffix and every
+    # sandbox suffix so concurrent batches never collide on results/ dirs or
+    # _sandbox/run_ dirs, even when running the same model at the same second.
+    batch_token = uuid.uuid4().hex[:6]
+    batch_pid = os.getpid()
+
     # Build run list: case x model x rep
     runs = []
     for tc in test_cases:
         for model in models:
             for rep in range(args.reps):
-                suffix = f"{tc.id}_{model.name.replace(' ', '_')}_{rep}"
+                suffix = f"{tc.id}_{sandbox_slug(model.name)}_{rep}_{batch_token}"
                 runs.append((tc, model, rep, suffix))
 
     all_results = []
+    expected_n = len(runs)
+    git_sha = get_git_sha()
     start_time = time.time()
 
-    if args.sequential:
-        for tc, model, rep, suffix in runs:
-            try:
-                r = run_one(tc, model, rep, suffix, timeout_override=args.timeout)
-            except Exception as e:
-                r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
-            all_results.append(r)
-            print_run_result(r)
-            sys.stdout.flush()
-    else:
-        with concurrent.futures.ThreadPoolExecutor(max_workers=len(runs)) as pool:
-            futures = {}
-            for i, (tc, model, rep, suffix) in enumerate(runs):
-                future = pool.submit(run_one, tc, model, rep, suffix, timeout_override=args.timeout)
-                futures[future] = (tc, model, rep)
-                if i < len(runs) - 1:
-                    time.sleep(args.delay)
-
-            for future in concurrent.futures.as_completed(futures):
-                tc, model, rep = futures[future]
+    # Create the results folder and seed manifest.json + an initial partial
+    # summary.json BEFORE any run launches, so a killed pass still leaves a
+    # self-describing (partial) archive.
+    output_dir = archive_results(
+        [], models, test_cases, args, 0.0,
+        output_dir=None, partial=True, expected_n=expected_n, git_sha=git_sha,
+        batch_token=batch_token, batch_pid=batch_pid,
+    )
+    print(f"Progressive archive: {output_dir}")
+    sys.stdout.flush()
+
+    try:
+        if args.sequential:
+            for tc, model, rep, suffix in runs:
                 try:
-                    r = future.result()
+                    r = run_one(
+                        tc, model, rep, suffix, timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
                 except Exception as e:
                     r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
                 all_results.append(r)
                 print_run_result(r)
+                # Progressive per-run archive + incremental rollup.
+                archive_results(
+                    all_results, models, test_cases, args,
+                    time.time() - start_time, output_dir=output_dir,
+                    partial=True, expected_n=expected_n, git_sha=git_sha,
+                    batch_token=batch_token, batch_pid=batch_pid,
+                )
                 sys.stdout.flush()
-
-    wall_time = time.time() - start_time
+        else:
+            max_workers = min(len(runs), args.max_concurrent)
+            with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as pool:
+                futures = {}
+                for i, (tc, model, rep, suffix) in enumerate(runs):
+                    future = pool.submit(
+                        run_one, tc, model, rep, suffix,
+                        timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
+                    futures[future] = (tc, model, rep)
+                    if i < len(runs) - 1:
+                        time.sleep(args.delay)
+
+                for future in concurrent.futures.as_completed(futures):
+                    tc, model, rep = futures[future]
+                    try:
+                        r = future.result()
+                    except Exception as e:
+                        r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
+                    all_results.append(r)
+                    print_run_result(r)
+                    # Progressive per-run archive + incremental rollup.
+                    archive_results(
+                        all_results, models, test_cases, args,
+                        time.time() - start_time, output_dir=output_dir,
+                        partial=True, expected_n=expected_n, git_sha=git_sha,
+                        batch_token=batch_token, batch_pid=batch_pid,
+                    )
+                    sys.stdout.flush()
+    finally:
+        # Final rollup runs even on KeyboardInterrupt/exception: partial=False
+        # only when every expected run completed.
+        wall_time = time.time() - start_time
+        all_done = len(all_results) == expected_n
+        archive_results(
+            all_results, models, test_cases, args, wall_time,
+            output_dir=output_dir, partial=not all_done,
+            expected_n=expected_n, git_sha=git_sha,
+            batch_token=batch_token, batch_pid=batch_pid,
+        )
 
     # Sort results by case order, then model order, then rep
     case_order = {tc.id: i for i, tc in enumerate(test_cases)}
@@ -681,8 +919,6 @@ def main():
     # Print summary
     print_summary(all_results, models, test_cases, wall_time)
 
-    # Archive results
-    output_dir = archive_results(all_results, models, test_cases, args, wall_time)
     print(f"\nResults archived to: {output_dir}")
 
 
diff --git a/benchmarks/scripts/run_skill_routing.py b/benchmarks/scripts/run_skill_routing.py
index 983a9ac3..25ed1db3 100644
--- a/benchmarks/scripts/run_skill_routing.py
+++ b/benchmarks/scripts/run_skill_routing.py
@@ -31,10 +31,13 @@
 import argparse
 import concurrent.futures
 import json
+import os
 import shutil
 import subprocess
 import sys
+import threading
 import time
+import uuid
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -47,6 +50,7 @@
 from benchmarks.harness.cost_estimator import estimate_batch_cost, format_estimate
 from benchmarks.harness.artifacts import (
     add_preflight_arg,
+    assert_unique_sandbox_slugs,
     attach_schema_version,
     build_error_artifact,
     build_run_artifact,
@@ -57,6 +61,7 @@
     model_manifest_entry,
     nullable_mean,
     run_preflight,
+    sandbox_slug,
 )
 from benchmarks.scorers.deterministic.checkpoint_adherence import (
     extract_new_tool_calls,
@@ -66,6 +71,7 @@
 from benchmarks.scorers.deterministic.skill_routing import (
     score_skill_routing,
 )
+from benchmarks.scorers.deterministic.error_classification import compute_error_counts
 
 # --- Config ---
 
@@ -74,6 +80,16 @@
 MODELS_FILE = BASE_DIR / "benchmarks" / "config" / "models.yaml"
 
 LAUNCH_DELAY_SECONDS = 2
+# Cap on simultaneously in-flight runs. Per-run state (sandbox dir, uuid4 session
+# ids, transcript dirs) is fully isolated, so the cap is purely a resource-
+# pressure guard, not a correctness one. --delay staggers submits independently.
+MAX_CONCURRENT_RUNS = 5
+
+# Serializes the progressive rollup (per-run archive write + summary/manifest
+# rewrite). In the parallel path the as_completed loop already collects results
+# on the main thread one at a time, but the lock makes the invariant explicit and
+# keeps the finalizer safe against any future concurrent caller.
+_ARCHIVE_LOCK = threading.Lock()
 
 
 # --- Load config ---
@@ -138,33 +154,76 @@ def score_run(session_id: str, test_case: TestCase) -> dict:
         "criteria": criteria_dicts,
         "transcript_path": str(transcript_path),
         "tool_call_count": tool_call_count,
+        # W1 (2026-07-28): expose the golden line count so the error scan can
+        # skip the checkpoint prefix on the parent transcript, exactly as
+        # extract_new_tool_calls does. Derived here so there is one source.
+        "checkpoint_lines": checkpoint_lines,
     }
 
 
 # --- Run + diagnose ---
 
 def run_one(test_case: TestCase, model: ModelConfig, rep: int,
-            sandbox_suffix: str, timeout_override=None):
-    """Execute a single benchmark run with checkpoint scoring."""
+            sandbox_suffix: str, timeout_override=None, watchdog_poll=60,
+            stall_threshold=330, stall_retries=1):
+    """Execute a single benchmark run with checkpoint scoring.
+
+    Run-lifecycle watchdog (Dispatch B): STALL DETECTION ONLY — no score-complete
+    early stop. This phase's ``no_forbidden_skills`` criterion is a monotone-FAIL
+    negative (it starts PASS and can only flip to FAIL when the model later loads
+    a forbidden skill). Early-stopping the moment all criteria pass would lock in
+    that not-yet-violated negative and mask a later forbidden-skill load, so
+    early stop is deliberately NOT wired here. Stall detection is safe and
+    enabled; a stalled run is relaunched from a fresh sandbox up to
+    ``stall_retries`` times.
+    """
     sandbox_dir = f"/daaf/benchmarks/_sandbox/run_{sandbox_suffix}"
 
-    # Disallow the Agent tool entirely (replaces the default git Bash-pattern
-    # deny list): Phase 4 scoring is main-transcript-only, and brainstorming
-    # questions are direct-answer territory per ad-hoc-collaboration-mode.md.
-    # Whole-tool disallow by exact name works reliably (unlike Bash sub-pattern
-    # deny rules — see benchmarks/README.md section 11, Limitation 1).
-    config = RunConfig(
-        test_case=test_case,
-        model=model,
-        run_index=rep,
-        sandbox_dir=sandbox_dir,
-        disallowed_tools=["Agent"],
-        timeout_override=timeout_override,
-    )
+    attempt = 0
+    # Accumulate each stalled attempt's diagnostics so a run that stalled once
+    # then passed is legible from the archive alone (previously console-only).
+    # Carried onto the FINAL result.json as an additive stall_attempts field.
+    stall_attempts = []
+    while True:
+        # Disallow the Agent tool entirely (replaces the default git Bash-pattern
+        # deny list): Phase 4 scoring is main-transcript-only, and brainstorming
+        # questions are direct-answer territory per ad-hoc-collaboration-mode.md.
+        # Whole-tool disallow by exact name works reliably (unlike Bash sub-pattern
+        # deny rules — see benchmarks/README.md section 11, Limitation 1).
+        config = RunConfig(
+            test_case=test_case,
+            model=model,
+            run_index=rep,
+            sandbox_dir=sandbox_dir,
+            disallowed_tools=["Agent"],
+            timeout_override=timeout_override,
+            stall_detection=True,
+            watchdog_poll_seconds=watchdog_poll,
+            stall_threshold_seconds=stall_threshold,
+        )
 
-    start = time.time()
-    result = execute_run(config)
-    elapsed = time.time() - start
+        start = time.time()
+        result = execute_run(config)
+        elapsed = time.time() - start
+
+        if getattr(result, "stalled", False):
+            stall_attempts.append({
+                "attempt": attempt,
+                "stall_diagnostics": dict(result.stall_diagnostics or {}),
+            })
+        if getattr(result, "stalled", False) and attempt < stall_retries:
+            print(
+                f"STALL [{test_case.id} | {model.name} | rep {rep}] attempt "
+                f"{attempt + 1}: {result.stall_diagnostics}; relaunching from a "
+                f"fresh sandbox (retry {attempt + 1}/{stall_retries})."
+            )
+            if test_case.golden_checkpoint and result.session_id:
+                cleanup_sandbox(result.session_id)
+            attempt += 1
+            continue
+        break
+
+    stall_relaunch_count = attempt
 
     # Always attempt scoring if we have a session_id — even for timed-out runs,
     # the live session file may contain partial but scorable transcript data.
@@ -200,6 +259,38 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             if subagent_dir.exists():
                 shutil.copytree(subagent_dir, archive_dir / "subagents", dirs_exist_ok=True)
 
+    # Classify error-bearing tool results (parent + any archived subagent
+    # transcripts) into hook-block vs genuine-failure buckets before cleanup
+    # removes the live transcripts. Additive diagnostic only.
+    subagent_transcripts = []
+    if archived_transcript:
+        sub_dir = Path(archived_transcript).parent / "subagents"
+        if sub_dir.exists():
+            subagent_transcripts = list(sub_dir.rglob("*.jsonl"))
+    # Fix 4 (2026-07-28): scan the parent transcript directly instead of
+    # relying on result.tool_failures. The executor extracts tool_failures
+    # only on the normal completion path — timeout/stalled/early-stopped runs
+    # return before that extraction (executor.py :229/:249), leaving the
+    # parent side undercounted. Scanning the archived parent transcript with
+    # the same _iter_transcript_error_contents used for subagents closes the
+    # gap. tool_failures is passed empty so parent errors are counted once:
+    # the transcript scan REPLACES, not augments, the tool_failures-derived
+    # counts (no double-count).
+    # W1 (2026-07-28): the parent transcript carries the prepended golden
+    # checkpoint prefix, so its scan skips the first checkpoint_lines lines
+    # (mirroring extract_new_tool_calls); subagent transcripts have no prefix
+    # and are scanned in full. Note: this scan sees FULL untruncated content
+    # over the WHOLE post-checkpoint transcript, unlike the legacy 500-char-
+    # truncated result.tool_failures path, so bucket classifications can differ
+    # from pre-2026-07-28 runs.
+    parent_skip_lines = scored.get("checkpoint_lines", 0)
+    error_counts = compute_error_counts(
+        [],
+        subagent_transcripts=subagent_transcripts,
+        parent_transcript=archived_transcript,
+        parent_skip_lines=parent_skip_lines,
+    )
+
     # Clean up checkpoint sandbox AFTER archiving
     if test_case.golden_checkpoint:
         cleanup_sandbox(result.session_id)
@@ -212,8 +303,11 @@ def run_one(test_case: TestCase, model: ModelConfig, rep: int,
             "subcategory": test_case.subcategory,
             "rep": rep,
             "criteria": scored["criteria"],
+            "error_counts": error_counts,
             "transcript_path": archived_transcript or scored.get("transcript_path"),
             "tool_call_count": scored.get("tool_call_count", 0),
+            "stall_relaunch_count": stall_relaunch_count,
+            "stall_attempts": stall_attempts,
         },
         duration_s=elapsed,
     )
@@ -237,6 +331,11 @@ def _error_result(test_case: TestCase, model: ModelConfig, rep: int, error_msg:
         phase_fields={
             "subcategory": test_case.subcategory,
             "criteria": criteria,
+            "error_counts": {
+                "hook_blocks": 0,
+                "tool_failures": 0,
+                "tool_failures_unclassified": 0,
+            },
             "transcript_path": None,
             "tool_call_count": 0,
         },
@@ -262,22 +361,70 @@ def get_git_sha() -> str:
     return "unknown"
 
 
+def _write_json_atomic(path: Path, obj) -> None:
+    """Write JSON to a sibling .tmp then os.replace() over the target.
+
+    Atomicity matters for the progressive rollup: a reader (or a kill) never sees
+    a half-written summary.json/manifest.json — the file either holds the prior
+    complete rollup or the new complete one.
+    """
+    tmp = path.with_suffix(path.suffix + ".tmp")
+    with open(tmp, "w") as f:
+        json.dump(obj, f, indent=2)
+    os.replace(tmp, path)
+
+
 def archive_results(all_results: list[dict], models: list[ModelConfig],
-                    test_cases: list[TestCase], args, wall_time: float) -> Path:
-    """Archive all run results, transcripts, and summary to a timestamped folder."""
-    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
-    output_dir = BASE_DIR / "benchmarks" / "results" / timestamp
+                    test_cases: list[TestCase], args, wall_time: float,
+                    output_dir: Path = None, partial: bool = False,
+                    expected_n: int = None, git_sha: str = None,
+                    batch_token: str = None, batch_pid: int = None) -> Path:
+    """Archive run results, transcripts, and rollups to a timestamped folder.
+
+    Progressive by design (2026-07 redesign): called once before the pool with
+    ``all_results=[]`` to create the folder and seed manifest.json + an initial
+    ``partial`` summary.json, then re-invoked after every completed run over the
+    completed-so-far set, and finally once more with ``partial=False`` when all
+    runs finished. Per-run artifact writes are existence-guarded so re-invocation
+    is cheap (each run's files are written exactly once); manifest/summary are
+    recomputed and atomically rewritten each call. The whole body runs under
+    ``_ARCHIVE_LOCK`` so concurrent callers cannot interleave writes.
+    """
+    with _ARCHIVE_LOCK:
+        return _archive_results_locked(
+            all_results, models, test_cases, args, wall_time,
+            output_dir, partial, expected_n, git_sha, batch_token, batch_pid,
+        )
+
+
+def _archive_results_locked(all_results, models, test_cases, args, wall_time,
+                            output_dir, partial, expected_n, git_sha,
+                            batch_token=None, batch_pid=None) -> Path:
+    if output_dir is None:
+        timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+        # Cross-process uniqueness: two batches starting the same wall-clock
+        # second would otherwise collide on results/{timestamp} and cross-write
+        # each other's manifest/summary. The short token disambiguates while the
+        # LEADING timestamp stays intact so viewer/rerun-queue lexicographic
+        # ordering and glob discovery are unaffected.
+        tok = batch_token or uuid.uuid4().hex[:6]
+        output_dir = BASE_DIR / "benchmarks" / "results" / f"{timestamp}_{tok}"
     output_dir.mkdir(parents=True, exist_ok=True)
     runs_dir = output_dir / "runs"
     runs_dir.mkdir(parents=True, exist_ok=True)
 
-    git_sha = get_git_sha()
+    if git_sha is None:
+        git_sha = get_git_sha()
 
     # --- Write manifest.json ---
     manifest = attach_schema_version({
         "benchmark": "skill_routing",
         "timestamp": datetime.now(timezone.utc).isoformat(),
         "daaf_git_sha": git_sha,
+        # Cross-batch forensics: the per-batch uniqueness token (also the results
+        # dir-name suffix and sandbox-suffix tail) and the launching process PID.
+        "batch_token": batch_token or output_dir.name.rsplit("_", 1)[-1],
+        "batch_pid": batch_pid if batch_pid is not None else os.getpid(),
         **manifest_provenance(
             golden_checkpoints=[tc.golden_checkpoint for tc in test_cases],
             run_records=all_results,
@@ -301,13 +448,16 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             for tc in test_cases
         ],
     })
-    with open(output_dir / "manifest.json", "w") as f:
-        json.dump(manifest, f, indent=2)
+    _write_json_atomic(output_dir / "manifest.json", manifest)
 
-    # --- Write per-run results and copy transcripts ---
+    # --- Write per-run results and copy transcripts (existence-guarded) ---
+    # Each run's artifacts are immutable once written, so re-invocation across
+    # progressive rollups writes each run exactly once (the result.json guard).
     for r in all_results:
         run_name = f"{r['case_id']}_{r['model'].replace(' ', '_')}_{r['rep']}"
         run_dir = runs_dir / run_name
+        if (run_dir / "result.json").exists():
+            continue
         run_dir.mkdir(parents=True, exist_ok=True)
 
         # Write every flat, phase-specific, and schema-v2 field. Transcript
@@ -316,8 +466,7 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             key: value for key, value in r.items()
             if key != "transcript_path"
         }
-        with open(run_dir / "result.json", "w") as f:
-            json.dump(result_data, f, indent=2)
+        _write_json_atomic(run_dir / "result.json", result_data)
 
         # Copy transcript if available
         transcript_src = r.get("transcript_path")
@@ -408,8 +557,25 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             name = tf.get("tool_name", "unknown")
             tool_failure_by_name[name] = tool_failure_by_name.get(name, 0) + 1
 
+    # Aggregate the per-run hook-block vs tool-failure diagnostic counters.
+    error_counts_total = {
+        "hook_blocks": 0,
+        "tool_failures": 0,
+        "tool_failures_unclassified": 0,
+    }
+    for r in all_results:
+        ec = r.get("error_counts") or {}
+        for key in error_counts_total:
+            error_counts_total[key] += ec.get(key, 0)
+
+    runs_completed = len(all_results)
     summary = attach_schema_version({
-        "total_runs": len(all_results),
+        "total_runs": runs_completed,
+        # Additive self-description so a crashed/partial pass is legible without
+        # re-deriving from the runs/ directory.
+        "partial": partial,
+        "runs_expected": expected_n if expected_n is not None else runs_completed,
+        "runs_completed": runs_completed,
         "total_cost_usd": total_cost,
         "accounting_coverage": batch_cost["accounting_coverage"],
         "wall_time_s": round(wall_time, 1),
@@ -419,12 +585,12 @@ def archive_results(all_results: list[dict], models: list[ModelConfig],
             "runs_affected": runs_with_failures,
             "by_tool": tool_failure_by_name,
         },
+        "error_counts": error_counts_total,
         "criterion_names": all_criterion_names,
         "by_model": model_summaries,
         "by_case": case_summaries,
     })
-    with open(output_dir / "summary.json", "w") as f:
-        json.dump(summary, f, indent=2)
+    _write_json_atomic(output_dir / "summary.json", summary)
 
     return output_dir
 
@@ -590,9 +756,30 @@ def main():
                         help="Run sequentially instead of parallel")
     parser.add_argument("--delay", type=float, default=LAUNCH_DELAY_SECONDS,
                         help="Seconds between parallel launches (default: 2)")
-    parser.add_argument("--timeout", type=int, default=300,
-                        help="Per-run timeout in seconds (Phase 4 default: 300; "
-                             "standardized 2026-07-10, replacing cost-tier defaults)")
+    parser.add_argument("--max-concurrent", type=int, default=MAX_CONCURRENT_RUNS,
+                        help=f"Max simultaneously in-flight runs "
+                             f"(default: {MAX_CONCURRENT_RUNS}). Caps the thread "
+                             f"pool; --delay still staggers submits")
+    parser.add_argument("--timeout", type=int, default=900,
+                        help="Per-run timeout in seconds. Uniform 900s logistical "
+                             "cap (2026-07-21 walltime redesign; formerly "
+                             "120/180/300/300 per-phase). High cap so runs complete "
+                             "rather than censor; duration is now the measured axis")
+    parser.add_argument("--watchdog-poll", type=int, default=60,
+                        help="Watchdog poll interval in seconds (default: 60)")
+    parser.add_argument("--stall-threshold", type=int, default=330,
+                        help="Staleness cutoff in seconds for one stalled read "
+                             "(default: 330; K3-validated). Two consecutive "
+                             "stalled reads trigger a stall kill")
+    parser.add_argument("--stall-retries", type=int, default=1,
+                        help="Times to relaunch a stalled rep from a fresh "
+                             "sandbox (default: 1)")
+    parser.add_argument("--no-early-stop", action="store_true",
+                        help="Accepted for CLI uniformity but INERT for this "
+                             "phase: score-complete early stop is intentionally "
+                             "not wired here (the no_forbidden_skills negative "
+                             "criterion makes it unfair). Stall detection always "
+                             "runs")
     parser.add_argument("--yes", "-y", action="store_true",
                         help="Skip cost confirmation prompt")
     add_preflight_arg(parser)
@@ -606,6 +793,11 @@ def main():
         print("ERROR: No valid models selected.")
         sys.exit(1)
 
+    # W2 (2026-07-28): fail fast on any sandbox-slug collision across the
+    # selected models before any run launches — colliding slugs would share a
+    # _sandbox/run_* directory and cross-contaminate fixtures/transcripts.
+    assert_unique_sandbox_slugs(models)
+
     # Load test cases
     all_cases = load_test_cases(CASES_FILE)
 
@@ -673,46 +865,102 @@ def main():
     print(f"{'='*100}")
     sys.stdout.flush()
 
+    # Per-batch uniqueness token (cross-process safety): one short token per
+    # runner invocation, reused for BOTH the results dir-name suffix and every
+    # sandbox suffix so concurrent batches never collide on results/ dirs or
+    # _sandbox/run_ dirs, even when running the same model at the same second.
+    batch_token = uuid.uuid4().hex[:6]
+    batch_pid = os.getpid()
+
     # Build run list: case x model x rep
     runs = []
     for tc in test_cases:
         for model in models:
             for rep in range(args.reps):
-                suffix = f"{tc.id}_{model.name.replace(' ', '_')}_{rep}"
+                suffix = f"{tc.id}_{sandbox_slug(model.name)}_{rep}_{batch_token}"
                 runs.append((tc, model, rep, suffix))
 
     all_results = []
+    expected_n = len(runs)
+    git_sha = get_git_sha()
     start_time = time.time()
 
-    if args.sequential:
-        for tc, model, rep, suffix in runs:
-            try:
-                r = run_one(tc, model, rep, suffix, timeout_override=args.timeout)
-            except Exception as e:
-                r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
-            all_results.append(r)
-            print_run_result(r)
-            sys.stdout.flush()
-    else:
-        with concurrent.futures.ThreadPoolExecutor(max_workers=len(runs)) as pool:
-            futures = {}
-            for i, (tc, model, rep, suffix) in enumerate(runs):
-                future = pool.submit(run_one, tc, model, rep, suffix, timeout_override=args.timeout)
-                futures[future] = (tc, model, rep)
-                if i < len(runs) - 1:
-                    time.sleep(args.delay)
-
-            for future in concurrent.futures.as_completed(futures):
-                tc, model, rep = futures[future]
+    # Create the results folder and seed manifest.json + an initial partial
+    # summary.json BEFORE any run launches, so a killed pass still leaves a
+    # self-describing (partial) archive.
+    output_dir = archive_results(
+        [], models, test_cases, args, 0.0,
+        output_dir=None, partial=True, expected_n=expected_n, git_sha=git_sha,
+        batch_token=batch_token, batch_pid=batch_pid,
+    )
+    print(f"Progressive archive: {output_dir}")
+    sys.stdout.flush()
+
+    try:
+        if args.sequential:
+            for tc, model, rep, suffix in runs:
                 try:
-                    r = future.result()
+                    r = run_one(
+                        tc, model, rep, suffix, timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
                 except Exception as e:
                     r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
                 all_results.append(r)
                 print_run_result(r)
+                # Progressive per-run archive + incremental rollup.
+                archive_results(
+                    all_results, models, test_cases, args,
+                    time.time() - start_time, output_dir=output_dir,
+                    partial=True, expected_n=expected_n, git_sha=git_sha,
+                    batch_token=batch_token, batch_pid=batch_pid,
+                )
                 sys.stdout.flush()
-
-    wall_time = time.time() - start_time
+        else:
+            max_workers = min(len(runs), args.max_concurrent)
+            with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as pool:
+                futures = {}
+                for i, (tc, model, rep, suffix) in enumerate(runs):
+                    future = pool.submit(
+                        run_one, tc, model, rep, suffix,
+                        timeout_override=args.timeout,
+                        watchdog_poll=args.watchdog_poll,
+                        stall_threshold=args.stall_threshold,
+                        stall_retries=args.stall_retries,
+                    )
+                    futures[future] = (tc, model, rep)
+                    if i < len(runs) - 1:
+                        time.sleep(args.delay)
+
+                for future in concurrent.futures.as_completed(futures):
+                    tc, model, rep = futures[future]
+                    try:
+                        r = future.result()
+                    except Exception as e:
+                        r = _error_result(tc, model, rep, f"{type(e).__name__}: {e}")
+                    all_results.append(r)
+                    print_run_result(r)
+                    # Progressive per-run archive + incremental rollup.
+                    archive_results(
+                        all_results, models, test_cases, args,
+                        time.time() - start_time, output_dir=output_dir,
+                        partial=True, expected_n=expected_n, git_sha=git_sha,
+                        batch_token=batch_token, batch_pid=batch_pid,
+                    )
+                    sys.stdout.flush()
+    finally:
+        # Final rollup runs even on KeyboardInterrupt/exception: partial=False
+        # only when every expected run completed.
+        wall_time = time.time() - start_time
+        all_done = len(all_results) == expected_n
+        archive_results(
+            all_results, models, test_cases, args, wall_time,
+            output_dir=output_dir, partial=not all_done,
+            expected_n=expected_n, git_sha=git_sha,
+            batch_token=batch_token, batch_pid=batch_pid,
+        )
 
     # Sort results by case order, then model order, then rep
     case_order = {tc.id: i for i, tc in enumerate(test_cases)}
@@ -722,8 +970,6 @@ def main():
     # Print summary
     print_summary(all_results, models, test_cases, wall_time)
 
-    # Archive results
-    output_dir = archive_results(all_results, models, test_cases, args, wall_time)
     print(f"\nResults archived to: {output_dir}")
 
 
diff --git a/benchmarks/scripts/viewer_template.html b/benchmarks/scripts/viewer_template.html
index d837affb..b1ecedd3 100644
--- a/benchmarks/scripts/viewer_template.html
+++ b/benchmarks/scripts/viewer_template.html
@@ -263,7 +263,7 @@
    keeps scrollbar geometry plausible before first render ("auto" then reuses
    the last rendered size); hash deep-links still work — the engine renders
    the navigation target on jump (Chrome / Firefox 125+). */
-#leaderboard,#cost-performance,#run-explorer,#provenance{
+#leaderboard,#cost-performance,#run-explorer{
   content-visibility:auto;
   contain-intrinsic-size:auto 900px;
 }
@@ -289,7 +289,7 @@
    pages. (http(s) retest item: re-verify the first-click landing and
    subsequent anchor jumps post-deploy.) */
 body.nav-rendered #leaderboard,body.nav-rendered #cost-performance,
-body.nav-rendered #run-explorer,body.nav-rendered #provenance,
+body.nav-rendered #run-explorer,
 body.nav-rendered #phases,body.nav-rendered #cases{
   content-visibility:visible;
 }
@@ -524,41 +524,6 @@
    teal links 8.78:1, accent-light 5.65:1, chip-val teal 9.44:1,
    code-chip indigo-light 5.19:1, SVG axis text 8.72:1 — all PASS. */
 
-/* === Timeout scale (leaderboard Timed-out column; fine-tuning round 3,
-   Wave A) === A dedicated 5-step RED worst-is-hot ramp on --c-fail-rgb,
-   mirroring the .rs-* mechanism but inverted semantics: 0% timeouts reads
-   quiet/neutral (good), the highest shares read strong fail-red. This
-   resolves the original objection that kept the column off a ramp (the
-   pass-green .rs-* family reads high-is-good — it would visually reward
-   timeouts); a fail-red ramp keeps worst-is-hot honest. Color never
-   carries meaning alone: the 1-decimal % text + k/n sub-line stay in the
-   cell, so the number itself is the redundancy (no glyphs needed).
-   Thresholds (toStep(), next to rateStep()) were designed from the actual
-   2026-06 corpus distribution (design basis: 17 models, now 19) clustering low: 0% (x2),
-   1.3-1.4% (x2), 4.3-6.4% (x4), 9.2-9.8% (x2), 13.7-15.0% (x3),
-   20.3-26.8% (x3), 45.8% (x1) — so rateStep's 50/90 breaks would dump 16
-   of 17 models into two steps. Breaks 0 / >0 / >=5% / >=10% / >=20% spread
-   the corpus 2/4/4/3/4 across the five steps and stay round and readable
-   (one-in-twenty / one-in-ten / one-in-five).
-   Contrast (computed for the WCAG 4.5:1 small-text floor, worse of the
-   two surfaces #0a0f1c/#151d2e): the fail red is DARKER than the pass
-   green, so the rs-3-style dark-text flip at alpha .65 FAILS here
-   (--surface-0 text measures 3.49:1) — to-3 instead keeps light text on a
-   .55 fill (text-1 5.66:1 worst; the opacity-.85 .lb-n sub-line 4.59:1).
-   to-4 (.85) flips dark like rs-4 (--surface-0 5.24:1 worst), but the
-   .lb-n at opacity .85 measures 4.49:1 — a hair under floor — so .to-4
-   carries an opacity:1 override for its k/n line. to-1 (.16, text-1
-   12.09:1) and to-2 (.34, text-1 8.62:1) mirror the rs-* alphas. to-0 is
-   deliberately untinted: a faint red wash on a 0% cell would suggest a
-   problem where there is none, and rs-na (the no-data idiom) must stay
-   visually distinct from "zero timeouts". */
-.to-0{ background:transparent; color:var(--text-2); }
-.to-1{ background:rgba(var(--c-fail-rgb),.16); color:var(--text-1); }
-.to-2{ background:rgba(var(--c-fail-rgb),.34); color:var(--text-1); }
-.to-3{ background:rgba(var(--c-fail-rgb),.55); color:var(--text-1); }
-.to-4{ background:rgba(var(--c-fail-rgb),.85); color:var(--surface-0); }
-.to-4 .lb-n{ opacity:1; } /* .85 opacity measured 4.49:1 — see comment above */
-
 /* === Leaderboard === */
 .lb-finding,.cp-finding,.pd-finding{ font-size:15px; max-width:980px; margin:4px 0 12px; line-height:1.55; }
 .lb-controls{ display:flex; align-items:center; gap:6px; flex-wrap:wrap; margin-bottom:12px; }
@@ -622,7 +587,14 @@
   border:1px solid var(--border-1); overflow:hidden;
 }
 .lb-bar-fill{ position:absolute; left:0; top:0; bottom:0; background:rgba(var(--c-pass-rgb),.75); }
-.lb-bar-tick{ position:absolute; top:0; bottom:0; width:1px; background:var(--text-1); opacity:.7; }
+/* Composite-bar component markers (v3.5.0, Fix 5): small hollow circles
+   (stroke = tick color, transparent fill), vertically centered on the bar and
+   horizontally centered on the component's left:X% position. Replaces the
+   former 1px vertical tick; positioning logic in the renderer is unchanged. */
+.lb-bar-tick{ position:absolute; top:50%; width:6px; height:6px; margin-top:-3px; margin-left:-3px; border-radius:50%; border:2px solid var(--text-1); background:transparent; opacity:.85; box-sizing:border-box; }
+/* .lb-api-equiv rule removed in v3.6.0 with its leaderboard badge (V4);
+   the api-equivalent basis disclosure now lives in the Relative Test Cost
+   methods prose and the cost-cell tooltip. */
 .lb-cell{ text-align:center; }
 .lb-cell .hm-cell{ min-width:64px; }
 .lb-n{ display:block; font-size:9px; font-weight:400; opacity:.85; }
@@ -809,14 +781,12 @@
 .run-list-item .case-label{ font-weight:600; color:var(--text-1); }
 .run-list-item .model-label{ color:var(--text-2); }
 /* Grade status glyphs (WP7 taxonomy): color + glyph + tooltip, never
-   color alone. Timeout is a separate clock marker (.to-mark), not a
-   status of its own — timed-out runs are usually still graded. */
+   color alone. */
 .st-glyph{ display:inline-block; width:12px; text-align:center; font-weight:700; cursor:help; }
 .st-perfect{ color:var(--c-pass); }
 .st-partial{ color:var(--c-partial); }
 .st-failed{ color:var(--c-fail); }
 .st-ungraded{ color:var(--c-neutral); }
-.to-mark{ color:var(--text-2); font-size:11px; cursor:help; }
 .run-detail-panel{
   flex:1; overflow-y:auto; border:1px solid var(--border-1); border-radius:14px;
   background:var(--surface-1); padding:16px 20px;
@@ -938,7 +908,6 @@
 .badge-fail{ background:rgba(var(--c-fail-rgb),.2); color:var(--c-fail-light); }
 .badge-partial{ background:rgba(251,191,36,.2); color:#fde68a; }
 .badge-neutral{ background:rgba(100,116,139,.2); color:var(--text-2); }
-.badge-timeout{ background:transparent; border:1px dashed var(--text-2); color:var(--text-2); }
 .empty-msg{ color:var(--text-3); text-align:center; padding:40px; font-size:13px; }
 .clickable{ cursor:pointer; }
 .clickable:hover{ opacity:.85; }
@@ -1228,7 +1197,6 @@
       <a class="toc-link" href="#phases" data-target="phases">Phase Deep-Dives</a>
       <a class="toc-link" href="#cases" data-target="cases">Cases &amp; Consistency</a>
       <a class="toc-link" href="#run-explorer" data-target="run-explorer">Run Explorer</a>
-      <a class="toc-link" href="#provenance" data-target="provenance">Provenance</a>
     </div>
     <a class="toc-top" href="#hero">&#8593; top</a>
   </div>
@@ -1270,7 +1238,9 @@ <h1>How well do different AI models handle the complexities of <span class="grad
   </p>
 
    <div class="two-bars">
-    <p>The bottom line for practical use of DAAF at this time: Fable 5 is the undisputed top performer if budget is not a constraint. Those who <b>are</b> budget-constrained should feel comfortable relying on Sonnet 4.6, and <b>GLM5.2 is equally viable for self-hosting/full control/hermetic systems</b>. There may nonetheless be benefits to using more generally powerful models like Opus 4.8 not explicitly tracked by this benchmark (e.g., actual coding quality, analytic fidelity, etc.) if your budget/use limits allow.</p>
+    <!-- Hero bottom-line: user-ratified VERBATIM in the 2026-07-29 voice pass
+         (v3.7.1) — do not reword. -->
+    <p>The bottom line for practical use of DAAF at this time: <b>Fable 5 is the undisputed top performer</b> if budget is not a constraint. Those who are budget-conscious should feel comfortable relying on <b>GPT-5.6 Sol or Sonnet 5</b> for strong performance at a more moderate cost, and <b>GPT-5.6 Luna</b> delivers most of that capability for a fraction of the spend. For self-hosting/full-control/hermetic systems, all of the leading open-weights are now viable options: <b>Kimi K3</b> sits at the top of that pack on capability when price and model size are not a constraint, while <b>GLM 5.2 and DeepSeek V4</b> are the economical choices. There may nonetheless be benefits to using more generally powerful models not explicitly tracked by this benchmark (e.g., actual coding quality, analytic fidelity, etc.) if your budget and use limits allow.</p>
   </div>
 
 </section>
@@ -1288,7 +1258,7 @@ <h1>How well do different AI models handle the complexities of <span class="grad
 <section class="doc-section" id="cvp-preview">
   <p class="section-lead">
     <b>The headline picture:</b> model performance across the benchmark suite plotted against estimated cost to run
-    the full battery, relative to Opus 4.8. 
+    the full battery, relative to Opus 4.8.
     <a href="#cost-performance">See the full chart</a> below for much more information, customization, and caveats.
   </p>
   <div class="card"><div class="chart-container" id="cvp-preview-chart"></div></div>
@@ -1300,52 +1270,84 @@ <h1>How well do different AI models handle the complexities of <span class="grad
      generator's dev-guide comment block.) -->
 <section class="doc-section" id="takeaways">
   <div class="sec-eyebrow">The Headlines</div>
-  <h2>Key Takeaways (June 2026)</h2>
+  <h2>Key Takeaways (July 2026)</h2>
 
   <div class="kt-item">
-    <div class="kt-claim">1. Fable 5 is actually in a class of its own.</div>
+    <!-- T1 headline + body: user HAND-EDITED directly in the 2026-07-29
+         intensive pass (v3.7.2, supersedes the v3.7.1 ratification) — the
+         strongest anchor tier; do not reword. -->
+    <div class="kt-claim">1. Fable 5 leads the pack, but the top tier is increasingly crowded with a diverse array of viable contenders.</div>
     <!-- The section's ONE accent-strong (Wave C budget: at most one per
          major section) sits on the headline Fable figure below — the
          single most load-bearing number on the page. Everything else in
          #takeaways stays plain <b>. -->
-    <p>Fable 5 leads the scoreboard at a Perfect average score of <b class="accent-strong"><span id="kt-t1-comp">&mdash;</span></b>
-    &mdash; <b><span id="kt-t1-margin">&mdash;</span></b> points clear of the next
-    model. It is also by far the most consistent model tested:
-    <b><span id="kt-t1-cons">&mdash;</span></b> of its repeated cases scored perfectly across every criterion
-    on every single repetition. Given that errors and issues quickly percolate and multiply in these chained agentic systems, this is an enormously valuable characteristic relative to competitors, and likely holds similar additional value in terms of code quality and other moment-to-moment junctures not tested by this benchmark.</p>
+    <p>Fable 5 leads the scoreboard at a Perfect average score of <b class="accent-strong"><span id="kt-t1-fable">&mdash;</span></b>.
+    Opus 5 arrives right behind it at <b><span id="kt-t1-opus5">&mdash;</span></b>, but costs
+    roughly <b><span id="kt-t1-opus5cost">&mdash;</span>% more</b> to run for a hair lower score, so Fable
+    simply dominates it. (The gap between them is small enough that sample noise matters; the cost gap is not.)
+    The bigger story is who else reaches the top: Tier 1 now also holds
+    GPT-5.6 Sol (<span id="kt-t1-sol">&mdash;</span>) and the open-weights Kimi K3 (<span id="kt-t1-kimi">&mdash;</span>), making clear that Anthropic has no monopoly on frontier compute capability for research orchestration.</p>
   </div>
 
   <div class="kt-item">
-    <div class="kt-claim">2. Opus 4.7 was genuinely worse than Opus 4.5/4.6, but Opus 4.8 was a strong return to form.</div>
-    <p>Claude Opus 4.7 was widely criticized for being far too stingy in its effort, perceived as a strategy by Anthropic to manage intense compute constraints at launch time. The testing bears this out empirically: Opus 4.5 and 4.6 scored at
-    <span id="kt-t2-o45">&mdash;</span> and 
-    <span id="kt-t2-o46">&mdash;</span>, respectively, Opus 4.7 came in at 
-    <b><span id="kt-t2-o47">&mdash;</span></b>, and Opus 4.8 returned to form at <b><span id="kt-t2-o48">&mdash;</span></b>. The 4.7 dip is even more pronounced when focusing only on critical criteria completion (&ldquo;Critical-only&rdquo;: scores counting just the must-pass criteria): <span id="kt-t2-o45h">&mdash;</span>/<span id="kt-t2-o46h">&mdash;</span>/<b><span id="kt-t2-o47h">&mdash;</span></b>/<span id="kt-t2-o48h">&mdash;</span> across the four Opus releases.</p>
+    <!-- T2 frontier definition + closer: user HAND-EDITED directly in the
+         2026-07-29 intensive pass (v3.7.2, supersedes the v3.7.1
+         ratification) — the strongest anchor tier; do not reword. -->
+    <div class="kt-claim">2. The efficiency frontier runs through four different model creators.</div>
+    <p>The efficiency frontier is the set of models no other model beats on <em>both</em> cost and conformance
+    at once (basically: the picks that are never simply outclassed by something cheaper). Six models make it, and they
+    come from four different providers: <b>Gemma 4 31B</b> (<span id="kt-fr-gemma-s">&mdash;</span> at
+    <span id="kt-fr-gemma-c">&mdash;</span> Opus 4.8&rsquo;s battery cost), <b>DeepSeek V4 Flash</b>
+    (<span id="kt-fr-dsflash-s">&mdash;</span> at <span id="kt-fr-dsflash-c">&mdash;</span>), <b>GPT-5.6 Luna</b>
+    (<span id="kt-fr-luna-s">&mdash;</span> at <span id="kt-fr-luna-c">&mdash;</span>), <b>Sonnet 5</b>
+    (<span id="kt-fr-sonnet5-s">&mdash;</span> at <span id="kt-fr-sonnet5-c">&mdash;</span>), <b>GPT-5.6 Sol</b>
+    (<span id="kt-fr-sol-s">&mdash;</span> at <span id="kt-fr-sol-c">&mdash;</span>), and <b>Fable 5</b>
+    (<span id="kt-fr-fable-s">&mdash;</span> at <span id="kt-fr-fable-c">&mdash;</span>). Two of the six &mdash;
+    Gemma 4 31B and DeepSeek V4 Flash &mdash; are open-weights, and Gemma can even be run on sufficiently powerful home computers. The practical lesson is that no single
+    vendor owns price-performance: the right pick depends on <b>which budget point you are shopping at</b> (and given imprecision in these estimates, note some fluidity in these recommendations; see the caveats below).</p>
   </div>
 
   <div class="kt-item">
-    <div class="kt-claim">3. Sonnet 4.6 is an enormously high performer relative to its cost.</div>
-    <p>Sonnet 4.6 posts a Perfect average score of <b><span id="kt-t3-comp">&mdash;</span></b> &mdash;
-    #2 overall, shockingly ahead of every Opus model in this corpus (best Opus:
-    <span id="kt-t3-bestopus">&mdash;</span>) except in the Critical-only category. And it does so cheaply:
-    running this benchmark&rsquo;s full battery on Sonnet costs roughly
-    <b><span id="kt-t3-batpct">&mdash;</span>%</b> of what it costs on
-    Opus 4.8. Recognizing that there is uncertainty/imprecision in these results, and many model capabilities not explicitly tested by these current tests, these numbers nonetheless suggest Sonnet 4.6 is more than capable of orchestration work on a budget with potentially minimal trade-off.</p>
+    <!-- T3 closer: user HAND-EDITED directly in the 2026-07-29 intensive
+         pass (v3.7.2, supersedes the v3.7.1 ratification) — the strongest
+         anchor tier; do not reword. -->
+    <div class="kt-claim">3. Raw performance follows steep diminishing returns in terms of cost.</div>
+    <p>The climb to the top gets expensive fast. GPT-5.6 Luna delivers about <b><span id="kt-t3-lunapct">&mdash;</span></b>
+    of Fable 5&rsquo;s composite for roughly <b><span id="kt-t3-lunacost">&mdash;</span></b> of its total cost to run the tests;
+    GPT-5.6 Sol, about <b><span id="kt-t3-solpct">&mdash;</span></b> of Fable&rsquo;s score for
+    <b><span id="kt-t3-solcost">&mdash;</span></b> of the cost. Buying the last ~8 points of performance (e.g.,
+    the jump from Sol up to Fable) costs about <b><span id="kt-t3-lastmult">&mdash;</span> as much</b>.
+    All to say: it&rsquo;s worth figuring out what quality bar your use case actually needs before you pay for the very top of it.</p>
   </div>
 
   <div class="kt-item">
-    <div class="kt-claim">4. Open-weight models have finally crossed the capability threshold &mdash; a real win for self-hosting.</div>
-    <p>GLM 5.2 leads the open-weight pack at <span id="kt-t4-glm">&mdash;</span>, looking roughly indistinguishable from the Opus line on every metric at anywhere between <b>a quarter and half of the cost</b>. This is an enormous boon for researchers, especially, given that open-weight models like GLM 5.2 also allow for self-hosting, modification/fine-tuning, and greater long-term support guarantees (i.e., not worrying about Opus 4.5 getting sun-setted in a few months when multiple analyses and products rely explicitly on it). DeepSeek V4 Flash presents a greater dip in performance relative to the Opus line (<span id="kt-t4-dsflash">&mdash;</span>) but with an almost unbelievable price differential, costing only 3-5% of Anthropic's flagships for the same tasks.</p>
+    <!-- T4: user HAND-EDITED directly in the 2026-07-29 intensive pass
+         (v3.7.2, supersedes the v3.7.1 ratification; the mechanism sentence
+         and closer were themselves reworded by the user in that pass) — the
+         strongest anchor tier; do not reword. -->
+    <div class="kt-claim">4. What budget models actually give up: reliability and predictability.</div>
+    <p>Moving down the price ladder, the first thing to erode isn&rsquo;t raw capability: it&rsquo;s <b>reliability</b> and
+    <b>predictability</b>. Because every test here runs three times, we can measure how often a model
+    scores <em>equally</em> well on repeat attempts: the share of repeated cases where all reps land on the
+    identical outcome. Fable 5 agrees with itself on <b><span id="kt-t4-topagree">&mdash;</span></b> of its
+    repeated cases; DeepSeek V4 Flash (a genuinely capable budget pick) manages only
+    <b><span id="kt-t4-budgetagree">&mdash;</span></b>. Cheaper models don&rsquo;t just score lower on average;
+    they <b>wobble more from run to run</b>, and in a chained agentic workflow where one bad step derails
+    everything downstream, that unpredictability is a real cost of its own to weigh against very judiciously.</p>
   </div>
 
   <div class="kt-item">
-    <div class="kt-claim">5. Local-class open-weight models just aren&rsquo;t there yet.</div>
-    <p>Qwen 3.6 27B, the best of the small open models here, manages
-    <b><span id="kt-t5-qwen">&mdash;</span></b>, and it's at its weakest in perhaps the most important part of the overall orchestration pipeline: careful skill routing
-    (basically: How often does it load the necessary grounding references before it responds to questions? <span id="kt-t5-qwenp4">&mdash;</span>) and mode
-    classification (basically: How often does it correctly assign a natural language query to the right workflow process? <span id="kt-t5-qwenp1">&mdash;</span>). Gemma 4 31B timed
-    out on <b><span id="kt-t5-g31to">&mdash;</span></b> of its runs, often (per transcripts) not actually doing any work at all when queried: by far the worst
-    reliability in the corpus. Some of these results may be simple harness incompatibility (Claude Code is not optimized for communicating with Gemma or Qwen, to be clear), but nonetheless point to more necessary improvements/development to be viable for rigorous research orchestration workflows. That being said, they <em>will</em> get there someday, and with DAAFBench, we&rsquo;ll now be able to know when they do!</p>
+    <!-- T5 headline + closer: user HAND-EDITED directly in the 2026-07-29
+         intensive pass (v3.7.2, supersedes the v3.7.1 ratification; the
+         "next crossover" closing sentence was deliberately removed by the
+         user) — the strongest anchor tier; do not reword. -->
+    <div class="kt-claim">5. Open-weight models are no longer the compromise option.</div>
+    <p>Open-weights hold the budget end of the frontier outright: Gemma 4 31B and DeepSeek V4 Flash are the two
+    cheapest non-dominated points on the entire chart. GLM 5.2 remains the natural <b>self-hosting</b> pick for
+    teams that want full control, at <span id="kt-t5-glm">&mdash;</span> composite for about
+    <b><span id="kt-t5-glmcost">&mdash;</span></b> of Opus 4.8&rsquo;s battery cost; and Kimi K3 now tops the
+    open-weights pack on raw capability (<span id="kt-t5-kimi">&mdash;</span>, squarely in Tier 1) when price and
+    model size are not the binding constraint. All of this is exactly why DAAF is built to be deliberately provider-flexible: provider competition keeps pushing costs down and capability up, and staying flexible is what lets you actually capture those gains as the market keeps moving.</p>
   </div>
 
   <!-- kt-foot removed (2026-06-12 user fine-tuning round): its
@@ -1584,11 +1586,6 @@ <h2>About DAAFBench</h2>
         <li><b>All analyses were conducted via Claude Code through OpenRouter</b> in a relatively naive fashion, and at least some
           of the results will be driven by models' compatibility with this specific harness combination.
           Tune your sense of generalizability around these benchmark results accordingly!</li>
-        <li><b>Timeouts are still graded.</b> Runs that hit the wall-clock limit
-            (<span id="ab-timeouts">some</span> runs in this corpus) have zeroed turn counts
-            and a duration recorded at the cutoff limit, but their criteria are fully
-            scored from the transcript
-            produced before the cutoff &mdash; a timed-out run can be a perfect run.</li>
         <li><b>Denominators are small and uneven.</b> Repetition counts are
             relatively small and can be uneven across providers and models due
             to cost limitations &mdash; some (model, phase) cells have 2 reps
@@ -1610,7 +1607,12 @@ <h2>About DAAFBench</h2>
             through an Anthropic-compatible endpoint whose counts come from
             Anthropic&rsquo;s tokenizer rather than each OpenRouter model&rsquo;s billing
             meter, so dollar costs derived from those counts were unreliable and
-            were removed.</li>
+            were removed. For the GPT-5.6 trio (Sol, Luna, Terra), the
+            API-equivalent list rates used here were verified against OpenAI&rsquo;s
+            published per-model schedules on 2026-07-29. A per-request audit of
+            the full GPT corpus further found zero requests above the 272k-token
+            long-context pricing threshold, so the short-context rates applied
+            here are exact for this corpus rather than a blended approximation.</li>
         <li><b>Deterministic scorers have known false negatives.</b>
             <code>prompt_has_context_section</code> is the canonical case: the scorer
             accepts seven heading variants, yet models often place genuine contextual
@@ -1661,12 +1663,22 @@ <h2>Cost vs. Performance</h2>
     whose costs span more than a hundredfold onto one chart. The stepped line
     traces the <b>efficiency frontier</b>, or the models no other model beats on
     both cost and conformance at once: anything off the line is outperformed
-    somewhere cheaper. The selectors switch the vertical axis between the
+    somewhere cheaper. On the default battery-cost basis that frontier runs
+    through <b>six models from four different providers</b> (two of them
+    open-weights), spanning more than a hundredfold in cost. The selectors switch the vertical axis between the
     composite and any single phase group (P1&ndash;P4) under either bar (Perfect
     or Critical-only), and the price-basis toggle offers two secondary views: the
     raw published <b>input</b> and <b>output</b> list rates in dollars per
     million tokens of text ($/Mtok &mdash; a million tokens is roughly 750,000
     words). Those are list prices, not measured benchmark spend.
+    <!-- Subscription-pricing note added 2026-07-29 (AI-drafted at user direction;
+         NOT yet voice-ratified — flagged for the user's intensive pass). -->
+    One more note on all of these dollar figures: they are API-style list
+    pricing. If you run DAAF through a subscription plan instead (Claude Max, or
+    ChatGPT for the GPT models &mdash; the GPT runs in this corpus were in fact
+    executed on the ChatGPT lane), your marginal cost per analysis is effectively
+    covered by the flat subscription price &mdash; often the single biggest
+    cost-efficiency lever available before you change models at all.
     Shape and color mark the serving provider; hover any point for its exact figures.
   </p>
   <div class="sec-body" id="sec-cost-performance"></div>
@@ -1725,8 +1737,7 @@ <h2>Run Explorer</h2>
     condensed transcript &mdash; including subagent transcripts where they exist. The
     filters below apply to this section only; clicks from the heatmaps and case views above
     land here with the matching filters pre-applied. Status reflects grading (perfect /
-    partial / failed / ungraded); a clock marker flags timed-out runs, which are still
-    fully graded from the transcript produced before the cutoff.
+    partial / failed / ungraded).
   </p>
   <div class="rx-filters" id="rx-filters">
     <div class="filter-group">
@@ -1754,30 +1765,18 @@ <h2>Run Explorer</h2>
     <div class="filter-group">
       <input type="text" class="filter-input" id="rx-search" placeholder="Search cases...">
     </div>
-    <label class="filter-checkbox"><input type="checkbox" id="rx-hide-timeouts"> Hide timeouts</label>
     <span class="rx-chip" id="rx-crit-chip" style="display:none"></span>
     <button class="filter-btn" id="rx-reset">Reset</button>
   </div>
   <div class="sec-body" id="sec-run-explorer"></div>
 </section>
 
-<!-- 9. Provenance footer -->
-<section class="doc-section" id="provenance">
-  <div class="sec-eyebrow">The Audit Trail</div>
-  <h2>Provenance</h2>
-  <p class="section-lead">
-    The audit trail for where the numbers come from: <b>one row per archived result set</b>,
-    with the DAAF git SHA and run configuration it was produced under. Run-level data
-    on disk is the source of truth; summary counts are shown for disclosure.
-  </p>
-  <div class="sec-body" id="sec-provenance"></div>
-  <p class="prov-foot">
-    Generator v<span id="prov-generator-version"></span> &middot; generated
-    __GENERATED_DISPLAY__ UTC.<br>
-    This document and the benchmark system that produced it were built with DAAF
-    (Data Analyst Augmentation Framework) tooling.
-  </p>
-</section>
+<!-- The Provenance footer section was removed in v3.6.0 (display cleanup).
+     The PRECOMPUTED.provenance data pipeline stays intact (still built and
+     embedded for inspection / other consumers); only the rendered section,
+     its TOC link, renderer, and registry entries were removed. The
+     generated-timestamp survives in the hero (#hero .gen) and DAAF/Open
+     Augments attribution survives in the site footer below. -->
 
 <!-- The #next-steps closing CTA section was removed 2026-06-12 (user
      fine-tuning round); its CTA links live on in the hero ¶1 and the About
@@ -1835,7 +1834,7 @@ <h2>Provenance</h2>
 var state = {
   /* criterion has no DOM control — it is set only by heatmap deep links
      and shown as a removable chip (see updateCritChip) */
-  filters: { phase:"", model:"", caseId:"", status:"", search:"", criterion:"", hideTimeouts:false },
+  filters: { phase:"", model:"", caseId:"", status:"", search:"", criterion:"" },
   selectedRunIdx: -1,
   /* Cost vs. Performance price basis: battery (default — the page-wide
      headline cost figure) | input | output */
@@ -1907,22 +1906,21 @@ <h2>Provenance</h2>
   return "";
 }
 
-/* Timeout-share steps for the leaderboard Timed-out column's .to-0...to-4
-   red ramp (fine-tuning round 3, Wave A). Deliberately NOT rateStep():
-   timeout rates cluster low (2026-06 corpus: 0% to 45.8%, median ~9%), so
-   the pass-ramp's 50/90 breaks would dump 16 of 17 models (design basis; now 19) into two steps.
-   Breaks 0 / >0 / >=5% / >=10% / >=20% spread the measured corpus 2/4/4/3/4
-   — full distribution + contrast arithmetic in the .to-* CSS comment. */
-function toStep(rate){
-  if(rate>=0.2) return 4;
-  if(rate>=0.1) return 3;
-  if(rate>=0.05) return 2;
-  if(rate>0) return 1;
-  return 0;
-}
-
 function pct(v){ return (v*100).toFixed(0)+"%"; }
 function esc(s){ if(!s) return ""; var d=document.createElement("div"); d.textContent=s; return d.innerHTML; }
+/* Model DISPLAY name (v3.6.0): strip the trailing " (ChatGPT Subscription)"
+   access-lane suffix for RENDERING ONLY. The full name (suffix included)
+   stays the payload join key across DATA.runs[].model, pricing, and the
+   reconciliation dicts — so never strip it for object keys, color/lookup
+   (modelColor), filter comparisons, data-model attributes, sort order, or
+   exploreRuns() arguments. escModel() is the escape-a-display-model-name
+   convenience wrapper (esc(displayModelName(m))). */
+function displayModelName(m){ return String(m==null?"":m).replace(/\s*\(ChatGPT Subscription\)\s*$/,""); }
+function escModel(m){ return esc(displayModelName(m)); }
+/* Provider DISPLAY label (v3.6.0): the "chatgpt-subscription" access lane
+   renders as "chatgpt" in badges/labels. Display only — run.provider keys,
+   pricing/route lookups, and cost-eligibility logic keep the raw value. */
+function displayProvider(p){ return p==="chatgpt-subscription"?"chatgpt":(p==null?"":String(p)); }
 function truncate(s,n){ if(!s) return ""; return s.length>n ? s.substring(0,n)+"..." : s; }
 function el(id){ return document.getElementById(id); }
 function fmt(n){ return n.toLocaleString(); }
@@ -2032,7 +2030,15 @@ <h2>Provenance</h2>
   {key:"input",label:"Input",formula:"Published input price, per million tokens",
    axis:"Input price (USD per 1M tokens, log scale)"},
   {key:"output",label:"Output",formula:"Published output price, per million tokens",
-   axis:"Output price (USD per 1M tokens, log scale)"}
+   axis:"Output price (USD per 1M tokens, log scale)"},
+  /* Duration (v3.3.0): a real-world LATENCY proxy, not a price. Like the
+     battery form it DISPLAYS as a relative multiplier (Opus 4.8 = 1.0x),
+     reading from PRECOMPUTED.duration (not cost.models) so it covers every
+     model — including OpenRouter and the cost-omitted subscription lane.
+     Built from summed per-run durations (parallelization-invariant). */
+  {key:"duration",label:"Relative Duration (1x=Opus 4.8)",
+   formula:"Estimated relative wall-clock time to run the full benchmark battery once, as a multiple of Opus 4.8 (= 1.0×) — from summed per-run durations (parallelization-invariant), a real-world latency proxy (definition + caveats in the notes below the chart)",
+   axis:"Est. relative duration vs Opus 4.8 to run the full battery once (×, log scale)"}
 ];
 function priceMap(){
   var map={};
@@ -2055,16 +2061,23 @@ <h2>Provenance</h2>
   var mu=bm.cost_multiplier_vs_ref!=null?bm.cost_multiplier_vs_ref
     :((refCost&&refCost>0&&bm.est_battery_cost!=null)?bm.est_battery_cost/refCost:null);
   if(mu==null) return null;
-  return {mult:mu,stale:!!bm.stale};
+  /* basis (v3.5.0, Fix 2): three token-mix provenances — "corpus-live"
+     (Anthropic, from result.json usage), "billing-snapshot-YYYY-MM-DD"
+     (OpenRouter, from the derived reconciliation snapshot), and
+     "api-equivalent" (chatgpt-subscription GPT lane, counterfactual list
+     price, never invoiced). Dollars are always uncached-list-rate
+     normalized. The leaderboard badges only api-equivalent rows. */
+  return {mult:mu,stale:!!bm.stale,basis:bm.basis||null};
 }
 
+/* (v3.7.0) The batteryMult latency twin durationMult() was removed with the
+   Relative Duration leaderboard column. The Cost vs. Performance duration
+   scatter axis reads PRECOMPUTED.duration directly (svgCostFrontier /
+   renderCostPerf), so the duration data pipeline is unaffected. */
+
 /* Run status = the precomputed grade (perfect / partial / failed /
-   ungraded), orthogonal to the timed_out flag (design record: README § 8 —
-   data realities). A
-   timed-out run is usually still fully graded, so timeout renders as
-   a separate clock marker (.to-mark / TIMED OUT badge) wherever the
-   grade appears — never as a status of its own, and never inferred by
-   string-matching the error field. */
+   ungraded), never inferred by string-matching the error field (design
+   record: README § 8 — data realities). */
 function runStatus(run){
   return run.grade||"ungraded";
 }
@@ -2102,7 +2115,17 @@ <h2>Provenance</h2>
 var evalGroups = [];
 (function buildEvalGroups(){
   var gmap={};
+  /* Degenerate-column suppression (v3.5.0, Fix 3) — lockstep with
+     build_eval_groups() in the generator. A result set spawns a column only
+     if it (1) is not the "unknown" phase fallback, (2) has >= 1 loaded run,
+     and (3) — for a subagent-less dispatch_compliance set — is folded into
+     the 3a dispatch group rather than emitting a bare column. Suppression is
+     column-scoped: runs still count in the all-runs (DATA.runs) aggregates. */
+  var activeTs={};
+  (DATA.runs||[]).forEach(function(r){ if(r&&r.result_set) activeTs[r.result_set]=true; });
   DATA.result_sets.forEach(function(rs){
+    if(rs.phase === "unknown") return;              /* Gate 1 */
+    if(!activeTs[rs.timestamp]) return;             /* Gate 2 */
     if(rs.phase === "dispatch_compliance" && rs.subagent_criterion_names && rs.subagent_criterion_names.length > 0){
       var idD=rs.phase+"_dispatch";
       if(!gmap[idD]) gmap[idD]={id:idD,phase:rs.phase,label:"Phase 3a — Dispatch Compliance",timestamps:[],criterion_names:rs.criterion_names.slice(),is_subagent:false};
@@ -2110,6 +2133,10 @@ <h2>Provenance</h2>
       var idS=rs.phase+"_subagent";
       if(!gmap[idS]) gmap[idS]={id:idS,phase:rs.phase,label:"Phase 3b — Subagent Behavior",timestamps:[],criterion_names:rs.subagent_criterion_names.slice(),is_subagent:true};
       gmap[idS].timestamps.push(rs.timestamp);
+    } else if(rs.phase === "dispatch_compliance"){    /* Gate 3: fold */
+      var idF=rs.phase+"_dispatch";
+      if(!gmap[idF]) gmap[idF]={id:idF,phase:rs.phase,label:"Phase 3a — Dispatch Compliance",timestamps:[],criterion_names:rs.criterion_names.slice(),is_subagent:false};
+      gmap[idF].timestamps.push(rs.timestamp);
     } else {
       var id=rs.phase;
       if(!gmap[id]) gmap[id]={id:id,phase:rs.phase,label:rs.phase_label,timestamps:[],criterion_names:rs.criterion_names.slice(),is_subagent:false};
@@ -2284,8 +2311,6 @@ <h2>Provenance</h2>
       var haystack=(r.case_id+" "+(c2?c2.prompt:"")).toLowerCase();
       if(haystack.indexOf(q)<0) return false;
     }
-    /* timed_out is the explicit harness flag — never string-match error */
-    if(f.hideTimeouts && r.timed_out) return false;
     return true;
   });
 }
@@ -2299,7 +2324,7 @@ <h2>Provenance</h2>
   var mSel=el("rx-model");
   mSel.innerHTML='<option value="">All Models</option>';
   uniqueModels().forEach(function(m){
-    mSel.innerHTML+='<option value="'+esc(m)+'">'+esc(m)+'</option>';
+    mSel.innerHTML+='<option value="'+esc(m)+'">'+escModel(m)+'</option>';
   });
   var cSel=el("rx-case");
   cSel.innerHTML='<option value="">All Cases</option>';
@@ -2316,7 +2341,6 @@ <h2>Provenance</h2>
   state.filters.caseId=el("rx-case").value;
   state.filters.status=el("rx-status").value;
   state.filters.search=el("rx-search").value;
-  state.filters.hideTimeouts=el("rx-hide-timeouts").checked;
   /* state.filters.criterion is deliberately NOT read from the DOM — it
      has no control; it is set by deep links and cleared via its chip */
 }
@@ -2343,7 +2367,6 @@ <h2>Provenance</h2>
   el("rx-case").value="";
   el("rx-status").value="";
   el("rx-search").value="";
-  el("rx-hide-timeouts").checked=false;
   state.filters.criterion="";
   readFilters();
   updateCritChip();
@@ -2476,86 +2499,83 @@ <h2>Provenance</h2>
   function set(id,txt){ var n=el(id); if(n&&txt!=null) n.textContent=txt; }
   function pct1(v){ return (v*100).toFixed(1)+"%"; }
   var comp=PRECOMPUTED.composite||{};
-  var hardComp=PRECOMPUTED.composite_hard||{};
-  var pmp=PRECOMPUTED.per_model_phase||{};
   var cons=PRECOMPUTED.consistency||{};
-  var tom=PRECOMPUTED.timeout_by_model||{};
   /* Cost claims run on the battery metric (PRECOMPUTED.cost.battery) and
      render as RELATIVE figures only — ratios and multipliers, never
      dollars (v2.8.1 user decision: exact dollars imply false precision) */
   var bat=(PRECOMPUTED.cost||{}).battery||{};
   var batModels=bat.models||{};
   function score(m){ return (comp[m]&&comp[m].score!=null)?comp[m].score:null; }
-  function hardScore(m){ return (hardComp[m]&&hardComp[m].score!=null)?hardComp[m].score:null; }
   function batCost(m){
     var b=batModels[m];
     return (b&&b.est_battery_cost!=null&&b.est_battery_cost>0)?b.est_battery_cost:null;
   }
-  /* All Opus variants share list pricing; 4.8 is the battery-cost anchor */
-  var OPUS_ANCHOR="Opus 4.8";
-
-  /* T1 — Fable's margin over the best non-Fable composite */
-  var fable=score("Fable 5");
-  var bestOther=null;
-  Object.keys(comp).forEach(function(m){
-    if(m==="Fable 5") return;
-    var s=score(m);
-    if(s!=null&&(bestOther==null||s>bestOther)) bestOther=s;
-  });
-  if(fable!=null) set("kt-t1-comp",pct1(fable));
-  if(fable!=null&&bestOther!=null){
-    var margin=(fable-bestOther)*100;
-    set("kt-t1-margin",margin.toFixed(1));
+  /* Relative battery-cost multiplier vs the Opus 4.8 anchor (the page-wide
+     cost lens); rendered via fmtMult (e.g. "0.02×"), consistent with the
+     leaderboard and Cost vs. Performance chart. */
+  function costMult(m){
+    var b=batModels[m];
+    return (b&&b.cost_multiplier_vs_ref!=null)?b.cost_multiplier_vs_ref:null;
   }
-  if(cons["Fable 5"]&&cons["Fable 5"].rate!=null) set("kt-t1-cons",pct1(cons["Fable 5"].rate));
-
-  /* T2 — the Opus line on both bars: the Perfect composite (kt-t2-o4X)
-     and the Critical-only composite (kt-t2-o4Xh, from composite_hard —
-     the same source as the leaderboard's Critical-only toggle) */
-  [["kt-t2-o45","Opus 4.5"],["kt-t2-o46","Opus 4.6"],
-   ["kt-t2-o47","Opus 4.7"],["kt-t2-o48","Opus 4.8"]].forEach(function(pair){
-    var s=score(pair[1]);
-    if(s!=null) set(pair[0],pct1(s));
-  });
-  [["kt-t2-o45h","Opus 4.5"],["kt-t2-o46h","Opus 4.6"],
-   ["kt-t2-o47h","Opus 4.7"],["kt-t2-o48h","Opus 4.8"]].forEach(function(pair){
-    var s=hardScore(pair[1]);
-    if(s!=null) set(pair[0],pct1(s));
-  });
-
-  /* T3 — Sonnet 4.6 vs the best Opus, and the battery-cost percentage
-     (Sonnet's est. battery cost as a share of Opus 4.8's) */
-  var sonnet=score("Sonnet 4.6");
-  var bestOpus=null;
-  ["Opus 4.5","Opus 4.6","Opus 4.7","Opus 4.8"].forEach(function(m){
-    var s=score(m);
-    if(s!=null&&(bestOpus==null||s>bestOpus)) bestOpus=s;
+  /* GPT ChatGPT-subscription models carry the "(ChatGPT Subscription)"
+     suffix in the PAYLOAD key (the cross-payload join key); prose renders
+     the stripped display name statically. Use the full keys for lookups. */
+  var SOL="GPT-5.6 Sol (ChatGPT Subscription)";
+  var LUNA="GPT-5.6 Luna (ChatGPT Subscription)";
+
+  /* T1 — the new three-provider top tier: Fable's headline, Opus 5 close
+     behind but pricier, and Sol + Kimi K3 joining Tier 1. */
+  var fable=score("Fable 5");
+  if(fable!=null) set("kt-t1-fable",pct1(fable));
+  var opus5=score("Opus 5");
+  if(opus5!=null) set("kt-t1-opus5",pct1(opus5));
+  var fBat=batCost("Fable 5"), o5Bat=batCost("Opus 5");
+  if(fBat!=null&&o5Bat!=null) set("kt-t1-opus5cost",String(Math.round((o5Bat/fBat-1)*100)));
+  var sol=score(SOL);
+  if(sol!=null) set("kt-t1-sol",pct1(sol));
+  var kimi=score("Kimi K3");
+  if(kimi!=null) set("kt-t1-kimi",pct1(kimi));
+
+  /* T2 — the six efficiency-frontier points, each with its Perfect
+     composite and its relative battery-cost multiplier (vs Opus 4.8). Static
+     names in the prose; live score + cost figures here so a repriced or
+     reshuffled frontier tracks automatically. */
+  [["gemma","Gemma 4 31B"],["dsflash","DeepSeek V4 Flash"],["luna",LUNA],
+   ["sonnet5","Sonnet 5"],["sol",SOL],["fable","Fable 5"]].forEach(function(p){
+    var s=score(p[1]);   if(s!=null) set("kt-fr-"+p[0]+"-s",pct1(s));
+    var cm=costMult(p[1]); if(cm!=null) set("kt-fr-"+p[0]+"-c",fmtMult(cm));
   });
-  if(sonnet!=null) set("kt-t3-comp",pct1(sonnet));
-  if(bestOpus!=null) set("kt-t3-bestopus",pct1(bestOpus));
-  var sBat=batCost("Sonnet 4.6"), oBat=batCost(OPUS_ANCHOR);
-  if(sBat!=null&&oBat!=null) set("kt-t3-batpct",String(Math.round(sBat/oBat*100)));
 
-  /* T4 — the open-weight pack: GLM 5.2 leads on score; DS Flash
-     cost-differential highlight */
+  /* T3 — diminishing returns: Luna and Sol as a share of Fable on both
+     score and battery cost, plus the Sol->Fable cost multiple. */
+  var luna=score(LUNA);
+  var lBat=batCost(LUNA), solBat=batCost(SOL);
+  function shareOfFableScore(s){ return (fable!=null&&s!=null)?Math.round(s/fable*100)+"%":null; }
+  function shareOfFableCost(c){ return (fBat!=null&&c!=null)?Math.round(c/fBat*100)+"%":null; }
+  set("kt-t3-lunapct",shareOfFableScore(luna));
+  set("kt-t3-lunacost",shareOfFableCost(lBat));
+  set("kt-t3-solpct",shareOfFableScore(sol));
+  set("kt-t3-solcost",shareOfFableCost(solBat));
+  if(fBat!=null&&solBat!=null&&solBat>0) set("kt-t3-lastmult",fmtMult(fBat/solBat));
+
+  /* T4 — reliability/predictability via the agreement metric (v3.7.0):
+     rate_agree is the share of repeated (phase, case) cells where every rep
+     landed on the identical grade — a predictability measure decoupled from
+     score level (distinct from `rate`, which is all-reps-perfect). Contrast
+     a top-tier model (Fable 5) with a capable budget pick (DeepSeek V4
+     Flash) to show that the cheap end gives up consistency, not just score. */
+  var topA=cons["Fable 5"];
+  if(topA&&topA.rate_agree!=null) set("kt-t4-topagree",pct1(topA.rate_agree));
+  var budA=cons["DeepSeek V4 Flash"];
+  if(budA&&budA.rate_agree!=null) set("kt-t4-budgetagree",pct1(budA.rate_agree));
+
+  /* T5 — open-weights: GLM 5.2 as the self-hosting pick (score + relative
+     cost) and Kimi K3 topping open-weights capability. */
   var glm=score("GLM 5.2");
-  if(glm!=null) set("kt-t4-glm",pct1(glm));
-  var dsflash=score("DeepSeek V4 Flash");
-  if(dsflash!=null) set("kt-t4-dsflash",pct1(dsflash));
-
-  /* T5 — Qwen's local-class ceiling (P4 skill routing + P1 mode
-     classification as the weak points); Gemma 4 31B timed-out rate (the
-     harness's timed_out flag, NOT transcript-level stall forensics) */
-  var qwen=score("Qwen 3.6 27B");
-  if(qwen!=null) set("kt-t5-qwen",pct1(qwen));
-  var qp4=(pmp["Qwen 3.6 27B"]||{})["skill_routing"];
-  if(qp4&&qp4.perfect_rate!=null) set("kt-t5-qwenp4",pct1(qp4.perfect_rate));
-  var qp1=(pmp["Qwen 3.6 27B"]||{})["mode_classification"];
-  if(qp1&&qp1.perfect_rate!=null) set("kt-t5-qwenp1",pct1(qp1.perfect_rate));
-  var g31=tom["Gemma 4 31B"];
-  if(g31&&g31.rate!=null){
-    set("kt-t5-g31to",fmt(g31.n_timed_out)+" of "+fmt(g31.n_runs)+" ("+(g31.rate*100).toFixed(1)+"%)");
-  }
+  if(glm!=null) set("kt-t5-glm",pct1(glm));
+  var glmCost=costMult("GLM 5.2");
+  if(glmCost!=null) set("kt-t5-glmcost",fmtMult(glmCost));
+  if(kimi!=null) set("kt-t5-kimi",pct1(kimi));
 
   /* kt-foot-bat — battery size for the relative-multiplier caveat. The
      span moved from the (removed) kt-foot into the About Key Caveats cost
@@ -2569,7 +2589,6 @@ <h2>Provenance</h2>
 
 function fillAboutCounts(){
   var T=PRECOMPUTED.totals||{};
-  if(T.n_timed_out!=null) el("ab-timeouts").textContent=fmt(T.n_timed_out);
   /* Per-phase case counts derived from per_case so the About table never
      drifts from the data. per_case phases are raw names; 3a/3b share
      dispatch_compliance — the count renders on the 3a row, 3b stays
@@ -2599,9 +2618,9 @@ <h2>Provenance</h2>
    Rank-ordered table-chart computed entirely from PRECOMPUTED:
    composite bar with component ticks, per-phase rate cells
    (rate + visible n, deep-linking to the phase deep-dives),
-   dispatch reliability, k-of-n consistency, the per-model timed-out
-   share (PRECOMPUTED.timeout_by_model; added 2026-06-12), and the
-   battery-cost multiplier (est. cost to run the full battery once, x Opus 4.8 —
+   dispatch reliability, k-of-n consistency, the battery-cost multiplier,
+   and the battery-duration multiplier (v3.3.0, the latency twin; est. cost
+   to run the full battery once, x Opus 4.8 —
    the page-wide headline cost figure; never observed spend, which
    was removed — see the CvP battery disclosure). A metric toggle switches composite, phase
    cells, ranks, and tier bands between the Perfect metric
@@ -2655,7 +2674,6 @@ <h2>Provenance</h2>
   var tierRule=(isHard?PRECOMPUTED.tier_rule_hard:PRECOMPUTED.tier_rule)||{};
   var pmp=PRECOMPUTED.per_model_phase||{};
   var consistency=PRECOMPUTED.consistency||{};
-  var toByModel=PRECOMPUTED.timeout_by_model||{};
   var groups=getEvalGroups();
 
   /* Composite ranking — mirrors the generator's ordering (score desc, name asc) */
@@ -2673,14 +2691,14 @@ <h2>Provenance</h2>
 
   /* Finding-as-title (computed): top model, runner-up gap, tier count */
   var top=ranked[0];
-  var finding='<b>'+esc(top.model)+'</b> leads at <b>'+pct(top.e.score)+'</b> '+metricLabel+' composite';
+  var finding='<b>'+escModel(top.model)+'</b> leads at <b>'+pct(top.e.score)+'</b> '+metricLabel+' composite';
   if(ranked.length>1){
     var ru=ranked[1];
     var gapPts=Math.round((top.e.score-ru.e.score)*100);
     if(gapPts>=1){
-      finding+=' &mdash; '+gapPts+' point'+(gapPts===1?'':'s')+' clear of <b>'+esc(ru.model)+'</b> at <b>'+pct(ru.e.score)+'</b>';
+      finding+=' &mdash; '+gapPts+' point'+(gapPts===1?'':'s')+' clear of <b>'+escModel(ru.model)+'</b> at <b>'+pct(ru.e.score)+'</b>';
     } else {
-      finding+=' &mdash; effectively tied with <b>'+esc(ru.model)+'</b> at <b>'+pct(ru.e.score)+'</b>';
+      finding+=' &mdash; effectively tied with <b>'+escModel(ru.model)+'</b> at <b>'+pct(ru.e.score)+'</b>';
     }
   }
   if(tiers.length>1){
@@ -2709,10 +2727,6 @@ <h2>Provenance</h2>
       var k=consistency[m];
       return (k&&k.rate!=null)?k.rate:null;
     }
-    if(sortKey==="timeout"){
-      var t=toByModel[m];
-      return (t&&t.rate!=null)?t.rate:null;
-    }
     if(sortKey==="composite"){
       var e=comp[m];
       return e?e.score:null;
@@ -2775,14 +2789,17 @@ <h2>Provenance</h2>
       '" onclick="lbSortBy(&#39;'+esc(key)+'&#39;,'+defDir+')">'+label+arrow+'</th>';
   }
 
-  /* Column order (fine-tuning round 3, Wave A — user decision): Tier, #,
-     Model, Cost, Composite, P1...P4 phases, Consistency, Timed out. Cost
-     was promoted from last to right after Model as a primary reference
-     point read alongside the composite; the Dispatch column (the P3a
-     agent_dispatched pass rate) was REMOVED — it duplicated signal the
-     P3a phase column already carries (the per-phase
-     dispatch_compliance_dispatch rate, which stays). Tier must stay the
-     first cell of band-start rows (the rowspan gutter contract). */
+  /* Column order: Tier, #, Model, Cost, Composite, P1...P4 phases,
+     Consistency. Cost was promoted (fine-tuning round 3, Wave A) to right
+     after Model as a primary reference point read alongside the composite.
+     The Relative Duration column (v3.3.0) was REMOVED in v3.7.0 — the
+     PRECOMPUTED.duration pipeline and the Cost vs. Performance duration
+     scatter axis remain, but the leaderboard no longer carries a duration
+     column. The Dispatch column (the P3a agent_dispatched pass rate) was
+     REMOVED — it duplicated signal the P3a phase column already carries.
+     The Timed-out column was REMOVED in v3.3.0: the viewer is timeout-blind,
+     so timed-out runs are excluded upstream and never presented. Tier must
+     stay the first cell of band-start rows (the rowspan gutter contract). */
   html+='<div class="card"><table class="data-table lb-table"><thead><tr>';
   if(showTier) html+='<th title="'+metricLabel+' composite tier band (banding rule below)">Tier</th>';
   html+='<th title="'+metricLabel+' composite rank (fixed across re-sorts)">#</th><th>Model</th>';
@@ -2796,17 +2813,6 @@ <h2>Provenance</h2>
   });
   html+=thSort("consistency","Consistency",
     "Share of repeated (phase, case) cells (2+ reps) where every rep was perfect. Always Perfect-based (all criteria), regardless of the metric toggle.",-1);
-  /* Timed-out column (2026-06-12, user fine-tuning round): per-model
-     timed-out share over all of the model's loaded runs, from
-     PRECOMPUTED.timeout_by_model — the same precompute that feeds the Key
-     Takeaways timeout claims. Default sort direction is DESCENDING
-     (worst-first): for a reliability column the interesting reading is
-     "who times out most", mirroring the worst-first instinct of the other
-     columns' best-first defaults. Since fine-tuning round 3 (Wave A) the
-     cells sit on the dedicated .to-* red worst-is-hot ramp (toStep();
-     design + contrast record at the .to-* CSS). */
-  html+=thSort("timeout","Timed out",
-    "Share of this model\u2019s runs cut off at the wall clock \u2014 the harness\u2019s timed_out flag counts genuine wall-clock timeouts AND silent stalls that simply ran out the clock. Timed-out runs are still graded from the transcript produced before the cutoff.",-1);
   html+='</tr></thead><tbody>';
 
   var anyPartial=false;
@@ -2821,8 +2827,8 @@ <h2>Provenance</h2>
     html+='<td class="lb-rank">'+rankOf[m]+'</td>';
 
     /* Model + provider chip (+ partial-data chip) */
-    html+='<td><span class="lb-model-name">'+esc(m)+'</span>'+
-      '<span class="lb-provider">'+esc(modelProvider(m))+'</span>';
+    html+='<td><span class="lb-model-name">'+escModel(m)+'</span>'+
+      '<span class="lb-provider">'+esc(displayProvider(modelProvider(m)))+'</span>';
     if(e.partial_data){
       anyPartial=true;
       var missing=(e.components_missing||[]).map(groupShort).join(", ");
@@ -2839,10 +2845,13 @@ <h2>Provenance</h2>
        disclosure). */
     var b=batteryMult(m);
     if(b){
+      var apiEquiv=b.basis&&b.basis.indexOf('api-equivalent')===0;
       html+='<td class="lb-cost" title="Est. cost to run the full battery once \u2248 '+
         fmtMult(b.mult)+' Opus 4.8\u2019s (= 1.0\u00d7); uncached list rates \u00d7 observed token mix \u2014 defined under Cost vs. Performance'+
+        (apiEquiv?' \u2014 API-equivalent counterfactual pricing (ChatGPT-subscription lane: list rates, never invoiced), not corpus-billed spend':'')+
         (b.stale?' \u26a0 token mix from a billing snapshot that predates this model\u2019s newest corpus runs':'')+
-        '">'+fmtMult(b.mult)+'</td>';
+        '">'+fmtMult(b.mult)+
+        '</td>';
     } else {
       html+='<td class="lb-cost text-muted">&mdash;</td>';
     }
@@ -2892,24 +2901,6 @@ <h2>Provenance</h2>
       html+='<td class="lb-cell"><span class="hm-cell rs-na" title="No (phase, case) cells with 2+ reps">&mdash;</span></td>';
     }
 
-    /* Timed-out share on the .to-* red worst-is-hot ramp (fine-tuning
-       round 3, Wave A; previously a plain cell). The original objection
-       to a ramp here — the pass-green .rs-* family reads high-is-good,
-       the inverse of a timeout rate — is resolved by a dedicated
-       fail-red family where MORE timeouts read HOTTER; 0% stays quiet/
-       neutral (.to-0 is untinted). The 1-decimal % text + k/n sub-line
-       stay, so color never carries the meaning alone; em-dash idiom if
-       the precompute lacks the model. Breaks + contrast record at the
-       .to-* CSS and toStep(). */
-    var to=toByModel[m];
-    if(to&&to.rate!=null){
-      html+='<td class="lb-cell"><span class="hm-cell to-'+toStep(to.rate)+'" title="'+fmt(to.n_timed_out)+' of '+fmt(to.n_runs)+
-        ' runs hit the wall clock (harness timed_out flag: wall-clock timeouts + silent stalls that ran out the clock); still graded from the transcript produced before the cutoff">'+
-        (to.rate*100).toFixed(1)+'%<span class="lb-n">'+fmt(to.n_timed_out)+'/'+fmt(to.n_runs)+'</span></span></td>';
-    } else {
-      html+='<td class="lb-cell text-muted">&mdash;</td>';
-    }
-
     html+='</tr>';
   });
   html+='</tbody></table></div>';
@@ -2928,9 +2919,10 @@ <h2>Provenance</h2>
     '&mdash; every token priced at uncached published list rates, applied to each model\u2019s own observed token mix &mdash; '+
     'expressed as a multiple of Opus 4.8 (= 1.0\u00d7), never dollars; not measured benchmark spend. '+
     'Where a model\u2019s token-mix snapshot predates its newest runs, the cell tooltip carries a \u26a0 marker. '+
-    'Full definition, sources, and caveats under <a href="#cost-performance">Cost vs. Performance</a>. '+
-    'Timed out is the share of a model\u2019s runs cut off at the wall clock (the harness\u2019s timed_out flag, '+
-    'which counts genuine wall-clock timeouts and silent stalls that ran out the clock alike); timed-out runs are still graded.</p>';
+    'For the ChatGPT-subscription GPT models, this figure is an API list-rate counterfactual: those models are '+
+    'accessed under a flat ChatGPT subscription and are never invoiced per token, so their battery cost is a '+
+    'published-list-rate estimate (basis <code>api-equivalent</code>), not corpus-billed spend. '+
+    'Full definition, sources, and caveats under <a href="#cost-performance">Cost vs. Performance</a>.</p>';
   if(anyPartial){
     html+='<p class="lb-foot">Models marked <i>partial</i> are missing one or more phase components; '+
       'their composite is the mean of the components present, not a comparable full-coverage score.</p>';
@@ -2977,40 +2969,64 @@ <h2>Provenance</h2>
 /* Shared point/frontier builder for the full Cost vs. Performance scatter
    AND its compact hero-flow preview (#cvp-preview) — one data path, two
    render targets, so the two charts cannot drift (2026-06-12 user
-   fine-tuning round). Returns {pts, frontier, isBat, prices, pv}. */
+   fine-tuning round). Returns {pts, frontier, isBat, isDur, prices, pv}. */
 function costPerfData(form,basis,metric){
   var prices=priceMap();
   var pvAll=(PRECOMPUTED.cost||{}).perf_values||{};
   var pv=(pvAll[basis]||{})[metric]||{};
-  var frontier=((((PRECOMPUTED.cost||{}).frontiers||{})[form]||{})[basis]||{})[metric]||[];
 
-  /* Battery formulation renders as a RELATIVE multiplier (v2.8.1): all
-     plotted values are divided by the reference model's (Opus 4.8)
-     battery cost — a pure positive scaling, so frontier membership and
-     shape are unchanged; only the axis numbers move. Dollar battery
-     figures are deliberately never displayed (false precision). */
+  /* Both the battery form and the duration form (v3.3.0) render as a
+     RELATIVE multiplier (v2.8.1 for battery): every plotted value is
+     divided by the reference model's (Opus 4.8) figure — a pure positive
+     scaling, so frontier membership and shape are unchanged; only the axis
+     numbers move. Dollar/second figures are deliberately never displayed
+     (false precision). Duration reads from a SEPARATE PRECOMPUTED.duration
+     block (its own models + frontiers), not cost.models/cost.frontiers,
+     because it covers models the cost block omits (OpenRouter, the
+     subscription lane). */
   var isBat=form==="battery";
-  var batScale=1;
+  var isDur=form==="duration";
+  var frontier;
+  if(isDur){
+    frontier=((((PRECOMPUTED.duration||{}).frontiers||{})[basis])||{})[metric]||[];
+  } else {
+    frontier=((((PRECOMPUTED.cost||{}).frontiers||{})[form]||{})[basis]||{})[metric]||[];
+  }
+
+  var scale=1;
+  var durModels=(PRECOMPUTED.duration||{}).models||{};
   if(isBat){
     var batRoot=(PRECOMPUTED.cost||{}).battery||{};
     var refB=((batRoot.models||{})[batRoot.reference_model||"Opus 4.8"]||{}).est_battery_cost;
-    if(refB>0) batScale=refB;
+    if(refB>0) scale=refB;
+  } else if(isDur){
+    var durRoot=(PRECOMPUTED.duration||{});
+    var refD=(durModels[durRoot.reference_model||"Opus 4.8"]||{}).est_battery_duration;
+    if(refD>0) scale=refD;
   }
   frontier=frontier.map(function(f){
-    return {model:f.model,price:f.price/batScale,score:f.score};
+    return {model:f.model,price:f.price/scale,score:f.score};
   });
 
   /* Points: models with a y-value under the active basis/metric AND a
-     positive published price under the active formulation (log axis
-     cannot place zero/unknown). */
+     positive x-value under the active formulation (log axis cannot place
+     zero/unknown). Duration x comes from PRECOMPUTED.duration; the
+     price formulations come from priceMap(). */
   var pts=[];
   Object.keys(pv).forEach(function(m){
-    var c=prices[m];
-    if(!c||c[form]==null||c[form]<=0) return;
-    pts.push({model:m,price:c[form]/batScale,score:pv[m],
-              provider:modelProvider(m),pm:c});
+    if(isDur){
+      var dm=durModels[m];
+      if(!dm||dm.est_battery_duration==null||dm.est_battery_duration<=0) return;
+      pts.push({model:m,price:dm.est_battery_duration/scale,score:pv[m],
+                provider:modelProvider(m),pm:dm});
+    } else {
+      var c=prices[m];
+      if(!c||c[form]==null||c[form]<=0) return;
+      pts.push({model:m,price:c[form]/scale,score:pv[m],
+                provider:modelProvider(m),pm:c});
+    }
   });
-  return {pts:pts,frontier:frontier,isBat:isBat,prices:prices,pv:pv};
+  return {pts:pts,frontier:frontier,isBat:isBat,isDur:isDur,prices:prices,pv:pv};
 }
 
 /* Billing-grade omission disclosure. PRECOMPUTED.cost.omitted_models is
@@ -3020,14 +3036,14 @@ <h2>Provenance</h2>
   var omitted=((PRECOMPUTED.cost||{}).omitted_models)||[];
   if(omitted.length===0) return '';
   var items=omitted.map(function(entry){
-    var providers=(entry.providers||[]).length?' ('+esc(entry.providers.join(', '))+')':'';
+    var providers=(entry.providers||[]).length?' ('+esc(entry.providers.map(displayProvider).join(', '))+')':'';
     var retained=entry.behavioral_scores_retained
       ?' remains in behavioral score views'
       :' has no behavioral-score retention flag';
     var reason=entry.reason==='subscription_access_api_equivalent_is_counterfactual_not_invoiced'
       ?'subscription access has API-equivalent counterfactual accounting that is not invoiced'
       :humanCode(entry.reason)||'its billing treatment is incompatible';
-    return '<b>'+esc(entry.model)+'</b>'+providers+retained+
+    return '<b>'+escModel(entry.model)+'</b>'+providers+retained+
       ', but is omitted from billing-grade cost charts, frontiers, relative battery estimates, and list-price tables because '+esc(reason)+'.';
   });
   return '<aside class="cost-omission-note" role="note"><span aria-hidden="true">ⓘ</span> '+
@@ -3062,8 +3078,29 @@ <h2>Provenance</h2>
     'not have \u2014 and the relative figures can shift as providers reprice tokens and as caching mechanics '+
     'interact with each model\u2019s behavior.'+
     (anyStale?' A \u26a0 marker (here and on the leaderboard) means that model\u2019s token-mix snapshot predates its newest corpus runs.':'')+
-    ' Timed-out runs are excluded from both providers\u2019 token averages, so the estimates reflect successful-run costs; '+
-    'timeout rates are shown separately on the leaderboard.</p>';
+    ' The estimates reflect successful-run costs only.</p>';
+}
+
+/* Duration-multiplier methodology footnote (v3.3.0), the latency twin of
+   batteryDisclosureHtml. Renders in the CvP footnote area whenever any
+   duration data is present (the Relative Duration leaderboard column and
+   the duration scatter axis both point here). Battery size injects live
+   from PRECOMPUTED.duration. */
+function durationDisclosureHtml(){
+  var dur=PRECOMPUTED.duration||{};
+  var durModels=dur.models||{};
+  if(Object.keys(durModels).length===0) return '';
+  return '<p class="cp-foot"><b>The duration multiplier, precisely.</b> '+
+    'Each model\u2019s figure is its estimated wall-clock time to run the full '+
+    (dur.battery_size||"?")+'-probe DAAFBench battery once, expressed as a multiple of '+
+    esc(dur.reference_model||"Opus 4.8")+' (= 1.0\u00d7). It is computed from each model\u2019s '+
+    'summed per-run durations, which are parallelization-INVARIANT (independent of whether the '+
+    'batch ran serially or in parallel) \u2014 never the batch wall-clock, which depends on run mode. '+
+    'Read it as a real-world LATENCY proxy: it folds in provider routing and congestion at the time '+
+    'each run executed, which multi-rep averaging mitigates but does not eliminate. Unlike the cost '+
+    'multiplier it needs no pricing, so it covers every model \u2014 including those without billing-grade '+
+    'cost data. Multipliers only, never seconds \u2014 exact durations would imply a precision these '+
+    'estimates do not have.</p>';
 }
 
 /* Published list-price table (relocated from the removed Costs Detail
@@ -3081,7 +3118,7 @@ <h2>Provenance</h2>
   h+='<div class="table-wrap"><table class="data-table" style="width:auto"><thead><tr><th style="cursor:default">Model</th><th style="cursor:default">Input / 1M</th><th style="cursor:default">Output / 1M</th><th style="cursor:default">Cache Read / 1M</th></tr></thead><tbody>';
   rows.forEach(function(m){
     var p=pricing[m];
-    h+='<tr><td style="font-weight:600;color:'+modelColorLight(m)+'">'+esc(m)+'</td>'+
+    h+='<tr><td style="font-weight:600;color:'+modelColorLight(m)+'">'+escModel(m)+'</td>'+
       '<td>$'+p.input_per_million.toFixed(2)+'</td>'+
       '<td>$'+p.output_per_million.toFixed(2)+'</td>'+
       '<td>'+(p.cached_input_per_million>0?'$'+p.cached_input_per_million.toFixed(2):'N/A')+'</td></tr>';
@@ -3090,6 +3127,23 @@ <h2>Provenance</h2>
   return h;
 }
 
+/* Provider legend (color + shape redundancy; design record: README § 8 —
+   design system). Extracted to a shared helper in v3.6.0 so the full
+   Cost-vs-Performance chart and the intro #cvp-preview render the identical
+   legend (markers must match svgCostFrontier's point shapes exactly). */
+function costPerfLegend(pts){
+  var provSeen={};
+  pts.forEach(function(p){ provSeen[p.provider||"unknown"]=true; });
+  var legend='<div class="cp-legend">';
+  if(provSeen.anthropic) legend+='<span><svg width="14" height="14"><circle cx="7" cy="7" r="5" style="fill:var(--accent-light)"/></svg>Anthropic</span>';
+  if(provSeen.openrouter) legend+='<span><svg width="14" height="14"><path d="M7 1.5 L12.5 7 L7 12.5 L1.5 7 Z" style="fill:var(--c-partial)"/></svg>OpenRouter</span>';
+  if(provSeen["chatgpt-subscription"]) legend+='<span><svg width="14" height="14"><path d="M7 2 L12 11.5 L2 11.5 Z" style="fill:var(--c-pass)"/></svg>ChatGPT</span>';
+  if(provSeen.unknown) legend+='<span><svg width="14" height="14"><rect x="2.5" y="2.5" width="9" height="9" style="fill:var(--c-neutral)"/></svg>other provider</span>';
+  legend+='<span><svg width="26" height="14"><line x1="1" y1="7" x2="25" y2="7" stroke="rgba(52,211,153,.8)" stroke-width="1.5" stroke-dasharray="4 3"/></svg>efficiency frontier (outlined points)</span>';
+  legend+='</div>';
+  return legend;
+}
+
 function renderCostPerf(container){
   var form=state.costForm||"battery";
   var formDef=COST_FORMS[0];
@@ -3103,19 +3157,31 @@ <h2>Provenance</h2>
   var yShort=basisDef.label+' '+metricDef.label+' rate';
 
   var d=costPerfData(form,basis,metric);
-  var pts=d.pts, frontier=d.frontier, isBat=d.isBat;
-
-  /* Omitted-model disclosure: priced models present in the baseline
-     composite view but absent under the active basis/metric. */
+  var pts=d.pts, frontier=d.frontier, isBat=d.isBat, isDur=d.isDur;
+  /* isRel: both battery and duration render as relative multipliers */
+  var isRel=isBat||isDur;
+  var durModels=(PRECOMPUTED.duration||{}).models||{};
+
+  /* Omitted-model disclosure: models present in the baseline composite
+     view that have an x-value under the active formulation but no y-value
+     under the active basis/metric. */
   var pvAll=(PRECOMPUTED.cost||{}).perf_values||{};
   var omitted=0;
   Object.keys((pvAll.composite||{}).perfect||{}).forEach(function(m){
-    var c=d.prices[m];
-    if(!c||c[form]==null||c[form]<=0) return;
+    if(isDur){
+      var dm=durModels[m];
+      if(!dm||dm.est_battery_duration==null||dm.est_battery_duration<=0) return;
+    } else {
+      var c=d.prices[m];
+      if(!c||c[form]==null||c[form]<=0) return;
+    }
     if(d.pv[m]==null) omitted++;
   });
   if(pts.length===0){
-    container.innerHTML=costOmissionNoteHtml()+'<div class="empty-msg">No models with both a '+esc(yShort)+' and billing-grade published pricing in this corpus.</div>';
+    var emptyWhy=isDur
+      ?'a '+esc(yShort)+' and duration data'
+      :'a '+esc(yShort)+' and billing-grade published pricing';
+    container.innerHTML=costOmissionNoteHtml()+'<div class="empty-msg">No models with both '+emptyWhy+' in this corpus.</div>';
     return;
   }
 
@@ -3146,10 +3212,10 @@ <h2>Provenance</h2>
      BELOW the chart (section layout rule); reflects the active basis +
      metric selections. */
   var finding='';
-  var priceUnit=isBat?" vs Opus 4.8":"/Mtok";
+  var priceUnit=isRel?" vs Opus 4.8":"/Mtok";
   if(frontier.length>0){
     var fbits=frontier.map(function(f){
-      return '<b>'+esc(f.model)+'</b> ('+(isBat?fmtMult(f.price):fmtCost(f.price)+priceUnit)+', '+pct(f.score)+')';
+      return '<b>'+escModel(f.model)+'</b> ('+(isRel?fmtMult(f.price):fmtCost(f.price)+priceUnit)+', '+pct(f.score)+')';
     });
     finding=frontier.length+' of '+pts.length+' models sit on the efficiency frontier &mdash; '+
       fbits.join(' &rarr; ')+' &mdash; every other model is beaten on both price and '+esc(yShort)+' by one of them.';
@@ -3159,9 +3225,9 @@ <h2>Provenance</h2>
         var ratio=topF.price/knee.price;
         var share=Math.round(knee.score/topF.score*100);
         if(ratio>=1.5){
-          finding+=' <b>'+esc(knee.model)+'</b> reaches '+share+'% of <b>'+esc(topF.model)+
+          finding+=' <b>'+escModel(knee.model)+'</b> reaches '+share+'% of <b>'+escModel(topF.model)+
             '</b>\u2019s '+esc(yShort)+' at roughly 1/'+ratio.toFixed(1)+' of the '+
-            (isBat?'estimated battery cost':esc(formDef.label)+' price')+'.';
+            (isDur?'estimated battery duration':(isBat?'estimated battery cost':esc(formDef.label)+' price'))+'.';
         }
       }
     }
@@ -3169,15 +3235,7 @@ <h2>Provenance</h2>
     finding='No efficiency frontier could be computed for this corpus under '+esc(yShort)+'.';
   }
 
-  /* Provider legend (color + shape redundancy; design record: README § 8 — design system) */
-  var provSeen={};
-  pts.forEach(function(p){ provSeen[p.provider||"unknown"]=true; });
-  var legend='<div class="cp-legend">';
-  if(provSeen.anthropic) legend+='<span><svg width="14" height="14"><circle cx="7" cy="7" r="5" style="fill:var(--accent-light)"/></svg>Anthropic API</span>';
-  if(provSeen.openrouter) legend+='<span><svg width="14" height="14"><path d="M7 1.5 L12.5 7 L7 12.5 L1.5 7 Z" style="fill:var(--c-partial)"/></svg>OpenRouter</span>';
-  if(provSeen.unknown) legend+='<span><svg width="14" height="14"><rect x="2.5" y="2.5" width="9" height="9" style="fill:var(--c-neutral)"/></svg>other provider</span>';
-  legend+='<span><svg width="26" height="14"><line x1="1" y1="7" x2="25" y2="7" stroke="rgba(52,211,153,.8)" stroke-width="1.5" stroke-dasharray="4 3"/></svg>efficiency frontier (outlined points)</span>';
-  legend+='</div>';
+  var legend=costPerfLegend(pts);
 
   /* Footnotes: active selections + omitted-model count (if any) +
      published-pricing-only disclosure + the battery disclosure block —
@@ -3195,7 +3253,11 @@ <h2>Provenance</h2>
        ' data for this selection and '+(omitted===1?'is':'are')+' omitted from this view.'
       :'')+'</p>';
   foot+='<p class="cp-foot">'+esc(formDef.formula)+'. '+
-    (isBat
+    (isDur
+      ?'A rough relative multiplier &mdash; a real-world latency proxy, not a stopwatch reading; '+
+       'full definition and disclosures below. Covers every model, including those without '+
+       'billing-grade cost data.'
+      :isBat
       ?'A rough relative multiplier &mdash; not a reading of an invoice; full definition '+
        'and disclosures below. Models without battery data are omitted under this basis.'
       :'Prices under this secondary basis are raw published list rates, '+
@@ -3208,6 +3270,10 @@ <h2>Provenance</h2>
      — inside the Details expander since the 2026-06-12 fine-tuning
      round 2, but on every render regardless of the price-basis toggle */
   foot+=batteryDisclosureHtml();
+  /* Duration-multiplier methodology footnote (v3.3.0): renders whenever
+     duration data exists, so the Relative Duration column and the duration
+     scatter axis both have a definition to point to. */
+  foot+=durationDisclosureHtml();
   foot+='</div></details>';
 
   /* Layout: controls + legend immediately adjacent to the chart; the
@@ -3217,7 +3283,7 @@ <h2>Provenance</h2>
     '<div class="card"><div class="chart-container">'+
     svgCostFrontier(pts,frontier,
       formDef.axis||(formDef.label+' price (USD per 1M tokens, log scale)'),yShort,
-      isBat?"Est. relative cost":"Published price",priceUnit,isBat)+
+      isDur?"Est. relative duration":(isBat?"Est. relative cost":"Published price"),priceUnit,isRel)+
     '</div></div>'+
     '<div class="cp-finding">'+finding+'</div>'+foot+
     pricingDetailsHtml();
@@ -3242,7 +3308,8 @@ <h2>Provenance</h2>
   }
   slot.innerHTML=svgCostFrontier(d.pts,d.frontier,
     COST_FORMS[0].axis,"Composite Perfect rate",
-    "Est. relative cost"," vs Opus 4.8",true,{H:330});
+    "Est. relative cost"," vs Opus 4.8",true,{H:330})+
+    costPerfLegend(d.pts);
 }
 
 /* =================================================================
@@ -3294,7 +3361,7 @@ <h2>Provenance</h2>
 var PD_EXPLAINERS={
   mode_classification:"The failure this phase catches: <i>the assistant starts the wrong kind of work.</i> Each run starts cold: the model sees only the user\u2019s opening request and must route it to the right one of DAAF\u2019s workflow modes (basically: Did it recognize what kind of work is actually being asked for?). It is a fairly easy task, but the one everything downstream depends on. Criteria check the mode it picks, that it pauses at a confirmation gate for the user\u2019s sign-off, and that it executes nothing before that approval arrives.",
   post_confirmation:"The failure this phase catches: <i>improvising instead of following the established process.</i> The model resumes from a checkpoint that ends at the confirmation gate, and the user says to proceed. Strict protocol adherence means doing the homework first: loading the governing reference documents (the ones that define how the work is supposed to be done) before conducting any of it. Criteria check that it actually loads the mode reference files and skills it just committed to loading \u2014 not merely that it claims to.",
-  dispatch_compliance_dispatch:"The failure this phase catches: <i>garbled delegation that degrades everything downstream.</i> The model resumes from a fully initialized Ad Hoc Collaboration session and must hand work to a specialist subagent the way a good manager would: concisely, coherently, and instructively. Criteria check that it dispatches the correct agent type with a properly structured handoff prompt \u2014 BASE_DIR, mode marker, and task / context / instructions sections.",
+  dispatch_compliance_dispatch:"The failure this phase catches: <i>garbled delegation that degrades everything downstream.</i> The model resumes from a fully initialized Ad Hoc Collaboration session and must hand work to a specialist subagent the way a good manager would: concisely, coherently, and instructively. Criteria check that it dispatches the correct agent type with a properly structured handoff prompt \u2014 BASE_DIR, mode marker, and task / context / instructions sections. Some models fail this phase not by skipping the dispatch at all, but by requesting a specialist their environment doesn\u2019t actually provide \u2014 a temptation seen in the GPT-5.6 family, which sometimes reaches for the tool schema\u2019s Claude model aliases instead of a model its own runtime can serve.",
   dispatch_compliance_subagent:"The failure this phase catches: <i>a specialist that ignores its own role\u2019s rules.</i> Whenever a Phase 3 dispatch succeeds, the dispatched subagent\u2019s own transcript gets scored too: did it operate correctly <i>as</i> that specialist (e.g., a coding agent actually writing a script and executing it through the audit-trail wrapper)? Criteria are derived from the agent type\u2019s work protocols, and which ones apply varies by case \u2014 so denominators vary across this heatmap, and \u201c\u2014\u201d marks criteria that never applied to a model\u2019s runs.",
   skill_routing:"The failure this phase catches: <i>confident, ungrounded methodological advice.</i> Models cannot be relied on to draw research methodology from their fuzzy general knowledge (basically: the baked-in impressions left over from training), so a genuine research assistant must load curated domain references into its working context to ground what it does, says, and recommends. The model resumes from the same fully initialized checkpoint as Phase 3 and receives a brainstorming task that calls for a specific analysis library; criteria check that it FIRST consults the data-scientist hub\u2019s routing guidance and THEN loads the specific library skills \u2014 scored on the main transcript only, and one of the five leaderboard composite components."
 };
@@ -3351,7 +3418,7 @@ <h2>Provenance</h2>
     }
     if(co.top_model){
       var tm=co.top_model;
-      cbits.push('top model: <b>'+esc(tm.model)+'</b> at <b>'+pct(tm.perfect_rate)+
+      cbits.push('top model: <b>'+escModel(tm.model)+'</b> at <b>'+pct(tm.perfect_rate)+
         '</b> perfect ('+fmt(tm.n_runs)+' runs)');
     }
     calloutHtml='<div class="pd-callout">'+cbits.join('; ')+'.</div>';
@@ -3376,7 +3443,7 @@ <h2>Provenance</h2>
 
   models.forEach(function(m){
     var cellPM=(pmp[m]||{})[gid];
-    html+='<tr><td class="pd-model">'+esc(m)+
+    html+='<tr><td class="pd-model">'+escModel(m)+
       (cellPM?'<span class="pd-row-rate">'+pct(cellPM.perfect_rate)+' perfect, '+
         cellPM.perfect_count+'/'+cellPM.n_runs+'</span>':'')+'</td>';
     cols.forEach(function(k,i){
@@ -3384,7 +3451,7 @@ <h2>Provenance</h2>
       var cell=(byModel[m]||{})[k];
       if(!cell||cell.total===0){
         html+='<td class="pd-cell rs-na'+sep+'" title="'+esc(k)+' \u2014 not applicable: never scored on '+
-          esc(m)+'\u2019s runs in this group">&mdash;</td>';
+          escModel(m)+'\u2019s runs in this group">&mdash;</td>';
         return;
       }
       var rate=cell.passed/cell.total;
@@ -3392,7 +3459,7 @@ <h2>Provenance</h2>
       /* Criterion-level deep link: lands on the Run Explorer with the
          (model, group, criterion) filters pre-applied — the criterion
          filter keeps exactly the runs this cell's denominator counts. */
-      html+='<td class="pd-cell rs-'+step+sep+'" title="'+esc(k)+' \u2014 '+esc(m)+': '+
+      html+='<td class="pd-cell rs-'+step+sep+'" title="'+esc(k)+' \u2014 '+escModel(m)+': '+
         cell.passed+'/'+cell.total+' passed ('+pct(rate)+') \u2014 click to open these runs" '+
         'onclick="exploreRuns(&#39;'+esc(m)+'&#39;,&#39;'+esc(gid)+'&#39;,null,&#39;'+esc(k)+'&#39;)">'+
         rateGlyph(step)+pct(rate)+'</td>';
@@ -3576,7 +3643,7 @@ <h2>Provenance</h2>
   html+='<th class="pd-crit-th" title="Cross-model difficulty: perfect reps over all reps of this case in this group"><span class="pd-crit-rot">All models</span></th>';
   models.forEach(function(m){
     var cell=(pmp[m]||{})[gid];
-    html+='<th class="pd-crit-th" title="'+esc(m)+(cell?' \u2014 '+pct(cell.perfect_rate)+' perfect in this group':'')+'"><span class="pd-crit-rot">'+esc(m)+'</span></th>';
+    html+='<th class="pd-crit-th" title="'+escModel(m)+(cell?' \u2014 '+pct(cell.perfect_rate)+' perfect in this group':'')+'"><span class="pd-crit-rot">'+escModel(m)+'</span></th>';
   });
   html+='</tr></thead><tbody>';
 
@@ -3590,11 +3657,11 @@ <h2>Provenance</h2>
     models.forEach(function(m){
       var c=byCase[cid][m];
       if(!c||c.n===0){
-        html+='<td class="pd-cell rs-na" title="'+esc(m)+' never ran '+esc(cid)+' in this group">&mdash;</td>';
+        html+='<td class="pd-cell rs-na" title="'+escModel(m)+' never ran '+esc(cid)+' in this group">&mdash;</td>';
         return;
       }
       var step=konStep(c.k,c.n);
-      html+='<td class="pd-cell rs-'+step+'" title="'+esc(m)+' on '+esc(cid)+': '+c.k+' of '+c.n+' reps perfect'+
+      html+='<td class="pd-cell rs-'+step+'" title="'+escModel(m)+' on '+esc(cid)+': '+c.k+' of '+c.n+' reps perfect'+
         (c.k>0&&c.k<c.n?' \u2014 split reps (flaky)':'')+' \u2014 click to open these runs" '+
         'onclick="exploreRuns(&#39;'+esc(m)+'&#39;,&#39;'+esc(gid)+'&#39;,&#39;'+esc(cid)+'&#39;)">'+
         rateGlyph(step)+c.k+'/'+c.n+'</td>';
@@ -3655,7 +3722,7 @@ <h2>Provenance</h2>
   var html='<div class="section-title" style="margin:14px 0 6px">'+esc(group.label)+' &mdash; per-rep marks</div>';
   html+='<div style="overflow-x:auto"><table class="data-table"><thead><tr>';
   html+='<th style="width:60px"></th><th>Criterion</th><th style="width:36px">Tier</th>';
-  models.forEach(function(m){ html+='<th style="text-align:center;color:'+modelColorLight(m)+'">'+esc(m)+'</th>'; });
+  models.forEach(function(m){ html+='<th style="text-align:center;color:'+modelColorLight(m)+'">'+escModel(m)+'</th>'; });
   html+='</tr></thead><tbody>';
 
   for(var rep=0;rep<=maxRep;rep++){
@@ -3792,8 +3859,7 @@ <h2>Provenance</h2>
 /* =================================================================
    SECTION 8: RUN EXPLORER
    Run list + detail panel. Status everywhere in this section is the
-   grade taxonomy (perfect / partial / failed / ungraded) with the
-   timed_out flag rendered as a separate clock marker; deep links from
+   grade taxonomy (perfect / partial / failed / ungraded); deep links from
    the leaderboard, phase heatmaps, and agreement grids land here via
    exploreRuns with filters pre-applied (incl. the chip-only criterion
    filter). Performance guard: the list renders at most
@@ -3818,14 +3884,10 @@ <h2>Provenance</h2>
       var st=runStatus(r);
       html+='<div class="run-list-item'+(state.selectedRunIdx===i?" selected":"")+'" data-ridx="'+i+'" onclick="selectRun('+i+')">';
       html+='<span class="st-glyph st-'+st+'" title="'+st+' \u2014 '+(GRADE_TIP[st]||"")+'">'+(GRADE_GLYPH[st]||"&mdash;")+'</span>';
-      if(r.timed_out){
-        html+='<span class="to-mark" title="Timed out \u2014 criteria were still scored from the transcript produced before the cutoff">&#9201;</span>';
-      }
       html+='<span class="case-label">'+esc(r.case_id)+'</span>';
-      html+='<span class="model-label">'+esc(r.model)+'</span>';
+      html+='<span class="model-label">'+escModel(r.model)+'</span>';
       html+='<span class="text-xs text-muted">rep'+r.rep+'</span>';
-      /* Timeouts have no meaningful duration — "0s" would misread as instant */
-      html+='<span class="text-xs text-muted">'+(r.timed_out?'&mdash;':(isObserved(r.duration_s)?r.duration_s.toFixed(0)+'s':'Unavailable'))+'</span>';
+      html+='<span class="text-xs text-muted">'+(isObserved(r.duration_s)?r.duration_s.toFixed(0)+'s':'Unavailable')+'</span>';
       html+='</div>';
     }
     if(runs.length>shown){
@@ -3864,6 +3926,11 @@ <h2>Provenance</h2>
    failure fallback below says so with a `python3 -m http.server`
    hint. The --single-file artifact remains the offline/file://
    audit path.
+   v3.4.0: a build may carry NO transcripts at all (neither DATA.transcripts
+   nor DATA.transcripts_index) — the --no-transcripts bundle or the
+   transcript-lite single-file default. renderRunDetail feature-detects that
+   third shape and renders transcriptsExcludedNotice() instead; this shard
+   machinery is only reached when DATA.transcripts_index is present.
    ================================================================= */
 
 /* Shard cache: result_set -> Promise of the parsed shard. Shards are
@@ -3923,8 +3990,7 @@ <h2>Provenance</h2>
       var idx=(DATA.transcripts_index||{})[r.result_set]||{};
       msg+=' The transcript data file ('+esc(idx.file||"")+') was not reachable.';
     }
-    msg+=' The archived run directory is named at the bottom of this panel; '+
-      'the Provenance section lists its result set.';
+    msg+=' The archived run directory is named at the bottom of this panel.';
     slot.innerHTML='<div class="section-title" style="margin-top:16px">Condensed Transcript</div>'+
       '<div class="card" style="border-color:var(--c-partial);font-size:12px;line-height:1.6">'+msg+'</div>';
   });
@@ -3932,6 +3998,24 @@ <h2>Provenance</h2>
     '<div class="text-muted text-xs">Loading transcript\u2026</div></div>';
 }
 
+/* Transcript-less build notice (generator v3.4.0). Shown when DATA carries
+   neither transcripts (inline) nor transcripts_index (lazy shards) \u2014 i.e. a
+   --no-transcripts bundle or the transcript-lite single-file default. Static:
+   there is nothing to fetch, so this never touches the network. The run's
+   scores, metrics, and provenance are all still present; only the condensed
+   transcript payload was omitted to keep the artifact small. */
+function transcriptsExcludedNotice(){
+  return '<div class="section-title" style="margin-top:16px">Condensed Transcript</div>'+
+    '<div class="card" style="border-color:var(--c-neutral);font-size:12px;line-height:1.6">'+
+    'Transcripts were not included in this build. This is a transcript-lite '+
+    'artifact (generated with <code>--no-transcripts</code>, or the default '+
+    'single-file monolith) \u2014 run scores, metrics, and provenance are complete, '+
+    'but the per-run condensed transcript payload was omitted to keep the file '+
+    'small. Regenerate the bundle (its default includes lazy-loaded '+
+    'transcripts) or run <code>--single-file --transcripts</code> for the full '+
+    'inline-transcript monolith.</div>';
+}
+
 function renderSchemaV2RunEvidence(r){
   if(!(r.schema_version>=2)) return '';
 
@@ -4104,17 +4188,14 @@ <h2>Provenance</h2>
 function renderRunDetail(r){
   var st=runStatus(r);
   var html='';
-  /* Header: grade badge (+ glyph) with the timeout flag as a separate
-     outlined marker; subcategory and expected mode surfaced as chips */
+  /* Header: grade badge (+ glyph); subcategory and expected mode surfaced
+     as chips */
   var gradeBadge={perfect:"badge-pass",partial:"badge-partial",failed:"badge-fail",ungraded:"badge-neutral"};
   html+='<div style="display:flex;flex-wrap:wrap;gap:12px;align-items:center;margin-bottom:12px">';
   html+='<span style="font-size:16px;font-weight:700">'+esc(r.case_id)+'</span>';
-  html+='<span class="badge" style="background:'+modelColor(r.model)+';color:#fff">'+esc(r.model)+'</span>';
+  html+='<span class="badge" style="background:'+modelColor(r.model)+';color:#fff">'+escModel(r.model)+'</span>';
   html+='<span class="badge">Rep '+r.rep+'</span>';
   html+='<span class="badge '+(gradeBadge[st]||"badge-neutral")+'" title="Grade: '+(GRADE_TIP[st]||"")+'">'+(GRADE_GLYPH[st]||"")+' '+st.toUpperCase()+'</span>';
-  if(r.timed_out){
-    html+='<span class="badge badge-timeout" title="'+esc(r.error||"Hit the wall-clock limit")+' \u2014 criteria were still scored from the transcript produced before the cutoff">&#9201; TIMED OUT</span>';
-  }
   if(r.subcategory) html+='<span class="badge" title="Case subcategory">'+esc(r.subcategory)+'</span>';
   if(r.expected_mode) html+='<span class="badge" title="Expected engagement mode for this Phase 1 case">expects: '+esc(r.expected_mode)+'</span>';
   html+='</div>';
@@ -4125,10 +4206,10 @@ <h2>Provenance</h2>
   html+='<div class="text-xs text-muted mb-2">Session: '+esc(r.session_id||"Unavailable")+' | Duration: '+(isObserved(r.duration_s)?r.duration_s.toFixed(1)+'s':'Unavailable')+'</div>';
   html+='<div class="text-xs text-muted mb-4">Turns: '+(isObserved(r.turns)?fmt(r.turns):'Unavailable')+
     (r.tool_call_count!=null?' | Tool calls: '+fmt(r.tool_call_count):'')+'</div>';
-  /* Non-timeout errors only — the timeout badge above already carries
-     the error string for timed-out runs (currently every on-disk error
-     is a timeout, but render genuine errors if they ever appear) */
-  if(r.error && !r.timed_out){
+  /* Render genuine errors. Timed-out runs are excluded from the corpus
+     entirely (v3.3.0 timeout-blindness), so any error surfaced here is a
+     real failure, not a wall-clock cutoff. */
+  if(r.error){
     html+='<div class="card" style="border-color:var(--c-fail);margin-bottom:12px"><strong style="color:var(--c-fail)">Error:</strong> '+esc(r.error)+'</div>';
   }
 
@@ -4185,19 +4266,25 @@ <h2>Provenance</h2>
     });
   }
 
-  /* Transcript block — two artifact shapes (generator v3.0.0):
-     single-file artifacts embed DATA.transcripts inline (render
-     synchronously, exactly the pre-3.0 behavior); bundle artifacts
-     ship transcripts in per-result-set shards listed in
-     DATA.transcripts_index (render a loading placeholder now, fill
-     when the shard arrives — cache, stale-click token, and file://
-     failure fallback all live in the shard-loading block above). */
+  /* Transcript block — three artifact shapes (generator v3.0.0 inline/lazy;
+     v3.4.0 added transcript-less). Feature-detect in priority order:
+       1. DATA.transcripts present -> inline dicts (full single-file monolith):
+          render synchronously, exactly the pre-3.0 behavior.
+       2. DATA.transcripts_index present -> bundle lazy shards: render a
+          loading placeholder now, fill when the shard arrives (cache,
+          stale-click token, and file:// failure fallback live in the
+          shard-loading block above).
+       3. Neither present -> transcript-less build (--no-transcripts, or the
+          v3.4.0 single-file default): show a static "not included" notice.
+          No fetch is attempted — there is no index to fetch from. */
   if(DATA.transcripts){
     html+=renderTranscriptBlocks(r,
       DATA.transcripts[r.result_set+"/"+r.run_dir],
       (DATA.subagent_transcripts||{})[r.result_set+"/"+r.run_dir]);
-  } else {
+  } else if(DATA.transcripts_index){
     html+=transcriptPlaceholder(r);
+  } else {
+    html+=transcriptsExcludedNotice();
   }
 
   html+='<div class="text-xs text-muted mt-4">Run dir: '+esc(r.run_dir)+'</div>';
@@ -4286,94 +4373,11 @@ <h2>Provenance</h2>
   return html;
 }
 
-/* =================================================================
-   SECTION 9: PROVENANCE FOOTER
-   One row per result set from PRECOMPUTED.provenance; rows where the
-   on-disk run count disagrees with summary.json are highlighted.
-   ================================================================= */
-
-function renderProvenance(container){
-  var prov=PRECOMPUTED.provenance||[];
-  var anyDisc=false;
-
-  function resultSetByTimestamp(ts){
-    for(var i=0;i<DATA.result_sets.length;i++){
-      if(DATA.result_sets[i].timestamp===ts) return DATA.result_sets[i];
-    }
-    return null;
-  }
-  function resultSetRoutes(ts){
-    var seen={};
-    DATA.runs.forEach(function(run){
-      if(run.result_set===ts&&isObserved(run.route_type)&&run.route_type!=='') seen[run.route_type]=true;
-    });
-    return Object.keys(seen).sort();
-  }
-  function coverageHtml(coverage,keys){
-    if(!coverage) return evidenceMissing('Not reported');
-    return keys.map(function(key){
-      return esc(humanCode(key))+': '+countEvidence(coverage[key],'Unavailable');
-    }).join('<br>');
-  }
-
-  var html='<div class="card"><table class="data-table"><thead><tr>'+
-    '<th scope="col">Result Set</th><th scope="col">Phase</th><th scope="col">Schema</th>'+
-    '<th scope="col">Observed provider / route</th><th scope="col">Accounting / purity coverage</th>'+
-    '<th scope="col">Cost surface</th><th scope="col">DAAF Git SHA</th><th scope="col">Config</th>'+
-    '<th scope="col">Runs (disk / summary)</th></tr></thead><tbody>';
-  prov.forEach(function(p){
-    var rs=resultSetByTimestamp(p.timestamp)||{};
-    var cfg=p.config||null;
-    var cfgStr='Unavailable';
-    if(cfg){
-      var bits=[];
-      if(cfg.reps!=null) bits.push('reps='+cfg.reps);
-      if(cfg.parallel!=null) bits.push(cfg.parallel?'parallel':'sequential');
-      if(cfg.launch_delay_s!=null) bits.push('delay='+cfg.launch_delay_s+'s');
-      bits.push('timeout='+(cfg.timeout_override!=null?cfg.timeout_override+'s':'tier default'));
-      cfgStr=bits.join(', ');
-    }
-    var disc=!!p.run_count_discrepancy;
-    if(disc) anyDisc=true;
-    var providers=p.providers||rs.providers||[];
-    var routes=resultSetRoutes(p.timestamp);
-    var schemaVersion=isObserved(p.schema_version)?p.schema_version:(isObserved(rs.schema_version)?rs.schema_version:1);
-    var classification=p.schema_classification||rs.schema_classification||(schemaVersion>=2?'schema_v2':'legacy_schema_v1');
-    var schemaSource=rs.schema_version_source||'Not reported';
-    var eligible=p.billing_grade_cost_eligible!==false;
-    var costStatus=eligible
-      ?statusEvidence('pass','✓','Billing-grade cost eligible')
-      :statusEvidence('partial','⊘','Excluded from billing-grade cost views');
-    var costReason=p.billing_grade_cost_exclusion_reason||rs.billing_grade_cost_exclusion_reason;
-    var totalCost=isObserved(rs.total_cost_usd)?usdEvidence(rs.total_cost_usd,'Unavailable'):evidenceMissing('Unavailable');
-
-    html+='<tr'+(disc?' class="prov-discrepancy"':'')+'>';
-    html+='<td><code>'+esc(p.timestamp)+'</code></td>';
-    html+='<td>'+esc(p.phase_label||p.phase)+'</td>';
-    html+='<td class="text-xs"><b>v'+esc(String(schemaVersion))+'</b><br>'+esc(humanCode(classification))+'<br><span class="text-muted">source: '+esc(humanCode(schemaSource))+'</span></td>';
-    html+='<td class="text-xs"><b>Provider:</b> '+(providers.length?providers.map(function(v){return '<code>'+esc(v)+'</code>';}).join(', '):evidenceMissing('Not observed'))+
-      '<br><b>Route:</b> '+(routes.length?routes.map(function(v){return '<code>'+esc(v)+'</code>';}).join(', '):evidenceMissing('Not observed'))+'</td>';
-    html+='<td class="text-xs"><b>Accounting</b><br>'+coverageHtml(rs.accounting_coverage,['exact','scenario_only','unavailable','legacy_numeric'])+
-      '<br><b>Purity</b><br>'+coverageHtml(p.purity_coverage||rs.purity_coverage,['verified','failed','unverifiable'])+'</td>';
-    html+='<td class="text-xs">'+costStatus+'<br><b>Archived total:</b> '+totalCost+
-      (!eligible?'<br>Behavioral scores retained; billing-grade cost surfaces omit this condition.':'')+
-      (costReason?'<br><code>'+esc(costReason)+'</code>':'')+'</td>';
-    html+='<td><code>'+esc(p.daaf_git_sha||'Unavailable')+'</code></td>';
-    html+='<td class="text-xs">'+esc(cfgStr)+'</td>';
-    html+='<td>'+countEvidence(p.disk_run_count,'Unavailable')+' / '+countEvidence(p.summary_total_runs,'Unavailable')+
-      (disc?' <span class="badge badge-partial">! mismatch</span>':'')+'</td>';
-    html+='</tr>';
-  });
-  html+='</tbody></table></div>';
-  if(anyDisc){
-    html+='<p class="prov-foot">Highlighted rows: summary.json reports a different run count '+
-      'than the run directories actually on disk. Run-level data on disk is the source of '+
-      'truth; every aggregate on this page is computed from it.</p>';
-  }
-
-  container.innerHTML=html;
-  el('prov-generator-version').textContent=DATA.generator_version||'?';
-}
+/* SECTION 9 (PROVENANCE FOOTER) renderer removed in v3.6.0 (display
+   cleanup). PRECOMPUTED.provenance is still built and embedded for
+   inspection / other consumers; only the rendered section, its TOC link,
+   this renderer, and its sectionRenderers/SECTION_IDS registrations were
+   removed. */
 
 /* =================================================================
    CHART HELPERS
@@ -4501,9 +4505,9 @@ <h2>Provenance</h2>
   pts.forEach(function(p){
     var px=xPos(p.price), py=yPos(p.score);
     var prov=p.provider||"unknown";
-    var fillVar=prov==="anthropic"?"var(--accent-light)":(prov==="openrouter"?"var(--c-partial)":"var(--c-neutral)");
+    var fillVar=prov==="anthropic"?"var(--accent-light)":(prov==="openrouter"?"var(--c-partial)":(prov==="chatgpt-subscription"?"var(--c-pass)":"var(--c-neutral)"));
     var ring=onFrontier[p.model]?' stroke="#f0f4f8" stroke-width="1.2"':'';
-    var tipHtml=esc(p.model)+'<br>'+esc(yLabel)+': <b>'+pct(p.score)+'</b><br>'+esc(priceName)+': <b>'+fmtPoint(p.price)+esc(priceUnit)+'</b>'+
+    var tipHtml=escModel(p.model)+'<br>'+esc(yLabel)+': <b>'+pct(p.score)+'</b><br>'+esc(priceName)+': <b>'+fmtPoint(p.price)+esc(priceUnit)+'</b>'+
       '<br>List rates: $'+p.pm.input.toFixed(2)+' in / $'+p.pm.output.toFixed(2)+' out per 1M tokens'+
       (onFrontier[p.model]?'<br><b>On the efficiency frontier</b>':'');
     /* No <title> children on the points (removed 2026-06-12, user
@@ -4516,6 +4520,12 @@ <h2>Provenance</h2>
         ' L'+px.toFixed(1)+' '+(py+6).toFixed(1)+' L'+(px-6).toFixed(1)+' '+py.toFixed(1)+' Z"'+common+'/>';
     } else if(prov==="anthropic"){
       svg+='<circle cx="'+px.toFixed(1)+'" cy="'+py.toFixed(1)+'" r="5"'+common+'/>';
+    } else if(prov==="chatgpt-subscription"){
+      /* ChatGPT lane (v3.6.0): distinct triangle + --c-pass fill so the
+         chatgpt-subscription GPT points are their own legend category
+         rather than falling through to the generic "other provider" square. */
+      svg+='<path d="M'+px.toFixed(1)+' '+(py-6).toFixed(1)+' L'+(px+6).toFixed(1)+' '+(py+5).toFixed(1)+
+        ' L'+(px-6).toFixed(1)+' '+(py+5).toFixed(1)+' Z"'+common+'/>';
     } else {
       svg+='<rect x="'+(px-4.5).toFixed(1)+'" y="'+(py-4.5).toFixed(1)+'" width="9" height="9"'+common+'/>';
     }
@@ -4545,7 +4555,7 @@ <h2>Provenance</h2>
     while(collides()&&guard<20){ ly+=11; guard++; }
     if(ly>pad.t+ch-2) ly=pad.t+ch-2;
     placed.push({ly:ly,x0:x0,x1:x1});
-    svg+='<text x="'+lx.toFixed(1)+'" y="'+ly.toFixed(1)+'" fill="#b0bcc8" font-size="9.5" text-anchor="'+anchor+'" pointer-events="none">'+esc(lb.model)+'</text>';
+    svg+='<text x="'+lx.toFixed(1)+'" y="'+ly.toFixed(1)+'" fill="#b0bcc8" font-size="9.5" text-anchor="'+anchor+'" pointer-events="none">'+escModel(lb.model)+'</text>';
   });
 
   svg+='</svg>';
@@ -4565,8 +4575,7 @@ <h2>Provenance</h2>
   "cost-performance": renderCostPerf,
   "phases": renderPhaseDives,
   "cases": renderCasesSection,
-  "run-explorer": renderRunExplorer,
-  "provenance": renderProvenance
+  "run-explorer": renderRunExplorer
 };
 var renderedSections={};
 
@@ -4630,7 +4639,7 @@ <h2>Provenance</h2>
    assigning location.hash during scroll would scroll-jump.
    ================================================================= */
 
-var SECTION_IDS=["hero","takeaways","about","leaderboard","cost-performance","phases","cases","run-explorer","provenance"];
+var SECTION_IDS=["hero","takeaways","about","leaderboard","cost-performance","phases","cases","run-explorer"];
 
 /* Scrollspy detection offset is nav-height-aware (geometry rework,
    2026-06-12): the sticky topbar occupies --nav-height + the 3px strip, so
@@ -4720,7 +4729,6 @@ <h2>Provenance</h2>
   el("rx-case").value=caseId||"";
   el("rx-status").value="";
   el("rx-search").value="";
-  el("rx-hide-timeouts").checked=false;
   state.filters.criterion=criterion||"";
   readFilters();
   updateCritChip();
@@ -4783,11 +4791,12 @@ <h2>Provenance</h2>
 };
 
 /* Leaderboard column-header sort: composite | per-phase gid |
-   consistency | timeout | cost. (The "dispatch" key was removed with the
-   Dispatch column, fine-tuning round 3 Wave A.) Clicking the active
-   column flips direction; clicking a new column applies that column's
-   default direction (best-first: descending for rates and the timeout
-   share's worst-first read, ascending for price).
+   consistency | cost. (The "dispatch", "timeout", and "duration" keys were
+   removed — dispatch with its column in fine-tuning round 3 Wave A, timeout
+   with the timeout-blindness change in v3.3.0, duration with its column in
+   v3.7.0.) Clicking the active column flips direction; clicking a new column
+   applies that column's default direction (best-first: descending for rates,
+   ascending for the cost multiplier).
    Performance: when the tier gutter column does not change, rows are
    reordered via DOM moves (no innerHTML rebuild); tier-column transitions
    fall back to full re-render. */
@@ -4818,7 +4827,6 @@ <h2>Provenance</h2>
   var comp=(isHard?PRECOMPUTED.composite_hard:PRECOMPUTED.composite)||{};
   var pmp=PRECOMPUTED.per_model_phase||{};
   var consistency=PRECOMPUTED.consistency||{};
-  var toByModel=PRECOMPUTED.timeout_by_model||{};
   var sortKey=state.lbSort;
   var sortDir=state.lbSortDir;
   var rankOf={};
@@ -4831,7 +4839,6 @@ <h2>Provenance</h2>
   var sortVal=function(m){
     if(sortKey==="cost"){ var b=batteryMult(m); return b?b.mult:null; }
     if(sortKey==="consistency"){ var k=consistency[m]; return(k&&k.rate!=null)?k.rate:null; }
-    if(sortKey==="timeout"){ var t=toByModel[m]; return(t&&t.rate!=null)?t.rate:null; }
     if(sortKey==="composite"){ var e=comp[m]; return e?e.score:null; }
     var cell=(pmp[m]||{})[sortKey];
     return(cell&&cell[rateField]!=null)?cell[rateField]:null;
@@ -4933,7 +4940,6 @@ <h2>Provenance</h2>
     el(id).addEventListener("change",applyFilters);
   });
   el("rx-search").addEventListener("input",applyFilters);
-  el("rx-hide-timeouts").addEventListener("change",applyFilters);
   el("rx-reset").addEventListener("click",resetFilters);
 
   /* TOC: first-click landing fix (2026-06-12, user fine-tuning round).
@@ -5009,15 +5015,18 @@ <h2>Provenance</h2>
   console.log("  Result sets:",DATA.result_sets.length);
   console.log("  Cases:",Object.keys(DATA.cases).length);
   console.log("  Runs:",DATA.runs.length);
-  /* Artifact-shape aware (v3.0.0): single-file embeds DATA.transcripts;
-     bundles carry only transcripts_index (counts, lazy shard fetch) */
+  /* Artifact-shape aware (v3.0.0 inline/lazy; v3.4.0 transcript-less):
+     single-file embeds DATA.transcripts; bundles carry transcripts_index
+     (counts, lazy shard fetch); transcript-less builds carry neither */
   if(DATA.transcripts){
     console.log("  Transcripts:",Object.keys(DATA.transcripts).length,"(inline, single-file artifact)");
-  } else {
+  } else if(DATA.transcripts_index){
     var txIdx=DATA.transcripts_index||{};
     var txMain=0;
     Object.keys(txIdx).forEach(function(k){ txMain+=txIdx[k].n_main||0; });
     console.log("  Transcripts:",txMain,"(lazy, "+Object.keys(txIdx).length+" shards)");
+  } else {
+    console.log("  Transcripts: none (transcript-less build — not included)");
   }
 }
 
diff --git a/benchmarks/tests/test_artifacts_and_preflight.py b/benchmarks/tests/test_artifacts_and_preflight.py
index a7d05139..a825c055 100644
--- a/benchmarks/tests/test_artifacts_and_preflight.py
+++ b/benchmarks/tests/test_artifacts_and_preflight.py
@@ -6,6 +6,7 @@
 
 import io
 import json
+import os
 import shutil
 import sys
 import unittest
@@ -23,11 +24,14 @@
     console_billing_label,
     cost_summary,
     error_measurement_defaults,
+    format_coverage,
     model_manifest_entry,
     nullable_mean,
     nullable_total,
     purity_coverage,
+    run_validity,
 )
+from benchmarks.harness.model_loader import load_models
 from benchmarks.harness.models import (
     ModelConfig,
     PricingConfig,
@@ -198,6 +202,20 @@ def test_null_aware_totals_means_and_accounting_coverage(self):
         self.assertEqual(1.25, summary["avg_cost_usd"])
         self.assertEqual(expected, summary["accounting_coverage"])
 
+    def test_format_coverage_relabels_only_legacy_numeric(self):
+        # FIX-7 (2026-07-29): the display relabel rewrites legacy_numeric ->
+        # numeric_computed_cost for console text while every other accounting
+        # category name passes through unchanged (the persisted keys are a
+        # summary.json contract and must not be renamed).
+        out = format_coverage(
+            {"exact": 2, "scenario_only": 1, "unavailable": 0, "legacy_numeric": 3}
+        )
+        self.assertIn("numeric_computed_cost=3", out)
+        self.assertNotIn("legacy_numeric", out)
+        self.assertIn("exact=2", out)
+        self.assertIn("scenario_only=1", out)
+        self.assertIn("unavailable=0", out)
+
     def test_provider_aware_error_defaults_and_legacy_compatibility(self):
         legacy = legacy_model()
         subscription = luna_model()
@@ -350,6 +368,191 @@ def test_unverifiable_when_transcript_exposes_no_model_field(self):
         )
         self.assertEqual(1, evidence["child_transcript_count"])
 
+    # --- Archive-case regressions: wire_id + non-model markers ---
+    #
+    # The four cases below are the COMPLETE set of runs the purity gate has ever
+    # marked invalid, taken verbatim from the archive (established with
+    # `find /daaf/benchmarks/results -name result.json -exec grep -l
+    # "child_model_purity_failed" {} +`). Three were false positives; the fourth
+    # is a genuine off-model failure and must stay failed.
+
+    def test_archive_case_deepseek_pinned_routing_id_verifies_against_wire_id(self):
+        """results/20260724_212503/runs/dc-01_DeepSeek_V4_Flash_0 — Defect 1.
+
+        Routing id carries the :atlas-cloud/fp8 pin; the CLI wrote only the bare
+        slug. Pre-fix this was 'failed' on the string mismatch alone.
+        """
+        transcript = self._transcript(
+            "agent-deepseek.jsonl",
+            [self._assistant("deepseek/deepseek-v4-flash")],
+        )
+        evidence = child_model_purity(
+            [transcript],
+            "deepseek/deepseek-v4-flash:atlas-cloud/fp8",
+            "deepseek/deepseek-v4-flash",
+        )
+
+        self.assertEqual("verified", evidence["purity_status"])
+        # Routing id and comparison target are BOTH recorded and distinguishable.
+        self.assertEqual(
+            "deepseek/deepseek-v4-flash:atlas-cloud/fp8",
+            evidence["requested_child_model_id"],
+        )
+        self.assertEqual(
+            "deepseek/deepseek-v4-flash",
+            evidence["comparison_target_child_model_id"],
+        )
+        self.assertTrue(evidence["wire_id_declared"])
+        # No observed string was rewritten; the target was declared, not derived.
+        self.assertFalse(evidence["normalization_applied"])
+        self.assertEqual("valid", run_validity(
+            {"child_model_purity": evidence})["status"])
+
+    def test_archive_case_kimi_k3_synthetic_stub_does_not_discard_on_model_run(self):
+        """results/20260721_223921/runs/dc-12_Kimi_K3_2 — Defect 2."""
+        transcript = self._transcript(
+            "agent-k3-a.jsonl",
+            [self._assistant("moonshotai/kimi-k3"), self._assistant("<synthetic>")],
+        )
+        evidence = child_model_purity([transcript], "moonshotai/kimi-k3")
+
+        self.assertEqual("verified", evidence["purity_status"])
+        # The marker is recorded, not silently dropped: raw keeps everything.
+        self.assertEqual(
+            ["moonshotai/kimi-k3", "<synthetic>"],
+            evidence["observed_child_model_ids_raw"],
+        )
+        self.assertEqual(["<synthetic>"], evidence["observed_non_model_markers"])
+        self.assertEqual(
+            ["moonshotai/kimi-k3"], evidence["comparison_child_model_ids"]
+        )
+        self.assertIsNone(evidence["incompleteness_reason"])
+        self.assertEqual("valid", run_validity(
+            {"child_model_purity": evidence})["status"])
+
+    def test_archive_case_kimi_k3_second_run_synthetic_stub_also_verifies(self):
+        """results/20260720_164319/runs/dc-12_Kimi_K3_0 — Defect 2, second run."""
+        transcript = self._transcript(
+            "agent-k3-b.jsonl",
+            [self._assistant("moonshotai/kimi-k3"), self._assistant("<synthetic>")],
+        )
+        evidence = child_model_purity([transcript], "moonshotai/kimi-k3")
+
+        self.assertEqual("verified", evidence["purity_status"])
+        self.assertEqual(["<synthetic>"], evidence["observed_non_model_markers"])
+        self.assertEqual("valid", run_validity(
+            {"child_model_purity": evidence})["status"])
+
+    def test_archive_case_sonnet_genuine_off_model_child_still_fails(self):
+        """_quarantine_2026-07-24/.../dc-02_Sonnet_4.6_0 — the real failure.
+
+        This is the anti-regression guard: neither fix may weaken the gate.
+        """
+        transcript = self._transcript(
+            "agent-sonnet.jsonl",
+            [self._assistant("claude-opus-4-8")],
+        )
+        evidence = child_model_purity([transcript], "claude-sonnet-4-6")
+
+        self.assertEqual("failed", evidence["purity_status"])
+        self.assertEqual([], evidence["observed_non_model_markers"])
+        self.assertEqual(
+            ["claude-opus-4-8"], evidence["comparison_child_model_ids"]
+        )
+        self.assertEqual("invalid", run_validity(
+            {"child_model_purity": evidence})["status"])
+
+    def test_marker_only_transcript_is_unverifiable_not_failed(self):
+        """No model-identity evidence in either direction is an absence, not a
+        contradiction — so it must not gate the run invalid."""
+        transcript = self._transcript(
+            "agent-stub-only.jsonl", [self._assistant("<synthetic>")]
+        )
+        evidence = child_model_purity([transcript], "moonshotai/kimi-k3")
+
+        self.assertEqual("unverifiable", evidence["purity_status"])
+        self.assertEqual(
+            "child_transcripts_expose_only_non_model_markers:<synthetic>",
+            evidence["incompleteness_reason"],
+        )
+        self.assertEqual([], evidence["comparison_child_model_ids"])
+        self.assertEqual(["<synthetic>"], evidence["observed_non_model_markers"])
+        self.assertEqual("valid", run_validity(
+            {"child_model_purity": evidence})["status"])
+
+    def test_bare_slug_model_without_wire_id_behaves_exactly_as_before(self):
+        """Omitting wire_model_id must be a no-op for every unpinned entry."""
+        transcript = self._transcript(
+            "agent-bare.jsonl", [self._assistant("moonshotai/kimi-k3")]
+        )
+        two_arg = child_model_purity([transcript], "moonshotai/kimi-k3")
+        explicit = child_model_purity(
+            [transcript], "moonshotai/kimi-k3", "moonshotai/kimi-k3"
+        )
+
+        self.assertEqual(two_arg, explicit)
+        self.assertEqual("verified", two_arg["purity_status"])
+        self.assertFalse(two_arg["wire_id_declared"])
+        self.assertEqual(
+            two_arg["requested_child_model_id"],
+            two_arg["comparison_target_child_model_id"],
+        )
+        # Pre-fix identity between raw and comparison lists is preserved when
+        # no markers are present.
+        self.assertEqual(
+            two_arg["observed_child_model_ids_raw"],
+            two_arg["comparison_child_model_ids"],
+        )
+
+    def test_wire_id_mismatch_against_declared_target_still_fails(self):
+        """A declared wire_id narrows the target; it must not become permissive."""
+        transcript = self._transcript(
+            "agent-wrong-wire.jsonl", [self._assistant("z-ai/glm-5.2")]
+        )
+        evidence = child_model_purity(
+            [transcript], "z-ai/glm-5.1:atlas-cloud/fp8", "z-ai/glm-5.1"
+        )
+
+        self.assertEqual("failed", evidence["purity_status"])
+
+    def test_registry_wire_ids_cover_every_pinned_entry(self):
+        """models.yaml: every :pinned id declares a wire_id; no bare slug does.
+
+        Exercises the real loader (not a hand-rolled YAML read) so the test also
+        proves wire_id survives load_models' provider env-override merging.
+        OpenRouter creds are faked because load_models SKIPS openrouter entries
+        when they are absent — without them the pinned entries would never be
+        loaded and this assertion would pass vacuously.
+        """
+        fake_creds = {
+            "OPENROUTER_BASE_URL": "https://example.invalid/api",
+            "OPENROUTER_AUTH_TOKEN": "not-a-real-token",
+        }
+        with patch.dict(os.environ, fake_creds):
+            models = load_models(Path("/daaf/benchmarks/config/models.yaml"))
+
+        pinned = [k for k, v in models.items() if ":" in v.id]
+        self.assertEqual(
+            10, len(pinned),
+            f"expected 10 provider-pinned registry entries, got {pinned}",
+        )
+        for key, config in models.items():
+            if ":" in config.id:
+                self.assertIsNotNone(
+                    config.wire_id, f"pinned entry {key} lacks wire_id"
+                )
+                self.assertNotIn(":", config.wire_id, f"{key} wire_id still pinned")
+                self.assertEqual(
+                    config.id.split(":", 1)[0], config.wire_id,
+                    f"{key} wire_id is not the bare slug of its routing id",
+                )
+            else:
+                # Unpinned entries rely on the default, keeping them untouched.
+                self.assertIsNone(config.wire_id, f"{key} should not declare wire_id")
+            self.assertEqual(
+                config.wire_id or config.id, config.comparison_model_id
+            )
+
     def test_purity_coverage_preserves_failed_and_unverifiable_states(self):
         records = [
             {"child_model_purity": {"purity_status": "verified"}},
@@ -523,7 +726,7 @@ def test_all_runner_help_paths_are_network_free(self):
             run_skill_routing,
         ):
             with self.subTest(module=module.__name__):
-                with patch("benchmarks.harness.route_provenance.urlopen") as network, \
+                with patch("benchmarks.harness.route_provenance.build_opener") as network, \
                         patch.object(module, "load_models") as load, \
                         patch.object(module, "execute_run") as execute, \
                         patch.object(sys, "argv", [str(module.__file__), "--help"]):
diff --git a/benchmarks/tests/test_chatgpt_route.py b/benchmarks/tests/test_chatgpt_route.py
index 8b922e2c..9b813019 100644
--- a/benchmarks/tests/test_chatgpt_route.py
+++ b/benchmarks/tests/test_chatgpt_route.py
@@ -1,4 +1,8 @@
-"""Focused deterministic tests for ChatGPT-subscription model routing."""
+"""Focused deterministic tests for ChatGPT-subscription model routing.
+
+Synthetic health fixtures are schema/provenance contract evidence only; they make
+no claim that a provider accepts or serves any requested tier.
+"""
 
 import argparse
 import json
@@ -7,6 +11,7 @@
 from pathlib import Path
 from unittest.mock import Mock, patch
 
+from benchmarks.harness import route_provenance
 from benchmarks.harness.cost_estimator import (
     LUNA_LONG_CONTEXT_RATES,
     LUNA_LONG_CONTEXT_THRESHOLD,
@@ -18,11 +23,13 @@
     ModelConfig,
     RouteProvenance,
     RunConfig,
+    RunResult,
     TestCase as BenchmarkCase,
 )
 from benchmarks.harness.route_provenance import (
     PROVENANCE_ALLOWLIST,
     RouteContractError,
+    _validate_gpt_service_tier_block,
     fetch_route_provenance,
     preflight_models,
     safe_provenance_dict,
@@ -74,11 +81,30 @@
     "kimi-k3",
 }
 
+# Concurrent OpenRouter keys added after the PREEXISTING snapshot. Kept separate
+# from the G1R Kimi K3 addition so both post-snapshot registry changes remain
+# explicit in the preexisting-key identity assertion.
+POST_SNAPSHOT_OPENROUTER_ADDITIONS = {
+    "gemini-35-flash",
+    "gemini-36-flash",
+    "gemini-35-flash-lite",
+    "gemini-25-pro",
+}
+
+# Anthropic keys added after the PREEXISTING snapshot (opus-5 added 2026-07-25
+# for the Opus 5 evaluation). Kept separate, mirroring G1R_OPENROUTER_ADDITIONS,
+# so the preexisting identity assertion keeps documenting exactly what predates
+# each later addition.
+ANTHROPIC_ADDITIONS = {
+    "opus-5",
+}
+
 
 def coherent_env(**overrides):
     env = {
         "DAAF_PROVIDER_SHIM": "openai",
         "SHIM_BACKEND_MODE": "chatgpt",
+        "CLAUDE_CODE_DISABLE_FAST_MODE": "1",
         "SHIM_PORT": "4141",
         "ANTHROPIC_BASE_URL": "http://localhost:4141",
     }
@@ -86,28 +112,65 @@ def coherent_env(**overrides):
     return env
 
 
+def healthy_tier_block(backend_mode="chatgpt", **overrides):
+    payload = {
+        "backend_mode": backend_mode,
+        "requested_tier_vocabulary": "priority",
+        "policy": {
+            "status": "ok",
+            "backend_mode": backend_mode,
+            "enabled": False,
+            "effective": False,
+        },
+        "native_fast_disabled": True,
+        "latest_terminal": None,
+    }
+    payload.update(overrides)
+    return payload
+
+
+def healthy_latest_terminal(**overrides):
+    payload = {
+        "model": "gpt-5.6-sol",
+        "requested_service_tier": "priority",
+        "requested_source": "shim_global",
+        "served_service_tier": "default",
+        "completed_at": "2026-07-25T18:00:00Z",
+    }
+    payload.update(overrides)
+    return payload
+
+
 def healthy_payload(**overrides):
     payload = {
+        "service": "daaf-anthropic-openai-shim",
         "status": "ok",
         "backend": "https://chatgpt.com/backend-api/codex",
         "backend_mode": "chatgpt",
         "codex_home_present": True,
-        "version": "1.2.5",
+        "version": "1.3.9",
         "sanitize_tools": True,
         "reasoning_effort": "high",
         "text_verbosity": "high",
+        "gpt_service_tier": healthy_tier_block(),
     }
     payload.update(overrides)
     return payload
 
 
 class FakeResponse:
-    def __init__(self, payload, status=200):
+    def __init__(self, payload, status=200, raw_body=None):
         self.status = status
         self.payload = payload
+        self.raw_body = raw_body
 
-    def read(self):
-        return json.dumps(self.payload).encode("utf-8")
+    def read(self, limit=None):
+        self.read_limit = limit
+        if self.raw_body is not None:
+            raw = self.raw_body
+        else:
+            raw = json.dumps(self.payload).encode("utf-8")
+        return raw[:limit] if limit is not None else raw
 
     def __enter__(self):
         return self
@@ -131,7 +194,11 @@ def test_preexisting_model_keys_are_identical(self):
         models = self.load_all()
         self.assertEqual(
             PREEXISTING_MODEL_KEYS,
-            set(models) - CHATGPT_SUBSCRIPTION_KEYS - G1R_OPENROUTER_ADDITIONS,
+            set(models)
+            - CHATGPT_SUBSCRIPTION_KEYS
+            - G1R_OPENROUTER_ADDITIONS
+            - POST_SNAPSHOT_OPENROUTER_ADDITIONS
+            - ANTHROPIC_ADDITIONS,
         )
 
     def test_explicit_key_selects_chatgpt_luna(self):
@@ -157,9 +224,11 @@ def test_explicit_key_selects_chatgpt_luna(self):
 
     def test_provider_filter_adds_chatgpt_without_changing_existing_counts(self):
         models = self.load_all()
-        self.assertEqual(8, len(filter_models(models, provider="anthropic")))
-        # 17 preexisting + kimi-k3 (added 2026-07-17 for the G1R K3 battery).
-        self.assertEqual(18, len(filter_models(models, provider="openrouter")))
+        self.assertEqual(34, len(models))
+        # 8 preexisting + opus-5 (added 2026-07-25 for the Opus 5 evaluation).
+        self.assertEqual(9, len(filter_models(models, provider="anthropic")))
+        # 17 preexisting + Kimi K3 + four later Gemini additions.
+        self.assertEqual(22, len(filter_models(models, provider="openrouter")))
         # Luna + Terra + Sol on the ChatGPT-subscription lane (2026-07-17).
         self.assertEqual(3, len(filter_models(models, provider="chatgpt-subscription")))
 
@@ -184,39 +253,52 @@ def test_kimi_k3_entry_is_openrouter_with_full_purity_pinning(self):
         ):
             self.assertEqual("moonshotai/kimi-k3", entry.env_overrides[selector])
 
-    def test_terra_and_sol_chatgpt_entries_mirror_luna(self):
+    def test_chatgpt_entries_preserve_tier_aliases_without_flatten_override(self):
         models = self.load_all()
         expected = {
+            "gpt-56-luna-chatgpt": "gpt-5.6-luna",
             "gpt-56-terra-chatgpt": "gpt-5.6-terra",
             "gpt-56-sol-chatgpt": "gpt-5.6-sol",
         }
-        for key, wire_id in expected.items():
-            selected = filter_models(models, [key])
-            self.assertEqual(1, len(selected), key)
-            entry = selected[0]
-            self.assertEqual(wire_id, entry.id)
-            self.assertEqual("chatgpt-subscription", entry.provider)
-            self.assertEqual(370_000, entry.context_window_tokens)
-            self.assertEqual("high", entry.effort_level)
-            self.assertEqual("not_separately_billed", entry.actual_billing_treatment)
-            prices = entry.api_equivalent_pricing
-            self.assertEqual(LUNA_LONG_CONTEXT_THRESHOLD, prices["threshold_input_tokens"])
-            self.assertEqual(LUNA_SHORT_CONTEXT_RATES, prices["short_context"])
-            self.assertEqual(LUNA_LONG_CONTEXT_RATES, prices["long_context"])
-            # Purity selectors all pinned to the bare wire ID.
-            for selector in (
-                "ANTHROPIC_DEFAULT_OPUS_MODEL",
-                "ANTHROPIC_DEFAULT_SONNET_MODEL",
-                "CLAUDE_CODE_SUBAGENT_MODEL",
-            ):
-                self.assertEqual(wire_id, entry.env_overrides[selector])
-            # Fail-closed local route overlay is applied identically to Luna.
-            self.assertEqual(
-                "http://127.0.0.1:4141", entry.env_overrides["ANTHROPIC_BASE_URL"]
-            )
-            self.assertEqual(
-                "daaf-shim-local", entry.env_overrides["ANTHROPIC_AUTH_TOKEN"]
-            )
+        for key, parent_id in expected.items():
+            with self.subTest(key=key):
+                selected = filter_models(models, [key])
+                self.assertEqual(1, len(selected))
+                entry = selected[0]
+                self.assertEqual(parent_id, entry.id)
+                self.assertEqual("chatgpt-subscription", entry.provider)
+                self.assertEqual(370_000, entry.context_window_tokens)
+                self.assertEqual("high", entry.effort_level)
+                self.assertEqual("not_separately_billed", entry.actual_billing_treatment)
+                prices = entry.api_equivalent_pricing
+                self.assertEqual(
+                    LUNA_LONG_CONTEXT_THRESHOLD, prices["threshold_input_tokens"]
+                )
+                self.assertEqual(LUNA_SHORT_CONTEXT_RATES, prices["short_context"])
+                self.assertEqual(LUNA_LONG_CONTEXT_RATES, prices["long_context"])
+                # Keep semantic tier selection operative while both aliases resolve
+                # to the same parent model for the child-model purity condition.
+                self.assertEqual(
+                    parent_id,
+                    entry.env_overrides["ANTHROPIC_DEFAULT_OPUS_MODEL"],
+                )
+                self.assertEqual(
+                    parent_id,
+                    entry.env_overrides["ANTHROPIC_DEFAULT_SONNET_MODEL"],
+                )
+                self.assertNotIn(
+                    "CLAUDE_CODE_SUBAGENT_MODEL", entry.env_overrides
+                )
+                # Fail-closed local route overlay is applied identically to all three.
+                self.assertEqual(
+                    "http://127.0.0.1:4141",
+                    entry.env_overrides["ANTHROPIC_BASE_URL"],
+                )
+                self.assertEqual(
+                    "daaf-shim-local",
+                    entry.env_overrides["ANTHROPIC_AUTH_TOKEN"],
+                )
+                self.assertEqual("", entry.env_overrides["ANTHROPIC_API_KEY"])
 
     def test_terra_and_sol_pass_batch_route_preflight(self):
         models = self.load_all()
@@ -232,13 +314,13 @@ def test_terra_and_sol_pass_batch_route_preflight(self):
         self.assertEqual(1, opener.call_count)
 
     def test_loading_registry_does_not_call_network(self):
-        with patch("benchmarks.harness.route_provenance.urlopen") as network:
+        with patch("benchmarks.harness.route_provenance.build_opener") as network:
             self.load_all()
         network.assert_not_called()
 
     def test_help_does_not_call_network(self):
         parser = argparse.ArgumentParser()
-        with patch("benchmarks.harness.route_provenance.urlopen") as network:
+        with patch("benchmarks.harness.route_provenance.build_opener") as network:
             add_model_args(parser)
             with self.assertRaises(SystemExit) as stopped:
                 parser.parse_args(["--help"])
@@ -247,6 +329,55 @@ def test_help_does_not_call_network(self):
 
 
 class RouteContractTests(unittest.TestCase):
+    def test_default_health_transport_is_loopback_no_proxy_no_redirect_and_bounded(self):
+        response = FakeResponse(healthy_payload())
+
+        class NetworkOpener:
+            def open(self, request, timeout):
+                self.request = request
+                self.timeout = timeout
+                return response
+
+        network = NetworkOpener()
+        with patch.object(route_provenance, "build_opener", return_value=network) as build:
+            provenance = fetch_route_provenance(environ=coherent_env(), timeout=2.5)
+        self.assertEqual("chatgpt", provenance.backend_mode)
+        self.assertEqual(
+            "http://127.0.0.1:4141/health", network.request.full_url
+        )
+        self.assertEqual(2.5, network.timeout)
+        self.assertEqual(
+            route_provenance.HEALTH_BODY_LIMIT + 1, response.read_limit
+        )
+        handlers = build.call_args.args
+        self.assertTrue(
+            any(
+                isinstance(item, route_provenance.ProxyHandler)
+                and item.proxies == {}
+                for item in handlers
+            )
+        )
+        redirect = next(
+            item
+            for item in handlers
+            if isinstance(item, route_provenance._RejectRedirects)
+        )
+        self.assertIsNone(
+            redirect.redirect_request(
+                None, None, 302, "Found", {}, "http://example.invalid"
+            )
+        )
+
+    def test_oversized_health_body_is_rejected_before_json_decode(self):
+        oversized = b"{" + b"x" * route_provenance.HEALTH_BODY_LIMIT
+        with self.assertRaisesRegex(RouteContractError, "16 KiB"):
+            fetch_route_provenance(
+                environ=coherent_env(),
+                opener=lambda *args, **kwargs: FakeResponse(
+                    healthy_payload(), raw_body=oversized
+                ),
+            )
+
     def test_route_coherence_failures(self):
         cases = [
             coherent_env(DAAF_PROVIDER_SHIM="off"),
@@ -262,8 +393,45 @@ def test_route_coherence_failures(self):
                         opener=lambda *args, **kwargs: FakeResponse(healthy_payload()),
                     )
 
+    def test_exact_gpt_ambient_boundary_fails_before_health_or_provider_execution(self):
+        controls = {
+            "DAAF_PROVIDER_SHIM": (None, "", "OpenAI", " openai", "openai ", "off"),
+            "SHIM_BACKEND_MODE": (None, "", "ChatGPT", " chatgpt", "chatgpt ", "openai"),
+            "CLAUDE_CODE_DISABLE_FAST_MODE": (None, "", "0", "TRUE", " 1", "1 ", "01"),
+        }
+        for name, malformed_values in controls.items():
+            for value in malformed_values:
+                with self.subTest(control=name, value=value):
+                    env = coherent_env()
+                    if value is None:
+                        env.pop(name)
+                    else:
+                        env[name] = value
+                    opener = Mock(return_value=FakeResponse(healthy_payload()))
+                    with self.assertRaises(RouteContractError):
+                        fetch_route_provenance(environ=env, opener=opener)
+                    opener.assert_not_called()
+
+    def test_native_anthropic_only_selection_does_not_inherit_gpt_boundary(self):
+        model = ModelConfig(
+            "claude-opus-4-8", "Opus 4.8", provider="anthropic", key="opus"
+        )
+        opener = Mock()
+        snapshots = preflight_models(
+            [model],
+            environ={
+                "DAAF_PROVIDER_SHIM": "OpenAI",
+                "SHIM_BACKEND_MODE": " CHATGPT ",
+                "CLAUDE_CODE_DISABLE_FAST_MODE": "0",
+            },
+            opener=opener,
+        )
+        self.assertEqual({}, snapshots)
+        opener.assert_not_called()
+
     def test_health_contract_failures(self):
         bad_payloads = [
+            healthy_payload(service="unrelated-service"),
             healthy_payload(status="degraded"),
             healthy_payload(backend_mode="openai"),
             healthy_payload(sanitize_tools=False),
@@ -279,6 +447,217 @@ def test_health_contract_failures(self):
                         opener=lambda *args, payload=payload, **kwargs: FakeResponse(payload),
                     )
 
+    def test_gpt_service_tier_rejects_missing_extra_and_route_mismatch(self):
+        extra_block = healthy_tier_block(extra="not-allowed")
+        missing_block_field = healthy_tier_block()
+        del missing_block_field["latest_terminal"]
+        wrong_backend = healthy_tier_block(backend_mode="openai")
+        wrong_vocabulary = healthy_tier_block(requested_tier_vocabulary="fast")
+        missing_native_flag = healthy_tier_block()
+        del missing_native_flag["native_fast_disabled"]
+        bad_payloads = [
+            healthy_payload(gpt_service_tier=None),
+            healthy_payload(gpt_service_tier=extra_block),
+            healthy_payload(gpt_service_tier=missing_block_field),
+            healthy_payload(gpt_service_tier=wrong_backend),
+            healthy_payload(gpt_service_tier=wrong_vocabulary),
+            healthy_payload(gpt_service_tier=missing_native_flag),
+            *(
+                healthy_payload(
+                    gpt_service_tier=healthy_tier_block(native_fast_disabled=value)
+                )
+                for value in (False, 0, 1, "true", None, [], {})
+            ),
+        ]
+        for payload in bad_payloads:
+            with self.subTest(payload=payload):
+                with self.assertRaises(RouteContractError):
+                    fetch_route_provenance(
+                        environ=coherent_env(),
+                        opener=lambda *args, payload=payload, **kwargs: FakeResponse(payload),
+                    )
+
+    def test_gpt_service_tier_rejects_duplicate_nested_json_key(self):
+        payload = healthy_payload()
+        rendered = json.dumps(payload).encode("utf-8")
+        marker = b'"gpt_service_tier": {'
+        duplicated = rendered.replace(
+            marker,
+            marker + b'"backend_mode": "chatgpt", ',
+            1,
+        )
+        with self.assertRaises(RouteContractError):
+            fetch_route_provenance(
+                environ=coherent_env(),
+                opener=lambda *args, **kwargs: FakeResponse(
+                    payload, raw_body=duplicated
+                ),
+            )
+
+    def test_gpt_service_tier_rejects_malformed_or_incoherent_policy(self):
+        bad_policies = [
+            {
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": False,
+            },
+            {
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": False,
+                "effective": False,
+                "extra": None,
+            },
+            {
+                "status": "unknown",
+                "backend_mode": None,
+                "enabled": False,
+                "effective": False,
+            },
+            {
+                "status": "invalid",
+                "backend_mode": "chatgpt",
+                "enabled": False,
+                "effective": False,
+            },
+            {
+                "status": "missing",
+                "backend_mode": None,
+                "enabled": True,
+                "effective": False,
+            },
+            {
+                "status": "ok",
+                "backend_mode": None,
+                "enabled": False,
+                "effective": False,
+            },
+            {
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": True,
+                "effective": False,
+            },
+            {
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": False,
+                "effective": True,
+            },
+            {
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": 1,
+                "effective": True,
+            },
+        ]
+        for policy in bad_policies:
+            payload = healthy_payload(
+                gpt_service_tier=healthy_tier_block(policy=policy)
+            )
+            with self.subTest(policy=policy):
+                with self.assertRaises(RouteContractError):
+                    fetch_route_provenance(
+                        environ=coherent_env(),
+                        opener=lambda *args, payload=payload, **kwargs: FakeResponse(payload),
+                    )
+
+    def test_gpt_service_tier_rejects_malformed_latest_terminal(self):
+        missing_latest_field = healthy_latest_terminal()
+        del missing_latest_field["completed_at"]
+        bad_latest_values = [
+            "not-an-object",
+            missing_latest_field,
+            healthy_latest_terminal(extra="not-allowed"),
+            healthy_latest_terminal(model="bad model"),
+            healthy_latest_terminal(requested_service_tier="fast"),
+            healthy_latest_terminal(requested_service_tier=" priority"),
+            healthy_latest_terminal(requested_source="policy"),
+            healthy_latest_terminal(requested_source=["shim_global"]),
+            healthy_latest_terminal(requested_source="Shim_Global"),
+            healthy_latest_terminal(requested_source=" shim_global"),
+            healthy_latest_terminal(requested_service_tier=None, requested_source="shim_global"),
+            healthy_latest_terminal(requested_source="none"),
+            healthy_latest_terminal(served_service_tier="FAST"),
+            healthy_latest_terminal(served_service_tier={"tier": "fast"}),
+            healthy_latest_terminal(served_service_tier="fast "),
+            healthy_latest_terminal(completed_at="2026-02-30T18:00:00Z"),
+            healthy_latest_terminal(completed_at="2026-07-25T18:00:00.000Z"),
+        ]
+        for latest in bad_latest_values:
+            payload = healthy_payload(
+                gpt_service_tier=healthy_tier_block(latest_terminal=latest)
+            )
+            with self.subTest(latest=latest):
+                with self.assertRaises(RouteContractError):
+                    fetch_route_provenance(
+                        environ=coherent_env(),
+                        opener=lambda *args, payload=payload, **kwargs: FakeResponse(payload),
+                    )
+
+    def test_reusable_tier_validator_rejects_legacy_requested_fast_for_both_backends(self):
+        for backend in ("chatgpt", "openai"):
+            with self.subTest(backend=backend):
+                block = healthy_tier_block(
+                    backend_mode=backend,
+                    requested_tier_vocabulary="fast",
+                )
+                with self.assertRaisesRegex(RouteContractError, "requested vocabulary"):
+                    _validate_gpt_service_tier_block(block, backend)
+
+    def test_reusable_tier_validator_accepts_openai_priority_vocabulary(self):
+        block = healthy_tier_block(
+            backend_mode="openai",
+            policy={
+                "status": "ok",
+                "backend_mode": "openai",
+                "enabled": True,
+                "effective": True,
+            },
+            latest_terminal=healthy_latest_terminal(
+                requested_service_tier="priority",
+                served_service_tier="priority",
+            ),
+        )
+        safe = _validate_gpt_service_tier_block(block, "openai")
+        self.assertEqual("priority", safe["gpt_requested_tier_vocabulary"])
+        self.assertTrue(safe["gpt_policy_enabled"])
+        self.assertTrue(safe["gpt_policy_effective"])
+        self.assertNotIn("latest_terminal", safe)
+
+        null_terminal = healthy_latest_terminal(
+            requested_service_tier=None,
+            requested_source="none",
+            served_service_tier=None,
+        )
+        safe = _validate_gpt_service_tier_block(
+            healthy_tier_block(
+                backend_mode="openai", latest_terminal=null_terminal
+            ),
+            "openai",
+        )
+        self.assertEqual("priority", safe["gpt_requested_tier_vocabulary"])
+
+    def test_route_provenance_keeps_legacy_positional_constructor_order(self):
+        legacy = RouteProvenance(
+            "chatgpt_subscription_shim",
+            "chatgpt-subscription",
+            "http://127.0.0.1:4141",
+            "chatgpt",
+            "https://chatgpt.com/backend-api/codex",
+            "1.3.7",
+            True,
+            "deployed_default",
+            True,
+            "high",
+            "high",
+            "2026-07-25T18:00:00+00:00",
+        )
+        self.assertEqual("2026-07-25T18:00:00+00:00", legacy.captured_at)
+        self.assertIsNone(legacy.gpt_requested_tier_vocabulary)
+        self.assertIsNone(legacy.gpt_policy_status)
+        self.assertIsNone(legacy.native_fast_disabled)
+
     def test_configured_shim_port_is_canonicalized(self):
         env = coherent_env(
             SHIM_PORT="4242",
@@ -290,9 +669,24 @@ def test_configured_shim_port_is_canonicalized(self):
         self.assertEqual("http://127.0.0.1:4242/health", opener.call_args.args[0])
 
     def test_success_returns_secret_safe_allowlist(self):
+        tier_block = healthy_tier_block(
+            policy={
+                "status": "ok",
+                "backend_mode": "chatgpt",
+                "enabled": True,
+                "effective": True,
+            },
+            latest_terminal=healthy_latest_terminal(
+                model="gpt-5.6-sol-terminal-only",
+                # Exact served `fast` is compatibility-only terminal evidence;
+                # requested vocabulary remains canonical `priority`.
+                served_service_tier="fast",
+            ),
+        )
         payload = healthy_payload(
             access_token="must-not-survive",
             auth_json="must-not-survive-either",
+            gpt_service_tier=tier_block,
         )
         provenance = fetch_route_provenance(
             environ=coherent_env(),
@@ -302,9 +696,33 @@ def test_success_returns_secret_safe_allowlist(self):
         self.assertEqual(PROVENANCE_ALLOWLIST, set(safe))
         rendered = json.dumps(safe)
         self.assertNotIn("must-not-survive", rendered)
+        self.assertNotIn("latest_terminal", safe)
+        self.assertNotIn("served_service_tier", safe)
+        self.assertNotIn("gpt-5.6-sol-terminal-only", rendered)
         self.assertEqual("http://127.0.0.1:4141", safe["endpoint_origin"])
         self.assertTrue(safe["sanitizer_enabled"])
         self.assertTrue(safe["auth_store_readable"])
+        self.assertEqual("priority", safe["gpt_requested_tier_vocabulary"])
+        self.assertEqual("ok", safe["gpt_policy_status"])
+        self.assertEqual("chatgpt", safe["gpt_policy_backend_mode"])
+        self.assertTrue(safe["gpt_policy_enabled"])
+        self.assertTrue(safe["gpt_policy_effective"])
+        self.assertTrue(safe["native_fast_disabled"])
+
+        # A valid shim-global terminal is contract-checked above but cannot become
+        # evidence about this run's served tier, billing, performance, or identity.
+        run = RunResult("tier-provenance", "gpt-5.6-sol", "Sol", 0)
+        run.route_provenance = provenance
+        run_record = run.to_dict()
+        self.assertNotIn("latest_terminal", run_record["route_provenance"])
+        self.assertNotIn("served_service_tier", run_record["route_provenance"])
+        self.assertIsNone(
+            run_record["model_identity"]["backend_confirmed_model_id"]
+        )
+        self.assertEqual("unknown", run_record["actual_billing"]["charge_status"])
+        self.assertIsNone(
+            run_record["actual_billing"]["actual_marginal_charge_usd"]
+        )
 
     def test_batch_preflight_fetches_health_once_for_chatgpt_models(self):
         models = [
@@ -325,25 +743,97 @@ def setUp(self):
             "OPENROUTER_AUTH_TOKEN": "test-only-placeholder",
         }
         with patch.dict(os.environ, env, clear=False):
-            self.model = load_models(MODELS_FILE)["gpt-56-luna-chatgpt"]
+            models = load_models(MODELS_FILE)
+        self.parent_ids = {
+            "gpt-56-luna-chatgpt": "gpt-5.6-luna",
+            "gpt-56-terra-chatgpt": "gpt-5.6-terra",
+            "gpt-56-sol-chatgpt": "gpt-5.6-sol",
+        }
+        self.models = {key: models[key] for key in self.parent_ids}
+        self.explicit_flatten_model = models["gpt-56-sol"]
         self.case = BenchmarkCase(
             id="route-test",
             category="test",
             prompt="No live request is launched in this unit test.",
             expected={},
         )
-        self.config = RunConfig(self.case, self.model, 0)
 
-    def test_model_purity_and_context_are_applied_to_child_only(self):
+    def test_tier_aliases_and_context_are_applied_to_each_child_environment(self):
+        route = RouteProvenance(provider="chatgpt-subscription")
+
+        for key, parent_id in self.parent_ids.items():
+            with self.subTest(key=key):
+                result_payload = {
+                    "type": "result",
+                    "subtype": "success",
+                    "session_id": "fake-session",
+                    "result": "ok",
+                    "total_cost_usd": 123.45,
+                    "num_turns": 1,
+                    "modelUsage": {
+                        parent_id: {
+                            "inputTokens": 10,
+                            "outputTokens": 2,
+                            "cacheReadInputTokens": 0,
+                            "cacheCreationInputTokens": 0,
+                        }
+                    },
+                }
+                process = Mock()
+                process.communicate.return_value = (json.dumps(result_payload), "")
+                process.returncode = 0
+                config = RunConfig(self.case, self.models[key], 0)
+
+                # A conflicting ambient sentinel proves the executor scrubs the
+                # flatten selector before applying this entry's two tier aliases.
+                ambient = {
+                    "SHIM_PORT": "4141",
+                    "CLAUDE_CODE_SUBAGENT_MODEL": "ambient-must-not-survive",
+                }
+                with patch.dict(os.environ, ambient, clear=True):
+                    with patch(
+                        "benchmarks.harness.executor.revalidate_route",
+                        return_value=route,
+                    ):
+                        with patch(
+                            "benchmarks.harness.executor.subprocess.Popen",
+                            return_value=process,
+                        ) as popen:
+                            result = execute_run(config)
+
+                child_env = popen.call_args.kwargs["env"]
+                self.assertEqual(
+                    parent_id, child_env["ANTHROPIC_DEFAULT_OPUS_MODEL"]
+                )
+                self.assertEqual(
+                    parent_id, child_env["ANTHROPIC_DEFAULT_SONNET_MODEL"]
+                )
+                self.assertNotIn("CLAUDE_CODE_SUBAGENT_MODEL", child_env)
+                self.assertEqual(
+                    "370000", child_env["CLAUDE_CODE_MAX_CONTEXT_TOKENS"]
+                )
+                self.assertEqual(parent_id, popen.call_args.args[0][4])
+                self.assertIsNone(result.total_cost_usd)
+                self.assertEqual(
+                    [parent_id], result.model_identity.claude_cli_model_usage_ids
+                )
+                self.assertIsNone(result.model_identity.backend_confirmed_model_id)
+                self.assertEqual("partial", result.usage_observed.completeness)
+                self.assertIsNotNone(result.start_time_utc)
+                self.assertIsNotNone(result.end_time_utc)
+                self.assertIsNotNone(result.wall_clock_seconds)
+
+    def test_explicit_model_flatten_override_is_reapplied_after_ambient_scrub(self):
+        model = self.explicit_flatten_model
         result_payload = {
             "type": "result",
             "subtype": "success",
             "session_id": "fake-session",
             "result": "ok",
-            "total_cost_usd": 123.45,
+            "total_cost_usd": 0.01,
             "num_turns": 1,
             "modelUsage": {
-                "gpt-5.6-luna": {
+                model.id: {
                     "inputTokens": 10,
                     "outputTokens": 2,
                     "cacheReadInputTokens": 0,
@@ -354,36 +844,39 @@ def test_model_purity_and_context_are_applied_to_child_only(self):
         process = Mock()
         process.communicate.return_value = (json.dumps(result_payload), "")
         process.returncode = 0
-        route = RouteProvenance(provider="chatgpt-subscription")
+        config = RunConfig(self.case, model, 0)
+        ambient = {"CLAUDE_CODE_SUBAGENT_MODEL": "ambient-must-not-survive"}
 
-        with patch("benchmarks.harness.executor.revalidate_route", return_value=route):
-            with patch("benchmarks.harness.executor.subprocess.Popen", return_value=process) as popen:
-                result = execute_run(self.config)
+        with patch.dict(os.environ, ambient, clear=True):
+            with patch("benchmarks.harness.executor.revalidate_route"):
+                with patch(
+                    "benchmarks.harness.executor.subprocess.Popen",
+                    return_value=process,
+                ) as popen:
+                    execute_run(config)
 
         child_env = popen.call_args.kwargs["env"]
-        for selector in (
-            "ANTHROPIC_DEFAULT_OPUS_MODEL",
-            "ANTHROPIC_DEFAULT_SONNET_MODEL",
-            "CLAUDE_CODE_SUBAGENT_MODEL",
-        ):
-            self.assertEqual("gpt-5.6-luna", child_env[selector])
-        self.assertEqual("370000", child_env["CLAUDE_CODE_MAX_CONTEXT_TOKENS"])
-        self.assertEqual("gpt-5.6-luna", popen.call_args.args[0][4])
-        self.assertIsNone(result.total_cost_usd)
-        self.assertEqual(["gpt-5.6-luna"], result.model_identity.claude_cli_model_usage_ids)
-        self.assertIsNone(result.model_identity.backend_confirmed_model_id)
-        self.assertEqual("partial", result.usage_observed.completeness)
-        self.assertIsNotNone(result.start_time_utc)
-        self.assertIsNotNone(result.end_time_utc)
-        self.assertIsNotNone(result.wall_clock_seconds)
+        self.assertEqual(
+            "openai/gpt-5.6-sol",
+            child_env["CLAUDE_CODE_SUBAGENT_MODEL"],
+        )
+        self.assertEqual(
+            "openai/gpt-5.6-sol",
+            child_env["ANTHROPIC_DEFAULT_OPUS_MODEL"],
+        )
+        self.assertEqual(
+            "openai/gpt-5.6-sol",
+            child_env["ANTHROPIC_DEFAULT_SONNET_MODEL"],
+        )
 
     def test_preflight_failure_aborts_before_process_launch(self):
+        config = RunConfig(self.case, self.models["gpt-56-luna-chatgpt"], 0)
         with patch(
             "benchmarks.harness.executor.revalidate_route",
             side_effect=RouteContractError("sanitizer mismatch"),
         ):
             with patch("benchmarks.harness.executor.subprocess.Popen") as popen:
-                result = execute_run(self.config)
+                result = execute_run(config)
         popen.assert_not_called()
         self.assertIn("RouteContractError", result.error)
         self.assertIn("sanitizer mismatch", result.error)
diff --git a/benchmarks/tests/test_concurrency_safety.py b/benchmarks/tests/test_concurrency_safety.py
new file mode 100644
index 00000000..b612729c
--- /dev/null
+++ b/benchmarks/tests/test_concurrency_safety.py
@@ -0,0 +1,202 @@
+"""Cross-process concurrency-safety regression tests for the benchmark runners.
+
+Covers the three mechanisms that make concurrent runner PROCESSES safe:
+
+1. The fixture reader/writer flock (EX excludes SH/EX; SH coexists with SH) —
+   exercised across a real child process via multiprocessing, since flock is an
+   open-file-description property that only contends across processes/OFDs.
+2. Per-batch results-dir uniqueness (token appended, leading timestamp
+   preserved) and the additive manifest ``batch_token``/``batch_pid`` fields.
+3. The read-only fixture-source chmod round-trip on a temporary tree.
+
+All fakes are in-memory or temp-dir; no backend/model call, no real benchmark
+result, checkpoint, or sandbox is created outside the test scratch dir.
+"""
+
+import fcntl
+import json
+import multiprocessing
+import os
+import shutil
+import stat
+import unittest
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from benchmarks.harness.models import ModelConfig, PricingConfig, TestCase as BenchmarkCase
+from benchmarks.scripts import run_dispatch_compliance
+
+
+TEST_SCRATCH = Path("/daaf/benchmarks/.test_scratch_concurrency")
+
+
+def _child_try_flock(lockfile, lock_type, result_q):
+    """Child-process worker: attempt a NON-blocking flock and report the outcome.
+
+    Opens its OWN fd (a fresh open file description) so contention with a lock
+    held by the parent process is genuine cross-OFD contention, exactly as two
+    separate runner invocations would experience.
+    """
+    fd = os.open(lockfile, os.O_RDWR | os.O_CREAT, 0o644)
+    try:
+        try:
+            fcntl.flock(fd, lock_type | fcntl.LOCK_NB)
+            result_q.put("acquired")
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        except BlockingIOError:
+            result_q.put("blocked")
+    finally:
+        os.close(fd)
+
+
+class FixtureLockTests(unittest.TestCase):
+    def setUp(self):
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+        TEST_SCRATCH.mkdir(parents=True)
+        self.lockfile = str(TEST_SCRATCH / ".fixtures.lock")
+        # fork so the child inherits the temp lockfile path via the module patch
+        # and contends via a fresh OFD (spawn would re-import and lose the patch).
+        self.ctx = multiprocessing.get_context("fork")
+
+    def tearDown(self):
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+
+    def _child_outcome(self, lock_type):
+        q = self.ctx.Queue()
+        p = self.ctx.Process(target=_child_try_flock, args=(self.lockfile, lock_type, q))
+        p.start()
+        outcome = q.get(timeout=10)
+        p.join(timeout=10)
+        return outcome
+
+    def test_exclusive_lock_blocks_shared_and_exclusive(self):
+        with patch.object(run_dispatch_compliance, "FIXTURE_LOCK_PATH", self.lockfile):
+            with run_dispatch_compliance._fixture_lock(fcntl.LOCK_EX, "restore"):
+                self.assertEqual("blocked", self._child_outcome(fcntl.LOCK_EX))
+                self.assertEqual("blocked", self._child_outcome(fcntl.LOCK_SH))
+            # Lock released on context exit — a fresh acquirer now succeeds.
+            self.assertEqual("acquired", self._child_outcome(fcntl.LOCK_EX))
+
+    def test_shared_lock_coexists_with_shared_but_blocks_exclusive(self):
+        with patch.object(run_dispatch_compliance, "FIXTURE_LOCK_PATH", self.lockfile):
+            with run_dispatch_compliance._fixture_lock(fcntl.LOCK_SH, "copy"):
+                self.assertEqual("acquired", self._child_outcome(fcntl.LOCK_SH))
+                self.assertEqual("blocked", self._child_outcome(fcntl.LOCK_EX))
+
+    def test_lock_released_on_process_death_no_stale_cleanup(self):
+        # A child that dies while holding the EX lock must not strand it: the
+        # kernel releases on process exit, so the parent acquires afterwards.
+        with patch.object(run_dispatch_compliance, "FIXTURE_LOCK_PATH", self.lockfile):
+            self.assertEqual("acquired", self._child_outcome(fcntl.LOCK_EX))
+            with run_dispatch_compliance._fixture_lock(fcntl.LOCK_EX, "restore"):
+                pass  # acquired without hanging => prior child's lock was released
+
+
+class FixtureChmodTests(unittest.TestCase):
+    def setUp(self):
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+        self.tree = TEST_SCRATCH / "test_fixtures"
+        (self.tree / "sub").mkdir(parents=True)
+        self.f1 = self.tree / "top.txt"
+        self.f2 = self.tree / "sub" / "nested.txt"
+        self.f1.write_text("a")
+        self.f2.write_text("b")
+        self.f1.chmod(0o644)
+        self.f2.chmod(0o644)
+
+    def tearDown(self):
+        # Re-enable writes so rmtree can remove the read-only tree.
+        for p in self.tree.rglob("*"):
+            try:
+                p.chmod(p.stat().st_mode | stat.S_IWUSR)
+            except OSError:
+                pass
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+
+    def test_readonly_then_writable_round_trip(self):
+        prefix = str(self.tree) + "/"
+        with patch.object(run_dispatch_compliance, "FIXTURE_PREFIX", prefix):
+            run_dispatch_compliance._set_fixture_tree_writable(False)
+            for f in (self.f1, self.f2):
+                mode = f.stat().st_mode
+                self.assertEqual(0, mode & stat.S_IWUSR, f"{f} should be read-only")
+                self.assertEqual(0, mode & stat.S_IWGRP)
+                self.assertEqual(0, mode & stat.S_IWOTH)
+            # Directories keep r-x (traversable) even when read-only.
+            self.assertTrue(self.tree.stat().st_mode & stat.S_IXUSR)
+            self.assertTrue(self.tree.stat().st_mode & stat.S_IRUSR)
+
+            run_dispatch_compliance._set_fixture_tree_writable(True)
+            for f in (self.f1, self.f2):
+                self.assertTrue(f.stat().st_mode & stat.S_IWUSR, f"{f} should be writable")
+
+
+class ResultsDirNamingTests(unittest.TestCase):
+    def setUp(self):
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+        TEST_SCRATCH.mkdir(parents=True)
+
+    def tearDown(self):
+        shutil.rmtree(TEST_SCRATCH, ignore_errors=True)
+
+    def _model(self):
+        return ModelConfig(
+            id="claude-sonnet-4-6",
+            name="Sonnet 4.6",
+            provider="anthropic",
+            pricing=PricingConfig(input=3.0, output=15.0, cached_input=0.3),
+        )
+
+    def _case(self):
+        return BenchmarkCase(
+            id="dc-01",
+            category="cat",
+            prompt="p",
+            golden_checkpoint="benchmarks/datasets/dispatch_compliance/goldens/dc-01.jsonl",
+            expected={},
+            subcategory="sub",
+        )
+
+    def _args(self, model):
+        return SimpleNamespace(
+            reps=1, sequential=True, delay=0, timeout=300,
+            test_id="dc-01", models=model.key,
+        )
+
+    def test_token_appended_timestamp_preserved_and_manifest_records_token_pid(self):
+        model, case = self._model(), self._case()
+        with patch.object(run_dispatch_compliance, "BASE_DIR", TEST_SCRATCH), \
+                patch.object(run_dispatch_compliance, "get_git_sha", return_value="test-sha"):
+            output_dir = run_dispatch_compliance.archive_results(
+                [], [model], [case], self._args(model), 0.0,
+                output_dir=None, partial=True, expected_n=1, git_sha="test-sha",
+                batch_token="abc123", batch_pid=4242,
+            )
+        self.assertTrue(output_dir.name.endswith("_abc123"))
+        ts_part = output_dir.name[: -len("_abc123")]
+        # Leading segment is a parseable %Y%m%d_%H%M%S timestamp (15 chars).
+        self.assertEqual(15, len(ts_part))
+        self.assertEqual("_", ts_part[8])
+        manifest = json.loads((output_dir / "manifest.json").read_text())
+        self.assertEqual("abc123", manifest["batch_token"])
+        self.assertEqual(4242, manifest["batch_pid"])
+
+    def test_auto_generated_tokens_are_unique_across_batches(self):
+        model, case = self._model(), self._case()
+        with patch.object(run_dispatch_compliance, "BASE_DIR", TEST_SCRATCH), \
+                patch.object(run_dispatch_compliance, "get_git_sha", return_value="test-sha"):
+            d1 = run_dispatch_compliance.archive_results(
+                [], [model], [case], self._args(model), 0.0,
+                output_dir=None, partial=True, expected_n=1, git_sha="test-sha",
+            )
+            d2 = run_dispatch_compliance.archive_results(
+                [], [model], [case], self._args(model), 0.0,
+                output_dir=None, partial=True, expected_n=1, git_sha="test-sha",
+            )
+        # Even if both start the same wall-clock second, the tokens differ.
+        self.assertNotEqual(d1.name, d2.name)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/benchmarks/tests/test_dispatch_heading_normalization.py b/benchmarks/tests/test_dispatch_heading_normalization.py
new file mode 100644
index 00000000..2c3e6bb6
--- /dev/null
+++ b/benchmarks/tests/test_dispatch_heading_normalization.py
@@ -0,0 +1,571 @@
+"""Regression tests for the 2026-07-28 dispatch-compliance heading normalization.
+
+Covers Fix 1 (structural section-heading matching) and Fix 3 (shell-safe
+sandbox slugs). No backend/model call; all scratch lives under benchmarks/.
+
+Key properties asserted:
+  * Strict widening: every label the LEGACY exact-match lists accepted still
+    passes under the new structural matcher (task / context / instructions).
+  * The archived-observed synonym "## Output format" (lowercase f) now passes.
+  * Additional real-world synonyms pass (## Return format, ## Output
+    requirements, ## Review expectations, ## Investigation requirements).
+  * End-to-end: score_dispatch_compliance emits the three section criteria as
+    PASS for a structurally-sound prompt and FAIL when the section is absent.
+  * sandbox_slug renders shell-hostile display names safe.
+"""
+
+import json
+import unittest
+from pathlib import Path
+
+from types import SimpleNamespace
+
+from benchmarks.harness.artifacts import (
+    assert_unique_sandbox_slugs,
+    sandbox_slug,
+)
+from benchmarks.scorers.deterministic.dispatch_compliance import (
+    CONTEXT_KEYWORDS,
+    INSTRUCTION_KEYWORDS,
+    TASK_KEYWORDS,
+    extract_normalized_headings,
+    match_section_heading,
+    score_dispatch_compliance,
+)
+
+TEST_SCRATCH = Path("/daaf/benchmarks/.test_scratch_heading_norm")
+
+# The exact-match label lists the scorer used BEFORE the fix. Every one of
+# these must still pass under the new structural matcher (strict-widening
+# property). Kept here verbatim as the frozen legacy contract.
+LEGACY_TASK_LABEL = "## Task"
+LEGACY_CONTEXT_HEADERS = [
+    "## Context", "## Scope", "## Background", "## Specifications",
+    "## Dataset Specifications", "## Known Symptoms", "## What to Search",
+]
+LEGACY_INSTRUCTION_HEADERS = [
+    "## Instructions", "## What to Report", "## What to Look For",
+    "## Where to Look", "## Validation Requirements", "## Output Format",
+    "## Expected Output", "## Deliverables",
+]
+
+
+class HeadingExtractionTests(unittest.TestCase):
+    def test_atx_headings_extracted_and_normalized(self):
+        text = "# Task\nsome body\n### Context\n#### Deliverables\n"
+        self.assertEqual(
+            extract_normalized_headings(text),
+            ["task", "context", "deliverables"],
+        )
+
+    def test_bold_label_headings_extracted(self):
+        text = "**Task**\nbody\n**Context:**\n"
+        self.assertEqual(
+            extract_normalized_headings(text), ["task", "context:"]
+        )
+
+    def test_non_heading_lines_ignored(self):
+        text = "regular prose mentioning Task and Context inline\nno headings\n"
+        self.assertEqual(extract_normalized_headings(text), [])
+
+
+class StrictWideningTests(unittest.TestCase):
+    """Every legacy-accepted label must still pass under structural matching."""
+
+    def test_legacy_task_label_still_passes(self):
+        headings = extract_normalized_headings(LEGACY_TASK_LABEL + "\n")
+        self.assertIsNotNone(
+            match_section_heading(headings, TASK_KEYWORDS, word_boundary=True)
+        )
+
+    def test_all_legacy_context_headers_still_pass(self):
+        for header in LEGACY_CONTEXT_HEADERS:
+            headings = extract_normalized_headings(header + "\n")
+            self.assertIsNotNone(
+                match_section_heading(headings, CONTEXT_KEYWORDS),
+                f"legacy context header regressed: {header!r}",
+            )
+
+    def test_all_legacy_instruction_headers_still_pass(self):
+        for header in LEGACY_INSTRUCTION_HEADERS:
+            headings = extract_normalized_headings(header + "\n")
+            self.assertIsNotNone(
+                match_section_heading(headings, INSTRUCTION_KEYWORDS),
+                f"legacy instruction header regressed: {header!r}",
+            )
+
+
+class SynonymWideningTests(unittest.TestCase):
+    """Archived-observed synonyms that FAILED under exact matching now pass."""
+
+    def test_output_format_lowercase_f_now_passes(self):
+        # The headline archived failure: "## Output format" (lowercase f) failed
+        # the case-sensitive "## Output Format" check on 42/136 GPT prompts.
+        headings = extract_normalized_headings("## Output format\n")
+        self.assertIsNotNone(
+            match_section_heading(headings, INSTRUCTION_KEYWORDS)
+        )
+
+    def test_additional_instruction_synonyms_pass(self):
+        for header in [
+            "## Output requirements", "## Return format",
+            "## Investigation requirements", "## Review expectations",
+        ]:
+            headings = extract_normalized_headings(header + "\n")
+            self.assertIsNotNone(
+                match_section_heading(headings, INSTRUCTION_KEYWORDS),
+                f"synonym should pass: {header!r}",
+            )
+
+    def test_task_variants_pass(self):
+        for header in ["## Tasks", "## Task Description", "## Your task"]:
+            headings = extract_normalized_headings(header + "\n")
+            self.assertIsNotNone(
+                match_section_heading(headings, TASK_KEYWORDS, word_boundary=True),
+                f"task variant should pass: {header!r}",
+            )
+
+
+class RequestKeywordTests(unittest.TestCase):
+    """Fix 3 (2026-07-28): '## User Request' must satisfy the TASK concept.
+
+    The GPT diagnostic cited '## User Request' as a near-miss that failed the
+    task check under the 'task'-only keyword set. The other cited near-misses
+    are pinned here too as named cases documenting current semantics.
+    """
+
+    def test_user_request_heading_passes_task(self):
+        headings = extract_normalized_headings("## User Request\n")
+        self.assertIsNotNone(
+            match_section_heading(headings, TASK_KEYWORDS, word_boundary=True),
+            "'## User Request' should satisfy the TASK concept",
+        )
+
+    def test_request_variants_pass_task(self):
+        for header in ["## Request", "## Requests", "## User request"]:
+            headings = extract_normalized_headings(header + "\n")
+            self.assertIsNotNone(
+                match_section_heading(headings, TASK_KEYWORDS, word_boundary=True),
+                f"request variant should pass task: {header!r}",
+            )
+
+    def test_required_scope_passes_context(self):
+        # '## Required scope' matches CONTEXT via the 'scope' substring keyword.
+        headings = extract_normalized_headings("## Required scope\n")
+        self.assertIsNotNone(
+            match_section_heading(headings, CONTEXT_KEYWORDS),
+            "'## Required scope' should satisfy the CONTEXT concept",
+        )
+
+    def test_evidence_and_output_format_passes_instructions(self):
+        # '## Evidence and Output Format' matches INSTRUCTIONS via 'output'.
+        headings = extract_normalized_headings("## Evidence and Output Format\n")
+        self.assertIsNotNone(
+            match_section_heading(headings, INSTRUCTION_KEYWORDS),
+            "'## Evidence and Output Format' should satisfy the INSTRUCTIONS concept",
+        )
+
+    def test_prose_requirements_colon_is_not_a_heading(self):
+        # Documents current semantics (NOT a change): a bare prose line
+        # 'Requirements:' is neither an ATX (#) nor a bold (**) heading, so
+        # extract_normalized_headings ignores it and it does not, on its own,
+        # satisfy the INSTRUCTIONS concept. The 'requirement' keyword only helps
+        # when it appears in an actual heading (e.g. '## Validation Requirements').
+        headings = extract_normalized_headings("Requirements:\nsome prose\n")
+        self.assertEqual(headings, [])
+        self.assertIsNone(
+            match_section_heading(headings, INSTRUCTION_KEYWORDS)
+        )
+
+
+def _write_transcript(path: Path, prompt: str, subagent_type: str) -> None:
+    """Write a minimal 2-line transcript: an Agent tool_use + a success result."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    assistant = {
+        "type": "assistant",
+        "message": {
+            "content": [
+                {
+                    "type": "tool_use",
+                    "id": "tu1",
+                    "name": "Agent",
+                    "input": {
+                        "subagent_type": subagent_type,
+                        "prompt": prompt,
+                        "description": "d",
+                    },
+                }
+            ]
+        },
+    }
+    user = {
+        "type": "user",
+        "message": {
+            "content": [
+                {"type": "tool_result", "tool_use_id": "tu1", "is_error": False}
+            ]
+        },
+    }
+    with open(path, "w") as f:
+        f.write(json.dumps(assistant) + "\n")
+        f.write(json.dumps(user) + "\n")
+
+
+class EndToEndScorerTests(unittest.TestCase):
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+        self.expected = {
+            "subagent_dispatched": "research-executor",
+            "prompt_contains": [],
+            "prompt_contains_any": [],
+        }
+
+    def tearDown(self):
+        import shutil
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def _section_passes(self, prompt: str) -> dict:
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        _write_transcript(tpath, prompt, "research-executor")
+        results = score_dispatch_compliance(str(tpath), 0, self.expected)
+        return {c.name: c.passed for c in results}
+
+    def test_synonym_prompt_passes_all_three_section_criteria(self):
+        # A GPT-style prompt that FAILED the old exact-label matcher.
+        prompt = (
+            "## Your task\nDo the thing.\n\n"
+            "## Scope\nThe boundaries.\n\n"
+            "## Output format\nReturn a table.\n"
+        )
+        passes = self._section_passes(prompt)
+        self.assertTrue(passes["prompt_has_task_section"])
+        self.assertTrue(passes["prompt_has_context_section"])
+        self.assertTrue(passes["prompt_has_instructions"])
+
+    def test_canonical_prompt_still_passes(self):
+        prompt = (
+            "## Task\nDo it.\n\n## Context\nHere.\n\n## Instructions\nSteps.\n"
+        )
+        passes = self._section_passes(prompt)
+        self.assertTrue(passes["prompt_has_task_section"])
+        self.assertTrue(passes["prompt_has_context_section"])
+        self.assertTrue(passes["prompt_has_instructions"])
+
+    def test_missing_sections_fail(self):
+        prompt = "just some prose with no markdown headings at all\n"
+        passes = self._section_passes(prompt)
+        self.assertFalse(passes["prompt_has_task_section"])
+        self.assertFalse(passes["prompt_has_context_section"])
+        self.assertFalse(passes["prompt_has_instructions"])
+
+    def test_legacy_label_not_at_heading_position_still_passes(self):
+        # Strict-widening guarantee: the old matcher used substring-anywhere,
+        # so a legacy label appearing NOT as a line-start heading (e.g. inside
+        # an indented block) passed. The new matcher ORs in the legacy
+        # substring check so such prompts never regress P->F.
+        prompt = (
+            "## Task\ndo it\n"
+            "## Context\nhere\n"
+            "        ## Instructions (deeply indented, not a heading line)\n"
+        )
+        passes = self._section_passes(prompt)
+        self.assertTrue(passes["prompt_has_task_section"])
+        self.assertTrue(passes["prompt_has_context_section"])
+        self.assertTrue(passes["prompt_has_instructions"])
+
+
+def _write_no_dispatch_transcript(path: Path) -> None:
+    """Write a transcript with tool activity but NO Agent tool_use (zero dispatch).
+
+    Uses a non-Agent tool (Read) so extract_new_tool_calls yields a non-empty
+    tool_calls list while extract_agent_calls yields none — the exact shape of a
+    run that did work but never dispatched a subagent.
+    """
+    path.parent.mkdir(parents=True, exist_ok=True)
+    assistant = {
+        "type": "assistant",
+        "message": {
+            "content": [
+                {"type": "text", "text": "Looking now."},
+                {
+                    "type": "tool_use",
+                    "id": "tu1",
+                    "name": "Read",
+                    "input": {"file_path": "/daaf/x"},
+                },
+            ]
+        },
+    }
+    user = {
+        "type": "user",
+        "message": {
+            "content": [
+                {"type": "tool_result", "tool_use_id": "tu1", "is_error": False}
+            ]
+        },
+    }
+    with open(path, "w") as f:
+        f.write(json.dumps(assistant) + "\n")
+        f.write(json.dumps(user) + "\n")
+
+
+def _write_failed_dispatch_transcript(path: Path, prompt: str, subagent_type: str) -> None:
+    """Write an Agent tool_use whose tool_result is_error=True (recorded failure)."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    assistant = {
+        "type": "assistant",
+        "message": {
+            "content": [
+                {
+                    "type": "tool_use",
+                    "id": "tu1",
+                    "name": "Agent",
+                    "input": {
+                        "subagent_type": subagent_type,
+                        "prompt": prompt,
+                        "description": "d",
+                    },
+                }
+            ]
+        },
+    }
+    user = {
+        "type": "user",
+        "message": {
+            "content": [
+                {"type": "tool_result", "tool_use_id": "tu1", "is_error": True}
+            ]
+        },
+    }
+    with open(path, "w") as f:
+        f.write(json.dumps(assistant) + "\n")
+        f.write(json.dumps(user) + "\n")
+
+
+class DispatchAttemptGateTests(unittest.TestCase):
+    """2026-07-29: the prompt_* family requires a dispatch ATTEMPT.
+
+    A zero-dispatch run must FAIL all eight prompt criteria rather than banking
+    the three that historically auto-passed on vacuous truth (prompt_has_project_dir
+    for read-only agents, the 0-required prompt_contains_required, and the
+    unspecified prompt_contains_any). Observed: 2 GPT-5.6 Sol dc-06 runs scored
+    3/10 with zero Agent calls.
+    """
+
+    PROMPT_CRITERIA = (
+        "prompt_has_base_dir", "prompt_has_mode_marker", "prompt_has_project_dir",
+        "prompt_has_task_section", "prompt_has_context_section",
+        "prompt_has_instructions", "prompt_contains_required",
+        "prompt_contains_any",
+    )
+    GATE_DETAIL = "No Agent dispatch attempt; prompt criteria not evaluable."
+
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+        # dc-06-shaped expected: a read-only agent + zero required strings — the
+        # exact shape whose three prompt criteria previously auto-passed.
+        self.expected = {
+            "subagent_dispatched": "search-agent",
+            "prompt_contains": [],
+            "prompt_contains_any": [],
+        }
+
+    def tearDown(self):
+        import shutil
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def test_no_dispatch_fails_all_prompt_criteria(self):
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        _write_no_dispatch_transcript(tpath)
+        results = score_dispatch_compliance(str(tpath), 0, self.expected)
+        by_name = {c.name: c for c in results}
+        # tier1 unaffected: no successful dispatch.
+        self.assertFalse(by_name["agent_dispatched"].passed)
+        self.assertFalse(by_name["correct_subagent_type"].passed)
+        # Every prompt_* criterion FAILS with the gate detail (previously 3
+        # auto-passed on vacuous truth).
+        for name in self.PROMPT_CRITERIA:
+            self.assertIn(name, by_name)
+            self.assertFalse(
+                by_name[name].passed, f"{name} must fail with no dispatch attempt"
+            )
+            self.assertEqual(by_name[name].detail, self.GATE_DETAIL)
+        # Full criterion set preserved (2 tier1 + 8 tier2), names + order intact.
+        self.assertEqual([c.name for c in results][2:], list(self.PROMPT_CRITERIA))
+        self.assertEqual(len(results), 10)
+
+    def test_dispatched_run_behavior_unchanged(self):
+        # A well-formed dispatched prompt still scores its prompt_* criteria under
+        # normal semantics — the gate does not fire when a dispatch exists.
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        prompt = (
+            "BASE_DIR context. Ad Hoc mode. PROJECT_DIR set.\n"
+            "## Task\nDo it.\n## Context\nHere.\n## Instructions\nSteps.\n"
+        )
+        _write_transcript(tpath, prompt, "search-agent")
+        results = score_dispatch_compliance(str(tpath), 0, self.expected)
+        passes = {c.name: c.passed for c in results}
+        self.assertTrue(passes["agent_dispatched"])
+        self.assertTrue(passes["correct_subagent_type"])
+        self.assertTrue(passes["prompt_has_base_dir"])
+        self.assertTrue(passes["prompt_has_mode_marker"])
+        self.assertTrue(passes["prompt_has_task_section"])
+        self.assertTrue(passes["prompt_has_context_section"])
+        self.assertTrue(passes["prompt_has_instructions"])
+        # read-only agent: project_dir auto-passes under its OWN semantics; the
+        # 0-required / unspecified checks pass under theirs. All unchanged.
+        self.assertTrue(passes["prompt_has_project_dir"])
+        self.assertTrue(passes["prompt_contains_required"])
+        self.assertTrue(passes["prompt_contains_any"])
+
+    def test_failed_only_dispatch_is_an_attempt(self):
+        # A RECORDED failed Agent call is an attempt: prompt criteria are
+        # evaluated under normal semantics (gate does NOT fire), even though
+        # agent_dispatched fails because no call succeeded.
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        _write_failed_dispatch_transcript(tpath, "## Task\nx\n", "search-agent")
+        results = score_dispatch_compliance(str(tpath), 0, self.expected)
+        by_name = {c.name: c for c in results}
+        self.assertFalse(by_name["agent_dispatched"].passed)
+        for name in self.PROMPT_CRITERIA:
+            self.assertNotEqual(
+                by_name[name].detail, self.GATE_DETAIL,
+                f"{name} should be evaluated (failed dispatch is an attempt)",
+            )
+
+
+def _write_subagent_recovery_fixture(sub_path: Path, prompt: str, agent_type: str) -> None:
+    """Write a subagent transcript + sibling meta.json shaped like real recovery
+    evidence (see dispatch_compliance.recover_agent_calls_from_subagent_transcripts).
+
+    The transcript's FIRST record is a type "user" record whose
+    ``message.content`` is a PLAIN STRING carrying the dispatched prompt; the
+    sibling ``agent-{id}.meta.json`` supplies ``agentType``.
+    """
+    sub_path.parent.mkdir(parents=True, exist_ok=True)
+    first_user = {"type": "user", "message": {"content": prompt}}
+    with open(sub_path, "w") as f:
+        f.write(json.dumps(first_user) + "\n")
+    meta_path = sub_path.with_suffix(".meta.json")
+    with open(meta_path, "w") as f:
+        f.write(json.dumps({"agentType": agent_type, "description": "d"}))
+
+
+class RecoveredOnlyGateTests(unittest.TestCase):
+    """FIX-3 (2026-07-29): a recovered dispatch is an ATTEMPT, so the
+    zero-dispatch gate must NOT fire when the main transcript has zero Agent
+    tool_use calls but subagent recovery evidence exists.
+
+    Mirrors the scorer's recovery derivation: main transcript yields no Agent
+    call, ``subagent_transcripts`` supplies the evidence, and the reconstructed
+    prompt is scored under normal semantics (with the recovered-provenance
+    suffix), never with the gate detail.
+    """
+
+    PROMPT_CRITERIA = (
+        "prompt_has_base_dir", "prompt_has_mode_marker", "prompt_has_project_dir",
+        "prompt_has_task_section", "prompt_has_context_section",
+        "prompt_has_instructions", "prompt_contains_required",
+        "prompt_contains_any",
+    )
+    GATE_DETAIL = "No Agent dispatch attempt; prompt criteria not evaluable."
+    RECOVERED_SUFFIX = " (recovered from subagent transcript)"
+
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+        self.expected = {
+            "subagent_dispatched": "search-agent",
+            "prompt_contains": [],
+            "prompt_contains_any": [],
+        }
+
+    def tearDown(self):
+        import shutil
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def test_recovered_dispatch_does_not_trip_the_gate(self):
+        # Main transcript: tool activity but NO Agent call.
+        main = TEST_SCRATCH / "transcript.jsonl"
+        _write_no_dispatch_transcript(main)
+        # Recovery evidence: a well-formed dispatched prompt off a subagent
+        # transcript keyed by a fresh session UUID.
+        sub = TEST_SCRATCH / "subagents" / "agent-abc123.jsonl"
+        prompt = (
+            "BASE_DIR context. Ad Hoc mode. PROJECT_DIR set.\n"
+            "## Task\nDo it.\n## Context\nHere.\n## Instructions\nSteps.\n"
+        )
+        _write_subagent_recovery_fixture(sub, prompt, "search-agent")
+
+        results = score_dispatch_compliance(
+            str(main), 0, self.expected, subagent_transcripts=[str(sub)]
+        )
+        by_name = {c.name: c for c in results}
+
+        # The gate did NOT fire: no prompt criterion carries the gate detail.
+        for name in self.PROMPT_CRITERIA:
+            self.assertIn(name, by_name)
+            self.assertNotIn(
+                self.GATE_DETAIL, by_name[name].detail,
+                f"{name} must be evaluated normally, not gated, for a "
+                f"recovered dispatch",
+            )
+        # The recovered dispatch is treated as a successful attempt: tier1 passes
+        # and every criterion carries the recovered-provenance suffix.
+        self.assertTrue(by_name["agent_dispatched"].passed)
+        self.assertTrue(by_name["correct_subagent_type"].passed)
+        for cr in results:
+            self.assertTrue(cr.detail.endswith(self.RECOVERED_SUFFIX))
+        # The reconstructed prompt scores under normal semantics.
+        self.assertTrue(by_name["prompt_has_task_section"].passed)
+        self.assertTrue(by_name["prompt_has_context_section"].passed)
+        self.assertTrue(by_name["prompt_has_instructions"].passed)
+
+
+class SandboxSlugTests(unittest.TestCase):
+    def test_parentheses_and_spaces_collapsed(self):
+        self.assertEqual(
+            sandbox_slug("GPT-5.6 Luna (ChatGPT Subscription)"),
+            "GPT-5.6_Luna_ChatGPT_Subscription",
+        )
+
+    def test_safe_chars_preserved(self):
+        self.assertEqual(sandbox_slug("Opus_4.8-preview"), "Opus_4.8-preview")
+
+    def test_no_shell_metacharacters_survive(self):
+        slug = sandbox_slug("weird (name) & $stuff; rm -rf")
+        for ch in "()&$; ":
+            self.assertNotIn(ch, slug)
+
+
+class SlugCollisionGuardTests(unittest.TestCase):
+    """W2 (2026-07-28): assert_unique_sandbox_slugs fails fast on collisions."""
+
+    def test_distinct_slugs_pass(self):
+        models = [
+            SimpleNamespace(name="Opus 4.8"),
+            SimpleNamespace(name="GPT-5.6 Sol"),
+        ]
+        # Should not raise.
+        assert_unique_sandbox_slugs(models)
+
+    def test_colliding_slugs_raise_with_names(self):
+        # "GPT-5.6 (A)" and "GPT-5.6 [A]" both slug to "GPT-5.6_A".
+        models = [
+            SimpleNamespace(name="GPT-5.6 (A)"),
+            SimpleNamespace(name="GPT-5.6 [A]"),
+        ]
+        self.assertEqual(
+            sandbox_slug("GPT-5.6 (A)"), sandbox_slug("GPT-5.6 [A]")
+        )
+        with self.assertRaises(SystemExit) as ctx:
+            assert_unique_sandbox_slugs(models)
+        msg = str(ctx.exception)
+        self.assertIn("GPT-5.6 (A)", msg)
+        self.assertIn("GPT-5.6 [A]", msg)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/benchmarks/tests/test_error_classification.py b/benchmarks/tests/test_error_classification.py
new file mode 100644
index 00000000..18036757
--- /dev/null
+++ b/benchmarks/tests/test_error_classification.py
@@ -0,0 +1,380 @@
+"""Tests for the error-bearing tool-result classifier and its runner wiring.
+
+Covers:
+  * Fix 4 / I2 (2026-07-28) compute_error_counts single-count property: with an
+    empty ``tool_failures`` list, a parent transcript is scanned exactly once —
+    no double-counting against the legacy tool_failures-derived path.
+  * I3 truncation-reclassification: the transcript scan sees FULL, untruncated
+    content, so a failure signature living past char 500 (which the legacy
+    500-char-truncated result.tool_failures path would have missed) is now
+    classified into its named bucket instead of ``unclassified``.
+  * W1 (2026-07-28) parent_skip_lines: the parent scan skips the prepended
+    golden-checkpoint prefix, mirroring extract_new_tool_calls's slice.
+  * Fix 1 fallback invariant: every golden checkpoint under benchmarks/golden/
+    carries ZERO is_error tool_results, so the checkpoint prefix can never
+    contribute spurious error counts (the safety net for the runners that do
+    not thread the boundary line count).
+
+No backend/model call. All scratch lives under benchmarks/.
+"""
+
+import json
+import shutil
+import unittest
+from pathlib import Path
+
+from benchmarks.scorers.deterministic.error_classification import (
+    classify_error_content,
+    classify_tool_failure_class,
+    compute_error_counts,
+)
+
+TEST_SCRATCH = Path("/daaf/benchmarks/.test_scratch_error_classification")
+GOLDEN_ROOT = Path("/daaf/benchmarks/golden")
+
+
+def _error_line(tool_use_id: str, content: str) -> str:
+    """One JSONL user record carrying a single is_error tool_result."""
+    return json.dumps({
+        "type": "user",
+        "message": {
+            "content": [
+                {
+                    "type": "tool_result",
+                    "tool_use_id": tool_use_id,
+                    "is_error": True,
+                    "content": content,
+                }
+            ]
+        },
+    })
+
+
+def _plain_line(text: str) -> str:
+    """A non-tool-result record (no is_error), for prefix/padding lines."""
+    return json.dumps({"type": "assistant", "message": {"content": [
+        {"type": "text", "text": text}
+    ]}})
+
+
+class ClassifyContentTests(unittest.TestCase):
+    def test_hook_block_wins_over_failure(self):
+        # A blocked call reports as an error but is the framework acting as
+        # designed; hook signatures are checked first.
+        self.assertEqual(
+            classify_error_content("BLOCKED by enforce-single-command hook"),
+            "hook_block",
+        )
+
+    def test_genuine_failure_signature(self):
+        self.assertEqual(
+            classify_error_content("Error: no such file or directory"),
+            "tool_failure",
+        )
+
+    def test_unrecognized_is_unclassified(self):
+        self.assertEqual(
+            classify_error_content("something totally novel"),
+            "tool_failure_unclassified",
+        )
+
+
+class ClassifyToolFailureClassTests(unittest.TestCase):
+    """C4: additive finer-grained cause tagging for tool failures.
+
+    Covers one case per returned class, the first-match-wins precedence order,
+    and both branches of the ChatGPT/Codex lane-pattern rule.
+    """
+
+    def test_policy_hook(self):
+        self.assertEqual(
+            classify_tool_failure_class("BLOCKED by enforce-single-command hook"),
+            "policy_hook",
+        )
+
+    def test_infra_transient_stream_closed(self):
+        self.assertEqual(
+            classify_tool_failure_class("API error: stream closed before completion"),
+            "infra_transient",
+        )
+
+    def test_infra_transient_stalled_mid_stream(self):
+        self.assertEqual(
+            classify_tool_failure_class("the response stalled mid-stream"),
+            "infra_transient",
+        )
+
+    def test_infra_transient_empty_200(self):
+        self.assertEqual(
+            classify_tool_failure_class("received an empty 200 from the backend"),
+            "infra_transient",
+        )
+
+    def test_capacity_limit_prompt_too_long(self):
+        self.assertEqual(
+            classify_tool_failure_class("prompt is too long: 250000 tokens"),
+            "capacity_limit",
+        )
+
+    def test_capacity_limit_quota_429(self):
+        self.assertEqual(
+            classify_tool_failure_class("HTTP 429 too many requests"),
+            "capacity_limit",
+        )
+
+    def test_default_model_error(self):
+        self.assertEqual(
+            classify_tool_failure_class("some entirely novel model behavior"),
+            "model_error",
+        )
+
+    def test_empty_is_model_error(self):
+        self.assertEqual(classify_tool_failure_class(""), "model_error")
+
+    # --- Lane-pattern rule: both branches -----------------------------------
+
+    def test_lane_refusal_matching_id_is_infra_config(self):
+        # Rejected id equals the configured child id → an infra/config problem.
+        err = "gpt-5.6-sol is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(err, configured_child_model_id="gpt-5.6-sol"),
+            "infra_config",
+        )
+
+    def test_lane_refusal_mismatched_id_is_model_error(self):
+        # A Terra run whose model authored a claude-fable-5 dispatch: the
+        # rejected id differs from the configured child → the model mis-routed.
+        err = "claude-fable-5 is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(
+                err, configured_child_model_id="gpt-5.6-terra"
+            ),
+            "model_error",
+        )
+
+    def test_lane_refusal_no_configured_id_falls_back_to_infra_config(self):
+        err = "model-x is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(err, configured_child_model_id=None),
+            "infra_config",
+        )
+
+    # --- FIX-1 (2026-07-29): delimiter-aware lane id matching --------------
+    # A bare substring match misclassified an id-with-extension as the same id.
+    # An id counts as "named by the error" only when NOT glued to an
+    # id-continuation character (letters/digits/``. _ - [ ]``), so ``[1m]``-style
+    # extensions read as a DIFFERENT id → model_error.
+
+    def test_lane_configured_base_vs_rejected_1m_is_model_error(self):
+        # Configured bare id; the error rejects the [1m] extension of it. The
+        # trailing "[" is an id-continuation char, so the bare id is NOT named →
+        # a different id → the model mis-routed → model_error.
+        err = "gpt-5.6-terra[1m] is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(
+                err, configured_child_model_id="gpt-5.6-terra"
+            ),
+            "model_error",
+        )
+
+    def test_lane_configured_1m_vs_rejected_base_is_model_error(self):
+        # Symmetric: configured id carries the [1m] extension, the error rejects
+        # the bare slug. The configured id string is not present verbatim → not
+        # named → model_error.
+        err = "gpt-5.6-terra is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(
+                err, configured_child_model_id="gpt-5.6-terra[1m]"
+            ),
+            "model_error",
+        )
+
+    def test_lane_exact_id_match_is_still_infra_config(self):
+        # The exact-id case is unchanged: id named verbatim with clean
+        # boundaries → the CONFIGURED child was rejected → infra_config.
+        err = "gpt-5.6-terra is not available via the ChatGPT (Codex) lane"
+        self.assertEqual(
+            classify_tool_failure_class(
+                err, configured_child_model_id="gpt-5.6-terra"
+            ),
+            "infra_config",
+        )
+
+    # --- FIX-2 (2026-07-29): anchored "429" --------------------------------
+    # A bare "429" substring false-matched trace ids and token counts. Only a
+    # standalone 429 (or an anchored HTTP-status phrasing) is a capacity signal.
+
+    def test_trace_id_429_is_not_capacity(self):
+        # "84290" contains the digits 4-2-9 but not a standalone 429.
+        self.assertNotEqual(
+            classify_tool_failure_class("request failed on trace-84290fae"),
+            "capacity_limit",
+        )
+
+    def test_token_count_429_is_not_capacity(self):
+        # "4293 tokens" — 429 is glued to a trailing digit, not standalone.
+        self.assertNotEqual(
+            classify_tool_failure_class("the call consumed 4293 tokens overall"),
+            "capacity_limit",
+        )
+
+    def test_genuine_http_429_is_capacity(self):
+        self.assertEqual(
+            classify_tool_failure_class("HTTP 429 Too Many Requests"),
+            "capacity_limit",
+        )
+
+    # --- FIX-6 (2026-07-29): transient wins over co-reported quota/429 ------
+
+    def test_transient_precedes_co_reported_429(self):
+        # A 429 rate-limit note co-occurring with a dropped stream classifies as
+        # infra_transient — the transient rule (2) precedes the capacity rule (5),
+        # and a stalled stream is the actionable, retryable cause.
+        err = "HTTP 429 rate limit; stream closed"
+        self.assertEqual(classify_tool_failure_class(err), "infra_transient")
+
+    # --- Precedence (first match wins) --------------------------------------
+
+    def test_policy_hook_precedes_transient(self):
+        # A hook block that also mentions a stream-closed phrase still classifies
+        # as policy_hook because hook signatures are checked first.
+        err = "BLOCKED by bash-safety hook; stream closed"
+        self.assertEqual(classify_tool_failure_class(err), "policy_hook")
+
+    def test_transient_precedes_capacity(self):
+        # infra_transient is checked before the prompt/quota capacity rules.
+        err = "stream closed after prompt is too long warning"
+        self.assertEqual(classify_tool_failure_class(err), "infra_transient")
+
+    def test_prompt_capacity_precedes_lane(self):
+        # prompt-too-long (rule 3) wins over the lane pattern (rule 4).
+        err = (
+            "prompt is too long and model is not available via the chatgpt lane"
+        )
+        self.assertEqual(
+            classify_tool_failure_class(err, configured_child_model_id="m"),
+            "capacity_limit",
+        )
+
+    def test_lane_precedes_quota(self):
+        # The lane branch (rule 4) is evaluated before quota/429 (rule 5).
+        err = "gpt-5.6-sol is not available via the chatgpt (codex) lane; quota"
+        self.assertEqual(
+            classify_tool_failure_class(err, configured_child_model_id="gpt-5.6-sol"),
+            "infra_config",
+        )
+
+
+class SingleCountPropertyTests(unittest.TestCase):
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+
+    def tearDown(self):
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def test_parent_scanned_once_with_empty_tool_failures(self):
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        with open(tpath, "w") as f:
+            f.write(_error_line("tu1", "no such file or directory") + "\n")
+            f.write(_error_line("tu2", "BLOCKED by bash-safety hook") + "\n")
+        counts = compute_error_counts([], parent_transcript=str(tpath))
+        # Exactly two errors, counted once each — no double count.
+        self.assertEqual(counts["tool_failures"], 1)
+        self.assertEqual(counts["hook_blocks"], 1)
+        self.assertEqual(counts["tool_failures_unclassified"], 0)
+
+    def test_empty_everything_is_all_zero(self):
+        counts = compute_error_counts([])
+        self.assertEqual(
+            counts,
+            {"hook_blocks": 0, "tool_failures": 0, "tool_failures_unclassified": 0},
+        )
+
+
+class TruncationReclassificationTests(unittest.TestCase):
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+
+    def tearDown(self):
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def test_signature_past_char_500_now_classified(self):
+        # Legacy result.tool_failures truncated content to 500 chars; a
+        # signature living beyond that boundary was invisible and the error
+        # landed in 'unclassified'. The transcript scan sees the full string.
+        content = ("x" * 600) + " no such file or directory"
+        # Demonstrate the legacy-vs-full divergence directly on the classifier.
+        self.assertEqual(
+            classify_error_content(content[:500]), "tool_failure_unclassified"
+        )
+        self.assertEqual(classify_error_content(content), "tool_failure")
+        # And through the full transcript scan the run is a tool_failure.
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        with open(tpath, "w") as f:
+            f.write(_error_line("tu1", content) + "\n")
+        counts = compute_error_counts([], parent_transcript=str(tpath))
+        self.assertEqual(counts["tool_failures"], 1)
+        self.assertEqual(counts["tool_failures_unclassified"], 0)
+
+
+class ParentSkipLinesTests(unittest.TestCase):
+    def setUp(self):
+        TEST_SCRATCH.mkdir(parents=True, exist_ok=True)
+
+    def tearDown(self):
+        if TEST_SCRATCH.exists():
+            shutil.rmtree(TEST_SCRATCH)
+
+    def test_checkpoint_prefix_errors_are_skipped(self):
+        tpath = TEST_SCRATCH / "transcript.jsonl"
+        with open(tpath, "w") as f:
+            # 3-line golden prefix, one of which (defensively) carries an error.
+            f.write(_plain_line("golden line 1") + "\n")
+            f.write(_error_line("tu0", "no such file or directory") + "\n")
+            f.write(_plain_line("golden line 3") + "\n")
+            # Post-checkpoint benchmark run.
+            f.write(_error_line("tu1", "BLOCKED by bash-safety hook") + "\n")
+        # Skipping the 3-line prefix drops the prefix error; only the
+        # post-checkpoint hook_block remains.
+        counts = compute_error_counts(
+            [], parent_transcript=str(tpath), parent_skip_lines=3
+        )
+        self.assertEqual(counts["hook_blocks"], 1)
+        self.assertEqual(counts["tool_failures"], 0)
+        # With skip=0 the prefix error is (wrongly, absent the boundary) counted.
+        counts0 = compute_error_counts([], parent_transcript=str(tpath))
+        self.assertEqual(counts0["tool_failures"], 1)
+
+
+class GoldensErrorFreeInvariantTests(unittest.TestCase):
+    """Fix 1 fallback: goldens must contain zero is_error tool_results.
+
+    This is the safety net for the runners that do NOT thread the checkpoint
+    boundary into the error scan (post_confirmation, mode_classification): if
+    every golden prefix is error-free, scanning it contributes nothing to the
+    counts regardless of parent_skip_lines.
+    """
+
+    def test_all_goldens_have_zero_error_tool_results(self):
+        goldens = sorted(GOLDEN_ROOT.rglob("*.jsonl"))
+        self.assertTrue(goldens, f"no golden .jsonl files found under {GOLDEN_ROOT}")
+        offenders = []
+        for g in goldens:
+            counts = compute_error_counts([], parent_transcript=str(g))
+            total = (
+                counts["hook_blocks"]
+                + counts["tool_failures"]
+                + counts["tool_failures_unclassified"]
+            )
+            if total:
+                offenders.append((str(g), total))
+        self.assertEqual(
+            offenders, [],
+            f"golden checkpoints with is_error tool_results: {offenders}",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/benchmarks/tests/test_g1r_harness_fixes.py b/benchmarks/tests/test_g1r_harness_fixes.py
index 405c28da..8e66401b 100644
--- a/benchmarks/tests/test_g1r_harness_fixes.py
+++ b/benchmarks/tests/test_g1r_harness_fixes.py
@@ -12,6 +12,7 @@
 
 import hashlib
 import json
+import os
 import shutil
 import unittest
 from pathlib import Path
@@ -110,7 +111,50 @@ def test_prepare_fixtures_adds_containment_for_a_no_fixture_case(self):
         self.assertIn("do not create", result.prompt)
         workspace = self.run_sandbox / "workspace"
         self.assertTrue(workspace.is_dir())
-        self.assertTrue((workspace / "scripts" / "run_with_capture.sh").exists())
+
+    def test_prepare_fixtures_seeds_wrapper_at_base_dir_scripts(self):
+        # The wrapper must live at BASE_DIR-level scripts/ (isomorphic to the real
+        # repo), NOT under workspace/scripts/ — the mislocation drove every model
+        # family to construct {BASE_DIR}/scripts/run_with_capture.sh -> exit 127.
+        case = SimpleNamespace(
+            id="dc-01",
+            prompt="Please dispatch a research-executor to run a Monte Carlo sim.",
+        )
+        run_dispatch_compliance.prepare_run_sandbox(str(self.run_sandbox))
+        run_dispatch_compliance.prepare_fixtures(case, str(self.run_sandbox))
+
+        wrapper = self.run_sandbox / "scripts" / "run_with_capture.sh"
+        # (a) exists at the BASE_DIR-level location and is executable.
+        self.assertTrue(wrapper.exists(), f"wrapper missing at {wrapper}")
+        self.assertTrue(
+            os.access(wrapper, os.X_OK), f"wrapper not executable at {wrapper}"
+        )
+        # It must NOT be seeded at the old workspace/scripts/ location.
+        self.assertFalse(
+            (self.run_sandbox / "workspace" / "scripts" / "run_with_capture.sh").exists(),
+            "wrapper should no longer be seeded under workspace/scripts/",
+        )
+
+    def test_prompt_wrapper_path_is_consistent_with_filesystem(self):
+        # (b) The path the prompt promises for the wrapper must be the path that
+        # actually exists on disk (prompt promises X => filesystem has X).
+        case = SimpleNamespace(
+            id="dc-01",
+            prompt="Please dispatch a research-executor to run a Monte Carlo sim.",
+        )
+        run_dispatch_compliance.prepare_run_sandbox(str(self.run_sandbox))
+        result = run_dispatch_compliance.prepare_fixtures(case, str(self.run_sandbox))
+
+        promised = f"{self.run_sandbox}/scripts/run_with_capture.sh"
+        self.assertIn(
+            promised,
+            result.prompt,
+            "prompt must name the wrapper's actual location",
+        )
+        self.assertTrue(
+            Path(promised).exists(),
+            f"prompt promises {promised} but it does not exist on disk",
+        )
 
 
 # --- B2: purity validity gate ---
diff --git a/benchmarks/tests/test_probe_model_route.py b/benchmarks/tests/test_probe_model_route.py
index 84637c96..e1c66342 100644
--- a/benchmarks/tests/test_probe_model_route.py
+++ b/benchmarks/tests/test_probe_model_route.py
@@ -165,7 +165,7 @@ def test_help_calls_no_registry_network_preflight_or_executor_path(self):
         with patch.object(probe_model_route, "load_models") as load, \
                 patch.object(probe_model_route, "run_preflight") as preflight, \
                 patch.object(probe_model_route, "execute_run") as execute, \
-                patch("benchmarks.harness.route_provenance.urlopen") as network, \
+                patch("benchmarks.harness.route_provenance.build_opener") as network, \
                 redirect_stdout(io.StringIO()), redirect_stderr(io.StringIO()):
             with self.assertRaises(SystemExit) as stopped:
                 probe_model_route.main(["--help"])
diff --git a/benchmarks/tests/test_viewer_schema_loading.py b/benchmarks/tests/test_viewer_schema_loading.py
index 4680c2be..68597a4b 100644
--- a/benchmarks/tests/test_viewer_schema_loading.py
+++ b/benchmarks/tests/test_viewer_schema_loading.py
@@ -246,11 +246,190 @@ def _write_non_result_containers(self):
         malformed.parent.mkdir()
         malformed.write_text("{broken", encoding="utf-8")
 
+    def _write_timeout_set(self):
+        """A dedicated Phase-1 set exercising the v3.3.0 timeout-exclusion
+        chokepoint. Two Anthropic models share case ``mc-a``: the reference
+        ``Opus 4.8`` (mean duration 2.0s over 2 completed runs) and
+        ``Timeout Model`` (mean 5.0s over 2 completed runs). ``Timeout Model``
+        also carries two ``timed_out: True`` runs that must vanish everywhere:
+        a would-have-failed ``mc-a`` run (whose 99s latency and failing
+        criteria would skew duration/rates if kept) and the ONLY run for
+        ``mc-degenerate`` (an all-timed-out (case, model) cell that must not
+        crash and must leave no per_case entry)."""
+        root = self.results_dir / "20260720_000000"
+        self._write_json(root / "manifest.json", {
+            "daaf_git_sha": "c" * 40,
+            "config": {"reps": 1, "parallel": False},
+            "models": [
+                {"id": "opus-4-8", "name": "Opus 4.8", "provider": "anthropic"},
+                {"id": "timeout-model", "name": "Timeout Model",
+                 "provider": "anthropic"},
+            ],
+        })
+        self._write_json(root / "summary.json", {
+            "total_runs": 6,
+            "errored_runs": 0,
+            "total_cost_usd": 0,
+            "wall_time_s": 10,
+            "by_model": {
+                "Opus 4.8": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 2, "total": 2, "rate": 1.0},
+                    "all_criteria": {"passed": 2, "total": 2, "rate": 1.0},
+                }},
+                "Timeout Model": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 2, "total": 4, "rate": 0.5},
+                    "all_criteria": {"passed": 2, "total": 4, "rate": 0.5},
+                }},
+            },
+        })
+
+        def _run(run_dir, model, model_id, case_id, duration, timed_out,
+                 passed, inp, outp):
+            self._write_json(root / "runs" / run_dir / "result.json", {
+                "case_id": case_id,
+                "model": model,
+                "model_id": model_id,
+                "provider": "anthropic",
+                "rep": 0,
+                "turns": 1,
+                "computed_cost_usd": 0,
+                "input_tokens": inp,
+                "output_tokens": outp,
+                "cache_read_tokens": 0,
+                "cache_creation_tokens": 0,
+                "duration_s": duration,
+                "timed_out": timed_out,
+                "criteria": {"orchestrator_skill_loaded": {"passed": passed}},
+            })
+
+        # Reference model: 2 completed runs, mean duration 2.0s
+        _run("opus_0", "Opus 4.8", "opus-4-8", "mc-a", 2.0, False, True, 100, 10)
+        _run("opus_1", "Opus 4.8", "opus-4-8", "mc-a", 2.0, False, True, 100, 10)
+        # Timeout Model: 2 completed runs, mean duration 5.0s
+        _run("tm_ok_0", "Timeout Model", "timeout-model", "mc-a", 4.0, False, True, 200, 20)
+        _run("tm_ok_1", "Timeout Model", "timeout-model", "mc-a", 6.0, False, True, 200, 20)
+        # Timed-out, would-have-failed mc-a run (skews rates/duration if kept)
+        _run("tm_timeout", "Timeout Model", "timeout-model", "mc-a", 99.0, True, False, 999, 999)
+        # Timed-out ONLY run for mc-degenerate (all-timed-out cell)
+        _run("tm_degenerate", "Timeout Model", "timeout-model", "mc-degenerate", 99.0, True, False, 999, 999)
+
+    def _write_phase_timeout_set(self):
+        """A per-PHASE analogue of the per-case degeneracy in
+        ``_write_timeout_set``. Two Anthropic models span two phases. In the
+        ``mode_classification`` set both models complete (``Phase Gap Model``
+        is deliberately 1-of-2 perfect, so its sole surviving composite
+        component has a non-1.0 rate). In the ``post_confirmation`` set only
+        ``Coverage Model`` completes: ``Phase Gap Model``'s ONLY
+        post_confirmation run is ``timed_out: True``. After the load-time
+        timeout exclusion, ``Phase Gap Model`` has NO runs for the
+        post_confirmation eval group, so that entire composite component drops
+        for it — while the group itself survives because ``Coverage Model``
+        keeps it alive. This is the headline degeneracy the design claims but
+        the per-case ``_write_timeout_set`` never exercises: a model whose
+        WHOLE phase timed out drops that component and still renders via the
+        composite ``partial`` idiom (the group id absent from
+        ``components_present``, listed in ``components_missing``,
+        ``partial_data`` flagged)."""
+        def _phase_run(root, run_dir, model, model_id, case_id, marker,
+                       duration, timed_out, passed):
+            self._write_json(root / "runs" / run_dir / "result.json", {
+                "case_id": case_id,
+                "model": model,
+                "model_id": model_id,
+                "provider": "anthropic",
+                "rep": 0,
+                "turns": 1,
+                "computed_cost_usd": 0,
+                "input_tokens": 100,
+                "output_tokens": 10,
+                "cache_read_tokens": 0,
+                "cache_creation_tokens": 0,
+                "duration_s": duration,
+                "timed_out": timed_out,
+                "criteria": {marker: {"passed": passed}},
+            })
+
+        # --- Phase 1 (mode_classification) set: both models complete; Phase
+        # Gap Model is 1-of-2 perfect so its retained component rate is 0.5 ---
+        p1 = self.results_dir / "20260721_030303"
+        self._write_json(p1 / "manifest.json", {
+            "daaf_git_sha": "d" * 40,
+            "config": {"reps": 1, "parallel": False},
+            "models": [
+                {"id": "coverage-model", "name": "Coverage Model",
+                 "provider": "anthropic"},
+                {"id": "phase-gap-model", "name": "Phase Gap Model",
+                 "provider": "anthropic"},
+            ],
+        })
+        self._write_json(p1 / "summary.json", {
+            "total_runs": 3,
+            "errored_runs": 0,
+            "total_cost_usd": 0,
+            "wall_time_s": 5,
+            "by_model": {
+                "Coverage Model": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 1, "total": 1, "rate": 1.0},
+                    "all_criteria": {"passed": 1, "total": 1, "rate": 1.0},
+                }},
+                "Phase Gap Model": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 1, "total": 2, "rate": 0.5},
+                    "all_criteria": {"passed": 1, "total": 2, "rate": 0.5},
+                }},
+            },
+        })
+        _phase_run(p1, "cov_0", "Coverage Model", "coverage-model", "mc-a",
+                   "orchestrator_skill_loaded", 2.0, False, True)
+        _phase_run(p1, "gap_0", "Phase Gap Model", "phase-gap-model", "mc-a",
+                   "orchestrator_skill_loaded", 2.0, False, True)
+        _phase_run(p1, "gap_1", "Phase Gap Model", "phase-gap-model", "mc-a",
+                   "orchestrator_skill_loaded", 2.0, False, False)
+
+        # --- Phase 2 (post_confirmation) set: Coverage Model completes and
+        # keeps the group alive; Phase Gap Model's ONLY run here is timed-out,
+        # so the whole component drops for it after load-time exclusion ---
+        p2 = self.results_dir / "20260721_040404"
+        self._write_json(p2 / "manifest.json", {
+            "daaf_git_sha": "e" * 40,
+            "config": {"reps": 1, "parallel": False},
+            "models": [
+                {"id": "coverage-model", "name": "Coverage Model",
+                 "provider": "anthropic"},
+                {"id": "phase-gap-model", "name": "Phase Gap Model",
+                 "provider": "anthropic"},
+            ],
+        })
+        self._write_json(p2 / "summary.json", {
+            "total_runs": 2,
+            "errored_runs": 0,
+            "total_cost_usd": 0,
+            "wall_time_s": 5,
+            "by_model": {
+                "Coverage Model": {"criteria": {
+                    "read_data_onboarding_mode": {"passed": 1, "total": 1, "rate": 1.0},
+                    "all_criteria": {"passed": 1, "total": 1, "rate": 1.0},
+                }},
+                "Phase Gap Model": {"criteria": {
+                    "read_data_onboarding_mode": {"passed": 0, "total": 1, "rate": 0.0},
+                    "all_criteria": {"passed": 0, "total": 1, "rate": 0.0},
+                }},
+            },
+        })
+        _phase_run(p2, "cov_p2_0", "Coverage Model", "coverage-model", "mc-b",
+                   "read_data_onboarding_mode", 3.0, False, True)
+        # Phase Gap Model's ONLY post_confirmation run is timed-out -> excluded
+        # at load, leaving it with no completed runs in this whole phase.
+        _phase_run(p2, "gap_p2_timeout", "Phase Gap Model", "phase-gap-model",
+                   "mc-b", "read_data_onboarding_mode", 99.0, True, False)
+
     def _load(self):
         stderr = io.StringIO()
         with redirect_stderr(stderr):
             result_sets = viewer.load_result_sets(str(self.results_dir))
-            runs, anth_tokens = viewer.load_runs(
+            # load_runs returns a 3-tuple as of v3.3.0; the timeout-exclusion
+            # count is asserted directly in the dedicated timeout test (which
+            # captures all three returns), so it is discarded here.
+            runs, anth_tokens, _ = viewer.load_runs(
                 str(self.results_dir), result_sets, cases={}
             )
         return result_sets, runs, anth_tokens, stderr.getvalue()
@@ -272,7 +451,7 @@ def test_schema_v1_and_absent_version_remain_compatible(self):
         self.assertTrue(legacy_run["billing_grade_cost_eligible"])
         self.assertEqual("perfect", legacy_run["grade"])
         self.assertEqual(1, anth_tokens["Legacy Model"]["n"])
-        self.assertIn("Ignoring reserved non-phase results container: probes", warnings)
+        self.assertIn("Ignoring non-phase results reserved container: probes", warnings)
 
     def test_missing_legacy_cost_remains_null_instead_of_zero(self):
         root = self.results_dir / "20260102_010101"
@@ -380,7 +559,7 @@ def test_secret_and_raw_extras_do_not_enter_embedded_payload(self):
         )
         self.assertNotIn("cli_model_usage", subscription_run["usage_observed"])
         self.assertEqual(2, bundle["embedded_schema_contract_version"])
-        self.assertEqual("3.2.0", bundle["generator_version"])
+        self.assertEqual("3.7.1", bundle["generator_version"])
 
     def test_subscription_cost_incompatibility_retains_behavioral_scores(self):
         result_sets, runs, anth_tokens, _ = self._load()
@@ -445,6 +624,337 @@ def test_generator_help_is_side_effect_free(self):
         load.assert_not_called()
         makedirs.assert_not_called()
 
+    def test_timed_out_runs_are_excluded_from_data_and_all_metrics(self):
+        self._write_timeout_set()
+        with redirect_stderr(io.StringIO()):
+            result_sets = viewer.load_result_sets(
+                str(self.results_dir), filter_timestamps=["20260720_000000"]
+            )
+            runs, anth_tokens, n_timed_out = viewer.load_runs(
+                str(self.results_dir), result_sets, cases={}
+            )
+
+        # (6) The 3rd return equals the number of injected timed-out runs.
+        self.assertEqual(2, n_timed_out)
+
+        # (3) Timed-out runs never enter the returned runs list (the embedded
+        # DATA payload), and the timed_out flag is not carried onto records.
+        self.assertEqual(4, len(runs))
+        self.assertTrue(all(not run.get("timed_out") for run in runs))
+        self.assertNotIn("timed_out", runs[0])
+        # The all-timed-out case_id is absent from the loaded runs entirely.
+        self.assertEqual({"mc-a"}, {run["case_id"] for run in runs})
+        # (3) Excluded from the Anthropic token aggregation: n counts completed
+        # runs only (the 99999-token timed-out run would inflate it if kept).
+        self.assertEqual(2, anth_tokens["Timeout Model"]["n"])
+        self.assertEqual(2, anth_tokens["Opus 4.8"]["n"])
+
+        precomputed = viewer.build_precomputed(
+            result_sets,
+            cases={},
+            runs=runs,
+            generation_params={"fixture": True},
+            model_pricing={},
+            anth_token_totals=anth_tokens,
+            reconciliation=None,
+        )
+
+        # (3) per_model_phase counts and both rates reflect completed runs only.
+        tm_cell = precomputed["per_model_phase"]["Timeout Model"]["mode_classification"]
+        self.assertEqual(2, tm_cell["n_runs"])
+        self.assertEqual(2, tm_cell["perfect_count"])
+        self.assertEqual(1.0, tm_cell["perfect_rate"])
+        self.assertEqual(1.0, tm_cell["hard_rate"])
+
+        # (3) per_case excludes timed-out runs; (3) the degenerate all-timed-out
+        # (case, model) cell produces no crash and simply leaves no per_case
+        # entry — the composite/partial idioms handle the now-empty cell.
+        self.assertEqual(4, precomputed["per_case"]["mc-a"]["n_runs"])
+        self.assertEqual(1.0, precomputed["per_case"]["mc-a"]["perfect_rate"])
+        self.assertNotIn("mc-degenerate", precomputed["per_case"])
+
+        # (3b) v3.7.0 schema-additive consistency fields: cells_all_agree /
+        # rate_agree computed over multi-rep (phase, case) cells. The fixture's
+        # "Timeout Model" has one multi-rep cell (2 completed reps, both
+        # graded perfect) -> identical grades -> full agreement.
+        tm_cons = precomputed["consistency"]["Timeout Model"]
+        self.assertEqual(1, tm_cons["cells_all_agree"])
+        self.assertEqual(1.0, tm_cons["rate_agree"])
+
+        # (4) PRECOMPUTED.duration mirrors cost.battery, over completed runs.
+        duration = precomputed["duration"]
+        dur_models = duration["models"]
+        # est_duration_per_run == mean duration_s over completed runs
+        self.assertEqual(2.0, dur_models["Opus 4.8"]["est_duration_per_run"])
+        self.assertEqual(5.0, dur_models["Timeout Model"]["est_duration_per_run"])
+        self.assertEqual(2, dur_models["Timeout Model"]["n_runs"])
+        # battery_size == distinct completed case_ids (mc-degenerate excluded)
+        self.assertEqual(1, duration["battery_size"])
+        # est_battery_duration == est_duration_per_run x battery_size
+        self.assertEqual(5.0, dur_models["Timeout Model"]["est_battery_duration"])
+        # duration_multiplier_vs_ref is vs "Opus 4.8" (reference == 1.0)
+        self.assertEqual("Opus 4.8", duration["reference_model"])
+        self.assertEqual(1.0, dur_models["Opus 4.8"]["duration_multiplier_vs_ref"])
+        self.assertEqual(2.5, dur_models["Timeout Model"]["duration_multiplier_vs_ref"])
+        # (4) The SEPARATE duration.frontiers[basis][metric] block is present.
+        self.assertIn("composite", duration["frontiers"])
+        self.assertIn("perfect", duration["frontiers"]["composite"])
+        self.assertIn("hard", duration["frontiers"]["composite"])
+
+        # (5) Removed timeout surfaces are gone from PRECOMPUTED.
+        self.assertNotIn("timeout_by_model", precomputed)
+        self.assertNotIn("n_timed_out", precomputed["totals"])
+        # totals.total_runs counts completed runs only.
+        self.assertEqual(4, precomputed["totals"]["total_runs"])
+
+    def test_completed_early_substitutes_score_complete_seconds_in_duration(self):
+        """The duration-aggregate contribution rule for early-stopped runs
+        (README § 8): a ``completed_early`` run carrying ``score_complete_seconds``
+        contributes THAT value (a time-to-demonstrated-compliance measure), not
+        its truncated ``duration_s`` and not an exclusion; a ``completed_early``
+        run WITHOUT the field falls through to the documented excluded path. This
+        exercises the real load_runs -> build_precomputed path (no mocks) and is
+        the seam the field-carry BLOCKER broke: load_runs must surface
+        ``score_complete_seconds`` onto the run record for the substitution to fire.
+        """
+        root = self.results_dir / "20260722_090909"
+        self._write_json(root / "manifest.json", {
+            "daaf_git_sha": "f" * 40,
+            "config": {"reps": 1, "parallel": False},
+            "models": [
+                {"id": "opus-4-8", "name": "Opus 4.8", "provider": "anthropic"},
+                {"id": "early-model", "name": "Early Model",
+                 "provider": "anthropic"},
+            ],
+        })
+        self._write_json(root / "summary.json", {
+            "total_runs": 3,
+            "errored_runs": 0,
+            "total_cost_usd": 0,
+            "wall_time_s": 10,
+            "by_model": {
+                "Opus 4.8": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 1, "total": 1, "rate": 1.0},
+                    "all_criteria": {"passed": 1, "total": 1, "rate": 1.0},
+                }},
+                "Early Model": {"criteria": {
+                    "orchestrator_skill_loaded": {"passed": 2, "total": 2, "rate": 1.0},
+                    "all_criteria": {"passed": 2, "total": 2, "rate": 1.0},
+                }},
+            },
+        })
+
+        def _early_run(run_dir, model, model_id, duration, status,
+                       score_complete):
+            record = {
+                "case_id": "mc-a",
+                "model": model,
+                "model_id": model_id,
+                "provider": "anthropic",
+                "rep": 0,
+                "turns": 1,
+                "computed_cost_usd": 0,
+                "input_tokens": 100,
+                "output_tokens": 10,
+                "cache_read_tokens": 0,
+                "cache_creation_tokens": 0,
+                "duration_s": duration,
+                "timed_out": False,
+                "status": status,
+                "criteria": {"orchestrator_skill_loaded": {"passed": True}},
+            }
+            if score_complete is not None:
+                record["score_complete_seconds"] = score_complete
+            self._write_json(root / "runs" / run_dir / "result.json", record)
+
+        # Reference model: one normal completed run, duration 2.0s.
+        _early_run("opus_0", "Opus 4.8", "opus-4-8", 2.0, "completed", None)
+        # Early Model, run WITH the field: truncated duration_s=50.0 must be
+        # ignored in favor of score_complete_seconds=7.0.
+        _early_run("early_with", "Early Model", "early-model", 50.0,
+                   "completed_early", 7.0)
+        # Early Model, run WITHOUT the field: must be EXCLUDED (not counted as
+        # its truncated duration_s=60.0, which would otherwise pull the mean).
+        _early_run("early_without", "Early Model", "early-model", 60.0,
+                   "completed_early", None)
+
+        with redirect_stderr(io.StringIO()):
+            result_sets = viewer.load_result_sets(
+                str(self.results_dir), filter_timestamps=["20260722_090909"]
+            )
+            runs, anth_tokens, _ = viewer.load_runs(
+                str(self.results_dir), result_sets, cases={}
+            )
+
+        # load_runs must surface score_complete_seconds onto the run record (the
+        # BLOCKER: absent this field the substitution is dead code and every
+        # completed_early run is dropped from the duration aggregate).
+        early_with = next(r for r in runs if r["model"] == "Early Model"
+                          and r["score_complete_seconds"] is not None)
+        self.assertEqual(7.0, early_with["score_complete_seconds"])
+        early_without = next(r for r in runs if r["model"] == "Early Model"
+                             and r["score_complete_seconds"] is None)
+        self.assertIsNone(early_without["score_complete_seconds"])
+
+        precomputed = viewer.build_precomputed(
+            result_sets,
+            cases={},
+            runs=runs,
+            generation_params={"fixture": True},
+            model_pricing={},
+            anth_token_totals=anth_tokens,
+            reconciliation=None,
+        )
+        dur_models = precomputed["duration"]["models"]
+        # Substitution fired: mean over the ONE contributing run == 7.0
+        # (NOT 50.0 duration_s, NOT (50+60)/2 = 55.0, NOT excluded/absent).
+        self.assertIn("Early Model", dur_models)
+        self.assertEqual(1, dur_models["Early Model"]["n_runs"])
+        self.assertEqual(7.0, dur_models["Early Model"]["est_duration_per_run"])
+        self.assertEqual(2.0, dur_models["Opus 4.8"]["est_duration_per_run"])
+
+    def test_all_timed_out_phase_drops_component_and_composite_renders_partial(self):
+        # Companion to the per-CASE degeneracy above: exercises an all-timed-out
+        # per-PHASE cell. The degenerate set flows through the shared _load()
+        # path (alongside the setUp fixtures), then the REAL build_precomputed
+        # path — no mocks — must not raise while dropping one model's whole
+        # phase component and rendering it via the composite partial idiom.
+        self._write_phase_timeout_set()
+        result_sets, runs, anth_tokens, _ = self._load()
+
+        precomputed = viewer.build_precomputed(
+            result_sets,
+            cases={},
+            runs=runs,
+            generation_params={"fixture": True},
+            model_pricing={},
+            anth_token_totals=anth_tokens,
+            reconciliation=None,
+        )
+
+        pmp = precomputed["per_model_phase"]
+        composite = precomputed["composite"]
+
+        # The all-timed-out phase leaves NO per_model_phase cell for that group
+        # (the model retains its mode_classification cell from the other phase)...
+        self.assertIn("mode_classification", pmp["Phase Gap Model"])
+        self.assertNotIn("post_confirmation", pmp["Phase Gap Model"])
+        # ...while the group still EXISTS in the corpus, kept alive by the model
+        # that completed a run in it — so this is a genuine dropped component,
+        # not an absent group.
+        self.assertIn("post_confirmation", pmp["Coverage Model"])
+
+        # The dropped-component model still renders, via the composite partial
+        # idiom: the group id is absent from components_present, listed in
+        # components_missing, and the entry is flagged partial_data.
+        self.assertIn("Phase Gap Model", composite)
+        gap = composite["Phase Gap Model"]
+        self.assertIn("mode_classification", gap["components_present"])
+        self.assertNotIn("post_confirmation", gap["components_present"])
+        self.assertIn("post_confirmation", gap["components_missing"])
+        self.assertTrue(gap["partial_data"])
+
+        # The composite score is the mean over PRESENT components only (missing
+        # components are excluded, not zero-filled): 0.5 over the sole
+        # mode_classification component (rate 0.5), NOT 0.25 as a zero-fill of
+        # the missing post_confirmation component would yield.
+        self.assertEqual(0.5, gap["score"])
+
+        # The coverage model that kept the group alive has full coverage: the
+        # component is present and it is not flagged partial.
+        self.assertIn(
+            "post_confirmation",
+            composite["Coverage Model"]["components_present"],
+        )
+        self.assertFalse(composite["Coverage Model"]["partial_data"])
+
+    def test_legacy_instant_exit_stub_excluded_but_errored_and_valid_kept(self):
+        """v3.6.1 load-time guard: a LEGACY instant-exit stub (status absent,
+        not timed out, error null, output_tokens null, 0/N criteria) is dropped
+        at load — mirroring the corpus parity scan — so it can never re-enter
+        rep counts or score averages. Two sibling legacy runs prove the screen
+        is narrow: one with output_tokens present is KEPT, and an errored
+        null-output run is KEPT with its handling UNCHANGED from pre-3.6.1 (the
+        loader has never screened legacy runs on output_tokens; only the pure
+        stub signature — null output AND null error — is newly excluded)."""
+        root = self.results_dir / "20260729_120000"
+        self._write_json(root / "manifest.json", {
+            "daaf_git_sha": "a" * 40,
+            "config": {"reps": 3, "parallel": False},
+            "models": [
+                {"id": "stub-model", "name": "Stub Legacy Model",
+                 "provider": "anthropic"},
+            ],
+        })
+        self._write_json(root / "summary.json", {
+            "total_runs": 3,
+            "errored_runs": 1,
+            "total_cost_usd": 0,
+            "wall_time_s": 6,
+            "by_model": {
+                "Stub Legacy Model": {"criteria": {
+                    "orchestrator_skill_loaded":
+                        {"passed": 1, "total": 3, "rate": 0.333},
+                    "all_criteria": {"passed": 1, "total": 3, "rate": 0.333},
+                }},
+            },
+        })
+
+        def _legacy_run(run_dir, rep, output_tokens, error, passed):
+            # NOTE: no "status" key is written — a legacy record (status
+            # absent/null) is exactly the branch the v3.6.1 stub screen targets.
+            self._write_json(root / "runs" / run_dir / "result.json", {
+                "case_id": "mc-a",
+                "model": "Stub Legacy Model",
+                "model_id": "stub-model",
+                "provider": "anthropic",
+                "rep": rep,
+                "turns": 1,
+                "computed_cost_usd": 0,
+                "input_tokens": 100,
+                "output_tokens": output_tokens,
+                "cache_read_tokens": 0,
+                "cache_creation_tokens": 0,
+                "duration_s": 2.0,
+                "timed_out": False,
+                "error": error,
+                "criteria": {"orchestrator_skill_loaded": {"passed": passed}},
+            })
+
+        # (1) The instant-exit stub: null output, no error, criterion fails.
+        _legacy_run("stub_rep0", 0, None, None, False)
+        # (2) Sibling legacy run WITH output_tokens present -> still loaded.
+        _legacy_run("valid_rep1", 1, 10, None, True)
+        # (3) Errored legacy null-output run -> handling UNCHANGED (kept).
+        _legacy_run("errored_rep2", 2, None, "TimeoutError: watchdog fired", False)
+
+        stderr = io.StringIO()
+        with redirect_stderr(stderr):
+            result_sets = viewer.load_result_sets(
+                str(self.results_dir), filter_timestamps=["20260729_120000"]
+            )
+            runs, anth_tokens, n_excluded = viewer.load_runs(
+                str(self.results_dir), result_sets, cases={}
+            )
+
+        loaded_dirs = {run["run_dir"] for run in runs}
+        # The stub is gone from the loaded runs (and thus every downstream
+        # metric — rep counts, per_case, composite, cost/duration).
+        self.assertNotIn("stub_rep0", loaded_dirs)
+        # The output-bearing sibling and the errored null-output run are kept.
+        self.assertIn("valid_rep1", loaded_dirs)
+        self.assertIn("errored_rep2", loaded_dirs)
+        self.assertEqual(2, len(runs))
+        # The stub is folded into the No-signal excluded count and emits a NOTE.
+        self.assertEqual(1, n_excluded)
+        self.assertIn("legacy instant-exit stub", stderr.getvalue())
+        self.assertIn("stub_rep0", stderr.getvalue())
+        # The errored run's real failure signal is carried through untouched —
+        # its handling is identical to pre-3.6.1 (loaded, error preserved).
+        errored = next(r for r in runs if r["run_dir"] == "errored_rep2")
+        self.assertEqual("TimeoutError: watchdog fired", errored["error"])
+        self.assertIsNone(errored["status"])
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/benchmarks/tests/test_viewer_schema_rendering.py b/benchmarks/tests/test_viewer_schema_rendering.py
index 873c381a..57e676f2 100644
--- a/benchmarks/tests/test_viewer_schema_rendering.py
+++ b/benchmarks/tests/test_viewer_schema_rendering.py
@@ -29,6 +29,10 @@
     "VIEWER_RAW_ENVIRONMENT_SECRET",
     "VIEWER_PROBE_SECRET",
 )
+# A unique session_id on a timed_out run. session_id IS carried onto embedded
+# run records, so this string reaches DATA/HTML only if the timed-out run is
+# NOT excluded at load — its absence proves v3.3.0 timeout-blindness.
+TIMED_OUT_SESSION_SENTINEL = "VIEWER_TIMED_OUT_RUN_SENTINEL"
 
 
 class _StructureProbe(HTMLParser):
@@ -132,7 +136,9 @@ def _write_subscription_set(self, results_dir, timestamp):
         })
         self._write_json(root / "summary.json", {
             "schema_version": 2,
-            "total_runs": 1,
+            # 2 on-disk runs: one completed, one timed_out. Kept equal to
+            # disk_run_count so provenance shows no run-count discrepancy.
+            "total_runs": 2,
             "errored_runs": 0,
             "total_cost_usd": None,
             "wall_time_s": 3,
@@ -264,6 +270,25 @@ def _write_subscription_set(self, results_dir, timestamp):
             },
             "raw_json": {"secret": SECRET_SENTINELS[1]},
         })
+        # A timed_out run in the same set. It carries a unique session_id
+        # sentinel and would-have-failed criteria; v3.3.0 drops it at the
+        # load chokepoint, so neither the sentinel nor the run reaches the
+        # embedded DATA payload or the rendered HTML.
+        self._write_json(root / "runs" / "subscription_timeout_1" / "result.json", {
+            "schema_version": 2,
+            "case_id": "dc-subscription",
+            "model": "Luna Subscription",
+            "model_id": "gpt-5.6-luna",
+            "provider": "chatgpt-subscription",
+            "rep": 0,
+            "session_id": TIMED_OUT_SESSION_SENTINEL,
+            "turns": 1,
+            "computed_cost_usd": None,
+            "duration_s": 0,
+            "timed_out": True,
+            "criteria": {"agent_dispatched": {"passed": False}},
+            "subagent_criteria": {"subagent_writes_script": {"passed": False}},
+        })
 
     def _write_probe_container(self, results_dir):
         self._write_json(results_dir / "probes" / "probe-a" / "probe.json", {
@@ -275,7 +300,9 @@ def _write_probe_container(self, results_dir):
     def _load_payload(self, results_dir):
         with redirect_stderr(io.StringIO()):
             result_sets = viewer.load_result_sets(str(results_dir))
-            runs, anth_tokens = viewer.load_runs(str(results_dir), result_sets, cases={})
+            # load_runs returns a 3-tuple as of v3.3.0 (runs, anth token totals,
+            # timeout-exclusion count); the excluded count is not needed here.
+            runs, anth_tokens, _ = viewer.load_runs(str(results_dir), result_sets, cases={})
         data_bundle = viewer.build_data_bundle(
             result_sets,
             cases={},
@@ -310,7 +337,6 @@ def _node_render_payload(self):
         main_script = main_script.replace(
             "\ninit();\n",
             "\nglobalThis.__DAAF_RENDER__={renderRunDetail:renderRunDetail," \
-            "renderProvenance:renderProvenance," \
             "costOmissionNoteHtml:costOmissionNoteHtml};\n",
         )
         node_source = r'''
@@ -353,16 +379,13 @@ def _node_render_payload(self):
   if(state==="unverifiable") variant.child_model_purity.incompleteness_reason="child_transcript_unreadable";
   purity[state]=__DAAF_RENDER__.renderRunDetail(variant);
 });
-var provenanceContainer={innerHTML:""};
-__DAAF_RENDER__.renderProvenance(provenanceContainer);
 process.stdout.write(JSON.stringify({
   legacy:__DAAF_RENDER__.renderRunDetail(legacy),
   subscription:__DAAF_RENDER__.renderRunDetail(subscription),
   exact:__DAAF_RENDER__.renderRunDetail(exact),
   actualZero:__DAAF_RENDER__.renderRunDetail(actualZero),
   purity:purity,
-  omission:__DAAF_RENDER__.costOmissionNoteHtml(),
-  provenance:provenanceContainer.innerHTML
+  omission:__DAAF_RENDER__.costOmissionNoteHtml()
 }));
 '''
         runner_path = TEST_SCRATCH / "render_template.js"
@@ -504,22 +527,31 @@ def test_cost_omission_note_retains_behavioral_scores(self):
         self.assertIn("remains in behavioral score views", omission)
         self.assertIn("omitted from billing-grade cost charts", omission)
         self.assertIn("not invoiced", omission)
-        self.assertIn("Behavioral scores retained", rendered["provenance"])
-        self.assertIn("Excluded from billing-grade cost views", rendered["provenance"])
-
-    def test_provenance_surfaces_schema_routes_and_summary_coverage(self):
-        provenance = self._node_render_payload()["provenance"]
-        self.assertIn("v1", provenance)
-        self.assertIn("legacy schema v1", provenance)
-        self.assertIn("default absent version", provenance)
-        self.assertIn("v2", provenance)
-        self.assertIn("schema v2", provenance)
-        self.assertIn("chatgpt-subscription", provenance)
-        self.assertIn("chatgpt_subscription_shim", provenance)
-        self.assertIn("scenario only: 1", provenance)
-        self.assertIn("verified: 1", provenance)
-        self.assertIn("failed: 0", provenance)
-        self.assertIn("Archived total", provenance)
+
+    def test_provenance_data_pipeline_intact_but_section_removed(self):
+        # v3.6.0 removed the rendered Provenance SECTION (renderProvenance,
+        # its TOC link, sectionRenderers/SECTION_IDS entries) but explicitly
+        # kept the provenance DATA pipeline. This test guards both halves:
+        # (a) PRECOMPUTED.provenance is still built with its schema fields and
+        # is still embedded in the generated HTML for inspection, and
+        # (b) the rendered section, its TOC link, and its renderer are gone.
+        provenance = self.precomputed["provenance"]
+        self.assertTrue(provenance, "provenance data pipeline must stay intact")
+        first = provenance[0]
+        for field in (
+            "timestamp", "phase", "schema_version", "providers",
+            "purity_coverage", "billing_grade_cost_eligible",
+            "disk_run_count", "summary_total_runs", "run_count_discrepancy",
+        ):
+            self.assertIn(field, first)
+        providers_seen = {p for entry in provenance for p in entry["providers"]}
+        self.assertIn("chatgpt-subscription", providers_seen)
+        # The embedded PRECOMPUTED payload still carries provenance (inspectable).
+        self.assertIn('"provenance"', self.generated_html)
+        # The rendered section and its wiring are gone.
+        self.assertNotIn('id="provenance"', self.generated_html)
+        self.assertNotIn("renderProvenance", self.generated_html)
+        self.assertNotIn('data-target="provenance"', self.generated_html)
 
     def test_probe_and_secret_sentinels_never_enter_generated_html(self):
         timestamps = [entry["timestamp"] for entry in self.data_bundle["result_sets"]]
@@ -535,6 +567,24 @@ def test_probe_and_secret_sentinels_never_enter_generated_html(self):
         ):
             self.assertNotIn(forbidden_key, self.generated_html)
 
+    def test_timed_out_runs_absent_from_embedded_data_and_rendered_html(self):
+        # The set carries one completed run and one timed_out run; v3.3.0
+        # excludes the timed-out run at load, so exactly one Luna Subscription
+        # run reaches the embedded DATA payload.
+        embedded = self.data_bundle["runs"]
+        subscription_runs = [
+            run for run in embedded if run["provider"] == "chatgpt-subscription"
+        ]
+        self.assertEqual(1, len(subscription_runs))
+        self.assertFalse(any(run.get("timed_out") for run in embedded))
+        # The timed-out run's session_id sentinel would appear in DATA/HTML if
+        # the run were embedded — its absence confirms load-time exclusion.
+        self.assertNotIn(
+            TIMED_OUT_SESSION_SENTINEL,
+            json.dumps(self.data_bundle),
+        )
+        self.assertNotIn(TIMED_OUT_SESSION_SENTINEL, self.generated_html)
+
     def test_inline_javascript_passes_node_syntax_check(self):
         scripts = self._inline_scripts(self.generated_html)
         self.assertGreaterEqual(len(scripts), 3)
diff --git a/benchmarks/tests/test_watchdog.py b/benchmarks/tests/test_watchdog.py
new file mode 100644
index 00000000..1a2941c8
--- /dev/null
+++ b/benchmarks/tests/test_watchdog.py
@@ -0,0 +1,369 @@
+"""Deterministic unit tests for the Dispatch B run-lifecycle watchdog.
+
+Exercises the executor's watchdog decision logic WITHOUT launching claude:
+each test drives ``_watchdog_wait`` against a real but trivial subprocess
+(``python -c "sleep"``) plus injected transcript-lookup functions and an
+injected clock (``now_fn``). Decoupling the decision clock (``now_fn``) from the
+real poll interval keeps the tests fast: the real ``proc.wait(timeout=poll)``
+uses a tiny 0.05s poll while ``now_fn`` fast-forwards elapsed time to cross the
+90s / 330s thresholds instantly.
+
+Covers:
+  - early-stop confirmation-poll path (requires two consecutive True readings)
+  - early-stop scorer-exception catch path (raise -> "not done", never kills)
+  - early-stop score_complete_seconds recording (first-hit elapsed, not confirm)
+  - stall consecutive-reads path (>330s staleness, two reads)
+  - first-activity path (no transcript at all past 90s)
+  - transcript-lookup-exception counting (regression != model stall)
+  - natural-completion path (process exits on its own -> reason None + stdout)
+  - wall-clock timeout backstop
+  - no-new-params backward-compat (RunConfig defaults leave the watchdog off)
+
+All scratch lives under benchmarks/tests/ (no /tmp writes).
+"""
+
+import subprocess
+import sys
+import time
+import unittest
+from pathlib import Path
+
+from benchmarks.harness import executor
+from benchmarks.harness.executor import _watchdog_wait, _transcript_recency
+from benchmarks.harness.models import RunConfig, TestCase, ModelConfig
+
+
+SCRATCH = Path(__file__).parent / "_watchdog_scratch"
+
+
+def _cfg(**overrides):
+    """Build a RunConfig with a throwaway test_case/model and watchdog fields."""
+    tc = TestCase(id="wd-01", category="x", prompt="p", expected={})
+    model = ModelConfig(id="m", name="m")
+    base = dict(
+        test_case=tc,
+        model=model,
+        run_index=0,
+        watchdog_poll_seconds=0.05,
+    )
+    base.update(overrides)
+    return RunConfig(**base)
+
+
+def _sleep_proc(seconds=30, prelude=""):
+    """Launch a long-running child with piped stdout/stderr.
+
+    ``prelude`` is python printed before the sleep so tests can assert the
+    reader threads captured stdout even after the process is killed.
+    """
+    code = f"{prelude}import time; time.sleep({seconds})"
+    return subprocess.Popen(
+        [sys.executable, "-c", code],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+
+class _Clock:
+    """Deterministic monotone clock: each call advances by ``step`` seconds."""
+
+    def __init__(self, start, step):
+        self.t = start
+        self.step = step
+
+    def __call__(self):
+        self.t += self.step
+        return self.t
+
+
+class WatchdogTest(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        SCRATCH.mkdir(parents=True, exist_ok=True)
+
+    def setUp(self):
+        # Track every spawned child so tearDown can close its pipes and reap it,
+        # silencing ResourceWarnings from GC-time pipe finalization.
+        self._procs = []
+
+    def _spawn(self, *args, **kwargs):
+        proc = _sleep_proc(*args, **kwargs)
+        self._procs.append(proc)
+        return proc
+
+    def tearDown(self):
+        for proc in self._procs:
+            if proc.poll() is None:
+                proc.kill()
+                try:
+                    proc.wait(timeout=5)
+                except subprocess.TimeoutExpired:
+                    pass
+            for pipe in (proc.stdout, proc.stderr):
+                try:
+                    if pipe is not None:
+                        pipe.close()
+                except OSError:
+                    pass
+        for p in SCRATCH.glob("*"):
+            try:
+                p.unlink()
+            except OSError:
+                pass
+
+    # --- Early stop: confirmation poll required ---
+
+    def test_early_stop_requires_confirmation_poll(self):
+        calls = {"n": 0}
+
+        def check(_session_id):
+            calls["n"] += 1
+            return True  # done from the very first poll
+
+        proc = self._spawn(30, prelude="print('HELLO', flush=True)\n")
+        start = 1000.0
+        cfg = _cfg(
+            early_stop_check=check,
+            stall_detection=False,
+        )
+        # now_fn stays well below the 900s deadline.
+        clock = _Clock(start, step=1.0)
+        stdout, stderr, reason, diag = _watchdog_wait(
+            proc, cfg, "sess", start, timeout=900, now_fn=clock,
+        )
+        self.assertEqual(reason, "early_stop")
+        # Two polls: first sets pending, second confirms.
+        self.assertGreaterEqual(calls["n"], 2)
+        # Reader thread captured stdout even though the proc was killed.
+        self.assertIn("HELLO", stdout)
+        self.assertIsNotNone(proc.poll())  # process was terminated
+
+    def test_early_stop_resets_on_intermittent_false(self):
+        # True, False, True, True -> must NOT stop until two consecutive Trues.
+        seq = iter([True, False, True, True, True, True])
+
+        def check(_s):
+            try:
+                return next(seq)
+            except StopIteration:
+                return True
+
+        proc = self._spawn(30)
+        start = 0.0
+        cfg = _cfg(early_stop_check=check, stall_detection=False)
+        clock = _Clock(start, step=1.0)
+        _, _, reason, _ = _watchdog_wait(
+            proc, cfg, "s", start, timeout=900, now_fn=clock,
+        )
+        self.assertEqual(reason, "early_stop")
+
+    # --- Stall: consecutive reads over the 330s threshold ---
+
+    def test_stall_consecutive_reads(self):
+        # A parent transcript exists but its mtime is far in the past relative to
+        # the injected clock, so every poll is a stalled read.
+        parent = SCRATCH / "parent.jsonl"
+        parent.write_text('{"type":"assistant"}\n')
+        old_mtime = 500.0
+        import os
+        os.utime(parent, (old_mtime, old_mtime))
+
+        def find_parent(_s):
+            return parent
+
+        def find_subs(_s):
+            return []
+
+        proc = self._spawn(30)
+        start = 500.0
+        cfg = _cfg(
+            stall_detection=True,
+            stall_threshold_seconds=330,
+            stall_consecutive_reads=2,
+            early_stop_check=None,
+        )
+        # Clock jumps to 500+400=900 on first read (staleness 400 > 330), etc.
+        clock = _Clock(start, step=400.0)
+        _, _, reason, diag = _watchdog_wait(
+            proc, cfg, "s", start, timeout=100000,
+            find_parent=find_parent, find_subs=find_subs, now_fn=clock,
+        )
+        self.assertEqual(reason, "stalled")
+        self.assertGreaterEqual(diag["stall_reads"], 2)
+        self.assertIsNotNone(proc.poll())
+
+    def test_stall_does_not_fire_on_single_read(self):
+        # First read stale, second read fresh -> counter resets, no stall; the
+        # process is then reaped by the wall-clock timeout instead.
+        parent = SCRATCH / "parent2.jsonl"
+        parent.write_text("{}\n")
+        import os
+
+        state = {"poll": 0}
+
+        def find_parent(_s):
+            # Make the file "fresh" on the 2nd poll by stamping mtime to ~now.
+            state["poll"] += 1
+            if state["poll"] == 1:
+                os.utime(parent, (100.0, 100.0))  # very stale
+            else:
+                os.utime(parent, (10_000.0, 10_000.0))  # fresh vs clock below
+            return parent
+
+        proc = self._spawn(30)
+        start = 100.0
+        cfg = _cfg(
+            stall_detection=True,
+            stall_threshold_seconds=330,
+            stall_consecutive_reads=2,
+        )
+        # Clock: poll1 ->  ~600 (staleness 500, stale); poll2 -> ~1100
+        # (staleness vs 10000 mtime is negative -> fresh); poll3 crosses deadline.
+        clock = _Clock(start, step=500.0)
+        _, _, reason, diag = _watchdog_wait(
+            proc, cfg, "s", start, timeout=1200,
+            find_parent=find_parent, find_subs=lambda _s: [], now_fn=clock,
+        )
+        self.assertEqual(reason, "timeout")
+        self.assertLess(diag["stall_reads"], 2)
+        self.assertIsNotNone(proc.poll())
+
+    # --- First-activity: no transcript at all past 90s ---
+
+    def test_first_activity_stall(self):
+        proc = self._spawn(30)
+        start = 0.0
+        cfg = _cfg(
+            stall_detection=True,
+            stall_first_activity_seconds=90,
+            stall_consecutive_reads=2,
+        )
+        # No transcript ever appears; clock jumps 100s each poll (>90 first-act).
+        clock = _Clock(start, step=100.0)
+        _, _, reason, diag = _watchdog_wait(
+            proc, cfg, "s", start, timeout=100000,
+            find_parent=lambda _s: None, find_subs=lambda _s: [], now_fn=clock,
+        )
+        self.assertEqual(reason, "stalled")
+        self.assertGreaterEqual(diag["stall_reads"], 2)
+
+    # --- Natural completion: process exits before any watchdog action ---
+
+    def test_natural_completion_returns_none(self):
+        proc = self._spawn(0.15, prelude="print('DONE', flush=True)\n")
+        start = time.time()
+        cfg = _cfg(stall_detection=True, early_stop_check=None)
+        # Fresh transcript so no stall; real clock is fine here.
+        parent = SCRATCH / "fresh.jsonl"
+        parent.write_text("{}\n")
+        stdout, _, reason, _ = _watchdog_wait(
+            proc, cfg, "s", start, timeout=900,
+            find_parent=lambda _s: parent, find_subs=lambda _s: [],
+        )
+        self.assertIsNone(reason)
+        self.assertIn("DONE", stdout)
+        self.assertEqual(proc.poll(), 0)
+
+    # --- Wall-clock timeout backstop ---
+
+    def test_wall_clock_timeout(self):
+        proc = self._spawn(30)
+        start = 0.0
+        cfg = _cfg(stall_detection=False, early_stop_check=None)
+        # No stop conditions; clock jumps past the deadline immediately.
+        clock = _Clock(start, step=1000.0)
+        _, _, reason, _ = _watchdog_wait(
+            proc, cfg, "s", start, timeout=900, now_fn=clock,
+        )
+        self.assertEqual(reason, "timeout")
+        self.assertIsNotNone(proc.poll())
+
+    # --- Backward compatibility: defaults leave the watchdog off ---
+
+    def test_defaults_disable_watchdog(self):
+        cfg = _cfg()
+        self.assertFalse(cfg.stall_detection)
+        self.assertIsNone(cfg.early_stop_check)
+        # execute_run gates the watchdog on exactly this predicate.
+        watchdog_active = cfg.stall_detection or cfg.early_stop_check is not None
+        self.assertFalse(watchdog_active)
+
+    # --- Recency helper aggregates parent + subagent mtimes ---
+
+    def test_transcript_recency_aggregates_max(self):
+        import os
+        parent = SCRATCH / "p.jsonl"
+        sub = SCRATCH / "s.jsonl"
+        parent.write_text("{}\n")
+        sub.write_text("{}\n")
+        os.utime(parent, (100.0, 100.0))
+        os.utime(sub, (9000.0, 9000.0))  # subagent more recent
+        latest, parent_exists, lookup_errors = _transcript_recency(
+            "sess", lambda _s: parent, lambda _s: [sub]
+        )
+        self.assertTrue(parent_exists)
+        self.assertEqual(latest, 9000.0)
+        self.assertEqual(lookup_errors, 0)
+
+    def test_transcript_recency_counts_lookup_exceptions(self):
+        # A lookup FUNCTION raising (not a merely-absent transcript) is a
+        # monitoring regression: it must be counted, not silently treated as a
+        # model stall. Both the parent and subagent lookups raise here.
+        def boom_parent(_s):
+            raise RuntimeError("parent lookup exploded")
+
+        def boom_subs(_s):
+            raise RuntimeError("subagent lookup exploded")
+
+        latest, parent_exists, lookup_errors = _transcript_recency(
+            "sess", boom_parent, boom_subs
+        )
+        self.assertIsNone(latest)
+        self.assertFalse(parent_exists)
+        self.assertEqual(lookup_errors, 2)
+
+    # --- Early stop: scorer exception is caught, run is not killed ---
+
+    def test_early_stop_check_exception_is_caught(self):
+        # early_stop_check raising must be swallowed as "not done" (never kills
+        # the run); the process is then reaped by the wall-clock backstop.
+        def boom(_s):
+            raise RuntimeError("scorer exploded")
+
+        proc = self._spawn(30)
+        start = 0.0
+        cfg = _cfg(early_stop_check=boom, stall_detection=False)
+        # Clock crosses the deadline after a couple of (exception-swallowing) polls.
+        clock = _Clock(start, step=500.0)
+        _, _, reason, diag = _watchdog_wait(
+            proc, cfg, "s", start, timeout=900, now_fn=clock,
+        )
+        self.assertEqual(reason, "timeout")
+        self.assertIsNone(diag["score_complete_seconds"])
+        self.assertIsNotNone(proc.poll())
+
+    # --- Early stop: score_complete_seconds is recorded on the early-stop path ---
+
+    def test_early_stop_records_score_complete_seconds(self):
+        # early_stop_check returns True from the first poll; score_complete_seconds
+        # must capture the elapsed time at that FIRST hit (not the confirmation
+        # poll). With start=1000 and a step=1.0 clock, the first now_fn() call is
+        # 1001.0, so the recorded value is 1.0.
+        def check(_s):
+            return True
+
+        proc = self._spawn(30)
+        start = 1000.0
+        cfg = _cfg(early_stop_check=check, stall_detection=False)
+        clock = _Clock(start, step=1.0)
+        _, _, reason, diag = _watchdog_wait(
+            proc, cfg, "s", start, timeout=900, now_fn=clock,
+        )
+        self.assertEqual(reason, "early_stop")
+        self.assertEqual(diag["score_complete_seconds"], 1.0)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/docker-compose.yml b/docker-compose.yml
index 793b7257..c38f740a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -50,6 +50,18 @@ services:
       # recreation, and image rebuilds. Only `docker compose down -v` or an
       # explicit `docker volume rm` deletes it.
       - daaf-claude-config:/home/appuser/.claude
+      # OPTIONAL host-folder bind mount (commented out by default). Uncomment the
+      # four lines below and set `source` to an ABSOLUTE path on your host to
+      # expose a host folder to the container at /host_data. Read-only
+      # (`read_only: true`) is strongly recommended so the container cannot alter
+      # your host files. IMPORTANT: a bind mount is OUTSIDE the DAAF backup/audit
+      # boundary -- files under /host_data are NOT captured by backup_daaf.sh and
+      # are not part of the reproducibility trail. See the Installation Guide,
+      # section "Linking Host Folders into the Container (Bind Mounts)".
+      # - type: bind
+      #   source: /absolute/path/on/host
+      #   target: /host_data
+      #   read_only: true
     environment:
       # Relocate ~/.claude.json and credentials into the persisted .claude
       # directory (above) so they survive rebuilds too. Set in compose (not the
@@ -84,4 +96,14 @@ services:
 
 volumes:
   daaf-data:                    # Docker manages this storage
+    # OPTIONAL shared-workspace mode (commented out by default). Uncomment BOTH
+    # lines below to point this install at an EXISTING data volume shared with
+    # another install, instead of letting Docker manage a per-project volume. Set
+    # `name:` to the full volume name and set the matching DAAF_DATA_VOLUME_NAME in
+    # environment_settings.txt so the host tools (backup_daaf.sh / restore) resolve
+    # the same volume. The named volume must ALREADY EXIST -- Docker will not
+    # create an `external: true` volume. See the Installation Guide, section
+    # "Sharing One Research Workspace Across Two Installs (Advanced)".
+    # external: true
+    # name: daaf_daaf-data
   daaf-claude-config:           # Docker manages this storage (Claude Code state)
diff --git a/scripts/deploy_smoke/route_detection.py b/scripts/deploy_smoke/route_detection.py
index b804557a..16435e8f 100644
--- a/scripts/deploy_smoke/route_detection.py
+++ b/scripts/deploy_smoke/route_detection.py
@@ -9,7 +9,7 @@
 The four routes (auto-detected from the live env, per the approved design):
 
     DAAF_PROVIDER_SHIM=openai + SHIM_BACKEND_MODE=chatgpt  -> chatgpt-subscription
-    DAAF_PROVIDER_SHIM=openai (otherwise)                  -> openai-api
+    DAAF_PROVIDER_SHIM=openai + SHIM_BACKEND_MODE=openai   -> openai-api
     ANTHROPIC_BASE_URL contains "openrouter.ai"            -> openrouter
     else                                                   -> anthropic-subscription
 
@@ -155,8 +155,10 @@ def to_dict(self) -> dict:
             "remap_active": self.remap_active,
             "session_model": self.session_model,
             "route_match": self.route_match,
-            "shim_control": self.shim_control,
-            "backend_mode_control": self.backend_mode_control,
+            "shim_control": _bounded_lane_control(self.shim_control, ("openai",)),
+            "backend_mode_control": _bounded_lane_control(
+                self.backend_mode_control, ("chatgpt", "openai")
+            ),
             "lane_control_issues": list(self.lane_control_issues),
         }
 
@@ -177,6 +179,15 @@ def redact_env_value(name: str, value):
     """
     if value is None:
         return "<unset>"
+    if name == "CLAUDE_CODE_DISABLE_FAST_MODE":
+        # This control is intentionally an exact-string contract.  Preserve the
+        # useful success fact while bounding every near miss instead of reflecting
+        # arbitrary environment text into a report.
+        return "1" if value == "1" else "<invalid:not-exact-1>"
+    if name == "DAAF_PROVIDER_SHIM":
+        return _bounded_lane_control(value, ("openai",))
+    if name == "SHIM_BACKEND_MODE":
+        return _bounded_lane_control(value, ("chatgpt", "openai"))
     if _SECRET_NAME_RE.search(name):
         return "<redacted:empty>" if value == "" else "<redacted:set>"
     return value
@@ -225,6 +236,7 @@ def scrub_secret_values(text, env=None):
     "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
     "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
     "CLAUDE_CODE_EFFORT_LEVEL",
+    "CLAUDE_CODE_DISABLE_FAST_MODE",
     "CODEX_HOME",
     # Secret-bearing (values redacted by name match; empty/set state preserved):
     "ANTHROPIC_API_KEY",
@@ -314,38 +326,53 @@ def _has_supported_1m_hint(model_id: str) -> bool:
     return bool(re.search(r"\[1m\](?:#[^/]*)?$", slug))
 
 
+def _bounded_lane_control(value: str, exact_values: tuple) -> str:
+    """Classify a lane control without reflecting arbitrary environment text."""
+    if value in exact_values:
+        return value
+    if not value:
+        return ""
+    if value.strip().lower() in exact_values:
+        return "<invalid:case-or-whitespace>"
+    return "<invalid:unsupported>"
+
+
 def _lane_control_issues(env) -> tuple:
     """Explain exact-value lane-control near misses without normalizing them."""
     shim = env.get("DAAF_PROVIDER_SHIM", "")
     backend = env.get("SHIM_BACKEND_MODE", "")
     problems = []
 
+    # A clean native/OpenRouter environment is not attempting a shim lane. Once
+    # either control is nonempty, require the complete exact pair fail-closed.
+    if not shim and not backend:
+        return ()
+
     if shim != "openai":
         if shim.strip().lower() == "openai":
             problems.append(
-                f"DAAF_PROVIDER_SHIM={shim!r} is a near miss; runtime requires exact "
-                "DAAF_PROVIDER_SHIM='openai' (case- and whitespace-sensitive)."
+                "DAAF_PROVIDER_SHIM is a case/whitespace near miss; runtime requires "
+                "exact DAAF_PROVIDER_SHIM='openai'."
             )
         elif shim:
             problems.append(
-                f"DAAF_PROVIDER_SHIM={shim!r} is not the exact supported shim value "
-                "'openai'; partial or alternate values do not activate a shim lane."
+                "DAAF_PROVIDER_SHIM is not the exact supported shim value 'openai'; "
+                "partial or alternate values do not activate a shim lane."
             )
-    if backend != "chatgpt":
-        if backend.strip().lower() == "chatgpt":
+    if backend not in ("chatgpt", "openai"):
+        if backend.strip().lower() in ("chatgpt", "openai"):
             problems.append(
-                f"SHIM_BACKEND_MODE={backend!r} is a near miss; runtime requires exact "
-                "SHIM_BACKEND_MODE='chatgpt' (case- and whitespace-sensitive)."
+                "SHIM_BACKEND_MODE is a case/whitespace near miss; runtime requires "
+                "exact SHIM_BACKEND_MODE='chatgpt' or 'openai'."
             )
-        elif backend not in ("", "openai"):
+        else:
             problems.append(
-                f"SHIM_BACKEND_MODE={backend!r} is not an exact supported lane value; "
-                "use 'chatgpt' for the subscription lane or leave it unset/use 'openai' "
-                "for the direct API lane."
+                "SHIM_BACKEND_MODE is not an exact supported lane value; use 'chatgpt' "
+                "for the subscription lane or 'openai' for the direct API lane."
             )
-    if backend == "chatgpt" and shim != "openai":
+    if backend in ("chatgpt", "openai") and shim != "openai":
         problems.append(
-            "SHIM_BACKEND_MODE='chatgpt' is set without the other exact lane signal: "
+            "SHIM_BACKEND_MODE is set without the other exact lane signal: "
             "DAAF_PROVIDER_SHIM must equal 'openai'."
         )
     return tuple(problems)
@@ -365,8 +392,10 @@ def detect_route(env) -> str:
     backend_mode = env.get("SHIM_BACKEND_MODE", "")
     base_url = (env.get("ANTHROPIC_BASE_URL") or "").strip().lower()
 
-    if shim == "openai":
-        return ROUTE_CHATGPT if backend_mode == "chatgpt" else ROUTE_OPENAI_API
+    if shim == "openai" and backend_mode == "chatgpt":
+        return ROUTE_CHATGPT
+    if shim == "openai" and backend_mode == "openai":
+        return ROUTE_OPENAI_API
     if "openrouter.ai" in base_url:
         return ROUTE_OPENROUTER
     return ROUTE_ANTHROPIC
@@ -465,9 +494,11 @@ def probe_route_detection(route_info: RouteInfo) -> ProbeResult:
     )
     r.add_evidence(
         "env: DAAF_PROVIDER_SHIM / SHIM_BACKEND_MODE",
-        output=(f"DAAF_PROVIDER_SHIM={route_info.shim_control!r}; "
-                f"SHIM_BACKEND_MODE={route_info.backend_mode_control!r}"),
-        note="raw values shown without trimming or case normalization",
+        output=("DAAF_PROVIDER_SHIM="
+                f"{_bounded_lane_control(route_info.shim_control, ('openai',))!r}; "
+                "SHIM_BACKEND_MODE="
+                f"{_bounded_lane_control(route_info.backend_mode_control, ('chatgpt', 'openai'))!r}"),
+        note="exact values or bounded invalid classifications; no normalization into success",
     )
     if route_info.lane_control_issues:
         r.verdict = Verdict.FAIL
@@ -575,9 +606,18 @@ def note_var(name):
         note_var("DAAF_PROVIDER_SHIM")
         note_var("ANTHROPIC_BASE_URL")
         note_var("ANTHROPIC_AUTH_TOKEN")
+        note_var("CLAUDE_CODE_DISABLE_FAST_MODE")
         base = (env.get("ANTHROPIC_BASE_URL") or "").lower()
         if "127.0.0.1:4141" not in base and "localhost:4141" not in base:
             problems.append("ANTHROPIC_BASE_URL should point at the local shim (http://127.0.0.1:4141) for shim routes.")
+        if env.get("CLAUDE_CODE_DISABLE_FAST_MODE") != "1":
+            problems.append(
+                "CLAUDE_CODE_DISABLE_FAST_MODE must be the exact string '1' for GPT "
+                "shim routes. Run 'bash /daaf/scripts/provider_shim/gpt_fast.sh off' "
+                "to keep the requested GPT service-tier policy safely OFF, set "
+                "CLAUDE_CODE_DISABLE_FAST_MODE=1 in the host environment_settings.txt, "
+                "recreate the container, and start a new Claude session."
+            )
         if route == ROUTE_CHATGPT:
             note_var("SHIM_BACKEND_MODE")
             note_var("CODEX_HOME")
@@ -586,8 +626,11 @@ def note_var(name):
             if not env.get("CODEX_HOME"):
                 problems.append("CODEX_HOME must be set (holds auth.json) for the ChatGPT route.")
         else:  # openai-api
+            note_var("SHIM_BACKEND_MODE")
             note_var("OPENAI_API_KEY")
             note_var("SHIM_BACKEND_API_KEY")
+            if env.get("SHIM_BACKEND_MODE") != "openai":
+                problems.append("SHIM_BACKEND_MODE must equal exact value 'openai' for the OpenAI-API route.")
             if _key_state(env, "OPENAI_API_KEY") != "set" and _key_state(env, "SHIM_BACKEND_API_KEY") != "set":
                 problems.append("OPENAI_API_KEY or SHIM_BACKEND_API_KEY must be set for the OpenAI-API route.")
 
diff --git a/scripts/deploy_smoke/smoke_probes.py b/scripts/deploy_smoke/smoke_probes.py
index 77519c53..6900c264 100644
--- a/scripts/deploy_smoke/smoke_probes.py
+++ b/scripts/deploy_smoke/smoke_probes.py
@@ -33,8 +33,8 @@
 import time
 import uuid
 from pathlib import Path
-from urllib.request import urlopen
-from urllib.error import URLError
+from urllib.error import HTTPError, URLError
+from urllib.request import HTTPRedirectHandler, ProxyHandler, Request, build_opener
 
 from route_detection import (
     Verdict,
@@ -65,9 +65,86 @@
 # interpolated into f-strings, wrapped in Path(...), and passed as cwd= throughout.
 BASE_DIR = str(Path(__file__).resolve().parents[2])
 SHIM_HEALTH_URL = "http://127.0.0.1:4141/health"
+HEALTH_BODY_LIMIT = 16_384
+EXPECTED_SHIM_SERVICE = "daaf-anthropic-openai-shim"
+_SAFE_SHIM_VERSION_RE = re.compile(r"[A-Za-z0-9._+-]{1,64}")
+_SAFE_HEALTH_MODEL_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}")
+_UTC_SECOND_RE = re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z")
+_GPT_REQUEST_TIER = {"chatgpt": "priority", "openai": "priority"}
+_GPT_POLICY_STATUSES = frozenset({"ok", "missing", "invalid", "unreadable", "unsafe"})
+_GPT_REQUEST_SOURCES = frozenset({"none", "anthropic", "shim_global", "both"})
+_GPT_SERVED_TIERS = frozenset({"fast", "priority", "default", "flex", "scale", "auto"})
 _GLM52_STATIC_ID = re.compile(r"z-ai/glm-5\.2(?:-[0-9]{8})?")
 
 
+class _DuplicateHealthKeyError(ValueError):
+    """A duplicate key makes the local health schema ambiguous."""
+
+
+class _RejectHealthRedirects(HTTPRedirectHandler):
+    """Reject loopback health redirects instead of following Location."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def _read_local_health(timeout=10, opener=None):
+    """Read fixed loopback /health with no proxy, redirect, or oversized body."""
+    request = Request(SHIM_HEALTH_URL, method="GET")
+    network_opener = opener or build_opener(
+        ProxyHandler({}), _RejectHealthRedirects()
+    )
+    with network_opener.open(request, timeout=timeout) as response:
+        status = getattr(response, "status", None)
+        if status is None and hasattr(response, "getcode"):
+            status = response.getcode()
+        if status is not None and status != 200:
+            raise ValueError(f"shim /health returned HTTP {status}")
+        raw = response.read(HEALTH_BODY_LIMIT + 1)
+        if len(raw) > HEALTH_BODY_LIMIT:
+            raise ValueError("shim /health response exceeded the 16 KiB limit")
+    health = json.loads(
+        raw.decode("utf-8", "replace"),
+        object_pairs_hook=_reject_duplicate_health_keys,
+    )
+    if not isinstance(health, dict):
+        raise ValueError("shim /health JSON must be an object")
+    return health
+
+
+def _is_safe_health_model(value):
+    return (
+        isinstance(value, str)
+        and _SAFE_HEALTH_MODEL_RE.fullmatch(value) is not None
+        and "://" not in value
+    )
+
+
+def _is_gpt_backend(value):
+    return type(value) is str and value in _GPT_REQUEST_TIER
+
+
+def _is_policy_status(value):
+    return type(value) is str and value in _GPT_POLICY_STATUSES
+
+
+def _is_request_source(value):
+    return type(value) is str and value in _GPT_REQUEST_SOURCES
+
+
+def _is_served_tier(value):
+    return type(value) is str and value in _GPT_SERVED_TIERS
+
+
+def _reject_duplicate_health_keys(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise _DuplicateHealthKeyError("duplicate health JSON key")
+        result[key] = value
+    return result
+
+
 def _project_slug(base_dir: str) -> str:
     """Encode a working-directory path the way Claude Code names its
     ~/.claude/projects/<slug> transcript directory, derived from BASE_DIR rather
@@ -485,9 +562,135 @@ def probe_statuslines(base_dir: str = BASE_DIR) -> ProbeResult:
     return r
 
 
+def _validate_gpt_service_tier_health(health, expected_mode):
+    """Return a bounded projection plus exact-schema/coherence diagnostics."""
+    problems = []
+    block = health.get("gpt_service_tier")
+    expected_block_keys = {
+        "backend_mode", "requested_tier_vocabulary", "policy",
+        "native_fast_disabled", "latest_terminal",
+    }
+    if not isinstance(block, dict):
+        return None, ["gpt_service_tier must be an object with the exact v1.3.9 key set"]
+    if set(block) != expected_block_keys:
+        return None, ["gpt_service_tier must have the exact v1.3.9 key set (no missing or extra fields)"]
+
+    backend = block.get("backend_mode")
+    vocabulary = block.get("requested_tier_vocabulary")
+    native_disabled = block.get("native_fast_disabled")
+    if backend != expected_mode:
+        problems.append("gpt_service_tier.backend_mode must exactly match the detected shim backend")
+    if vocabulary != _GPT_REQUEST_TIER[expected_mode]:
+        problems.append(
+            f"gpt_service_tier.requested_tier_vocabulary must equal "
+            f"'{_GPT_REQUEST_TIER[expected_mode]}' on the {expected_mode} backend"
+        )
+    if type(native_disabled) is not bool:
+        problems.append("gpt_service_tier.native_fast_disabled must be an exact JSON boolean")
+    elif native_disabled is not True:
+        problems.append("gpt_service_tier.native_fast_disabled must be true on an exact GPT shim route")
+
+    policy = block.get("policy")
+    policy_projection = None
+    if not isinstance(policy, dict) or set(policy) != {
+        "status", "backend_mode", "enabled", "effective",
+    }:
+        problems.append("gpt_service_tier.policy must have the exact key set (no missing or extra fields)")
+    else:
+        status = policy.get("status")
+        policy_backend = policy.get("backend_mode")
+        enabled = policy.get("enabled")
+        effective = policy.get("effective")
+        status_is_valid = _is_policy_status(status)
+        policy_backend_is_valid = _is_gpt_backend(policy_backend)
+        if not status_is_valid:
+            problems.append("gpt_service_tier.policy.status is outside the canonical vocabulary")
+        if type(enabled) is not bool or type(effective) is not bool:
+            problems.append("gpt_service_tier.policy enabled/effective must be exact JSON booleans")
+        elif status == "ok":
+            if not policy_backend_is_valid:
+                problems.append("an ok gpt_service_tier.policy requires a canonical backend_mode")
+            elif effective is not (enabled and policy_backend == expected_mode):
+                problems.append("gpt_service_tier.policy effective is incoherent with enabled/backend_mode")
+        elif status_is_valid and (
+            policy_backend is not None or enabled is not False or effective is not False
+        ):
+            problems.append("a non-ok gpt_service_tier.policy must be fail-safe OFF with null backend")
+        policy_projection = {
+            "status": status if status_is_valid else "<invalid>",
+            "backend_mode": policy_backend if policy_backend_is_valid else None,
+            "enabled": enabled if type(enabled) is bool else "<invalid>",
+            "effective": effective if type(effective) is bool else "<invalid>",
+        }
+
+    latest = block.get("latest_terminal")
+    latest_projection = None
+    if latest is not None:
+        expected_latest_keys = {
+            "model", "requested_service_tier", "requested_source",
+            "served_service_tier", "completed_at",
+        }
+        if not isinstance(latest, dict) or set(latest) != expected_latest_keys:
+            problems.append("gpt_service_tier.latest_terminal must be null or have the exact bounded key set")
+        else:
+            model = latest.get("model")
+            requested = latest.get("requested_service_tier")
+            source = latest.get("requested_source")
+            served = latest.get("served_service_tier")
+            completed = latest.get("completed_at")
+            if model is not None and (
+                not _is_safe_health_model(model)
+            ):
+                problems.append("gpt_service_tier.latest_terminal.model is not a bounded canonical token or null")
+            requested_is_valid = (
+                requested is None
+                or (type(requested) is str and requested == _GPT_REQUEST_TIER[expected_mode])
+            )
+            source_is_valid = _is_request_source(source)
+            served_is_valid = served is None or _is_served_tier(served)
+            if not requested_is_valid:
+                problems.append("gpt_service_tier.latest_terminal requested tier does not match backend vocabulary")
+            if not source_is_valid:
+                problems.append("gpt_service_tier.latest_terminal.requested_source is outside the canonical vocabulary")
+            elif (source == "none") is not (requested is None):
+                problems.append("gpt_service_tier.latest_terminal requested tier/source are incoherent")
+            if not served_is_valid:
+                problems.append("gpt_service_tier.latest_terminal.served_service_tier is not canonical or null")
+            completed_is_valid = (
+                isinstance(completed, str)
+                and _UTC_SECOND_RE.fullmatch(completed) is not None
+            )
+            if completed_is_valid:
+                try:
+                    time.strptime(completed, "%Y-%m-%dT%H:%M:%SZ")
+                except (OverflowError, ValueError):
+                    completed_is_valid = False
+            if not completed_is_valid:
+                problems.append("gpt_service_tier.latest_terminal.completed_at must be a real canonical UTC second")
+            latest_projection = {
+                "model": model if model is None or _is_safe_health_model(model) else "<invalid>",
+                "requested_service_tier": requested if requested_is_valid else "<invalid>",
+                "requested_source": source if source_is_valid else "<invalid>",
+                "served_service_tier": served if served_is_valid else "<invalid>",
+                "completed_at": completed if completed_is_valid else "<invalid>",
+            }
+
+    projection = {
+        "backend_mode": backend if _is_gpt_backend(backend) else "<invalid>",
+        "requested_tier_vocabulary": (
+            vocabulary
+            if type(vocabulary) is str and vocabulary in _GPT_REQUEST_TIER.values()
+            else "<invalid>"
+        ),
+        "policy": policy_projection if policy_projection is not None else "<invalid>",
+        "native_fast_disabled": native_disabled if type(native_disabled) is bool else "<invalid>",
+        "latest_terminal": latest_projection,
+    }
+    return projection, problems
+
+
 def probe_shim_health(route_info: RouteInfo) -> ProbeResult:
-    """GET the shim /health endpoint (shim routes only) and verify backend_mode
-    matches the detected route; report sanitize_tools, codex_home_present, version."""
+    """GET shim /health and fail closed on its route/service-tier contract."""
     r = ProbeResult(probe_id="T0.8", name="Provider shim /health", tier="0")
     if route_info.detected_route not in SHIM_ROUTES:
         r.verdict = Verdict.SKIP
@@ -496,48 +699,100 @@ def probe_shim_health(route_info: RouteInfo) -> ProbeResult:
         return r
 
     try:
-        with urlopen(SHIM_HEALTH_URL, timeout=10) as resp:
-            body = resp.read().decode("utf-8", "replace")
-        health = json.loads(body)
-        # Scrub any secret env value that the /health JSON might echo verbatim
-        # before it enters evidence (defense-in-depth; the placeholder keeps the
-        # blob parseable for the evidence/ snapshot).
-        r.add_evidence(f"GET {SHIM_HEALTH_URL}",
-                       output=scrub_secret_values(json.dumps(health, indent=2)[:1500]))
-    except (URLError, socket.timeout, json.JSONDecodeError, OSError) as e:
+        health = _read_local_health(timeout=10)
+        if not isinstance(health, dict):
+            raise ValueError("shim /health JSON must be an object")
+    except (HTTPError, URLError, socket.timeout, json.JSONDecodeError, OSError, ValueError) as e:
         r.verdict = Verdict.FAIL
-        r.detail = f"shim /health unreachable/invalid: {type(e).__name__}: {e}"
-        r.add_evidence(f"GET {SHIM_HEALTH_URL}", note=str(e))
+        r.detail = f"shim /health unreachable/invalid: {type(e).__name__}: {str(e)[:200]}"
+        r.add_evidence(f"GET {SHIM_HEALTH_URL}", note=str(e)[:200])
         return r
 
     expected_mode = "chatgpt" if route_info.detected_route == ROUTE_CHATGPT else "openai"
     actual_mode = health.get("backend_mode")
+    version = health.get("version")
+    version_is_safe = isinstance(version, str) and _SAFE_SHIM_VERSION_RE.fullmatch(version) is not None
+    version_marker = version if version_is_safe else "<invalid>"
+    codex_home_present = health.get("codex_home_present")
+    codex_home_marker = codex_home_present if type(codex_home_present) is bool else "<invalid>"
+    tier_projection, tier_problems = _validate_gpt_service_tier_health(health, expected_mode)
+
     problems = []
+    if health.get("service") != EXPECTED_SHIM_SERVICE:
+        problems.append(f"service must equal '{EXPECTED_SHIM_SERVICE}'")
+    if health.get("status") != "ok":
+        problems.append("status must equal 'ok'")
     if actual_mode != expected_mode:
-        problems.append(f"backend_mode='{actual_mode}' but route expects '{expected_mode}'")
-    if route_info.detected_route == ROUTE_CHATGPT and not health.get("codex_home_present"):
-        problems.append("codex_home_present=false (auth.json missing/unreadable) for chatgpt route")
-
-    r.add_evidence("", note=(
-        f"backend_mode={actual_mode} sanitize_tools={health.get('sanitize_tools')} "
-        f"codex_home_present={health.get('codex_home_present')} version={health.get('version')}"
-    ))
+        problems.append("top-level backend_mode must exactly match the detected shim route")
+    if not version_is_safe:
+        problems.append("version must match [A-Za-z0-9._+-]{1,64}")
+    if route_info.detected_route == ROUTE_CHATGPT and codex_home_present is not True:
+        problems.append("codex_home_present must be boolean true (auth.json missing/unreadable) for chatgpt route")
+    problems.extend(tier_problems)
+
+    # Deliberately project only allowlisted identity/configuration facts.  Never
+    # serialize dict(health): the broad document includes a backend URL and can gain
+    # arbitrary nested fields that do not belong in deploy-smoke evidence.
+    health_evidence = {
+        "service": EXPECTED_SHIM_SERVICE if health.get("service") == EXPECTED_SHIM_SERVICE else "<invalid>",
+        "status": "ok" if health.get("status") == "ok" else "<invalid>",
+        "backend_mode": actual_mode if _is_gpt_backend(actual_mode) else "<invalid>",
+        "version": version_marker,
+        "sanitize_tools": health.get("sanitize_tools") if type(health.get("sanitize_tools")) is bool else "<invalid>",
+        "codex_home_present": codex_home_marker,
+        "gpt_service_tier": tier_projection if tier_projection is not None else "<invalid>",
+    }
+    r.add_evidence(f"GET {SHIM_HEALTH_URL}", output=json.dumps(health_evidence, indent=2))
+
+    policy = tier_projection.get("policy") if isinstance(tier_projection, dict) else None
+    latest = tier_projection.get("latest_terminal") if isinstance(tier_projection, dict) else None
+    policy_on = bool(
+        isinstance(policy, dict)
+        and policy.get("status") == "ok"
+        and policy.get("effective") is True
+    )
+    policy_marker = "ON" if policy_on else "OFF"
+    policy_status = policy.get("status") if isinstance(policy, dict) else "<invalid>"
+    served_marker = (
+        latest.get("served_service_tier") if isinstance(latest, dict) else None
+    ) or "unknown"
+    r.add_evidence(
+        "",
+        note=(
+            f"backend_mode={actual_mode if _is_gpt_backend(actual_mode) else '<invalid>'} "
+            f"version={version_marker} codex_home_present={codex_home_marker} "
+            f"native_fast_disabled="
+            f"{tier_projection.get('native_fast_disabled') if isinstance(tier_projection, dict) else '<invalid>'} "
+            f"requested_policy={policy_marker} policy_status={policy_status} "
+            f"latest_terminal_served={served_marker}; requested policy is not served-tier evidence"
+        ),
+    )
     if problems:
         r.verdict = Verdict.FAIL
         r.detail = "; ".join(problems)
     else:
         r.verdict = Verdict.PASS
-        r.detail = f"shim healthy: backend_mode={actual_mode}, version={health.get('version')}."
+        r.detail = (
+            f"shim healthy: backend_mode={actual_mode}, version={version_marker}, "
+            f"requested_policy={policy_marker} (status={policy_status}); "
+            f"latest terminal served tier={served_marker}. Requested policy is not "
+            "proof of provider-served Fast/Priority service."
+        )
     return r
 
 
 def probe_auth_json(route_info: RouteInfo, env) -> ProbeResult:
-    """chatgpt route only: confirm $CODEX_HOME/auth.json exists and is readable
-    (presence/readability only — never read or emit its contents)."""
-    r = ProbeResult(probe_id="T0.9", name="ChatGPT auth.json readable", tier="0")
+    """chatgpt route only: assert the shim /health auth block reports usable
+    subscription auth. v1.3.0 (A1-R6b) extends this from a bare "auth.json readable"
+    filesystem check to the authoritative /health auth state (derived by the shim from
+    auth.json presence + the access_token's JWT exp — never token material):
+    FAIL on expired|absent|unreadable, WARN on expiring, PASS on valid. The filesystem
+    readability check is retained as supplementary evidence (presence/readability only —
+    contents never read). Non-chatgpt routes SKIP (auth validity N/A there)."""
+    r = ProbeResult(probe_id="T0.9", name="ChatGPT auth validity (/health)", tier="0")
     if route_info.detected_route != ROUTE_CHATGPT:
         r.verdict = Verdict.SKIP
-        r.detail = f"Not the chatgpt-subscription route ({route_info.detected_route}); auth.json N/A."
+        r.detail = f"Not the chatgpt-subscription route ({route_info.detected_route}); auth validity N/A."
         return r
     codex_home = env.get("CODEX_HOME")
     if not codex_home:
@@ -545,15 +800,63 @@ def probe_auth_json(route_info: RouteInfo, env) -> ProbeResult:
         r.detail = "CODEX_HOME unset — cannot locate auth.json for the chatgpt route."
         r.add_evidence("env: CODEX_HOME", output="<unset>")
         return r
+
+    # Supplementary filesystem evidence (presence/readability only; contents never read).
     auth_path = Path(codex_home) / "auth.json"
-    readable = auth_path.exists() and os.access(auth_path, os.R_OK)
-    r.add_evidence(f"os.access({auth_path}, R_OK)", output=str(readable), note="presence/readability only; contents never read")
-    if readable:
+    fs_readable = auth_path.exists() and os.access(auth_path, os.R_OK)
+    r.add_evidence(
+        f"os.access({auth_path}, R_OK)", output=str(fs_readable),
+        note="supplementary; presence/readability only, contents never read",
+    )
+
+    # Authoritative: the /health auth block (JWT-exp-derived validity state).
+    try:
+        health = _read_local_health(timeout=10)
+        if not isinstance(health, dict):
+            raise ValueError("shim /health JSON must be an object")
+    except (HTTPError, URLError, socket.timeout, json.JSONDecodeError, OSError, ValueError) as e:
+        r.verdict = Verdict.FAIL
+        r.detail = f"shim /health unreachable/invalid, cannot assess auth: {type(e).__name__}: {str(e)[:200]}"
+        r.add_evidence(f"GET {SHIM_HEALTH_URL}", note=str(e)[:200])
+        return r
+
+    auth = health.get("auth")
+    if not isinstance(auth, dict):
+        r.verdict = Verdict.FAIL
+        r.detail = "shim /health carries no auth block — a pre-v1.3.0 shim or a broken build."
+        r.add_evidence("GET /health .auth", output="<absent>")
+        return r
+
+    _KNOWN_STATES = {"valid", "expiring", "expired", "absent", "unreadable", "n/a"}
+    state = auth.get("state")
+    state_marker = state if state in _KNOWN_STATES else "<invalid>"
+    days_left = auth.get("days_left")
+    days_marker = days_left if isinstance(days_left, (int, float)) else "<n/a>"
+    r.add_evidence(
+        "GET /health .auth",
+        output=scrub_secret_values(json.dumps(auth)[:500]),
+        note=f"state={state_marker} days_left={days_marker}",
+    )
+
+    if state == "valid":
         r.verdict = Verdict.PASS
-        r.detail = "auth.json present and readable (contents not inspected)."
+        r.detail = f"ChatGPT subscription auth valid (days_left={days_marker})."
+    elif state == "expiring":
+        r.verdict = Verdict.WARN
+        r.detail = (
+            f"ChatGPT subscription auth expires soon (days_left={days_marker}) — "
+            "run 'codex login --device-auth' before it lapses."
+        )
+    elif state in ("expired", "absent", "unreadable"):
+        r.verdict = Verdict.FAIL
+        r.detail = (
+            f"ChatGPT subscription auth is dead (state={state_marker}) — "
+            "run 'codex login --device-auth' to re-authenticate."
+        )
     else:
+        # "n/a" on a chatgpt route, or an unrecognized state — both unexpected here.
         r.verdict = Verdict.FAIL
-        r.detail = f"auth.json missing or unreadable at {auth_path} — run 'codex login --device-auth'."
+        r.detail = f"unexpected auth state on the chatgpt route: state={state_marker}."
     return r
 
 
diff --git a/scripts/host/backup_daaf.ps1 b/scripts/host/backup_daaf.ps1
index 590e75c3..c4bb0a61 100644
--- a/scripts/host/backup_daaf.ps1
+++ b/scripts/host/backup_daaf.ps1
@@ -74,7 +74,7 @@ if ($env:DAAF_DRY_RUN -eq "1") {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -83,7 +83,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
@@ -116,9 +120,14 @@ Set-StrictMode -Version 3.0
 # derives the prefix from the project name (default "daaf"), so a second instance
 # with DAAF_PROJECT_NAME=daaf2 owns the volume "daaf2_daaf-data". Default unset =>
 # "daaf_daaf-data" (byte-for-byte identical to the previous hardcoded value).
+# DAAF_DATA_VOLUME_NAME, when set, overrides the whole derivation with a verbatim
+# full volume name (the shared-workspace escape hatch); unset => the derived
+# default. Matches Resolve-DaafDataVolumeName in daaf_lib.ps1 (inlined here because
+# this standalone script does not dot-source the library).
 $projectName = "daaf"
 if ($env:DAAF_PROJECT_NAME) { $projectName = $env:DAAF_PROJECT_NAME }
 $VolumeName = "${projectName}_daaf-data"
+if ($env:DAAF_DATA_VOLUME_NAME) { $VolumeName = $env:DAAF_DATA_VOLUME_NAME }
 # Second volume: Claude Code state (auth/credentials, session history and
 # transcripts, plugins, ~/.claude.json). Backed up into a dedicated hidden
 # subfolder of the backup so it does not contaminate the data-volume file counts
@@ -221,9 +230,9 @@ Write-Host ""
 # staging-failure error below points the user at the Docker Desktop disk image.
 $BackupDrive = (Get-Item -Path ".").PSDrive.Name
 $DriveInfo = New-Object System.IO.DriveInfo($BackupDrive)
-$AvailableKB = [long]($DriveInfo.AvailableFreeSpace / 1024)
+$AvailableKB = [long][math]::Floor($DriveInfo.AvailableFreeSpace / 1024)
 # Add 10% buffer to account for filesystem overhead
-$RequiredKB = [long]($VolumeSizeKB * 110 / 100)
+$RequiredKB = [long][math]::Floor($VolumeSizeKB * 110 / 100)
 if ($AvailableKB -lt $RequiredKB) {
     $RequiredMB = [math]::Floor($RequiredKB / 1024)
     $AvailableMB = [math]::Floor($AvailableKB / 1024)
@@ -343,8 +352,18 @@ if (-not $stageStartOk) {
 $savedEAP = $ErrorActionPreference; $ErrorActionPreference = "SilentlyContinue"
 $StageStatusRaw = (docker wait $StageCid 2>&1 | Select-Object -Last 1)
 $ErrorActionPreference = $savedEAP
+# Gate on TryParse's BOOLEAN return. [int]::TryParse writes 0 into the [ref] on a
+# parse FAILURE (not just a parse of "0"), so the old `$null = TryParse(...)` form
+# silently overwrote the fail-closed default with 0 whenever `docker wait` emitted a
+# non-numeric last line (e.g. a daemon error merged via 2>&1) -- flipping this fatal
+# gate from "abort" to "proceed to copy a partial staged tree." Parse into a temp var
+# and adopt it ONLY on success; otherwise stay fail-closed at 1 (mirrors the correct
+# idiom at restore_from_backup.ps1:279).
 $StageStatus = 1
-if ($null -ne $StageStatusRaw) { $null = [int]::TryParse("$StageStatusRaw".Trim(), [ref]$StageStatus) }
+$StageStatusParsed = 0
+if ($null -ne $StageStatusRaw -and [int]::TryParse("$StageStatusRaw".Trim(), [ref]$StageStatusParsed)) {
+    $StageStatus = $StageStatusParsed
+}
 if ($StageStatus -ne 0) {
     # The staging container is DETACHED (`docker run -d`), so the gate's STDOUT --
     # including the offender list it prints on an exit-3 -- went to the container
@@ -422,6 +441,14 @@ try {
 $CopyProcess.WaitForExit()
 $CopyExitCode = if ($null -ne $CopyProcess.ExitCode) { $CopyProcess.ExitCode } else { 0 }
 
+# Latch for the completion banner: any of the non-fatal WARNING paths below
+# (file-count mismatch, size mismatch, Claude-state copy failure, permission-manifest
+# failure) sets this so the final banner can say the backup completed WITH WARNINGS
+# rather than claiming an unqualified success. The exit status stays 0 on those paths
+# -- the banner wording is the signal, not the exit code (the corroborated short-copy
+# case below is the one that is fatal, and it exits before the banner).
+$HadWarnings = $false
+
 # --- Verify ---
 # The staged tree the copy streamed = volume regular files + 1 symlink manifest
 # - symlinks. Symlinks were never counted by the source scan (TotalFiles), and the
@@ -452,24 +479,44 @@ if ($FileCount -eq 0) {
     Wait-AndExit 1
 }
 
-if ($CopyExitCode -ne 0) {
+# --- Corroborated short-copy check (fatal) ---
+# A nonzero docker cp exit AND a copied count short of the volume scan are two
+# independent signals that agree the backup is truncated -- the nonzero exit
+# corroborates the shortfall, so no tolerance is applied here (unlike the 1% count
+# and size tolerances below, which absorb benign filesystem/metadata drift on an
+# otherwise-clean copy). A truncated backup that passed as usable could cost a user
+# their data on restore, so fail hard: name the partial folder, tell them to delete
+# it, and exit before the completion banner. (A nonzero exit with a FULL count falls
+# through to the Note below -- warnings without an actual shortfall.)
+if ($CopyExitCode -ne 0 -and $FileCount -lt $TotalFiles) {
+    Write-Host ""
+    Write-Host "ERROR: Backup failed (exit code $CopyExitCode); only $FileCount of $TotalFiles expected files were copied." -ForegroundColor Red
+    Write-Host "       This backup is incomplete and must not be relied on. Delete this"
+    Write-Host "       partial backup folder and re-run once the copy issue is resolved."
+    Write-Host "Location: $HostPath\"
+    Wait-AndExit 1
+} elseif ($CopyExitCode -ne 0) {
     Write-Host "Note: File copy reported warnings (exit code $CopyExitCode); $FileCount of $TotalFiles expected files were transferred." -ForegroundColor Yellow
 }
 
 # --- File-count verification ---
 # Do NOT trust docker cp's exit code as the sole failure signal: the Windows
-# symlink-abort truncation surfaced with a ZERO exit on the user's run. Compare the
-# copied data-file count (manifest excluded) against the source scan count and warn
-# loudly on a shortfall beyond a 1% tolerance -- the count and size checks are the
-# authoritative completeness signals, not $CopyExitCode.
+# symlink-abort truncation surfaced with a ZERO exit on the user's run. A nonzero
+# exit that ALSO comes up short on the count is already fatal (the corroborated
+# short-copy branch above). This block catches the harder case -- a clean ZERO exit
+# that still copied too few files -- comparing the copied data-file count (manifest
+# excluded) against the source scan count and warning loudly on a shortfall beyond a
+# 1% tolerance. The count and size checks are the authoritative completeness signals,
+# not $CopyExitCode.
 if ($TotalFiles -gt 0 -and $FileCount -gt 0) {
-    $CountTolerance = [math]::Max(1, [long]($TotalFiles / 100))
+    $CountTolerance = [math]::Max(1, [long][math]::Floor($TotalFiles / 100))
     $CountDiff = [math]::Abs($TotalFiles - $FileCount)
     if ($CountDiff -gt $CountTolerance) {
         Write-Host ""
         Write-Host "WARNING: Backup file-count mismatch." -ForegroundColor Yellow
         Write-Host "         Source: $TotalFiles files, Backup: $FileCount files (difference: $CountDiff)"
         Write-Host "         The backup may be incomplete. Consider re-running."
+        $HadWarnings = $true
     }
 }
 
@@ -479,16 +526,17 @@ $SourceSizeKB = $VolumeLogicalKB
 # Exclude the ".daaf-symlinks" manifest from the backup byte sum: it exists in the
 # backup but not the volume, and the source side (VolumeLogicalKB) never counted it
 # -- so counting it here would skew the comparison.
-$BackupSizeKB = [long]((Get-ChildItem -Path $BackupName -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -ne $SymlinksManifest } | Measure-Object -Property Length -Sum).Sum / 1024)
+$BackupSizeKB = [long][math]::Floor((Get-ChildItem -Path $BackupName -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -ne $SymlinksManifest } | Measure-Object -Property Length -Sum).Sum / 1024)
 if ($SourceSizeKB -gt 0 -and $BackupSizeKB -gt 0) {
     # Allow 1% tolerance for filesystem metadata differences
-    $ToleranceKB = [math]::Max(1, [long]($SourceSizeKB / 100))
+    $ToleranceKB = [math]::Max(1, [long][math]::Floor($SourceSizeKB / 100))
     $DiffKB = [math]::Abs($SourceSizeKB - $BackupSizeKB)
     if ($DiffKB -gt $ToleranceKB) {
         Write-Host ""
         Write-Host "WARNING: Backup size mismatch." -ForegroundColor Yellow
         Write-Host "         Source: ${SourceSizeKB} KB, Backup: ${BackupSizeKB} KB (difference: ${DiffKB} KB)"
         Write-Host "         The backup may be incomplete. Consider re-running."
+        $HadWarnings = $true
     }
 }
 
@@ -528,8 +576,15 @@ if ($claudeVolumeExists) {
             $savedEAP = $ErrorActionPreference; $ErrorActionPreference = "SilentlyContinue"
             $ClaudeStageStatusRaw = (docker wait $ClaudeStageCid 2>&1 | Select-Object -Last 1)
             $ErrorActionPreference = $savedEAP
+            # Gate on TryParse's BOOLEAN return (see the data-volume staging block
+            # above): a parse failure writes 0 into the [ref], which would flip this
+            # gate from "skip the copy" to "copy a partial staged tree." Parse into a
+            # temp var; stay fail-closed at 1 on failure.
             $ClaudeStageStatus = 1
-            if ($null -ne $ClaudeStageStatusRaw) { $null = [int]::TryParse("$ClaudeStageStatusRaw".Trim(), [ref]$ClaudeStageStatus) }
+            $ClaudeStageStatusParsed = 0
+            if ($null -ne $ClaudeStageStatusRaw -and [int]::TryParse("$ClaudeStageStatusRaw".Trim(), [ref]$ClaudeStageStatusParsed)) {
+                $ClaudeStageStatus = $ClaudeStageStatusParsed
+            }
             if ($ClaudeStageStatus -eq 0) {
                 $savedEAP = $ErrorActionPreference; $ErrorActionPreference = "SilentlyContinue"
                 $null = docker cp "${ClaudeStageCid}:/staging/." "${ClaudeDestPath}" 2>&1
@@ -575,6 +630,7 @@ if ($claudeVolumeExists) {
             Write-Host "         (no details could be retrieved from the staging container)"
         }
         Write-Host "         The data volume backup above is still valid."
+        $HadWarnings = $true
     }
 } else {
     Write-Host ""
@@ -639,16 +695,22 @@ if ($manifestScanOk) {
         Write-Host "WARNING: Could not record the executable-permission manifest." -ForegroundColor Yellow
         Write-Host "         The backup is still valid; on restore, file permissions may need"
         Write-Host "         manual repair if this backup is restored on a Windows host."
+        $HadWarnings = $true
     }
 } else {
     Write-Host "WARNING: Could not record the executable-permission manifest." -ForegroundColor Yellow
     Write-Host "         The backup is still valid; on restore, file permissions may need"
     Write-Host "         manual repair if this backup is restored on a Windows host."
+    $HadWarnings = $true
 }
 
 Write-Host ""
 Write-Host "=========================================="
-Write-Host "  Backup complete!"
+if ($HadWarnings) {
+    Write-Host "  Backup completed WITH WARNINGS -- verify before relying on it"
+} else {
+    Write-Host "  Backup complete!"
+}
 Write-Host "=========================================="
 Write-Host ""
 Write-Host "Location: $HostPath\"
diff --git a/scripts/host/backup_daaf.sh b/scripts/host/backup_daaf.sh
index d598f961..ac8bc1f3 100755
--- a/scripts/host/backup_daaf.sh
+++ b/scripts/host/backup_daaf.sh
@@ -43,7 +43,7 @@ _daaf_load_settings() {
         line="$(printf '%s' "${line}" | tr -d '\r')"
         case "${line}" in ''|'#'*) continue ;; esac
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"; val="${line#*=}"
                 case "${val}" in
                     \"*\") val="${val#\"}"; val="${val%\"}" ;;
@@ -64,7 +64,11 @@ _daaf_load_settings
 # derives the prefix from the project name (default "daaf"), so a second instance
 # with DAAF_PROJECT_NAME=daaf2 owns the volume "daaf2_daaf-data". Default unset =>
 # "daaf_daaf-data" (byte-for-byte identical to the previous hardcoded value).
-VOLUME_NAME="${DAAF_PROJECT_NAME:-daaf}_daaf-data"
+# DAAF_DATA_VOLUME_NAME, when set, overrides the whole derivation with a verbatim
+# full volume name (the shared-workspace escape hatch); unset => the derived
+# default. Matches resolve_data_volume_name in daaf_lib.sh (inlined here because
+# this standalone script does not source the library).
+VOLUME_NAME="${DAAF_DATA_VOLUME_NAME:-${DAAF_PROJECT_NAME:-daaf}_daaf-data}"
 # Second volume: Claude Code state (auth/credentials, session history and
 # transcripts, plugins, ~/.claude.json). Backed up into a dedicated hidden
 # subfolder of the backup so it does not contaminate the data-volume file
@@ -305,6 +309,12 @@ if ! STAGE_CID="$(docker run -d -v "${VOLUME_NAME}:/source:ro" busybox sh -c "${
     echo "" >&2
     echo "ERROR: Could not start the staging container for a symlink-safe backup." >&2
     echo "       No backup files were written. Check Docker Desktop for errors and re-run." >&2
+    # Best-effort reap: `docker run -d` can fail AFTER creating the container
+    # (Created/Exited state) while still printing its CID to stdout, which the
+    # command substitution above captured -- remove it so a launch failure does not
+    # leak a helper container (mirrors backup_daaf.ps1's stage-start cleanup). The
+    # `${STAGE_CID:-}` guard makes this a harmless no-op if no CID was captured.
+    docker rm -f "${STAGE_CID:-}" > /dev/null 2>&1 || true
     exit 1
 fi
 trap 'docker rm -f "${STAGE_CID:-}" > /dev/null 2>&1 || true' INT TERM
@@ -376,6 +386,14 @@ wait "${COPY_PID}" || COPY_EXIT=$?
 docker rm -f "${STAGE_CID}" > /dev/null 2>&1 || true
 trap - INT TERM
 
+# Latch for the completion banner: any of the non-fatal WARNING paths below
+# (file-count mismatch, size mismatch, Claude-state copy failure, permission-manifest
+# failure) sets this so the final banner can say the backup completed WITH WARNINGS
+# rather than claiming an unqualified success. The exit status stays 0 on those paths
+# -- the banner wording is the signal, not the exit code (the corroborated short-copy
+# case below is the one that is fatal, and it exits before the banner).
+HAD_WARNINGS=0
+
 # --- Verify ---
 # The staged tree the copy streamed = volume regular files + 1 symlink manifest
 # - symlinks. Symlinks were never counted by the `find -type f` volume scan
@@ -407,16 +425,35 @@ if [ "${FILE_COUNT}" -eq 0 ]; then
     exit 1
 fi
 
-if [ "${COPY_EXIT}" -ne 0 ]; then
+# --- Corroborated short-copy check (fatal) ---
+# A nonzero docker cp exit AND a copied count short of the volume scan are two
+# independent signals that agree the backup is truncated -- the nonzero exit
+# corroborates the shortfall, so no tolerance is applied here (unlike the 1% count
+# and size tolerances below, which absorb benign filesystem/metadata drift on an
+# otherwise-clean copy). A truncated backup that passed as usable could cost a user
+# their data on restore, so fail hard: name the partial folder, tell them to delete
+# it, and exit before the completion banner. (A nonzero exit with a FULL count falls
+# through to the Note below -- warnings without an actual shortfall.)
+if [ "${COPY_EXIT}" -ne 0 ] && [ "${FILE_COUNT}" -lt "${TOTAL_FILES}" ]; then
+    echo ""
+    echo "ERROR: Backup failed (exit code ${COPY_EXIT}); only ${FILE_COUNT} of ${TOTAL_FILES} expected files were copied."
+    echo "       This backup is incomplete and must not be relied on. Delete this"
+    echo "       partial backup folder and re-run once the copy issue is resolved."
+    echo "Location: $(pwd)/${BACKUP_NAME}/"
+    exit 1
+elif [ "${COPY_EXIT}" -ne 0 ]; then
     echo "Note: File copy reported warnings (exit code ${COPY_EXIT}); ${FILE_COUNT} of ${TOTAL_FILES} expected files were transferred."
 fi
 
 # --- File-count verification ---
 # Do NOT trust docker cp's exit code as the sole failure signal: the Windows
-# symlink-abort truncation surfaced with a ZERO exit on the user's run. Compare the
-# copied data-file count (manifest excluded) against the source scan count and warn
-# loudly on a shortfall beyond a 1% tolerance -- the count and size checks are the
-# authoritative completeness signals, not COPY_EXIT.
+# symlink-abort truncation surfaced with a ZERO exit on the user's run. A nonzero
+# exit that ALSO comes up short on the count is already fatal (the corroborated
+# short-copy branch above). This block catches the harder case -- a clean ZERO exit
+# that still copied too few files -- comparing the copied data-file count (manifest
+# excluded) against the source scan count and warning loudly on a shortfall beyond a
+# 1% tolerance. The count and size checks are the authoritative completeness signals,
+# not COPY_EXIT.
 if [ "${TOTAL_FILES}" -gt 0 ] && [ "${FILE_COUNT}" -gt 0 ]; then
     COUNT_TOLERANCE=$(( TOTAL_FILES / 100 ))
     if [ "${COUNT_TOLERANCE}" -lt 1 ]; then COUNT_TOLERANCE=1; fi
@@ -427,6 +464,7 @@ if [ "${TOTAL_FILES}" -gt 0 ] && [ "${FILE_COUNT}" -gt 0 ]; then
         echo "WARNING: Backup file-count mismatch." >&2
         echo "         Source: ${TOTAL_FILES} files, Backup: ${FILE_COUNT} files (difference: ${COUNT_DIFF})" >&2
         echo "         The backup may be incomplete. Consider re-running." >&2
+        HAD_WARNINGS=1
     fi
 fi
 
@@ -450,6 +488,7 @@ if [ "${SOURCE_SIZE_KB}" -gt 0 ] && [ "${BACKUP_SIZE_KB}" -gt 0 ]; then
         echo "WARNING: Backup size mismatch." >&2
         echo "         Source: ${SOURCE_SIZE_KB} KB, Backup: ${BACKUP_SIZE_KB} KB (difference: ${DIFF_KB} KB)" >&2
         echo "         The backup may be incomplete. Consider re-running." >&2
+        HAD_WARNINGS=1
     fi
 fi
 
@@ -475,16 +514,32 @@ if docker volume inspect "${CLAUDE_VOLUME_NAME}" &> /dev/null; then
     # replays it against the claude volume.
     # Guard the launch so a `docker run -d` failure does NOT abort the whole backup
     # under `set -e` -- the Claude backup is best-effort (failure must be a WARNING,
-    # never fatal; the data backup above already succeeded). `|| CLAUDE_STAGE_CID=""`
-    # swallows the exit status and leaves an empty CID, so the `docker wait` below
-    # yields status 1 and the `if` falls into the existing WARNING path (mirrors the
-    # `|| CLAUDE_CID=""` idiom in restore_from_backup.sh's Claude restore block).
-    CLAUDE_STAGE_CID="$(docker run -d -v "${CLAUDE_VOLUME_NAME}:/source:ro" busybox sh -c "${STAGE_PROGRAM}")" || CLAUDE_STAGE_CID=""
+    # never fatal; the data backup above already succeeded). Capture the launch
+    # outcome in a SEPARATE flag rather than blanking the CID: `docker run -d` can
+    # fail AFTER creating the container (Created/Exited) while still printing its CID,
+    # and the old `|| CLAUDE_STAGE_CID=""` discarded that CID before any cleanup could
+    # reap it -- leaking the helper container. Keep the captured CID intact so the
+    # trap below and the `docker rm -f` at the end of this block can remove it
+    # (mirrors backup_daaf.ps1's $claudeStageStartOk flag + finally-reap pattern).
+    # Assigning inside the `if` condition keeps `set -e` from aborting on a launch
+    # failure while still capturing whatever the substitution produced.
+    if CLAUDE_STAGE_CID="$(docker run -d -v "${CLAUDE_VOLUME_NAME}:/source:ro" busybox sh -c "${STAGE_PROGRAM}")"; then
+        CLAUDE_STAGE_START_OK=1
+    else
+        CLAUDE_STAGE_START_OK=0
+    fi
     # Re-register an interrupt trap around this block: the data-copy trap was
     # cleared above, so without this a Ctrl-C during the Claude staging/cp window
     # would leak the helper container. Best-effort removal; guarded under set -u.
     trap 'docker rm -f "${CLAUDE_STAGE_CID:-}" > /dev/null 2>&1 || true' INT TERM
-    CLAUDE_STAGE_STATUS="$(docker wait "${CLAUDE_STAGE_CID}" 2>/dev/null || echo 1)"
+    # Only wait on a container that actually launched; a launch failure is treated as
+    # a nonzero staging status so control flows into the WARNING path below (with the
+    # CID preserved so the reap at the end of this block can remove it).
+    if [ "${CLAUDE_STAGE_START_OK}" -eq 1 ]; then
+        CLAUDE_STAGE_STATUS="$(docker wait "${CLAUDE_STAGE_CID}" 2>/dev/null || echo 1)"
+    else
+        CLAUDE_STAGE_STATUS=1
+    fi
     # On a staging-gate trip the offender list went to the DETACHED container's log.
     # Capture it now, before the `docker rm -f` below removes the container, so the
     # WARNING branch can relay it. Kept asymmetric with the data volume: this stays a
@@ -510,6 +565,7 @@ if docker volume inspect "${CLAUDE_VOLUME_NAME}" &> /dev/null; then
             echo "         (no details could be retrieved from the staging container)" >&2
         fi
         echo "         The data volume backup above is still valid." >&2
+        HAD_WARNINGS=1
     fi
     docker rm -f "${CLAUDE_STAGE_CID}" > /dev/null 2>&1 || true
     trap - INT TERM
@@ -567,16 +623,22 @@ if EXEC_PATHS=$(docker run --rm -v "${VOLUME_NAME}:/source:ro" busybox sh -c 'fi
         echo "WARNING: Could not record the executable-permission manifest." >&2
         echo "         The backup is still valid; on restore, file permissions may need" >&2
         echo "         manual repair if this backup is restored on a Windows host." >&2
+        HAD_WARNINGS=1
     fi
 else
     echo "WARNING: Could not record the executable-permission manifest." >&2
     echo "         The backup is still valid; on restore, file permissions may need" >&2
     echo "         manual repair if this backup is restored on a Windows host." >&2
+    HAD_WARNINGS=1
 fi
 
 echo ""
 echo "=========================================="
-echo "  Backup complete!"
+if [ "${HAD_WARNINGS}" -eq 1 ]; then
+    echo "  Backup completed WITH WARNINGS -- verify before relying on it"
+else
+    echo "  Backup complete!"
+fi
 echo "=========================================="
 echo ""
 echo "Location: $(pwd)/${BACKUP_NAME}/"
diff --git a/scripts/host/daaf_lib.ps1 b/scripts/host/daaf_lib.ps1
index ff05180a..e0320806 100644
--- a/scripts/host/daaf_lib.ps1
+++ b/scripts/host/daaf_lib.ps1
@@ -11,7 +11,10 @@
 # helpers the Bash Control Panel relies on, adapted to PowerShell idiom:
 #   Import-DaafSettingsFile -- export the whitelisted DAAF_* vars (four multi-instance
 #                              keys + the DAAF_DEV build flag + the DAAF_BRANCH
-#                              updater ref) from environment_settings.txt
+#                              updater ref + the DAAF_DATA_VOLUME_NAME data-volume
+#                              override) from environment_settings.txt
+#   Resolve-DaafDataVolumeName -- echo the resolved data-volume name, honoring the
+#                              optional DAAF_DATA_VOLUME_NAME full-name override
 #   Set-DaafSettingsKey -- insert/update a single KEY=value line in a settings
 #                              file (write counterpart to Import-DaafSettingsFile)
 #   Read-DaafLine       -- read one input line, working under redirected stdin (CI)
@@ -67,13 +70,16 @@ if (Get-Command Read-DaafLine -ErrorAction SilentlyContinue) { return }
 
 # --- Multi-Instance / Build-Flag Settings Loader ---
 # PowerShell counterpart to daaf_lib.sh load_daaf_settings. Bridges
-# environment_settings.txt -> process environment for the six whitelisted
+# environment_settings.txt -> process environment for the seven whitelisted
 # DAAF_* variables: the four multi-instance keys so `docker compose`
 # interpolation in docker-compose.yml (${DAAF_PROJECT_NAME:-daaf},
 # ${DAAF_PORT_*:-27xx}) resolves them, plus DAAF_DEV, the opt-in
 # BUILD flag consumed as `--build-arg DAAF_DEV=${DAAF_DEV:-0}`, plus DAAF_BRANCH,
 # the updater's target ref (read env-only today; whitelisting it here lets a
-# value persisted in environment_settings.txt reach update_daaf.ps1).
+# value persisted in environment_settings.txt reach update_daaf.ps1), plus
+# DAAF_DATA_VOLUME_NAME, the optional full-name override for the research-workspace
+# data volume (consumed by Resolve-DaafDataVolumeName below and by the backup /
+# restore tools).
 #
 # WHY: environment_settings.txt is a compose `env_file` (feeds the CONTAINER
 # env only). Compose *interpolation* (and build args) read the host/process
@@ -82,7 +88,7 @@ if (Get-Command Read-DaafLine -ErrorAction SilentlyContinue) { return }
 # ports / build flag to take effect.
 #
 # PARSING SAFETY: we never dot-source the file (it holds API keys with arbitrary
-# characters). We extract only the six known DAAF_* keys via a line scan and a
+# characters). We extract only the seven known DAAF_* keys via a line scan and a
 # regex on KEY=VALUE. CR is stripped for CRLF tolerance.
 #
 # PRECEDENCE: an already-set process env var WINS over the file value (matches
@@ -97,7 +103,7 @@ function Import-DaafSettingsFile {
         return
     }
 
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
 
     # -Encoding UTF8 pins BOM-less UTF-8 decoding: a bare Get-Content on Windows
     # PowerShell 5.1 misreads BOM-less UTF-8 as legacy ANSI (cp1252), corrupting
@@ -110,7 +116,11 @@ function Import-DaafSettingsFile {
 
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
 
         $val = $line.Substring($eq + 1)
@@ -128,6 +138,44 @@ function Import-DaafSettingsFile {
     }
 }
 
+# --- Data Volume Name Resolver ---
+# PowerShell counterpart to daaf_lib.sh resolve_data_volume_name. Return the
+# Docker volume name that holds the DAAF research workspace (/daaf), honoring the
+# optional DAAF_DATA_VOLUME_NAME full-name override.
+#
+# PRECEDENCE (returned to the caller):
+#   1. DAAF_DATA_VOLUME_NAME, when set non-empty -> used VERBATIM as the full
+#      volume name (no project prefix is added). This is the escape hatch for
+#      pointing two installs at ONE shared workspace volume; it must match the
+#      `name:` under the external `daaf-data` block in docker-compose.yml.
+#   2. Otherwise "<project>_daaf-data", where <project> is DAAF_PROJECT_NAME or
+#      the "daaf" default -- the Compose-prefixed default. So an UNSET
+#      DAAF_DATA_VOLUME_NAME is byte-for-byte identical to the historical
+#      hardcoded derivation, and a second instance with DAAF_PROJECT_NAME=daaf2
+#      still owns "daaf2_daaf-data".
+# A set-but-EMPTY DAAF_DATA_VOLUME_NAME falls through to the derived default: an
+# empty string is falsy in PowerShell, so the `if ($env:DAAF_DATA_VOLUME_NAME)`
+# guard treats empty and unset alike, matching the bash `:-` semantics and the
+# way Import-DaafSettingsFile adopts a whitelisted key only when it is non-empty.
+#
+# The claude-config volume is deliberately NOT resolved here: per-install auth
+# isolation is by design, so it keeps its project-prefixed default everywhere and
+# has no analogous override.
+#
+# Callers that need a value persisted in environment_settings.txt to win should
+# Import-DaafSettingsFile first (which bridges DAAF_DATA_VOLUME_NAME into the
+# process env), then call this. Strict-clean: only $env: reads and string ops.
+function Resolve-DaafDataVolumeName {
+    [CmdletBinding()]
+    param()
+    if ($env:DAAF_DATA_VOLUME_NAME) {
+        return $env:DAAF_DATA_VOLUME_NAME
+    }
+    $projectName = "daaf"
+    if ($env:DAAF_PROJECT_NAME) { $projectName = $env:DAAF_PROJECT_NAME }
+    return "${projectName}_daaf-data"
+}
+
 # --- Line Input ---
 # Read one line of input from the user, compatible with both interactive
 # terminals and redirected stdin (CI pipelines). Mirrors the pattern used in
diff --git a/scripts/host/daaf_lib.sh b/scripts/host/daaf_lib.sh
index be1e4a97..c4ff708d 100755
--- a/scripts/host/daaf_lib.sh
+++ b/scripts/host/daaf_lib.sh
@@ -12,7 +12,10 @@
 # Functions provided:
 #   load_daaf_settings -- export the whitelisted DAAF_* vars (four multi-instance
 #                         keys + the DAAF_DEV build flag + the DAAF_BRANCH updater
-#                         ref) from environment_settings.txt
+#                         ref + the DAAF_DATA_VOLUME_NAME data-volume override) from
+#                         environment_settings.txt
+#   resolve_data_volume_name -- echo the resolved data-volume name, honoring the
+#                         optional DAAF_DATA_VOLUME_NAME full-name override
 #   upsert_settings_key -- insert/update a single KEY=value line in a settings
 #                         file (write counterpart to load_daaf_settings)
 #   setup_colors    -- populate color variables (respects NO_COLOR + non-TTY)
@@ -30,16 +33,20 @@ fi
 _DAAF_LIB_LOADED=1
 
 # --- Multi-Instance / Build-Flag Settings Loader ---
-# Bridge environment_settings.txt -> host shell environment for the six
+# Bridge environment_settings.txt -> host shell environment for the seven
 # whitelisted DAAF_* variables: the four multi-instance keys
 # (DAAF_PROJECT_NAME, DAAF_PORT_MARIMO, DAAF_PORT_LOGVIEWER, DAAF_PORT_VSCODE)
 # plus DAAF_DEV, the opt-in BUILD flag consumed as
 # `--build-arg DAAF_DEV=${DAAF_DEV:-0}` in docker-compose.yml, plus DAAF_BRANCH,
 # the updater's target ref (read env-only today; whitelisting it here lets a
-# value persisted in environment_settings.txt reach update_daaf.sh). The build
-# flag and branch ref ride the same bridge for the same reason: env_file feeds
-# the container env only, while compose interpolation (and build args) resolve
-# from the host shell env.
+# value persisted in environment_settings.txt reach update_daaf.sh), plus
+# DAAF_DATA_VOLUME_NAME, the optional full-name override for the research-workspace
+# data volume (consumed by resolve_data_volume_name below and by the backup /
+# restore tools; whitelisting it lets a value persisted in the settings file reach
+# those tools and compose interpolation of the external `daaf-data` volume). The
+# build flag, branch ref, and data-volume override ride the same bridge for the
+# same reason: env_file feeds the container env only, while compose interpolation
+# (and build args) resolve from the host shell env.
 #
 # WHY THIS EXISTS: environment_settings.txt is wired into docker-compose.yml as a
 # service-level `env_file`, which feeds the CONTAINER environment only. Docker
@@ -54,7 +61,7 @@ _DAAF_LIB_LOADED=1
 # PARSING SAFETY: we deliberately do NOT `source`/`.` the file. It holds API keys
 # with arbitrary characters (quotes, $, backticks, spaces) that would be
 # interpreted by the shell -- a correctness and safety hazard. We extract only the
-# six known DAAF_* keys via a line-oriented grep/sed/case scan, stripping CR for
+# seven known DAAF_* keys via a line-oriented grep/sed/case scan, stripping CR for
 # CRLF tolerance (matches how the rest of the codebase handles container output).
 #
 # PRECEDENCE: an already-set shell environment variable WINS over the file value.
@@ -80,9 +87,9 @@ load_daaf_settings() {
         case "${line}" in
             ''|'#'*) continue ;;
         esac
-        # Only lines of the form KEY=VALUE for our six known keys.
+        # Only lines of the form KEY=VALUE for our seven known keys.
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"
                 val="${line#*=}"
                 # Strip one layer of surrounding quotes if present (tolerant of
@@ -104,6 +111,34 @@ load_daaf_settings() {
     return 0
 }
 
+# --- Data Volume Name Resolver ---
+# Echo the Docker volume name that holds the DAAF research workspace (/daaf),
+# honoring the optional DAAF_DATA_VOLUME_NAME full-name override.
+#
+# PRECEDENCE (printed to stdout, captured by callers via `$(resolve_data_volume_name)`):
+#   1. DAAF_DATA_VOLUME_NAME, when set non-empty -> used VERBATIM as the full
+#      volume name (no project prefix is added). This is the escape hatch for
+#      pointing two installs at ONE shared workspace volume; it must match the
+#      `name:` under the external `daaf-data` block in docker-compose.yml.
+#   2. Otherwise "${DAAF_PROJECT_NAME:-daaf}_daaf-data" -- the Compose-prefixed
+#      default. So an UNSET DAAF_DATA_VOLUME_NAME is byte-for-byte identical to the
+#      historical hardcoded derivation, and a second instance with
+#      DAAF_PROJECT_NAME=daaf2 still owns "daaf2_daaf-data".
+# A set-but-EMPTY DAAF_DATA_VOLUME_NAME falls through to the derived default (the
+# `:-` test treats empty and unset alike), matching how load_daaf_settings adopts
+# a whitelisted key only when it is non-empty.
+#
+# The claude-config volume is deliberately NOT resolved here: per-install auth
+# isolation is by design, so it keeps its project-prefixed default everywhere and
+# has no analogous override.
+#
+# Callers that need a value persisted in environment_settings.txt to win should
+# `load_daaf_settings` first (which bridges DAAF_DATA_VOLUME_NAME into the shell
+# env), then call this. Bash 3.2 safe: pure parameter expansion, no arrays.
+resolve_data_volume_name() {
+    printf '%s\n' "${DAAF_DATA_VOLUME_NAME:-${DAAF_PROJECT_NAME:-daaf}_daaf-data}"
+}
+
 # --- Color Setup ---
 # Populate global color variables for terminal output.
 # Respects NO_COLOR (https://no-color.org/) and non-TTY contexts.
diff --git a/scripts/host/environment_settings_example.txt b/scripts/host/environment_settings_example.txt
index f7e1ceae..66cee69b 100644
--- a/scripts/host/environment_settings_example.txt
+++ b/scripts/host/environment_settings_example.txt
@@ -24,6 +24,10 @@
 #                an inline comment breaks some parsers). Delete the one leading
 #                '#' to turn it on.
 #   # text       An explanatory prose line (it may be indented AFTER the '#').
+#   Write values bare: KEY=value with nothing extra -- no quotes around the
+#   value and no spaces around the '='. DAAF's readers take the line literally,
+#   so quotes or stray spaces can end up inside your value. (Editing on Windows
+#   is fine -- Windows line endings are tolerated.)
 #   Adjacent #KEY lines introduced with "pick ONE" are mutually exclusive
 #   alternatives -- uncomment only the set for the method you chose.
 #
@@ -131,6 +135,17 @@
 #DAAF_PORT_LOGVIEWER=3719
 #DAAF_PORT_VSCODE=3720
 #
+# Data-volume override (advanced; shared workspace across installs). Normally the
+# research workspace lives in a Docker volume named "<project>_daaf-data" (the
+# default install uses "daaf_daaf-data"). Set DAAF_DATA_VOLUME_NAME to a full,
+# verbatim volume name to point THIS install at a specific data volume -- the
+# escape hatch for sharing ONE research workspace across two installs. When set it
+# must match the "name:" under the external "daaf-data" block you uncomment in
+# docker-compose.yml. Leave unset for normal installs (the project-prefixed
+# default derivation is used, byte-for-byte identical to the historical behavior).
+# --- To activate, remove the leading '#': ---
+#DAAF_DATA_VOLUME_NAME=daaf_daaf-data
+#
 # The developer build flag DAAF_DEV also belongs to this install-time family, but
 # it is documented alongside the other developer options in section [6].
 #
@@ -163,8 +178,12 @@
 # ----------------------------------------------------------------------------
 # Option B: Max / Pro / Team / Enterprise subscription
 # ----------------------------------------------------------------------------
-# Run `claude setup-token` once inside the container to generate a long-lived
-# OAuth token (valid ~1 year), then paste it here for persistent auth.
+# Most users don't need this anymore: your interactive login (option 5 in the
+# priority list above) now persists across rebuilds on the config volume, so
+# signing in once is enough. This token method is mainly useful if you run
+# SEVERAL installs (skip logging in per container) or need fully non-interactive
+# startup. If that's you: run `claude setup-token` once inside the container to
+# generate a long-lived OAuth token (valid ~1 year), then paste it here.
 # NOTE: do NOT also set ANTHROPIC_API_KEY -- it takes priority and you would be
 # billed per-use instead of through your subscription.
 # --- To activate, remove the leading '#': ---
@@ -192,6 +211,10 @@
 # ----------------------------------------------------------------------------
 # Option D: Amazon Bedrock
 # ----------------------------------------------------------------------------
+# For organizations that run Claude through their own cloud platform. Claude
+# Code supports these routes, but the DAAF maintainers have not yet validated
+# them end-to-end -- see the install guide's cloud-provider note before relying
+# on one.
 # Docs: https://code.claude.com/docs/en/bedrock-vertex
 # --- To activate, remove the leading '#' on the lines you need: ---
 #CLAUDE_CODE_USE_BEDROCK=1
@@ -201,6 +224,8 @@
 # ----------------------------------------------------------------------------
 # Option E: Google Vertex AI
 # ----------------------------------------------------------------------------
+# Same audience and caveat as Option D above: org cloud platforms only, not yet
+# maintainer-validated end-to-end.
 # Docs: https://code.claude.com/docs/en/bedrock-vertex
 # --- To activate, remove the leading '#' on the lines you need: ---
 #CLAUDE_CODE_USE_VERTEX=1
@@ -252,6 +277,9 @@
 # ----------------------------------------------------------------------------
 # Context window size
 # ----------------------------------------------------------------------------
+# TL;DR: on a standard Anthropic setup you can ignore this key entirely -- it
+# only matters on alternative-provider routes (OpenRouter, GLM, GPT).
+#
 # Tell Claude Code the real context window so it does not assume ~200K for an
 # unknown slug and end sessions early with "Prompt is too long." This override is
 # GLOBAL: it applies to the main session and every subagent, not per model. Choose
@@ -342,11 +370,29 @@
 # ----------------------------------------------------------------------------
 # 4.1 Basic shim setup (both auth lanes need these)
 # ----------------------------------------------------------------------------
-# --- To activate, remove the leading '#' on all four lines: ---
+# --- To activate, remove the leading '#' on all five lines: ---
 #DAAF_PROVIDER_SHIM=openai
 #ANTHROPIC_BASE_URL=http://127.0.0.1:4141
 #ANTHROPIC_AUTH_TOKEN=daaf-shim-local
 #ANTHROPIC_API_KEY=
+#CLAUDE_CODE_DISABLE_FAST_MODE=1
+#
+# The exact disable value above hides Claude Code's misleading native /fast control
+# on GPT routes. Supported Anthropic models retain native /fast. Edit this private
+# HOST file yourself: in-container DAAF code cannot access it. Recreate the
+# container and start a new Claude session after changing it; no image rebuild is
+# required for this setting.
+#
+# GPT FAST / GPT PRIORITY SPEED BOOST (shim v1.3.9+): OFF by default. One command
+# inside the container turns it on, turns it off, or reports where things stand:
+#     bash /daaf/scripts/provider_shim/gpt_fast.sh {on|off|status}
+# (In a Claude Code session, prefix the same command with `!`.) Changes apply
+# immediately -- no restart needed. Turning it `on` requires the
+# exact CLAUDE_CODE_DISABLE_FAST_MODE=1 line above, and switching provider
+# routes resets the boost OFF until you explicitly turn it back on. One honest
+# caveat: requesting the boost doesn't guarantee it was served on any given
+# request -- `status` reports the most recent evidence of what actually served.
+# Full details: the technical FAQ's GPT Fast entry.
 #
 # Then pick ONE auth lane below: 4.2 (OpenAI API key, sanctioned) or 4.3 (ChatGPT
 # subscription via Codex OAuth, an unofficial dev lane).
@@ -377,8 +423,11 @@
 # 4.2 Auth lane A: OpenAI API key  (sanctioned)
 # ----------------------------------------------------------------------------
 # Get a key: https://platform.openai.com/api-keys
-# This is the default lane (SHIM_BACKEND_MODE unset -> "openai").
-# --- To activate, remove the leading '#': ---
+# The legacy shim process still defaults to openai when unset, but a supported GPT
+# provider-shim route and its service-tier controller require this exact route value.
+# Set it explicitly; unset, case-varied, or whitespace-padded values fail route checks.
+# --- To activate, remove the leading '#' on both lines: ---
+#SHIM_BACKEND_MODE=openai
 #OPENAI_API_KEY=sk-your_openai_key_here
 #
 # CONTEXT WINDOW (API-key lane): this lane serves the model's full window
@@ -386,18 +435,16 @@
 # --- To activate, remove the leading '#': ---
 #CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000
 #
+# ON on this lane requests GPT Priority (`service_tier:"priority"`). Priority may
+# cost extra and depends on provider/model/account eligibility.
+#
 # ----------------------------------------------------------------------------
 # 4.3 Auth lane B: ChatGPT subscription (Codex backend)  (unofficial dev lane)
 # ----------------------------------------------------------------------------
 # Instead of a pay-per-token OpenAI API key, the SAME shim can route Claude Code
-# through your CHATGPT SUBSCRIPTION's Codex backend. Request translation, tools,
-# and content-block lifecycle stay shared. As of v1.2.7, ChatGPT always uses
-# upstream SSE (including for inbound non-stream callers, which receive internally
-# accumulated JSON), fails explicitly on malformed/missing terminals or invalid
-# block order, and retains v1.2.6's ChatGPT-only reasoning-summary blank-line
-# boundaries (`\n\n`). OpenAI/API-key mode retains its real upstream non-stream
-# JSON path and legacy exact concatenation. This lane reads OAuth from your `codex`
-# login (auth.json).
+# through your CHATGPT SUBSCRIPTION's Codex backend. Everything else about how
+# the shim behaves stays the same on this lane. It reads its sign-in from your
+# `codex` login (auth.json).
 #
 # UNOFFICIAL / DEV-LANE PATH: this reuses Codex's OAuth against an undocumented,
 # OpenAI-controlled backend -- NOT an OpenAI-sanctioned API method. It may break if
@@ -460,18 +507,25 @@
 # --- To activate, remove the leading '#': ---
 #CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000
 #
+# ON on this lane requests friendly ChatGPT Fast using canonical Responses wire
+# `service_tier:"priority"`. This remains ChatGPT plan/credit usage, NOT OpenAI API
+# Priority Processing billing. Availability depends on provider/model/account eligibility.
+#
 # CODEX_HOME (chatgpt mode): the directory holding auth.json. Compose already sets
 # this to the persisted, backed-up store and pre-creates it on fresh volumes;
 # override only to point at a separate per-tool login store for parallel use.
 # --- To activate, remove the leading '#': ---
 #CODEX_HOME=/home/appuser/.claude/codex-daaf
 #
-# The two OAuth override vars below are TEST / STAGING overrides only -- the
-# production defaults are correct (auth.openai.com/oauth/token and the codex
-# first-party client_id). Leave them unset for normal use.
+# CODEX DELEGATION (shim v1.3.0+, chatgpt lane): the shim delegates token refresh
+# to the codex CLI (the single writer of auth.json). The two knobs below tune that
+# delegated call; the defaults are correct for the standard image.
+# SHIM_CODEX_BIN: path to the codex binary the shim invokes for the delegated auth
+#   refresh (default "codex" -- resolved on PATH).
+# SHIM_CODEX_TIMEOUT_S: seconds to wait for that invocation (default 30).
 # --- To activate, remove the leading '#' on the lines you need: ---
-#SHIM_OAUTH_TOKEN_URL=
-#SHIM_OAUTH_CLIENT_ID=
+#SHIM_CODEX_BIN=
+#SHIM_CODEX_TIMEOUT_S=
 #
 # Troubleshooting (inside the container):
 #     codex --version                                          (confirm the standard-image Codex CLI is present)
@@ -486,7 +540,9 @@
 # ----------------------------------------------------------------------------
 # Network / backend overrides (SHIM_BACKEND_API_KEY defaults to OPENAI_API_KEY):
 # --- To activate, remove the leading '#' on the lines you need: ---
+# DEFAULT: 4141 is the default port; the line below shows it, so uncommenting it changes nothing.
 #SHIM_PORT=4141
+# DEFAULT: https://api.openai.com/v1 is the default backend; the line below shows it, so uncommenting it changes nothing.
 #SHIM_BACKEND_BASE_URL=https://api.openai.com/v1
 #SHIM_BACKEND_API_KEY=
 #
diff --git a/scripts/host/install.ps1 b/scripts/host/install.ps1
index a8d27906..1615f0fc 100644
--- a/scripts/host/install.ps1
+++ b/scripts/host/install.ps1
@@ -146,7 +146,10 @@ if ($LASTEXITCODE -ne 0) {
 # (DAAF_PROJECT_NAME set) are detected correctly. The value comes from the process
 # environment first, else DAAF_PROJECT_NAME in the existing install's
 # environment_settings.txt, else the "daaf" default (byte-for-byte identical to the
-# former hardcoded "daaf_daaf-data"). Parse only that one key (never dot-source --
+# former hardcoded "daaf_daaf-data"). DAAF_DATA_VOLUME_NAME, when set in the
+# process environment, overrides the whole derivation with a verbatim full volume
+# name (the shared-workspace escape hatch; matches Resolve-DaafDataVolumeName in
+# daaf_lib.ps1). Parse only that one key (never dot-source --
 # the file holds API keys); process env wins; CR stripped; PS 5.1 safe.
 $InstallProjectName = $env:DAAF_PROJECT_NAME
 if ([string]::IsNullOrEmpty($InstallProjectName)) {
@@ -170,6 +173,7 @@ if ([string]::IsNullOrEmpty($InstallProjectName)) {
 }
 if ([string]::IsNullOrEmpty($InstallProjectName)) { $InstallProjectName = "daaf" }
 $DataVolumeName = "${InstallProjectName}_daaf-data"
+if ($env:DAAF_DATA_VOLUME_NAME) { $DataVolumeName = $env:DAAF_DATA_VOLUME_NAME }
 
 # --- Bridge the DAAF_DEV build flag into the environment ---
 # Unlike DAAF_PROJECT_NAME above (only needed locally to derive the volume name;
@@ -614,7 +618,7 @@ else {
     $SeedKeys = @()
     try {
         Copy-Item -LiteralPath $SeedSrc -Destination $SeedDst
-        foreach ($k in @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')) {
+        foreach ($k in @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')) {
             $v = [Environment]::GetEnvironmentVariable($k, "Process")
             if ([string]::IsNullOrEmpty($v)) { continue }
             if ($k -eq 'DAAF_BRANCH' -and -not $SeedBranchOk) { continue }
@@ -700,12 +704,6 @@ Write-Host "     and all DAAF operations in one place."
 Write-Host ""
 Write-Host "  2. On first launch, you'll be asked to authenticate with your Anthropic account."
 Write-Host ""
-Write-Host "  3. Configure Claude Code (required):"
-Write-Host "     - Type /config and set:"
-Write-Host "         Auto-compact  -> False"
-Write-Host "         Verbose output -> True"
-Write-Host "     - Press ESC to return to the chat"
-Write-Host ""
 Write-Host "Available scripts (in $InstallDir):"
 Write-Host "  .\daaf.ps1                     DAAF Control Panel (recommended)"
 Write-Host "  .\run_daaf.ps1                 Launch Claude Code directly"
diff --git a/scripts/host/install.sh b/scripts/host/install.sh
index aa10034f..2a93bf07 100755
--- a/scripts/host/install.sh
+++ b/scripts/host/install.sh
@@ -119,7 +119,10 @@ fi
 # (DAAF_PROJECT_NAME set) are detected correctly. The value comes from the shell
 # environment first, else DAAF_PROJECT_NAME in the existing install's
 # environment_settings.txt, else the "daaf" default (byte-for-byte identical to
-# the former hardcoded "daaf_daaf-data"). Parse only that one key (never `source`
+# the former hardcoded "daaf_daaf-data"). DAAF_DATA_VOLUME_NAME, when set in the
+# shell environment, overrides the whole derivation with a verbatim full volume
+# name (the shared-workspace escape hatch; matches resolve_data_volume_name in
+# daaf_lib.sh). Parse only that one key (never `source`
 # -- the file holds API keys); shell env wins; CR stripped; Bash 3.2 safe.
 INSTALL_PROJECT_NAME="${DAAF_PROJECT_NAME:-}"
 if [ -z "${INSTALL_PROJECT_NAME}" ] && [ -f "${INSTALL_DIR}/environment_settings.txt" ]; then
@@ -137,7 +140,7 @@ if [ -z "${INSTALL_PROJECT_NAME}" ] && [ -f "${INSTALL_DIR}/environment_settings
         esac
     done < "${INSTALL_DIR}/environment_settings.txt"
 fi
-DATA_VOLUME_NAME="${INSTALL_PROJECT_NAME:-daaf}_daaf-data"
+DATA_VOLUME_NAME="${DAAF_DATA_VOLUME_NAME:-${INSTALL_PROJECT_NAME:-daaf}_daaf-data}"
 
 # --- Bridge the DAAF_DEV build flag into the environment ---
 # Unlike DAAF_PROJECT_NAME above (only needed locally to derive the volume name;
@@ -590,7 +593,7 @@ else
     SEED_OK=1
     SEED_KEYS=""
     if cp "${SEED_SRC}" "${SEED_DST}"; then
-        for _k in DAAF_PROJECT_NAME DAAF_PORT_MARIMO DAAF_PORT_LOGVIEWER DAAF_PORT_VSCODE DAAF_DEV DAAF_BRANCH; do
+        for _k in DAAF_PROJECT_NAME DAAF_PORT_MARIMO DAAF_PORT_LOGVIEWER DAAF_PORT_VSCODE DAAF_DEV DAAF_BRANCH DAAF_DATA_VOLUME_NAME; do
             _v="${!_k:-}"
             [ -n "${_v}" ] || continue
             if [ "${_k}" = "DAAF_BRANCH" ] && [ "${SEED_BRANCH_OK}" != "1" ]; then
@@ -676,12 +679,6 @@ echo "     and all DAAF operations in one place."
 echo ""
 echo "  2. On first launch, you'll be asked to authenticate with your Anthropic account."
 echo ""
-echo "  3. Configure Claude Code (required):"
-echo "     - Type /config and set:"
-echo "         Auto-compact  -> False"
-echo "         Verbose output -> True"
-echo "     - Press ESC to return to the chat"
-echo ""
 echo "Available scripts (in ${INSTALL_DIR}):"
 echo "  bash daaf.sh                    DAAF Control Panel (recommended)"
 echo "  bash run_daaf.sh               Launch Claude Code directly"
diff --git a/scripts/host/migrate_daaf.ps1 b/scripts/host/migrate_daaf.ps1
index 7ea356b9..a4a67d50 100644
--- a/scripts/host/migrate_daaf.ps1
+++ b/scripts/host/migrate_daaf.ps1
@@ -57,6 +57,12 @@ function Wait-ForUser {
 $Repo = "DAAF-Contribution-Community/daaf"
 $Branch = if ($env:DAAF_BRANCH) { $env:DAAF_BRANCH } else { "main" }
 $RawBase = "https://raw.githubusercontent.com/$Repo/$Branch"
+# Migration deliberately targets the DEFAULT data volume "daaf_daaf-data" and does
+# NOT honor DAAF_PROJECT_NAME or the DAAF_DATA_VOLUME_NAME override. This tool is a
+# one-time bootstrap for LEGACY installs that predate custom project names and the
+# data-volume override -- those installs always used the single hardcoded default
+# name, so deriving or overriding it here would only risk missing the volume the
+# migration is meant to find.
 $VolumeName = "daaf_daaf-data"
 $ContainerName = ""
 $BackupCompleted = $false
diff --git a/scripts/host/migrate_daaf.sh b/scripts/host/migrate_daaf.sh
index 7aed835a..31c580b5 100755
--- a/scripts/host/migrate_daaf.sh
+++ b/scripts/host/migrate_daaf.sh
@@ -54,6 +54,12 @@ fi
 REPO="DAAF-Contribution-Community/daaf"
 BRANCH="${DAAF_BRANCH:-main}"
 RAW_BASE="https://raw.githubusercontent.com/${REPO}/${BRANCH}"
+# Migration deliberately targets the DEFAULT data volume "daaf_daaf-data" and does
+# NOT honor DAAF_PROJECT_NAME or the DAAF_DATA_VOLUME_NAME override. This tool is a
+# one-time bootstrap for LEGACY installs that predate custom project names and the
+# data-volume override -- those installs always used the single hardcoded default
+# name, so deriving or overriding it here would only risk missing the volume the
+# migration is meant to find.
 VOLUME_NAME="daaf_daaf-data"
 CONTAINER_NAME=""
 BACKUP_COMPLETED=false
@@ -373,8 +379,21 @@ if [ "${DAAF_DRY_RUN:-}" = "1" ]; then
 else
     ORIGINAL_DIR="$(pwd)"
     cd "${HOST_DIR}"
-    DAAF_NESTED=1 bash backup_daaf.sh
+    # Capture the backup exit explicitly. Under this script's `set -euo pipefail` an
+    # unguarded failed backup would abort the migration abruptly with no explanation;
+    # `|| BACKUP_EXIT=$?` defuses set -e so we can abort gracefully with a clear
+    # message instead. This backup is mandatory (not prompted), so any failure stops
+    # the migration -- mirroring migrate_daaf.ps1's existing gated abort.
+    BACKUP_EXIT=0
+    DAAF_NESTED=1 bash backup_daaf.sh || BACKUP_EXIT=$?
     cd "${ORIGINAL_DIR}"
+    if [ "${BACKUP_EXIT}" -ne 0 ]; then
+        echo ""
+        echo "ERROR: Backup failed (exit code ${BACKUP_EXIT})."
+        echo "The migration will not proceed without a successful backup."
+        echo "Please resolve the backup issue and re-run: bash migrate_daaf.sh"
+        exit 1
+    fi
     BACKUP_COMPLETED=true
 fi
 
diff --git a/scripts/host/rebuild_daaf.ps1 b/scripts/host/rebuild_daaf.ps1
index 6ae9e148..90406e7f 100644
--- a/scripts/host/rebuild_daaf.ps1
+++ b/scripts/host/rebuild_daaf.ps1
@@ -49,7 +49,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -58,7 +58,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
@@ -290,12 +294,23 @@ Write-Host ""
 # on `docker compose up --progress`, which is rejected as "unknown flag" on
 # Docker Compose versions prior to ~v2.27.
 # BUILDX_BUILDER is set only when the diagnostic builder was selected above, then
-# cleared right after the build so it does not leak into later docker calls.
+# restored right after the build so it does not leak into later docker calls.
+# HAZARD (parallel to the bash twin's comment at rebuild_daaf.sh:251-255, whose
+# command-scoped `BUILDX_BUILDER=... docker compose build` prefix never mutates the
+# process env): assigning `$env:BUILDX_BUILDER = $null` REMOVES the variable entirely
+# rather than setting it empty, so a naive clear would DESTROY a user's own
+# pre-exported BUILDX_BUILDER selection. Save the prior value first and restore it
+# afterwards; remove the var only when the user had none set. ($env: reads are
+# strict-mode-safe even when the variable is unset -- they yield $null, not an error.)
+$priorBuildxBuilder = $env:BUILDX_BUILDER   # $null when the user had none set
 if ($UseDiagBuilder) { $env:BUILDX_BUILDER = "daaf-diag-builder" }
 $savedEAP = $ErrorActionPreference; $ErrorActionPreference = "SilentlyContinue"
 docker compose build --progress plain
 $ErrorActionPreference = $savedEAP
-if ($UseDiagBuilder) { $env:BUILDX_BUILDER = $null }
+if ($UseDiagBuilder) {
+    if ($null -ne $priorBuildxBuilder) { $env:BUILDX_BUILDER = $priorBuildxBuilder }
+    else { $env:BUILDX_BUILDER = $null }
+}
 if ($LASTEXITCODE -ne 0) {
     Write-Host ""
     Write-Host "ERROR: Rebuild failed. Check the output above for details." -ForegroundColor Red
diff --git a/scripts/host/rebuild_daaf.sh b/scripts/host/rebuild_daaf.sh
index efdb5bda..1c3263b6 100755
--- a/scripts/host/rebuild_daaf.sh
+++ b/scripts/host/rebuild_daaf.sh
@@ -51,7 +51,7 @@ _daaf_load_settings() {
         line="$(printf '%s' "${line}" | tr -d '\r')"
         case "${line}" in ''|'#'*) continue ;; esac
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"; val="${line#*=}"
                 case "${val}" in
                     \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/host/restore_from_backup.ps1 b/scripts/host/restore_from_backup.ps1
index d52c3076..065be3b3 100644
--- a/scripts/host/restore_from_backup.ps1
+++ b/scripts/host/restore_from_backup.ps1
@@ -41,7 +41,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -50,7 +50,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
@@ -67,9 +71,14 @@ Import-DaafSettingsInline
 # --- Configuration ---
 # The Docker named volume is project-prefixed: "<project>_daaf-data". Default
 # unset => "daaf_daaf-data" (byte-for-byte identical to the previous hardcoded value).
+# DAAF_DATA_VOLUME_NAME, when set, overrides the whole derivation with a verbatim
+# full volume name (the shared-workspace escape hatch); unset => the derived
+# default. Matches Resolve-DaafDataVolumeName in daaf_lib.ps1 (inlined here because
+# this standalone script does not dot-source the library).
 $projectName = "daaf"
 if ($env:DAAF_PROJECT_NAME) { $projectName = $env:DAAF_PROJECT_NAME }
 $VolumeName = "${projectName}_daaf-data"
+if ($env:DAAF_DATA_VOLUME_NAME) { $VolumeName = $env:DAAF_DATA_VOLUME_NAME }
 # Second volume: Claude Code state. Restored only when the selected backup
 # contains the dedicated subfolder (newer backups); older backups predating the
 # volume are restored data-only with a warning.
diff --git a/scripts/host/restore_from_backup.sh b/scripts/host/restore_from_backup.sh
index 3a2cebdc..3ca56cc2 100755
--- a/scripts/host/restore_from_backup.sh
+++ b/scripts/host/restore_from_backup.sh
@@ -43,7 +43,7 @@ _daaf_load_settings() {
         line="$(printf '%s' "${line}" | tr -d '\r')"
         case "${line}" in ''|'#'*) continue ;; esac
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"; val="${line#*=}"
                 case "${val}" in
                     \"*\") val="${val#\"}"; val="${val%\"}" ;;
@@ -62,7 +62,11 @@ _daaf_load_settings
 # --- Configuration ---
 # Project-prefixed volume name "<project>_daaf-data". Default unset =>
 # "daaf_daaf-data" (byte-for-byte identical to the previous hardcoded value).
-VOLUME_NAME="${DAAF_PROJECT_NAME:-daaf}_daaf-data"
+# DAAF_DATA_VOLUME_NAME, when set, overrides the whole derivation with a verbatim
+# full volume name (the shared-workspace escape hatch); unset => the derived
+# default. Matches resolve_data_volume_name in daaf_lib.sh (inlined here because
+# this standalone script does not source the library).
+VOLUME_NAME="${DAAF_DATA_VOLUME_NAME:-${DAAF_PROJECT_NAME:-daaf}_daaf-data}"
 # Second volume: Claude Code state. Restored only when the selected backup
 # contains the dedicated subfolder (newer backups); older backups predating the
 # volume are restored data-only with a warning.
@@ -396,6 +400,16 @@ trap 'docker rm -f "${CID:-}" > /dev/null 2>&1 || true' INT TERM
 # was already cleared in Step 1, so the user would be left with an empty volume
 # and no explanation. Capture into CID first, then check the status.
 if ! CID="$(docker create -v "${VOLUME_NAME}:/dest" busybox)"; then
+    # Best-effort reap: `docker create` can in principle fail AFTER creating the
+    # container while still printing its CID to stdout, which the command
+    # substitution above captured -- remove it so a launch failure does not leak a
+    # helper container (mirrors backup_daaf.sh's stage-start reap and
+    # backup_daaf.ps1's stage-start cleanup). `docker create` is single-phase, so a
+    # fail-with-CID is near-theoretical here, but this keeps parity with the twin and
+    # with the `docker cp` failure branch just below. The `${CID:-}` guard makes this
+    # a harmless no-op if no CID was captured. Reap first, then drop the trap (matches
+    # the cp-branch order).
+    docker rm -f "${CID:-}" > /dev/null 2>&1 || true
     trap - INT TERM
     echo "" >&2
     echo "ERROR: Could not create the helper container for the volume copy." >&2
@@ -628,10 +642,21 @@ if [ "${HAS_CLAUDE_BACKUP}" -eq 1 ]; then
         trap 'docker rm -f "${CLAUDE_CID:-}" > /dev/null 2>&1 || true' INT TERM
         # Guard the create under `set -e`: a failure here is non-fatal (the data
         # volume restore already succeeded), so it must fall into the WARNING path
-        # below, not abort the whole script. `|| CLAUDE_CID=""` keeps the exit
-        # status from tripping `set -e` while leaving CLAUDE_CID empty on failure.
-        CLAUDE_CID="$(docker create -v "${CLAUDE_VOLUME_NAME}:/dest" busybox)" || CLAUDE_CID=""
-        if [ -n "${CLAUDE_CID}" ] \
+        # below, not abort the whole script. Capture the launch outcome in a SEPARATE
+        # flag rather than blanking the CID: `docker create` can in principle fail
+        # after emitting a CID, and the old `|| CLAUDE_CID=""` discarded that CID
+        # before the trap above or the `docker rm -f` at the end of this block could
+        # reap it -- leaking the helper container. Keep the captured CID intact so both
+        # reap sites can remove it (mirrors backup_daaf.sh's CLAUDE_STAGE_START_OK flag
+        # and backup_daaf.ps1's $claudeStageStartOk + finally-reap pattern). Assigning
+        # inside the `if` condition keeps `set -e` from aborting on a launch failure
+        # while still capturing whatever the substitution produced.
+        if CLAUDE_CID="$(docker create -v "${CLAUDE_VOLUME_NAME}:/dest" busybox)"; then
+            CLAUDE_CREATE_OK=1
+        else
+            CLAUDE_CREATE_OK=0
+        fi
+        if [ "${CLAUDE_CREATE_OK}" -eq 1 ] \
             && docker cp "${CLAUDE_BACKUP_PATH}/." "${CLAUDE_CID}:/dest/" \
             && docker run --rm -v "${CLAUDE_VOLUME_NAME}:/dest" busybox chown -R 1000:1000 /dest; then
             # Replay the Claude volume's own symlink manifest (staged out by backup),
diff --git a/scripts/host/run_daaf.ps1 b/scripts/host/run_daaf.ps1
index 838d23ea..94278cf2 100644
--- a/scripts/host/run_daaf.ps1
+++ b/scripts/host/run_daaf.ps1
@@ -34,7 +34,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -43,7 +43,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
diff --git a/scripts/host/run_daaf.sh b/scripts/host/run_daaf.sh
index 33c572a8..a9a88dbe 100755
--- a/scripts/host/run_daaf.sh
+++ b/scripts/host/run_daaf.sh
@@ -41,7 +41,7 @@ _daaf_load_settings() {
         line="$(printf '%s' "${line}" | tr -d '\r')"
         case "${line}" in ''|'#'*) continue ;; esac
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"; val="${line#*=}"
                 case "${val}" in
                     \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/host/run_vscode.ps1 b/scripts/host/run_vscode.ps1
index 94fffcc0..2d08ffb7 100644
--- a/scripts/host/run_vscode.ps1
+++ b/scripts/host/run_vscode.ps1
@@ -39,7 +39,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -48,7 +48,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
diff --git a/scripts/host/run_vscode.sh b/scripts/host/run_vscode.sh
index dde4ebc4..860c67c5 100755
--- a/scripts/host/run_vscode.sh
+++ b/scripts/host/run_vscode.sh
@@ -45,7 +45,7 @@ else
             line="$(printf '%s' "${line}" | tr -d '\r')"
             case "${line}" in ''|'#'*) continue ;; esac
             case "${line}" in
-                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                     key="${line%%=*}"; val="${line#*=}"
                     case "${val}" in
                         \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/host/test_migration.ps1 b/scripts/host/test_migration.ps1
index c945e7a3..da907a82 100644
--- a/scripts/host/test_migration.ps1
+++ b/scripts/host/test_migration.ps1
@@ -2682,6 +2682,36 @@ if (-not $SkipMultiInstance) {
     Test-Check "Default instance container still present ($ContainerMain)" (Test-DockerContainer $ContainerMain)
     Test-Check "Default instance data volume still present ($VolumeName)" (Test-DockerVolume $VolumeName)
 
+    # --- 8c-override. DAAF_DATA_VOLUME_NAME resolver sub-scenario ---
+    # Twin of the .sh 8c-override block: the checks above prove DAAF_PROJECT_NAME
+    # reprojects the DERIVED data-volume name; this proves the ORTHOGONAL escape
+    # hatch on the same machinery -- an explicit DAAF_DATA_VOLUME_NAME is honored
+    # VERBATIM (no project prefix) by Resolve-DaafDataVolumeName in daaf_lib.ps1, the
+    # single resolver every host tool (backup/restore, compose interpolation) calls
+    # to name the data volume, which is what lets two installs share ONE workspace
+    # volume. It is docker-free (pure $env reads + string ops), so we assert it
+    # directly in the same Test-Check style as the volume checks above. daaf_lib.ps1
+    # is dot-sourced for the call and the override is set/restored via the harness's
+    # save-try-finally idiom (as in 8b), so the harness env is left exactly as it was
+    # -- the paired "parent env unchanged" check evidences that non-leak.
+    $DvnOverride = "daaf_shared_workspace_daaf-data"
+    $DvnLibPath = Join-Path $LocalRepoRoot "scripts\host\daaf_lib.ps1"
+    $DvnParentBefore = $env:DAAF_DATA_VOLUME_NAME
+    $DvnResolved = "<resolver-invocation-failed>"
+    try {
+        $env:DAAF_DATA_VOLUME_NAME = $DvnOverride
+        . $DvnLibPath
+        $DvnResolved = Resolve-DaafDataVolumeName
+    } catch {
+        $DvnResolved = "<resolver-invocation-failed: $_>"
+    } finally {
+        if ($null -ne $DvnParentBefore) { $env:DAAF_DATA_VOLUME_NAME = $DvnParentBefore } else { Remove-Item Env:\DAAF_DATA_VOLUME_NAME -ErrorAction SilentlyContinue }
+    }
+    Test-Check "Host resolver honors DAAF_DATA_VOLUME_NAME verbatim ($DvnOverride)" ($DvnResolved -eq $DvnOverride)
+    # The override was restored in the finally above, so the harness's own
+    # DAAF_DATA_VOLUME_NAME is unchanged -- proving the set did not leak forward.
+    Test-Check "DAAF_DATA_VOLUME_NAME override stayed scoped to the sub-scenario (parent env unchanged)" ($env:DAAF_DATA_VOLUME_NAME -eq $DvnParentBefore)
+
     Write-Host ""
 
     # --- 8d. Tear the second instance down completely ---
diff --git a/scripts/host/test_migration.sh b/scripts/host/test_migration.sh
index dcb40b3c..fb02588f 100755
--- a/scripts/host/test_migration.sh
+++ b/scripts/host/test_migration.sh
@@ -2356,6 +2356,39 @@ if [ "${SKIP_MULTI_INSTANCE:-}" != "1" ]; then
         check "Default instance data volume still present (${VOLUME_NAME})" "1"
     fi
 
+    # --- 8c-override. DAAF_DATA_VOLUME_NAME resolver sub-scenario ---
+    # The checks above prove DAAF_PROJECT_NAME reprojects the DERIVED data-volume
+    # name for a second instance. This sub-scenario exercises the ORTHOGONAL escape
+    # hatch on the same machinery: an explicit DAAF_DATA_VOLUME_NAME must be honored
+    # VERBATIM (no project prefix) by resolve_data_volume_name in daaf_lib.sh -- the
+    # single resolver every host tool (backup/restore, compose interpolation) calls
+    # to name the data volume, which is what lets two installs point at ONE shared
+    # workspace volume. It is docker-free (the resolver is pure parameter expansion),
+    # so we assert it directly in the same check() style as the volume checks above
+    # rather than standing up a third instance. The override is exported ONLY inside
+    # the command-substitution subshell (mirroring the 8b bring-up's scoped export),
+    # so the harness env is never mutated and later phases are unaffected -- the
+    # paired "parent env unchanged" check below evidences that non-leak.
+    DVN_OVERRIDE="daaf_shared_workspace_daaf-data"
+    DVN_PARENT_BEFORE="${DAAF_DATA_VOLUME_NAME:-}"
+    DVN_RESOLVED="$(
+        export DAAF_DATA_VOLUME_NAME="${DVN_OVERRIDE}"
+        source "${LOCAL_REPO_ROOT}/scripts/host/daaf_lib.sh"
+        resolve_data_volume_name
+    )" || DVN_RESOLVED="<resolver-invocation-failed>"
+    if [ "${DVN_RESOLVED}" = "${DVN_OVERRIDE}" ]; then
+        check "Host resolver honors DAAF_DATA_VOLUME_NAME verbatim (${DVN_OVERRIDE})" "0"
+    else
+        check "Host resolver honors DAAF_DATA_VOLUME_NAME verbatim (got: '${DVN_RESOLVED}')" "1"
+    fi
+    # The override was scoped to the subshell above, so the harness's own
+    # DAAF_DATA_VOLUME_NAME is unchanged -- proving the export did not leak forward.
+    if [ "${DAAF_DATA_VOLUME_NAME:-}" = "${DVN_PARENT_BEFORE}" ]; then
+        check "DAAF_DATA_VOLUME_NAME override stayed scoped to the sub-scenario (parent env unchanged)" "0"
+    else
+        check "DAAF_DATA_VOLUME_NAME override stayed scoped to the sub-scenario (leaked: '${DAAF_DATA_VOLUME_NAME:-}')" "1"
+    fi
+
     echo ""
 
     # --- 8d. Tear the second instance down completely ---
diff --git a/scripts/host/update_daaf.ps1 b/scripts/host/update_daaf.ps1
index d1d70193..5074578b 100644
--- a/scripts/host/update_daaf.ps1
+++ b/scripts/host/update_daaf.ps1
@@ -139,7 +139,7 @@ $PersistBranch = ""
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -148,7 +148,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
@@ -1404,12 +1408,29 @@ if (Test-Path "backup_daaf.ps1") {
         # above): a bare Remove-Item would clobber a value inherited from a
         # parent process.
         $savedNested = $env:DAAF_NESTED
+        # Defensive pre-init: if the try below unwinds before $backupExit is
+        # assigned, the nonzero default makes the gate fail closed (abort) rather
+        # than compare against $null.
+        $backupExit = 1
         try {
             $env:DAAF_NESTED = "1"
             & .\backup_daaf.ps1
+            $backupExit = $LASTEXITCODE
         } finally {
             if ($null -ne $savedNested) { $env:DAAF_NESTED = $savedNested } else { Remove-Item Env:\DAAF_NESTED -ErrorAction SilentlyContinue }
         }
+        # A user who opted into a backup and had it fail must not have the update
+        # proceed on a missing restore point (a DECLINED backup -- the else path below
+        # -- still lets the update continue). The .sh twin runs under `set -e`, so it
+        # guards the call with `|| BACKUP_EXIT=$?`; here we read $LASTEXITCODE, which
+        # PS 5.1 does not gate. Mirrors migrate_daaf.ps1's gated abort.
+        if ($backupExit -ne 0) {
+            Write-Host ""
+            Write-Host "ERROR: Backup failed (exit code $backupExit)."
+            Write-Host "The update will not proceed without a successful backup."
+            Write-Host "Please resolve the backup issue and re-run: .\update_daaf.ps1"
+            Wait-AndExit 1
+        }
         Write-Host ""
     }
 } else {
diff --git a/scripts/host/update_daaf.sh b/scripts/host/update_daaf.sh
index 5ac09450..5aaff28e 100755
--- a/scripts/host/update_daaf.sh
+++ b/scripts/host/update_daaf.sh
@@ -76,7 +76,7 @@ _daaf_load_settings() {
         line="$(printf '%s' "${line}" | tr -d '\r')"
         case "${line}" in ''|'#'*) continue ;; esac
         case "${line}" in
-            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+            DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                 key="${line%%=*}"; val="${line#*=}"
                 case "${val}" in
                     \"*\") val="${val#\"}"; val="${val%\"}" ;;
@@ -1312,7 +1312,22 @@ if [ -f "backup_daaf.sh" ]; then
     CHOICE=$(prompt_choice "  Run backup now? [y/n]: " "y n")
     if [ "${CHOICE}" = "y" ]; then
         echo ""
-        DAAF_NESTED=1 bash backup_daaf.sh
+        # Capture the backup exit explicitly. Under this script's `set -euo pipefail`
+        # an unguarded failed backup would abort the update abruptly with no
+        # explanation; `|| BACKUP_EXIT=$?` defuses set -e so we can abort gracefully
+        # with a clear message instead (mirrors migrate_daaf.ps1's gated abort). A
+        # user who opted into a backup and had it fail must not have the update
+        # proceed on a missing restore point; a DECLINED backup (the else path below)
+        # still lets the update continue.
+        BACKUP_EXIT=0
+        DAAF_NESTED=1 bash backup_daaf.sh || BACKUP_EXIT=$?
+        if [ "${BACKUP_EXIT}" -ne 0 ]; then
+            echo ""
+            echo "ERROR: Backup failed (exit code ${BACKUP_EXIT})."
+            echo "The update will not proceed without a successful backup."
+            echo "Please resolve the backup issue and re-run: bash update_daaf.sh"
+            exit 1
+        fi
         echo ""
     fi
 else
diff --git a/scripts/host/view_logs.ps1 b/scripts/host/view_logs.ps1
index 6efbf5fa..01b79aa1 100644
--- a/scripts/host/view_logs.ps1
+++ b/scripts/host/view_logs.ps1
@@ -40,7 +40,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -49,7 +49,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
diff --git a/scripts/host/view_logs.sh b/scripts/host/view_logs.sh
index 9625551b..06d46680 100755
--- a/scripts/host/view_logs.sh
+++ b/scripts/host/view_logs.sh
@@ -47,7 +47,7 @@ else
             line="$(printf '%s' "${line}" | tr -d '\r')"
             case "${line}" in ''|'#'*) continue ;; esac
             case "${line}" in
-                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                     key="${line%%=*}"; val="${line#*=}"
                     case "${val}" in
                         \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/host/view_notebooks.ps1 b/scripts/host/view_notebooks.ps1
index 91cb2415..c011cdc2 100644
--- a/scripts/host/view_notebooks.ps1
+++ b/scripts/host/view_notebooks.ps1
@@ -39,7 +39,7 @@ function Wait-AndExit {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -48,7 +48,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
diff --git a/scripts/host/view_notebooks.sh b/scripts/host/view_notebooks.sh
index 0fbfadba..3047553f 100755
--- a/scripts/host/view_notebooks.sh
+++ b/scripts/host/view_notebooks.sh
@@ -45,7 +45,7 @@ else
             line="$(printf '%s' "${line}" | tr -d '\r')"
             case "${line}" in ''|'#'*) continue ;; esac
             case "${line}" in
-                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                     key="${line%%=*}"; val="${line#*=}"
                     case "${val}" in
                         \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/host/view_quarto.ps1 b/scripts/host/view_quarto.ps1
index 1f918e07..17f3ae18 100644
--- a/scripts/host/view_quarto.ps1
+++ b/scripts/host/view_quarto.ps1
@@ -72,7 +72,7 @@ function Read-QuartoSelection {
 function Import-DaafSettingsInline {
     param([string]$SettingsFile = "./environment_settings.txt")
     if (-not (Test-Path -LiteralPath $SettingsFile)) { return }
-    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH')
+    $known = @('DAAF_PROJECT_NAME', 'DAAF_PORT_MARIMO', 'DAAF_PORT_LOGVIEWER', 'DAAF_PORT_VSCODE', 'DAAF_DEV', 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')
     # -Encoding UTF8: PS 5.1's bare Get-Content misreads BOM-less UTF-8 as ANSI
     # (cp1252); the settings writer is BOM-less UTF-8, so reads are pinned to match.
     foreach ($rawLine in (Get-Content -LiteralPath $SettingsFile -Encoding UTF8)) {
@@ -81,7 +81,11 @@ function Import-DaafSettingsInline {
         if ($trimmed -eq "" -or $trimmed.StartsWith("#")) { continue }
         $eq = $line.IndexOf("=")
         if ($eq -lt 1) { continue }
-        $key = $line.Substring(0, $eq).Trim()
+        # Extract the key WITHOUT trimming: a leading or trailing space means the
+        # line is not flush at column 0, so it must fall through as unrecognized --
+        # matching the bash loaders' column-0 `case` glob so a padded key like
+        # "  DAAF_PROJECT_NAME=..." is rejected identically on both platforms.
+        $key = $line.Substring(0, $eq)
         if ($known -notcontains $key) { continue }
         $val = $line.Substring($eq + 1)
         if (($val.StartsWith('"') -and $val.EndsWith('"')) -or ($val.StartsWith("'") -and $val.EndsWith("'"))) {
diff --git a/scripts/host/view_quarto.sh b/scripts/host/view_quarto.sh
index b651460b..abb56069 100755
--- a/scripts/host/view_quarto.sh
+++ b/scripts/host/view_quarto.sh
@@ -59,7 +59,7 @@ else
             line="$(printf '%s' "${line}" | tr -d '\r')"
             case "${line}" in ''|'#'*) continue ;; esac
             case "${line}" in
-                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*)
+                DAAF_PROJECT_NAME=*|DAAF_PORT_MARIMO=*|DAAF_PORT_LOGVIEWER=*|DAAF_PORT_VSCODE=*|DAAF_DEV=*|DAAF_BRANCH=*|DAAF_DATA_VOLUME_NAME=*)
                     key="${line%%=*}"; val="${line#*=}"
                     case "${val}" in
                         \"*\") val="${val#\"}"; val="${val%\"}" ;;
diff --git a/scripts/provider_shim/anthropic_openai_shim.py b/scripts/provider_shim/anthropic_openai_shim.py
index 5a784c73..70b9e614 100644
--- a/scripts/provider_shim/anthropic_openai_shim.py
+++ b/scripts/provider_shim/anthropic_openai_shim.py
@@ -63,6 +63,390 @@
 #   * GET /health endpoint for the manager's idempotency/status checks.
 #
 # Changelog:
+#   v1.3.9 (2026-07-26): Canonical GPT service-tier request vocabulary.
+#     Both exact GPT shim backends now converge on the one OpenAI Responses wire value
+#     `service_tier:"priority"` for valid inbound Anthropic Fast and shim-global ON.
+#     ChatGPT subscription continues to present this as Fast with plan/credit semantics;
+#     OpenAI API continues to present it as Priority with API Priority billing semantics.
+#     OFF still omits service_tier, policy persistence remains schema-v1 backend+boolean,
+#     and request snapshots, retry invariance, route reset, and no-fallback behavior are
+#     unchanged. Canonical served `priority` maps to Anthropic usage.speed=`fast`; exact
+#     served `fast` remains a compatibility-only terminal parser value and is never emitted
+#     as requested vocabulary. SHIM_VERSION -> 1.3.9.
+#   v1.3.8 (2026-07-25): Route-bound shim-native GPT service-tier control.
+#     Adds a strict persistent default-OFF policy shared across both GPT lanes, startup
+#     compare-and-set reset on route changes, one request-boundary policy snapshot reused
+#     by all retries, additive precedence with validated inbound Anthropic Fast, bounded
+#     requested-source telemetry, process-local latest-terminal evidence, and the stable
+#     gpt_service_tier /health block. SHIM_VERSION -> 1.3.8.
+#   v1.3.7 (2026-07-24): Claude Code Fast mode with route-specific service tiers.
+#     Valid `speed:"fast"` plus beta `fast-mode-2026-02-01` emits Responses
+#     `service_tier:"priority"` on the OpenAI API lane and `service_tier:"fast"` on the
+#     ChatGPT/Codex lane. Invalid speed requests fail locally before auth/upstream; beta-only
+#     and ordinary traffic omit service_tier. Fast never changes model, reasoning, tools,
+#     retry payloads, or context gating and never falls back to Standard. Terminal actual
+#     tiers priority/fast map to Anthropic usage.speed=fast; default/flex/scale/auto map to
+#     standard; absent/unknown remain omitted. Terminal telemetry distinguishes scrubbed
+#     requested_service_tier from served_service_tier. No env or /health field was added.
+#     SHIM_VERSION -> 1.3.7.
+#   v1.3.6 (2026-07-22): Prompt-cache observability + reasoning-cache persistence cap resize
+#     (minor bump — the observability is additive and the client-visible usage mapping is
+#     sum-invariant, so downstream context accounting is byte-equivalent). Step 1 of the
+#     prompt-cache backlog item; Step 2 (prompt_cache_key emission) remains out of scope
+#     (blocked on there being no stable cross-turn identifier in the shim today).
+#     * CAPTURE (V6-R1): the shim now reads usage.input_tokens_details.cached_tokens at all
+#       three usage-parse sites (streaming response.completed/incomplete reducer, and both
+#       non-stream lanes via _responses_to_anthropic, which carries the value through a
+#       private _cached_tokens key each lane pops before send). Defensive typing via
+#       _resolve_cached_tokens: only a non-bool int >= 0 that does not exceed the reported
+#       input total is accepted; absent/null/string/negative/bool/clamped all resolve to
+#       ABSENT (None), indistinguishable from "no cache info" (old backends/fixtures emit no
+#       detail). _RequestLifecycleState gains self.cached_tokens. Never raises.
+#     * TERMINAL RECORD (V6-R2): the terminal log record gains cached_tokens (the captured
+#       int, or the "-" absent-convention when None) at the single lane-agnostic emission
+#       site. This is the field the ~1-week telemetry review greps.
+#     * ANTHROPIC USAGE MAPPING (V6-R3, Decision 1 + Decision 2 = always-emit): client-
+#       visible usage blocks now use the subtraction mapping — input_tokens = openai_total
+#       - cached, cache_read_input_tokens = cached, cache_creation_input_tokens = 0 (OpenAI
+#       reports no cache-write count). Anthropic's input_tokens is the uncached remainder,
+#       so this preserves the sum invariant EXACTLY (the three fields sum to the OpenAI
+#       total) and Claude Code shows real cache behavior natively. The two cache fields are
+#       ALWAYS present (0 when absent) for a deterministic shape matching Anthropic's own
+#       responses; message_start zero-usage seeds and error frames carry them as zeros too.
+#       Clamp guard folds into _resolve_cached_tokens (cached > input_total -> absent,
+#       fail-open, never a negative input_tokens).
+#     * /HEALTH (V6-R4, Decision 3): a NEW top-level prompt_cache block — requests_with_usage,
+#       requests_with_cached, cached_tokens_total, input_tokens_total (module-global int
+#       counters, counts only, ticked once per terminal). hit-rate = cached_tokens_total /
+#       input_tokens_total. This changes the pinned /health key set, so _HEALTH_KEYS + the
+#       version pin move in the same commit (the sanctioned money-test extension).
+#     * REASONING-CACHE PERSISTENCE CAP RESIZE (V6-R5, Decision 4b): _REASONING_PERSIST_MAX_
+#       ENTRIES 256 -> 1024, _REASONING_PERSIST_MAX_BYTES 2 MiB -> 8 MiB (4x headroom for
+#       ~4 session-tails). In-memory _REASONING_CACHE_CAP (2048) UNCHANGED — the persist cap
+#       stays under it (no RAM change, no restore-clamp interaction). Worst-case persist
+#       write measured at low tens of ms at the 8 MiB bound (see the persistence-bounds
+#       comment). Bounds stay hard constants (no env seam).
+#     SHIM_VERSION -> 1.3.6.
+#   v1.3.5 (2026-07-21): Janitorial — removed the dead non-streaming lazy-401 refresh
+#     branch (no behavior change). The branch lived inside the OpenAI/API-key
+#     `if not stream:` block and was guarded by `SHIM_BACKEND_MODE == "chatgpt"`, but
+#     that condition is unreachable there: the earlier v1.2.7 chatgpt non-stream adapter
+#     (`if not stream and SHIM_BACKEND_MODE == "chatgpt":`) returns on every exit path, so
+#     control reaches the OpenAI/API-key `if not stream:` block only when
+#     SHIM_BACKEND_MODE != "chatgpt", making the deleted guard a permanent contradiction.
+#     Unreachable since the v1.3.0 auth delegation reshaped the non-stream chatgpt path;
+#     the live chatgpt non-stream case is fully handled by the v1.2.7 adapter, and the
+#     live lazy-401 refresh path is the shared opener's did_401_refresh guard
+#     (_open_backend_stream). No test asserted the deleted branch's log strings; the
+#     lazy-401 regression tests exercise the live opener path. SHIM_VERSION -> 1.3.5.
+#   v1.3.4 (2026-07-21): Stale-blob insurance for restored reasoning + known-events
+#     allowlist absorption + reasoning-cache effectiveness telemetry (minor bump — the
+#     insurance is additive around the existing 400 fail-fast contract, and the other two
+#     are observability/stability riders; no change to the clean-path translation
+#     semantics). Landed as two implementation commits under one release.
+#     * STALE-BLOB INSURANCE (V4-R1..R4): v1.3.3 persistence introduced the one scenario
+#       where the reasoning cache's graceful-miss guarantee did not hold — a restored
+#       (disk-loaded) `encrypted_content` blob has an undocumented backend-side validity
+#       lifetime, and a 400 rejecting a re-injected restored blob previously failed the
+#       request outright (400s are never in RETRY_STATUSES). Now: a module-level
+#       _REASONING_CACHE_RESTORED_IDS set records which call_ids came from disk (rebuilt
+#       after each restore; discarded on any live re-population or LRU eviction), and each
+#       request tracks the restored reasoning-item ids/call_ids it actually injects. In
+#       BOTH retry loops (JSON _post_with_retry, SSE _open_backend_stream), after _plan_retry
+#       declines, a 400 whose error body NAMES reasoning material (broad case-insensitive
+#       match of `reasoning`/`encrypted_content` over the normalized type/code/param/message/
+#       detail fields) AND that injected >=1 restored item triggers a one-shot strip: remove
+#       exactly those restored reasoning items from the reused payload["input"] by id (never
+#       index), evict+discard the proven-stale call_ids and rewrite the persisted snapshot,
+#       then retry once (retry_reason=stale_reasoning_400, retry_source=body). The detector's
+#       breadth is safe because the restored-items-present + 400 + one-shot gate carries the
+#       precision: a request that injected no restored items can never trigger, and a true
+#       false positive costs at most one extra attempt in today's graceful-miss shape. Every
+#       non-triggering 400 stays fail-fast, byte-identical to v1.3.3. Logs a distinct
+#       counts-only event=reasoning_cache_stale_strip stripped=N line — never blob content or
+#       backend error prose.
+#     * ALLOWLIST ABSORPTION (V4-R5): `keepalive` (a top-level type, namespaced like `error`)
+#       and `response.metadata` join the ignored status/lifecycle group of
+#       _KNOWN_EVENT_TYPES. Both were observed live during v1.2.14 validation and have been
+#       throttle-logged as "unknown wire" ever since despite carrying nothing the translation
+#       needs; absorbing them restores unknown_events=0 on a clean stream from backends that
+#       emit them. Not added to _MALFORMED_TOLERANT_EVENT_TYPES (a malformed instance should
+#       still fail strictly). The two catch-alls compare raw event-type strings, so both
+#       absorb by plain set membership with no namespace logic.
+#     * EFFECTIVENESS TELEMETRY (V4-R6/R7): the terminal record gains two additive,
+#       always-present ints — reasoning_cache_hit (per-request cache-hit count, parallel to
+#       reasoning_cache_miss) and reasoning_cache_stripped (restored items stripped by the
+#       insurance this request, 0 otherwise). /health's existing NESTED reasoning_cache block
+#       gains hits (process-cumulative cache hits) and restored_hits (the subset whose call_id
+#       was still disk-restored at hit time — the direct measure for the ~1-week cap/ceiling
+#       review); no new top-level /health key, so the health key set is unchanged. The hit
+#       path stays strictly read-only — it reads via .get(), NEVER move_to_end, so hit-
+#       counting introduces no LRU mutation and no persist / write amplification. Counts only.
+#     SHIM_VERSION -> 1.3.4.
+#   v1.3.3 (2026-07-21): Reasoning-cache persistence across shim restarts (Tier 3 A2;
+#     minor bump — additive continuity feature, no change to the live response path's
+#     translation semantics). Before this, a restart mid-session discarded the entire
+#     in-memory _REASONING_CACHE, so every subsequent turn replayed tool history WITHOUT
+#     its reasoning items (graceful misses — the miss path has always omitted-and-sent,
+#     never 400d — but degraded model context for the rest of long tool loops). The cache
+#     now survives restarts.
+#     * PERSIST: after each cache mutation the shim writes a bounded, newest-first snapshot
+#       (LRU tail) to a state file — capped at 256 entries OR 2 MiB, whichever hits first —
+#       and restores it at module import. The write is atomic (mkstemp + os.replace), 0600,
+#       and absolutely fail-open (the whole writer is try/except: pass — a persistence write
+#       must NEVER affect, delay, or raise on the response path), exactly mirroring the
+#       _write_quota_state precedent. Restore is likewise fail-open: a missing/malformed/
+#       stale/oversize file silently skips (next persist overwrites it) and the shim starts
+#       cold. Staleness is a 30-day sanity ceiling only (_REASONING_PERSIST_TTL_S) — the
+#       primary bound is the entry/byte cap, mirroring the in-memory cache's age-less LRU;
+#       a short TTL would erase exactly the entries a multi-day session-resume replays.
+#     * PLACEMENT: default path is $HOME/.claude/provider_shim/reasoning_cache.json (the
+#       shim owns directory creation, mode 0700). This is deliberately OFF the repo tree,
+#       UNLIKE shim.log/quota_state.json which stay in scripts/provider_shim/logs/: the
+#       reasoning blobs are backend-encrypted content and must never be committable to any
+#       VCS (gitignore notwithstanding), so they live on the per-container claude-config
+#       volume ($HOME/.claude, the same volume codex CLI state uses). Per-container by
+#       intent: because the file is not install-shared, the cross-install last-writer-wins
+#       race that quota_state.json accepts as status-quo degradation cannot occur here. The
+#       file is expendable continuity state (loss = graceful misses = prior behavior), never
+#       a research artifact, and sits outside the /daaf backup/audit boundary by design.
+#     * SEAM: DAAF_REASONING_CACHE_FILE redirects the path, resolved at MODULE IMPORT time
+#       (_REASONING_CACHE_PATH is computed once when the module loads), so a post-import env
+#       change does not redirect a live shim — the seam must be set before the module loads.
+#       Same contract as DAAF_QUOTA_STATE_FILE; it is a redirect / hermetic-test seam, not
+#       an off-switch (persistence stays unconditional and fail-open).
+#     * SECURITY: persisted values are exactly the in-memory values — opaque backend
+#       `encrypted_content` blobs plus item metadata, decryptable only by the backend. No
+#       plaintext reasoning, no prompts, no tool arguments, no key material. Anthropic
+#       thinking blocks are consumed, never stored. Logging stays counts-only (a single
+#       event=reasoning_cache_restore entries=N age_s=M line on a successful restore),
+#       never entry contents.
+#     * OBSERVABILITY: /health gains "reasoning_cache": {"entries": N, "restored": M}
+#       (counts only; restored = entries loaded at startup, 0 if none). No reader outside
+#       the shim — this file is shim-internal continuity state, unlike quota_state.json.
+#     * LIFECYCLE: start_shim.sh's state_targets_are_safe() now also covers quota_state.json
+#       in its symlink/non-regular hijack checklist (closing a pre-existing gap — the file
+#       has lived in that dir since v1.3.1). The reasoning-cache file is intentionally out
+#       of that checklist: it lives under $HOME/.claude/, outside start_shim's domain, and
+#       os.replace does not dereference a destination symlink.
+#     * TOPOLOGY: the supported deployment is one running shim per container at a time.
+#     * HARDENING (A2 review fold-in, no version bump): restore now (a) skips a file whose
+#       on-disk size exceeds the 2 MiB persist cap BEFORE reading it (defense-in-depth — a
+#       shim-written file can never exceed the cap, so only a hand-tampered file trips it),
+#       and (b) reports the count of entries actually RESIDENT after restore on /health, so
+#       a tampered over-cap file can no longer overstate reasoning_cache.restored.
+#     SHIM_VERSION -> 1.3.3.
+#   v1.3.2 (2026-07-21): Hermetic quota-state writes + a statusline reader tightening
+#     (two-part maintenance release; no shim behavior change on the live response path).
+#     * SHIM: _write_quota_state now honors DAAF_QUOTA_STATE_FILE — the SAME env var the
+#       reader (context-bar.sh) already consumes — so one variable coherently redirects
+#       both ends. Set + non-empty: the write (and its mkstemp temp sibling) land at that
+#       exact path; unset/empty: the __file__-derived default is byte-identical to v1.3.1.
+#       This is a redirect / hermetic-test seam, NOT an off-switch — the write stays
+#       unconditional and absolutely fail-open (a bad seam value is swallowed like any
+#       other failure). It resolves at MODULE IMPORT time (_QUOTA_STATE_PATH is computed
+#       once when the module loads), so a post-import env change does not redirect a live
+#       shim — the seam must be set before the module loads. Motivation: the loopback
+#       harness exercises the PRODUCTION shim two ways — spawned in chatgpt mode AND loaded
+#       in-process (controlled_asgi_probe drives the real request path inside the test-
+#       runner process) — and before the seam every mocked chatgpt 2xx overwrote the live
+#       INSTALL-SHARED quota_state.json with all-"-" snapshots (observed live 2026-07-21: a
+#       full-suite run rewrote the production file every ~15s, blanking the OTHER install's
+#       "Plan usage:" segment). The decisive polluter was the in-process load, whose write
+#       ran deterministically in the runner with the env var unset. The harness now covers
+#       BOTH contexts — a per-instance child-env seam for spawned shims plus a runner-level
+#       os.environ.setdefault for in-process loads — which together keep test runs off the
+#       install-shared file.
+#     * READER (context-bar.sh, statusline-hardening deferred observation O2): the
+#       fractional-floor strip of primary/secondary used-percent is now gated on
+#       ^[0-9]+\.[0-9]+$ so an exponent-notation value carrying a dot (e.g. "1.0e999")
+#       DROPS the segment instead of surviving the strip as "1" and rendering "1%". Plain
+#       fractionals (69.9 -> 69) still render; this change lives in the reader, not here.
+#     SHIM_VERSION -> 1.3.2.
+#   v1.3.1 (2026-07-20): Statusline Plan-usage telemetry (additive, no behavior change).
+#     On every chatgpt-lane 2xx (same guard as the D1 quota_snapshot line), the shim now
+#     also caches the latest quota snapshot to <log dir>/quota_state.json — an atomic,
+#     0600, absolutely-fail-open write next to shim.log. The file is a single JSON object
+#     {captured_at:<int epoch>, <the 11 x-codex-* snapshot fields, raw header strings or
+#     "-">}; the READER (context-bar.sh) computes the absolute reset instant as
+#     captured_at + primary_reset_s. context-bar.sh renders it as the "Plan usage:"
+#     segment on shim-lane sessions (window labels derived from window-minutes; stale-
+#     window drop rule; zero secondary omitted). INSTALL-SHARED: under the shared-/daaf
+#     multi-install assumption this state file lives on the shared mount and is read by
+#     any install's statusline (auth under $HOME stays per-install). Pure additive
+#     telemetry: no new env vars, no off-switch; a write failure is swallowed and never
+#     touches the response path. SHIM_VERSION -> 1.3.1.
+#   v1.3.0 (2026-07-20): ChatGPT-lane auth refresh DELEGATED to the codex CLI
+#     (Tier 3 A1; minor bump — behavior + config-surface change). The shim is now a
+#     pure READER of $CODEX_HOME/auth.json; codex is the SINGLE WRITER. This deletes
+#     the shim's Python OAuth reimplementation and structurally eliminates the
+#     refresh-rotation race that caused the 2026-07-20 auth lockout.
+#     A1-i (delegation core, committed separately):
+#       * DELETED the Python refresh path: the OAuth token POST to
+#         auth.openai.com/oauth/token, rotated-refresh-token atomic persistence, the
+#         manager.rs-mirror reload-before-refresh guard, and the SHIM_OAUTH_TOKEN_URL/
+#         SHIM_OAUTH_CLIENT_ID env seams (their only consumer was the deleted path).
+#         No legacy fallback flag — a retained Python path would preserve the race.
+#       * ADDED delegated_refresh(): a single-flight (asyncio.Lock) primitive that
+#         spawns `{SHIM_CODEX_BIN} login status` (CODEX_HOME passthrough, bounded by
+#         SHIM_CODEX_TIMEOUT_S) then RE-READS auth.json and judges success SOLELY by
+#         the re-read result — the subprocess exit code/output are diagnostic-only.
+#         Proactive trigger: token within a 5-min exp margin (was 30 min) mirroring
+#         codex's CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES so codex actually
+#         refreshes when asked. Reactive trigger: backend 401 -> one delegated_refresh
+#         + single retry (existing retry-guard shape preserved).
+#       * NEW config: SHIM_CODEX_BIN (default "codex") and SHIM_CODEX_TIMEOUT_S
+#         (float, default 30, unparseable->30). CODEX_HOME passthrough unchanged.
+#       * Every auth-failure surface (failed delegation, post-retry 401, absent/
+#         unreadable store, codex "Not logged in"/missing/timeout) raises the actionable
+#         _RELOGIN_MSG that literally contains `codex login --device-auth` (A1-R5).
+#     A1-ii (auth surfaces, this dispatch):
+#       * A1-R4: /health gains a read-only `auth` block {state, expires_at, days_left,
+#         recovery?} on the chatgpt lane ("n/a" on the openai lane). state is
+#         valid|expiring|expired|absent|unreadable, derived from auth.json presence +
+#         JWT exp decode only — NEVER token material. `recovery` (the literal re-login
+#         command) is present only for the four actionable states. "expiring" = exp
+#         within _AUTH_EXPIRING_WINDOW_S (48h) — a USER heads-up horizon, deliberately
+#         wider than the internal 5-min refresh margin.
+#       * A1-R6a: start_shim.sh readiness + --status query /health and print an auth
+#         line; expiring -> prominent "expires in N days" warning naming
+#         `codex login --device-auth`; expired/absent/unreadable -> the "is dead" phrasing.
+#       * A1-R6b: deploy-smoke T0.9 extends from "auth.json readable" to asserting the
+#         /health auth block on shim routes: FAIL on expired|absent|unreadable, WARN on
+#         expiring, PASS on valid (SKIP on non-shim routes).
+#       * A1-R7: SHIM_CODEX_BIN/SHIM_CODEX_TIMEOUT_S documented in the Config block and
+#         start_shim.sh help/env passthrough.
+#     Review fix-it (post-A1 three-angle review; version unchanged): guard
+#       _auth_health_block() against a pathological JWT exp overflowing platform time_t
+#       (classify "unreadable" rather than raising, upholding the never-raises
+#       contract); bound the post-kill codex reap with a 5s wait_for so an unkillable
+#       child cannot stall the request path; and swept the deleted SHIM_OAUTH_* seams
+#       out of the host settings template and the user docs (install guide + technical
+#       FAQ), which still framed the now-delegated refresh as a shim-side rotation race.
+#     The two historical v1.2.5 comments describing the now-deleted Python OAuth path
+#     carry inline "[superseded in v1.3.0 ...]" markers so version history stays
+#     accurate without asserting present-tense behavior that no longer exists.
+#     SHIM_VERSION -> 1.3.0.
+#   v1.2.14 (2026-07-20): Robustness (R1-R6) + diagnostics (D1-D5) hardening pass,
+#     driven by the v1.2.8/v1.2.13 self-inflicted-outage retrospective. Doctrine:
+#     "strict emit, tolerant accept" — every change moves an unexpected upstream
+#     input from {silent drop | hard fail} to {tolerate + count + log}, while the
+#     downstream Anthropic SSE emission stays exactly as strict as before.
+#     ROBUSTNESS:
+#       R1 (observability): a bounded process map + per-request counters make unknown
+#         SSE event types, unmodeled output_item types, and unrecognized error
+#         envelopes VISIBLE (terminal record: unknown_events/unknown_items, 0 when
+#         clean) instead of vanishing. Logged via the v1.2.12 wire-divergence channel
+#         (first + every 100th), never per-event, never bodies. A live obfuscation
+#         field on arguments.delta is explicitly tolerated (no count, no failure).
+#       R2 (classification): ONE code-driven classifier on all failure paths (pre-
+#         stream HTTP, in-band error, response.failed, non-stream adapter). Envelope
+#         tolerance parses {error:{...}}, {status,error:{...}}, flat root code/message,
+#         and the Codex {detail:"..."} shape; first match wins, unrecognized is R1-
+#         counted then status-classified. insufficient_quota/usage_not_included ->
+#         invalid_request_error (mirrors Anthropic's own credit-balance 400); unknown-
+#         code 4xx -> invalid_request_error (CHANGED from retryable api_error).
+#         ADJUDICATED: a bare/unknown-code 503 -> api_error (retryable); overloaded_
+#         error is reserved for recognized overload codes and status 529 (both classes
+#         retryable, so client behavior is equivalent).
+#       R4 (retry policy): retry gating is now classification-driven (RETRY_STATUSES
+#         stays as the envelope-less fallback). insufficient_quota-coded 429 fails
+#         fast (was retried as a transient 429 — a confirmed defect class). Per-attempt
+#         delay precedence parsed -> Retry-After -> backoff; the rate-limit-delay hint
+#         ("try again in <n>") is parsed for the NUMBER only (gated on
+#         rate_limit_exceeded, never logged). Rate-limit-class cap raised 30s -> 60s;
+#         a delay beyond the cap fails fast with rate_limit_error so the client owns
+#         the long wait. Terminal record gains retry_delay_source (parsed|header|
+#         backoff). Retry counts and the no-retry-after-first-byte invariant unchanged.
+#         The ≥400 error body read for classification is bounded at 1 MiB
+#         (MAX_ERROR_BODY_BYTES): a pathologically large body is truncated before the
+#         retry-classification parse and falls back to HTTP-status gating; the full body
+#         stays cached on resp for the caller's error re-read (behavior unchanged).
+#       R5 (SSE tail): BEHAVIOR CHANGE — at EOF a non-blank-terminated tail whose
+#         pending event parses cleanly is now FLUSHED as the final event (recovers a
+#         complete terminal whose trailing blank line a proxy trimmed, B7); a malformed
+#         tail after the terminal frame is R1-counted and ignored; before the terminal
+#         it stays a fatal framing failure. One pinned test intentionally flipped
+#         (..._fails -> ..._flushes).
+#       R3 (tolerant reducer): open-block bookkeeping is a deferred-open scheduler
+#         (pending tools opened FIFO in added order; at most one Anthropic tool_use
+#         block open at a time; downstream blocks stay strictly non-overlapping).
+#         null/[] response.completed.output after tool events is guarded (streamed
+#         state wins); a text block still opens on output_text.delta independent of
+#         content_part.added; a no-reasoning turn is tolerated. Malformed-JSON on NON-
+#         load-bearing status events is skipped + R1-counted; load-bearing events
+#         (deltas, argument events, output_item.*, terminal, error) keep strict
+#         failure. Out-of-order text/reasoning arriving while a block is open is
+#         buffered and emitted as a TRAILING text/thinking block (ratified shapes).
+#         DEVIATION: _finalize_stream_failure's block-close sort is filtered to OPENED
+#         tools only (a still-deferred tool has no downstream block and a None index) —
+#         semantically inert. DEFERRED: oversized-payload tolerance (the 16 MiB cap
+#         fires inside the bounded reader before the event type is knowable; a type-
+#         aware reader would disturb the R5 EOF-tail region). Four pinned strict-
+#         ordering tests intentionally flipped to the tolerant contract.
+#       R6 (heartbeat): while the upstream is silent after message_start, the streaming
+#         path emits Anthropic `ping` SSE events every SHIM_PING_INTERVAL_S (env, float-
+#         tolerant, default 15, <=0 disables) through the SAME single-writer lock as
+#         emit(), so a ping can never split a partial frame. The watchdog stops before
+#         the terminal frames and on failure/disconnect (reaped by the request resource
+#         finalizer as a safety net); a failed ping write is treated as a disconnect
+#         (fast dead-client detection). Streaming only; /health unchanged. Terminal
+#         record gains max_idle_gap_ms (max upstream inter-event silence, ms).
+#     DIAGNOSTICS:
+#       D1 (quota capture): DIAG_HEADER_ALLOWLIST gains prefix matching (x-codex-*)
+#         plus exact x-oai-request-id; a chatgpt-lane 2xx now emits ONE grep-stable
+#         event=quota_snapshot line of numeric/enum fields (plan/limit, primary+
+#         secondary used-percent/window-minutes/reset-after, credits flags/balance;
+#         absent -> "-", values machine-field-encoded, never free text). openai lane
+#         and every non-2xx unchanged (no line).
+#       D2 (terminal enrichment): additive-only terminal fields — unknown_events/
+#         unknown_items, populated backend_type/backend_code on in-band failures,
+#         retry_delay_source, max_idle_gap_ms. All existing fields unchanged.
+#       D5 (400 diagnosis): a backend-classified invalid_request_error emits one
+#         request-correlated event=request_shape line of sorted top-level request key
+#         NAMES (+ text/reasoning sub-key names) — names only, never values.
+#       D3/D4 (lifecycle honesty + --auto footgun): implemented in start_shim.sh by a
+#         parallel dispatch (supervisor.state running|gave_up_storm|stopped surfaced by
+#         --status; an unrecognized non-empty DAAF_PROVIDER_SHIM warns once and still
+#         exits 0). See start_shim.sh; not in this file.
+#     R1 ALLOWLIST-SYNC OBLIGATION: the R1 unknown-event/item counters fire only for
+#       types outside _KNOWN_EVENT_TYPES/_KNOWN_ITEM_TYPES; those allowlists MUST stay
+#       in sync with the R3 reducer's handled/skippable event sets or "0 when clean"
+#       regresses (A1b tripwire tests guard this). v1.3.4 (V4-R5) grew the ignored
+#       (skippable) group by `keepalive` and `response.metadata` — see that changelog
+#       entry; the two catch-alls compare raw event-type strings, so both absorb by
+#       plain set membership with no namespace logic.
+#     ENVIRONMENTAL NOTE: shim STATE under /daaf (the repo/volume) is install-shared
+#       across containers on the same mount, while OAuth auth under $HOME/.claude
+#       (CODEX_HOME) is per-install — a token refresh in one install does not
+#       propagate, so concurrent installs must not be assumed to share auth.
+#     SCOPE: no auth-layer changes (the OAuth/token-delegation direction is the
+#       BindMounts session's Tier 3). Additive-only logging; scrubber discipline
+#       preserved. INTENTIONAL TEST UPDATES: 6 total (2 R5-region + 4 R3-region flips).
+#       SHIM_VERSION -> 1.2.14.
+#   v1.2.13 (2026-07-19): System-role message admission (live-outage fix). Current
+#     Claude Code appends a role:"system" message inside `messages`; the v1.2.12
+#     request-validation role check (user/assistant only) and the translator's
+#     matching raise rejected every real conversation turn with the static 400
+#     "invalid request structure" while small side requests (no system-role
+#     message) still passed. Validation now admits "system" and the translator
+#     folds system-role messages to user-role input — the exact pre-v1.2.12
+#     mapping proven against the live Codex backend. Captured-payload repro and
+#     bisection: scripts/scratch/replay_captured_request.py. All other v1.2.12
+#     hardening, translation, and lifecycle behavior unchanged.
+#     SHIM_VERSION -> 1.2.13.
+#   v1.2.12 (2026-07-18): Content-blind image fidelity and bounded translator
+#     diagnostics. User and tool-result image blocks now map to Responses
+#     input_image parts for the shared OpenAI/ChatGPT payload shape, with strict
+#     local validation and explicit 400s for unsupported sources, assistant images,
+#     and unknown history blocks. Transport lifecycle records now attribute bounded
+#     exception classes/phases, sent and returned request IDs, and retry sources.
+#     The live Codex arguments.done missing-name divergence is process-aggregated
+#     (first occurrence plus periodic summaries) instead of warning per event.
+#     /health now carries an exact service identity so the lifecycle manager can
+#     reject an unrelated HTTP 200 before declaring readiness. Retry counts,
+#     backoff policy, response translation, reasoning continuity, and cancellation/
+#     cleanup ownership are unchanged. SHIM_VERSION -> 1.2.12.
 #   v1.2.11 (2026-07-17): Correlated request-lifecycle observability and
 #     structured backend-error normalization. Every /v1/messages request now owns
 #     an internally generated 32-hex correlation ID in a ContextVar before body
@@ -298,7 +682,12 @@
 #       strict:false->true) and returns STANDARD Responses SSE. So chatgpt mode emits
 #       ONLY the 3-header floor: authorization (Bearer <access_token>),
 #       content-type: application/json, accept: text/event-stream.
-#     TOKEN LAYER (the only genuinely new component; notes/09 + notes/10, live-
+#     TOKEN LAYER [SUPERSEDED in v1.3.0 — the Python OAuth refresh described in
+#       present tense below (the auth.openai.com token POST, rotated-refresh-token
+#       persistence, and the manager.rs-mirror reload guard) was DELETED in v1.3.0;
+#       auth refresh is now delegated to the codex CLI (see the v1.3.0 entry). The
+#       paragraph is preserved verbatim as v1.2.5 history — read it in the past tense]
+#       (the only genuinely new component; notes/09 + notes/10, live-
 #       verified): the access_token TTL is ~10 days, so within any DAAF session the
 #       shim refreshes ~never — it is read-mostly. It decodes the access_token JWT
 #       PAYLOAD ONLY (never the signature) for the `exp` claim and refreshes only
@@ -332,9 +721,11 @@
 #       hung auth.openai.com cannot hold _token_refresh_lock (and block concurrent
 #       chatgpt-lane requests) for up to 600s; httpx timeout -> the existing clean
 #       RuntimeError(_RELOGIN_MSG). (b) The two OAuth test/staging override env vars
-#       (SHIM_OAUTH_TOKEN_URL, SHIM_OAUTH_CLIENT_ID) are now documented in the Config
-#       block here and in start_shim.sh (production leaves them unset -> hardcoded
-#       codex defaults). (c) codex_home_present is now HONEST — it reflects actual
+#       (SHIM_OAUTH_TOKEN_URL, SHIM_OAUTH_CLIENT_ID) were documented in the Config
+#       block and in start_shim.sh (production leaves them unset -> hardcoded
+#       codex defaults). [SUPERSEDED in v1.3.0 — both env seams were REMOVED with the
+#       Python refresh path; they no longer exist in the Config block or start_shim.sh.]
+#       (c) codex_home_present is now HONEST — it reflects actual
 #       auth.json readability (os.access R_OK), not merely CODEX_HOME being set,
 #       matching the "resolvable auth.json" docstring; applied to BOTH /health and
 #       the startup log field so they agree. Still a presence-only boolean (no
@@ -506,10 +897,28 @@
 #
 # Config (all via env):
 #   SHIM_PORT               default 4141
-#   SHIM_BACKEND_MODE       backend lane selector (v1.2.5). "openai" (default) |
-#                           "chatgpt". Read once at startup (case-insensitive,
-#                           whitespace-trimmed). An unknown value logs ONE startup
-#                           WARNING and falls back to "openai".
+#   CLAUDE_CODE_DISABLE_FAST_MODE
+#                           REQUIRED as exact `CLAUDE_CODE_DISABLE_FAST_MODE=1` on
+#                           GPT provider-shim installations/routes. This is Claude
+#                           Code's supported native `/fast` disable/hide control.
+#                           Control the shim-native route tier with:
+#                             bash /daaf/scripts/provider_shim/gpt_fast.sh {on|off|status}
+#                           Both exact GPT backends request canonical Responses wire
+#                           `service_tier:"priority"` when ON. ChatGPT presents this as
+#                           Fast with plan/credit semantics; OpenAI API presents it as
+#                           Priority with API Priority billing semantics. Setting changes
+#                           require container recreation and a new Claude session,
+#                           not a daemon restart or image rebuild. In-container DAAF
+#                           code does not mutate the private host configuration.
+#   SHIM_BACKEND_MODE       backend lane selector (v1.2.5). Legacy core process
+#                           behavior intentionally trims/normalizes the value,
+#                           defaults to "openai" when omitted, and warns then falls
+#                           back to "openai" for an unknown value. The strict product
+#                           boundary is separate: supported provider-route detection,
+#                           gpt_fast.sh, and v1.3.8 GPT policy activation require exact
+#                           SHIM_BACKEND_MODE="openai" or "chatgpt" paired with exact
+#                           DAAF_PROVIDER_SHIM="openai"; omitted, case-varied, or
+#                           whitespace-padded values are not accepted there.
 #                             * openai  — api.openai.com/v1 API-key lane (the
 #                               original, unchanged). Auth = Bearer of
 #                               SHIM_BACKEND_API_KEY (from env); default base URL
@@ -519,10 +928,9 @@
 #                               (default; still overridable via SHIM_BACKEND_BASE_URL).
 #                               Auth = Bearer of the OAuth access_token read from
 #                               $CODEX_HOME/auth.json (NOT an API key); the outbound
-#                               request emits ONLY the 3-header floor (authorization,
-#                               content-type: application/json, accept:
-#                               text/event-stream) — the backend gates on nothing
-#                               else (notes/08). REQUIRES CODEX_HOME set and a
+#                               request emits the validated auth/content/accept floor
+#                               plus the privacy-safe X-Client-Request-Id used for
+#                               transport correlation. REQUIRES CODEX_HOME set and a
 #                               readable auth.json; if either is missing the shim
 #                               fails fast with the re-login message rather than
 #                               inventing a default path. Request translation, tools,
@@ -548,21 +956,23 @@
 #   CODEX_HOME              (chatgpt mode only) directory holding auth.json (the
 #                           codex OAuth token store, mode 0600). Compose sets it to
 #                           /home/appuser/.claude/codex-daaf. In chatgpt mode the
-#                           shim reads $CODEX_HOME/auth.json for the access_token
-#                           and refreshes it in place when near expiry or on a 401.
-#                           Never logged as a path-of-secrets; /health reports only
-#                           a codex_home_present boolean (True iff auth.json is
+#                           shim READS $CODEX_HOME/auth.json for the access_token;
+#                           when the token is near expiry or a backend 401 rejects
+#                           it, the shim DELEGATES the refresh to the codex CLI
+#                           (`codex login status`, CODEX_HOME passed through) and
+#                           re-reads the result — codex is the single writer, the
+#                           shim never writes auth.json. Never logged as a
+#                           path-of-secrets; /health reports only a
+#                           codex_home_present boolean (True iff auth.json is
 #                           readable).
-#   SHIM_OAUTH_TOKEN_URL    (chatgpt mode only) TEST/STAGING OVERRIDE for the OAuth
-#                           token endpoint. Default (production) is the hardcoded
-#                           https://auth.openai.com/oauth/token. Set only to point
-#                           the refresh POST at a mock/staging token endpoint (the
-#                           mock rig uses this); leave unset in production.
-#   SHIM_OAUTH_CLIENT_ID    (chatgpt mode only) TEST/STAGING OVERRIDE for the OAuth
-#                           client_id sent on refresh. Default (production) is the
-#                           hardcoded codex first-party client_id. Set only for a
-#                           mock/staging token endpoint that expects a different
-#                           client_id; leave unset in production.
+#   SHIM_CODEX_BIN          (chatgpt mode only) codex binary invoked for delegated
+#                           token refresh. Default "codex" (on PATH in the DAAF
+#                           image). Overridable for portability and for test
+#                           injection of a fake-codex stub.
+#   SHIM_CODEX_TIMEOUT_S    (chatgpt mode only) wall-clock bound (float seconds) on
+#                           the `codex login status` subprocess. Default 30; an
+#                           unparseable value falls back to 30. On timeout the child
+#                           is killed and the auth.json re-read decides success.
 #   SHIM_STRIP_MODEL_PREFIX default "" (e.g. "openai/" to strip for api.openai.com)
 #   SHIM_SANITIZE_TOOLS     default ON ("0"/"false"/"no" to disable). Strips
 #                           known GPT "fill-every-optional" tool-call quirks
@@ -612,20 +1022,33 @@
 import os
 import sys
 import json
+import re
 import uuid
 import time
 import random
 import asyncio
 import logging
+import tempfile
+import threading
 import urllib.parse
 from collections import OrderedDict
 from contextvars import ContextVar
 
+# The shim is also loaded directly from its file path by deterministic tests. Add only
+# this script's own directory so the sibling strict policy library resolves identically
+# under direct execution and importlib-based loading.
+_SHIM_SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
+if _SHIM_SCRIPT_DIR not in sys.path:
+    sys.path.insert(0, _SHIM_SCRIPT_DIR)
+
+from gpt_fast import PolicyStore, native_fast_is_disabled
+
 import httpx
 import uvicorn
 
 # --- Config ---
-SHIM_VERSION = "1.2.11"
+SHIM_VERSION = "1.3.9"
+SHIM_SERVICE_ID = "daaf-anthropic-openai-shim"
 
 SHIM_PORT = int(os.environ.get("SHIM_PORT", "4141"))
 
@@ -643,8 +1066,20 @@
 #   impersonation = existing translator + base-URL swap + Bearer-from-auth.json).
 _BACKEND_MODE_SUPPORTED = frozenset({"openai", "chatgpt"})
 _BACKEND_MODE_DEFAULT = "openai"
-_raw_backend_mode = os.environ.get("SHIM_BACKEND_MODE", _BACKEND_MODE_DEFAULT)
-_backend_mode_norm = (_raw_backend_mode or "").strip().lower()
+_raw_provider_shim = os.environ.get("DAAF_PROVIDER_SHIM")
+_raw_backend_mode = os.environ.get("SHIM_BACKEND_MODE")
+_legacy_backend_mode_input = (
+    _BACKEND_MODE_DEFAULT if _raw_backend_mode is None else _raw_backend_mode
+)
+_backend_mode_norm = (_legacy_backend_mode_input or "").strip().lower()
+# Keep two independent boundaries. Core v1.2.5/v1.3.7 routing intentionally defaults an
+# omitted backend to OpenAI, normalizes case/whitespace, and warns+falls back on unknown
+# values. The v1.3.8 shim-global policy is stricter: only the complete raw exact provider
+# and backend pair may reconcile as valid, project effective, or activate on a request.
+_GPT_FAST_ROUTE_VALID = bool(
+    _raw_provider_shim == "openai"
+    and _raw_backend_mode in _BACKEND_MODE_SUPPORTED
+)
 if _backend_mode_norm in _BACKEND_MODE_SUPPORTED:
     SHIM_BACKEND_MODE = _backend_mode_norm
     _backend_mode_warn = None
@@ -657,6 +1092,24 @@
         "falling back to default %r" % (_raw_backend_mode, _BACKEND_MODE_DEFAULT)
     )
 
+# v1.3.8: process-wide route-bound GPT tier policy. The startup reconciliation is one
+# lock-serialized compare-and-set operation: a valid policy bound to the other lane, or
+# a current-lane ON policy without either the complete raw exact provider/backend pair
+# or exact native-Fast disable boundary, is replaced by explicit OFF. A concurrent
+# current-lane `on` that wins the writer lock is observed and preserved only when both
+# boundaries are exact. Every failure remains effective OFF; unsafe filesystem objects
+# are never overwritten and can never crash shim startup.
+_GPT_FAST_STORE = PolicyStore()
+_GPT_FAST_NATIVE_DISABLED = native_fast_is_disabled()
+try:
+    _GPT_FAST_STARTUP_NORMALIZATION = _GPT_FAST_STORE.normalize_backend(
+        SHIM_BACKEND_MODE,
+        route_boundary_valid=_GPT_FAST_ROUTE_VALID,
+        native_fast_disabled=_GPT_FAST_NATIVE_DISABLED,
+    )
+except Exception:
+    _GPT_FAST_STARTUP_NORMALIZATION = None
+
 # HARDENING: the backend base URL default is MODE-CONDITIONAL. openai ->
 # api.openai.com/v1 (the original production target); chatgpt -> the Codex backend
 # (notes/08). An explicit SHIM_BACKEND_BASE_URL env value overrides the mode
@@ -788,6 +1241,17 @@ def _resolve_startup_verbosity():
 BACKOFF_BASE = 0.5   # seconds; doubles each attempt
 BACKOFF_CAP = 8.0    # seconds; ceiling before jitter
 RETRY_AFTER_CAP = 30.0  # seconds; never honor an absurd Retry-After
+# v1.2.14 (R4): rate-limit-class retries may honor a longer advertised/parsed delay
+# than other classes (a genuine per-minute rate window can exceed 30s), but a delay
+# beyond THIS cap is failed fast to the client rather than slept internally, so the
+# client owns any multi-minute wait instead of a silent shim stall. Non-rate-limit
+# classes keep RETRY_AFTER_CAP.
+RATE_LIMIT_RETRY_AFTER_CAP = 60.0  # seconds
+# v1.2.14 (R4): Codex-style rate-limit delay hint embedded in the backend message
+# text. Parsed for the NUMBER only (gated on code rate_limit_exceeded); the prose is
+# never logged or reflected. "s"/"seconds" -> seconds, "ms" -> milliseconds.
+_RATE_LIMIT_DELAY_RE = re.compile(
+    r"try again in (\d+(?:\.\d+)?)\s*(s|ms|seconds?)", re.IGNORECASE)
 
 # Backend-error diagnostics distinguish status plus exact structured type/code
 # (for example insufficient_quota versus rate_limit_exceeded) and retain only
@@ -798,6 +1262,23 @@ def _resolve_startup_verbosity():
 # payloads, so 16 MiB is deliberately generous while still preventing an unbounded
 # upstream line from exhausting shim memory. The raw SSE transcript is never stored.
 MAX_RESPONSES_SSE_EVENT_BYTES = 16 * 1024 * 1024
+# v1.2.14 (F3): cap the ≥400 error body handed to the retry classifier at 1 MiB. A
+# legitimate backend error envelope is tiny; a pathological/oversized body must not
+# drive an unbounded json.loads/scan in _plan_retry. Beyond-cap bodies are truncated
+# and parse-fail on the truncated bytes, falling back to HTTP-status classification.
+MAX_ERROR_BODY_BYTES = 1024 * 1024
+
+# v1.2.14 (R6): downstream heartbeat interval in seconds. After message_start is on
+# the wire, the streaming path emits Anthropic `ping` SSE events every
+# SHIM_PING_INTERVAL_S while the upstream is silent, so an intermediary/client keeps
+# the connection warm and a dead client is detected within one interval instead of
+# only at the next upstream event. Float-tolerant: an unparseable value falls back to
+# the 15s default; a value <= 0 disables the heartbeat entirely (no watchdog task is
+# started). Streaming responses only — non-streaming paths never start a watchdog.
+try:
+    SHIM_PING_INTERVAL_S = float(os.environ.get("SHIM_PING_INTERVAL_S", "15"))
+except (ValueError, TypeError):
+    SHIM_PING_INTERVAL_S = 15.0
 
 # v1.2.11 request-local lifecycle accounting. The mutable record is intentionally
 # stored as one ContextVar value: child tasks inherit the same record, while
@@ -812,6 +1293,223 @@ def _resolve_startup_verbosity():
 _UPSTREAM_REQUEST_ID_MAXLEN = 200
 _CLIENT_ERROR_MESSAGE_MAXLEN = 200
 _MACHINE_FIELD_VALUE_MAXLEN = 1000
+_WIRE_DIVERGENCE_SUMMARY_INTERVAL = 100
+_WIRE_DIVERGENCE_COUNTS = {}
+_WIRE_DIVERGENCE_LAST_EMITTED = {}
+_WIRE_DIVERGENCE_LOCK = threading.Lock()
+
+# v1.2.14 (R1): forward-compatible observability for wire shapes the shim does not
+# model. Bounded process-level aggregation keyed by (kind, name) with kind in
+# {event_type, item_type, envelope}. The cap bounds distinct keys; once reached,
+# further novel keys collapse into (kind, "__overflow__") so a hostile or highly
+# variable backend cannot grow the map without limit. Lock-guarded independently
+# of the wire-divergence lock it forwards into.
+_UNKNOWN_WIRE_COUNTS = {}
+_UNKNOWN_WIRE_CAP = 256
+_UNKNOWN_WIRE_LOCK = threading.Lock()
+
+# Event types the shim either explicitly handles or benignly ignores. A clean
+# stream contains ONLY these, so the reducer/accumulator catch-alls can count any
+# event type outside this set as genuinely unknown wire (R1) while keeping
+# unknown_events at 0 for well-behaved backends. Kept in sync with the streaming
+# reducer in _handle_messages and _accumulate_terminal_response: the first group
+# is actively translated; the second is known status/lifecycle scaffolding the
+# reducer skips (they still reach the catch-all today and must not be miscounted).
+# v1.3.4 (V4-R5) added `keepalive` and `response.metadata` to the second group.
+_KNOWN_EVENT_TYPES = frozenset({
+    # Actively handled by the reducer.
+    "response.reasoning_summary_text.delta",
+    "response.output_text.delta",
+    "response.output_item.added",
+    "response.output_item.done",
+    "response.function_call_arguments.delta",
+    "response.function_call_arguments.done",
+    "response.completed",
+    "response.incomplete",
+    "response.failed",
+    "error",
+    # Known status/lifecycle events the reducer legitimately ignores.
+    "response.created",
+    "response.in_progress",
+    "response.queued",
+    "response.content_part.added",
+    "response.content_part.done",
+    "response.output_text.done",
+    "response.reasoning_summary_text.done",
+    "response.reasoning_summary_part.added",
+    "response.reasoning_summary_part.done",
+    "response.reasoning_text.delta",
+    "response.reasoning_text.done",
+    # v1.3.4 (V4-R5): two benign scaffolding types observed live during v1.2.14
+    # validation and throttle-logged as "unknown wire" ever since — a top-level
+    # keepalive (namespaced like `error`, matched by raw set membership at the two
+    # catch-alls) and a response.metadata lifecycle frame. Both carry nothing the
+    # translation needs, so absorbing them into the ignored group makes them silently
+    # skipped rather than counted, restoring "unknown_events=0 when clean" on the
+    # backends that emit them. Deliberately NOT added to _MALFORMED_TOLERANT_EVENT_TYPES:
+    # tolerance is for malformed FRAMES of load-free events, and there is no evidence
+    # either type appears malformed — a malformed instance should still fail strictly.
+    "keepalive",
+    "response.metadata",
+})
+# output_item.added/done item types the reducer models. Any other item type is
+# counted as unknown_items (R1) — observability only; it is still not translated.
+_KNOWN_ITEM_TYPES = frozenset({"function_call", "message", "reasoning"})
+
+# v1.2.14 (R3.5): non-load-bearing event types whose FRAME may be tolerated when it
+# fails strict JSON parse. These are pure status/lifecycle scaffolding the reducer
+# already ignores when well-formed, so a malformed instance carries nothing the
+# translation needs — it is counted (R1) and skipped rather than failing the stream.
+# A load-bearing event type (deltas, tool-argument events, terminal frames, error)
+# is deliberately absent, so a malformed instance of one still fails strictly. This
+# is a subset of the ignored group in _KNOWN_EVENT_TYPES and must stay consistent
+# with it. Tolerance is malformed-JSON only; an oversized payload is capped inside
+# the bounded SSE reader before the type is knowable and is deferred (see changelog).
+_MALFORMED_TOLERANT_EVENT_TYPES = frozenset({
+    "response.created",
+    "response.in_progress",
+    "response.queued",
+    "response.content_part.added",
+    "response.content_part.done",
+    "response.reasoning_summary_part.added",
+    "response.reasoning_summary_part.done",
+})
+# Extract a clean, bounded, unescaped `"type":"..."` token from the RAW bytes of an
+# SSE frame that failed strict JSON parse. Only an ASCII type of 1-64 chars with no
+# quote/backslash qualifies; anything else yields None (strict failure preserved).
+_MALFORMED_TYPE_PROBE = re.compile(rb'"type"\s*:\s*"([^"\\]{1,64})"')
+
+# v1.3.9 Fast-mode constants. Header names are case-insensitive, while Anthropic beta
+# tokens are case-sensitive. Both exact GPT routes emit the one canonical Responses request
+# value `priority`. Served tier is read only from a terminal Responses object; exact served
+# `fast` is retained temporarily as a compatibility-only parser value and is never emitted.
+_FAST_BETA_TOKEN = "fast-mode-2026-02-01"
+_FAST_REQUEST_SERVICE_TIERS = {"openai": "priority", "chatgpt": "priority"}
+_FAST_ACTUAL_SERVICE_TIERS = frozenset({"priority", "fast"})
+_STANDARD_ACTUAL_SERVICE_TIERS = frozenset({"default", "flex", "scale", "auto"})
+_FAST_REQUEST_SOURCES = frozenset({"none", "anthropic", "shim_global", "both"})
+_LATEST_TERMINAL_LOCK = threading.Lock()
+_LATEST_TERMINAL = None
+_LATEST_TERMINAL_SEQUENCE = 0
+_LATEST_TERMINAL_ORDER = 0
+_HEALTH_MODEL_TOKEN_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$")
+
+
+class _JSONObjectPairs(list):
+    """Temporary marker preserving object-pair order through JSON decoding."""
+
+
+class _DuplicateTopLevelSpeedError(ValueError):
+    """The privileged exact top-level `speed` key appeared more than once."""
+
+
+def _preserve_json_object_pairs(pairs):
+    return _JSONObjectPairs(pairs)
+
+
+def _collapse_inbound_json(value, *, root=False):
+    # Narrow duplicate-key protection for the privileged top-level Fast marker.
+    # Every unrelated duplicate and every nested duplicate retains json.loads()'s
+    # established last-key-wins behavior after recursive collapse.
+    if isinstance(value, _JSONObjectPairs):
+        collapsed = {}
+        speed_seen = False
+        for key, child in value:
+            if root and key == "speed":
+                if speed_seen:
+                    raise _DuplicateTopLevelSpeedError()
+                speed_seen = True
+            collapsed[key] = _collapse_inbound_json(child)
+        return collapsed
+    if isinstance(value, list):
+        return [_collapse_inbound_json(child) for child in value]
+    return value
+
+
+def _decode_anthropic_request_json(body):
+    preserved = json.loads(
+        body.decode("utf-8"), object_pairs_hook=_preserve_json_object_pairs
+    )
+    return _collapse_inbound_json(preserved, root=True)
+
+
+def _anthropic_beta_tokens(scope_headers):
+    # Preserve duplicate-field semantics by scanning every ASGI header pair, then split
+    # every value on commas. Malformed non-ASCII values cannot equal the ASCII beta token.
+    tokens = set()
+    for raw_name, raw_value in scope_headers or ():
+        try:
+            name = raw_name.decode("ascii").lower()
+            value = raw_value.decode("ascii")
+        except (AttributeError, UnicodeDecodeError):
+            continue
+        if name == "anthropic-beta":
+            # HTTP list optional whitespace is SP / HTAB only. A broader str.strip()
+            # would erase controls such as VT / FF and could turn a tainted member into
+            # the privileged exact beta token.
+            tokens.update(
+                part.strip(" \t") for part in value.split(",") if part.strip(" \t")
+            )
+    return tokens
+
+
+def _requested_service_tier(body, beta_tokens, policy_snapshot):
+    # v1.3.8 additive precedence. Inbound Anthropic Fast is validated exactly as in
+    # v1.3.7 even when global mode is ON; global policy never makes malformed input valid.
+    inbound_fast = False
+    if "speed" in body:
+        speed = body.get("speed")
+        if not isinstance(speed, str) or speed != "fast":
+            raise _InvalidRequestError("unsupported speed value")
+        if _FAST_BETA_TOKEN not in beta_tokens:
+            raise _InvalidRequestError(
+                "speed 'fast' requires anthropic beta fast-mode-2026-02-01")
+        inbound_fast = True
+    # The persisted opt-in is necessary but never sufficient: every accepted request
+    # also requires the complete raw exact provider/backend pair and exact native-Fast
+    # disable boundary captured for this process at startup. This keeps configuration
+    # immutable for the daemon lifetime while failing closed on every malformed control.
+    global_fast = bool(
+        _GPT_FAST_ROUTE_VALID
+        and _GPT_FAST_NATIVE_DISABLED
+        and policy_snapshot is not None
+        and policy_snapshot.status == "ok"
+        and policy_snapshot.backend_mode == SHIM_BACKEND_MODE
+        and policy_snapshot.effective
+    )
+    if inbound_fast and global_fast:
+        source = "both"
+    elif inbound_fast:
+        source = "anthropic"
+    elif global_fast:
+        source = "shim_global"
+    else:
+        source = "none"
+    # OFF means omission, never service_tier:"default" and never suppression of a valid
+    # inbound request. Both active sources converge on the lane's one canonical value.
+    requested_tier = (
+        _FAST_REQUEST_SERVICE_TIERS[SHIM_BACKEND_MODE]
+        if inbound_fast or global_fast else None
+    )
+    return requested_tier, source
+
+
+def _probe_malformed_event_type(data_bytes):
+    # v1.2.14 (R3.5): best-effort event-type recovery from a malformed SSE frame.
+    # INTENT: decide whether a frame that failed json.loads is a tolerable
+    #   non-load-bearing status event. Probes only the first 4 KiB so a large junk
+    #   frame cannot drive an unbounded scan. Returns the type string or None.
+    # REASONING: a regex over the raw bytes never executes the malformed JSON and
+    #   cannot be tricked into recovering a load-bearing type via escapes (the token
+    #   class excludes quote and backslash). The caller checks membership in
+    #   _MALFORMED_TOLERANT_EVENT_TYPES; a non-match falls through to strict failure.
+    match = _MALFORMED_TYPE_PROBE.search(data_bytes[:4096])
+    if not match:
+        return None
+    try:
+        return match.group(1).decode("ascii")
+    except (UnicodeDecodeError, AttributeError):
+        return None
 
 
 class _RequestLifecycleState:
@@ -826,13 +1524,72 @@ def __init__(self):
         self.stop_reason = "-"
         self.input_tokens = None
         self.output_tokens = None
+        # v1.3.6 (V6-R1): cached-prefix count (OpenAI usage.input_tokens_details.
+        # cached_tokens), None until a backend terminal usage is parsed. Emitted on the
+        # terminal record (as "-" when None) and feeds the /health prompt_cache counters.
+        # Lane-agnostic, like the token fields above.
+        self.cached_tokens = None
         self.usage_source = "-"
+        # v1.3.7: requested intent and actual served tier remain distinct. "-" means
+        # absent/unknown and must never be interpreted as Standard.
+        self.requested_service_tier = "-"
+        self.requested_service_tier_source = "none"
+        # Captured exactly once by app() immediately after this lifecycle object is
+        # created and before body reading/authentication. Retries never consult global state.
+        self.gpt_policy_snapshot = None
+        self.served_service_tier = "-"
         self.tools_called = 0
         self.effort_value = "-"
         self.effort_source = "-"
         self.reasoning_cache_misses = 0
+        # v1.3.4 (V4-R6): per-request cache-hit count (parallel to the miss count above),
+        # emitted on the terminal record. reasoning_cache_stripped is the count of restored
+        # reasoning items stripped by the stale-blob 400 insurance this request (0 unless a
+        # strip-retry fired — see _maybe_strip_restored_reasoning). Both always-present ints
+        # so the terminal record parses stably regardless of whether a strip occurred.
+        self.reasoning_cache_hits = 0
+        self.reasoning_cache_stripped = 0
+        # v1.3.4 (V4-R1): per-request working state for the stale-blob 400 insurance.
+        # injected_restored_reasoning_ids holds the reasoning-item ids (rs_...) of restored
+        # blobs actually injected into this request's outbound payload (what R3 strips, by
+        # id, from the reused payload["input"]); injected_restored_call_ids holds the
+        # matching call_ids (what R4 evicts as proven-stale). stale_strip_used is the
+        # one-shot gate — a request may strip-and-retry exactly once. None of these are
+        # emitted on the terminal record (internal working state only).
+        self.injected_restored_reasoning_ids = set()
+        self.injected_restored_call_ids = set()
+        self.stale_strip_used = False
+        # v1.2.14 (R1/D2): per-request counts of unknown SSE event types and
+        # unmodeled output_item types, surfaced on the terminal record (0 when clean).
+        self.unknown_events = 0
+        self.unknown_items = 0
+        # v1.2.14 (R6/D2): maximum upstream inter-event idle gap in whole
+        # milliseconds (monotonic clock), surfaced on the terminal record for stall
+        # triage. last_upstream_event_at holds the monotonic timestamp of the previous
+        # upstream event yield; the first event has no predecessor and therefore
+        # contributes no gap (it only seeds the timer).
+        self.max_idle_gap_ms = 0
+        self.last_upstream_event_at = None
+        # v1.2.14 (R6): the downstream heartbeat watchdog task for a streaming
+        # response (None until message_start is emitted; torn down before the terminal
+        # frames and reaped by the request-level resource finalizer as a safety net).
+        self.heartbeat_task = None
+        # v1.2.14 (D5): sorted top-level request key names (+ text/reasoning sub-key
+        # names) captured once after translation, emitted once if the backend
+        # classifies the request as invalid_request_error. Names only, never values.
+        self.request_shape = None
+        self.invalid_request_shape_logged = False
         self.attempts = 0
         self.retries = 0
+        self.last_retry_reason = "-"
+        self.last_retry_source = "-"
+        # v1.2.14 (R4/D2): source of the delay used for the most recent retry sleep
+        # (parsed = backend message "try again in" text; header = Retry-After; backoff
+        # = local exponential backoff). Stays "-" when no retry slept; on a fail-fast
+        # beyond the rate-limit cap it records the advertised source that triggered it.
+        self.retry_delay_source = "-"
+        self.client_request_id = self.req_id
+        self.transport_exception = "-"
         self.upstream_request_id = "-"
         self.upstream_request_id_header = "-"
         self.upstream_http_version = "unknown"
@@ -902,13 +1659,20 @@ def _machine_field_value(value):
     )
 
 
-def _lifecycle_event(name, **fields):
+def _lifecycle_event(name, _fields_before_elapsed=False, **fields):
     state = _request_state()
     if state is None:
         return
-    parts = ["event=%s" % name, "elapsed_ms=%d" % _elapsed_ms(state)]
+    parts = ["event=%s" % name]
+    if not _fields_before_elapsed:
+        parts.append("elapsed_ms=%d" % _elapsed_ms(state))
     for key, value in fields.items():
         parts.append("%s=%s" % (key, _machine_field_value(value)))
+    if _fields_before_elapsed:
+        # Compatibility for a pre-lifecycle diagnostic whose exact event/field prefix is
+        # consumed by focused regressions. It still uses this one bounded serializer and
+        # retains elapsed timing; only the token order is preserved.
+        parts.append("elapsed_ms=%d" % _elapsed_ms(state))
     log.info(" ".join(parts))
 
 
@@ -924,6 +1688,70 @@ def _normalize_http_version(value):
     return normalized if normalized in {"HTTP/1.0", "HTTP/1.1", "HTTP/2"} else "unknown"
 
 
+# v1.3.1: quota-state cache for the statusline Plan-usage segment. The file lives in
+# the shim's own logs/ directory — the SAME directory start_shim.sh writes shim.log to
+# (SCRIPT_DIR/logs); it is derived here from __file__ because the shim itself logs only
+# to stderr and holds no log-directory constant of its own. Under the shared-/daaf
+# multi-install assumption this file is INSTALL-SHARED across containers on the mount:
+# any install's context-bar.sh reads it to render "Plan usage:" (auth under $HOME stays
+# per-install). The shim records only captured_at (write-time epoch); the reader does the
+# clock math (absolute reset = captured_at + primary_reset_s).
+# v1.3.2: DAAF_QUOTA_STATE_FILE, when set and non-empty, redirects the write to that exact
+# path (the state dir becomes its dirname, so the mkstemp temp sibling lands there too).
+# This is the SAME env var the reader (context-bar.sh) already honors, so one variable
+# coherently redirects BOTH ends — a hermetic-test / redirect seam mirroring the reader's,
+# NOT an off-switch: the write itself stays unconditional and fail-open (a bad seam value
+# that makes the write fail is swallowed like any other failure). When unset/empty the
+# __file__-derived default below is byte-identical to prior behavior.
+_QUOTA_STATE_FILE_ENV = os.environ.get("DAAF_QUOTA_STATE_FILE", "")
+if _QUOTA_STATE_FILE_ENV:
+    _QUOTA_STATE_PATH = _QUOTA_STATE_FILE_ENV
+    _QUOTA_STATE_DIR = os.path.dirname(_QUOTA_STATE_PATH)
+else:
+    _QUOTA_STATE_DIR = os.path.join(
+        os.path.dirname(os.path.abspath(__file__)), "logs"
+    )
+    _QUOTA_STATE_PATH = os.path.join(_QUOTA_STATE_DIR, "quota_state.json")
+
+
+def _write_quota_state(snapshot):
+    # Absolutely fail-open telemetry: a quota-state write must NEVER affect, delay, or
+    # raise on the response path. Every failure mode (unwritable dir, replace error,
+    # serialization surprise) is swallowed, leaving at most one debug line and no stale
+    # temp sibling. The DAAF_QUOTA_STATE_FILE seam (above) only redirects WHERE the write
+    # lands (mirroring the reader's seam); it is NOT an off-switch — the write stays
+    # unconditional, and a bad seam value is swallowed here like any other failure.
+    tmp_path = None
+    try:
+        payload = {"captured_at": int(time.time())}
+        # snapshot carries the 11 raw header-string values (or "-" when the header was
+        # absent), exactly as emitted on the quota_snapshot line.
+        payload.update(snapshot)
+        data = json.dumps(payload).encode("utf-8")
+        # Atomic publish via a uniquely-named sibling temp file + os.replace(): a reader
+        # sees either the old file or the fully-written new one, never a partial write.
+        # mkstemp creates the temp with mode 0600 already (matching the shim.log
+        # permission discipline) and a unique name, so concurrent installs sharing this
+        # directory cannot clobber each other's in-flight temp file.
+        fd, tmp_path = tempfile.mkstemp(
+            prefix="quota_state.", suffix=".tmp", dir=_QUOTA_STATE_DIR
+        )
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(data)
+        os.replace(tmp_path, _QUOTA_STATE_PATH)
+        tmp_path = None
+    except Exception:
+        try:
+            log.debug("quota_state write skipped (fail-open)")
+        except Exception:
+            pass
+        if tmp_path is not None:
+            try:
+                os.unlink(tmp_path)
+            except Exception:
+                pass
+
+
 def _record_upstream_headers(response):
     state = _request_state()
     if state is None or response is None:
@@ -942,6 +1770,20 @@ def _record_upstream_headers(response):
         upstream_req_id_header=state.upstream_request_id_header,
         upstream_req_id=state.upstream_request_id,
     )
+    # v1.2.14 (D1): on the chatgpt lane a 2xx carries the full x-codex-* subscription
+    # quota surface. Emit ONE compact, grep-stable quota_snapshot line of numeric/enum
+    # fields for subscription-window triage. The openai lane (no x-codex-*) and every
+    # non-2xx response are unchanged — no line is emitted.
+    if SHIM_BACKEND_MODE == "chatgpt" and 200 <= response.status_code < 300:
+        snapshot = {}
+        for field, header_name in _QUOTA_SNAPSHOT_HEADER_FIELDS:
+            value = response.headers.get(header_name)
+            snapshot[field] = value if value is not None else "-"
+        _lifecycle_event("quota_snapshot", **snapshot)
+        # v1.3.1: also cache the snapshot to an install-shared JSON state file so the
+        # statusline (context-bar.sh) can render a "Plan usage:" segment on shim-lane
+        # sessions. Fail-open; never affects the response path.
+        _write_quota_state(snapshot)
 
 
 def _record_upstream_first_event():
@@ -953,6 +1795,28 @@ def _record_upstream_first_event():
     _lifecycle_event("upstream_first_event")
 
 
+def _record_upstream_event_gap():
+    # v1.2.14 (R6): timestamp each dispatched upstream SSE event and track the maximum
+    # inter-event idle gap (monotonic clock) for stall triage on the terminal record.
+    # INTENT: give the terminal record a single max_idle_gap_ms number that summarizes
+    #   the longest silent stretch between upstream events, without storing a
+    #   transcript or per-event timing.
+    # REASONING: the first event has no predecessor, so it only seeds the timer; every
+    #   later event updates the running maximum with the elapsed span since the prior
+    #   event when it is larger. Purely additive telemetry — it never alters the
+    #   control flow of the bounded SSE reader that calls it at each yield point.
+    # ASSUMES: called once per yielded upstream event, on the same request context.
+    state = _request_state()
+    if state is None:
+        return
+    now = time.monotonic()
+    if state.last_upstream_event_at is not None:
+        gap_ms = int((now - state.last_upstream_event_at) * 1000)
+        if gap_ms > state.max_idle_gap_ms:
+            state.max_idle_gap_ms = gap_ms
+    state.last_upstream_event_at = now
+
+
 def _record_downstream_first_content():
     state = _request_state()
     if state is None or state.downstream_first_content_at is not None:
@@ -971,13 +1835,33 @@ def _record_attempt(transport):
     _lifecycle_event("upstream_attempt", attempt=state.attempts, transport=transport)
 
 
-def _record_retry(reason):
+def _record_retry(reason, source="shim_policy"):
     state = _request_state()
     if state is None:
         return
     state.phase = "upstream_retry"
     state.retries += 1
-    _lifecycle_event("upstream_retry", retry=state.retries, reason=reason)
+    state.last_retry_reason = _scrub_metadata(reason, 100)
+    state.last_retry_source = _scrub_metadata(source, 100)
+    _lifecycle_event(
+        "upstream_retry", retry=state.retries, reason=state.last_retry_reason,
+        source=state.last_retry_source,
+    )
+
+
+def _record_transport_failure(error, phase, retryable):
+    state = _request_state()
+    if state is None:
+        return
+    exception_class = _scrub_metadata(type(error).__name__, 100)
+    state.transport_exception = exception_class
+    if not retryable and state.failure_phase == "-":
+        state.failure_phase = phase
+    _lifecycle_event(
+        "transport_failure", exception_class=exception_class,
+        failure_phase=phase, attempt=state.attempts,
+        retryable="y" if retryable else "n",
+    )
 
 
 def _record_disconnect(phase):
@@ -1018,6 +1902,15 @@ def _record_backend_error(error_type="api_error", backend_type="-", backend_code
             backend_code=state.backend_code, anthropic_type=error_type,
             failure_phase=state.failure_phase,
         )
+    # v1.2.14 (D5): a backend-classified invalid_request_error gets one
+    # request-correlated shape line to aid 400 diagnosis. Guarded by its own flag
+    # (independent of backend_error_logged) so it emits exactly once even when the
+    # backend_error line was already recorded by an earlier failure hop. Names only.
+    if (error_type == "invalid_request_error"
+            and not state.invalid_request_shape_logged
+            and state.request_shape is not None):
+        state.invalid_request_shape_logged = True
+        _lifecycle_event("request_shape", **state.request_shape)
 
 
 def _mark_success():
@@ -1060,21 +1953,55 @@ def _log_terminal_once():
         if state.body_close_send == "not_attempted":
             state.body_close_send = "skipped_disconnect"
     state.phase = "terminal"
+    # v1.3.6 (V6-R4): tick the process-cumulative /health prompt_cache counters exactly
+    # once per request (this function is idempotent via terminal_logged, checked above).
+    _bump_prompt_cache_counters(state)
     _lifecycle_event(
         "terminal", outcome=state.outcome, model=state.model,
         stream=("y" if state.stream else "n") if state.stream is not None else "-",
         msgs=state.message_count, tools=state.tool_count,
         stop=state.stop_reason, input_tokens=state.input_tokens,
         output_tokens=state.output_tokens, usage=state.usage_source,
+        # v1.3.6 (V6-R2): cached-prefix count for the ~1-week telemetry review. The
+        # captured int, or the "-" absent-convention when no valid detail was parsed
+        # (absent/malformed/clamped -> None). Mapped explicitly because _machine_field_value
+        # would render None as "None"; the "-" convention matches usage/stop above. Single
+        # lane-agnostic emission site.
+        cached_tokens=(state.cached_tokens if state.cached_tokens is not None else "-"),
+        requested_service_tier=state.requested_service_tier,
+        requested_service_tier_source=state.requested_service_tier_source,
+        served_service_tier=state.served_service_tier,
         tools_called=state.tools_called, effort="%s:%s" % (
             state.effort_value, state.effort_source),
         reasoning_cache_miss=state.reasoning_cache_misses,
+        # v1.3.4 (V4-R6): additive, always-present ints. reasoning_cache_hit is this
+        # request's cache-hit count; reasoning_cache_stripped is 0 unless the stale-blob
+        # 400 insurance stripped restored items this request (counts only, never content).
+        reasoning_cache_hit=state.reasoning_cache_hits,
+        reasoning_cache_stripped=state.reasoning_cache_stripped,
         attempts=state.attempts, retries=state.retries,
+        retry_reason=state.last_retry_reason,
+        retry_source=state.last_retry_source,
+        # v1.2.14 (R4/D2): additive. "-" when no retry slept.
+        retry_delay_source=state.retry_delay_source,
+        transport_exception=state.transport_exception,
+        client_req_id=state.client_request_id,
+        upstream_req_id=state.upstream_request_id,
         failure_phase=state.failure_phase,
         terminal_frame_send=state.terminal_frame_send,
         body_close_send=state.body_close_send,
         disconnect=state.disconnect_observed,
         disconnect_phase=state.disconnect_phase,
+        # v1.2.14 (D2): additive observability. unknown_events/unknown_items are 0
+        # on a clean stream; backend_type/backend_code default to "-" and carry the
+        # extracted structural metadata on an in-band or HTTP backend failure.
+        unknown_events=state.unknown_events,
+        unknown_items=state.unknown_items,
+        backend_type=state.backend_type,
+        backend_code=state.backend_code,
+        # v1.2.14 (R6/D2): additive. Longest observed upstream inter-event silence in
+        # whole milliseconds (0 on a single-event or non-streaming response).
+        max_idle_gap_ms=state.max_idle_gap_ms,
         dur_ms=_elapsed_ms(state),
     )
 
@@ -1135,6 +2062,10 @@ class _ProtocolError(Exception):
     """Controlled upstream Responses protocol/schema violation."""
 
 
+class _InvalidRequestError(Exception):
+    """Sanitized local Anthropic request rejection before any backend call."""
+
+
 class _ClientDisconnected(Exception):
     """Response-local control signal for a downstream client disconnect."""
 
@@ -1285,11 +2216,41 @@ async def _await_or_disconnect(operation, disconnect_event, discard_result=None,
     "x-ratelimit-limit-tokens",
     "x-ratelimit-remaining-tokens",
     "x-ratelimit-reset-tokens",
+    # v1.2.14 (D1): the chatgpt lane's request-id header (openai lane uses the
+    # x-*request-id family already captured for upstream correlation).
+    "x-oai-request-id",
+)
+# v1.2.14 (D1): prefix-allowlisted diagnostic header families. The live chatgpt lane
+# emits a broad, evolving x-codex-* quota surface (used-percent, window-minutes,
+# reset-after, plan-type, credits, per-model-family buckets) that a fixed name list
+# cannot track, so it is matched by prefix. Authorization and any credential-bearing
+# header remain structurally unreachable — a prefix here is never "authorization".
+DIAG_HEADER_PREFIX_ALLOWLIST = (
+    "x-codex-",
+)
+# v1.2.14 (D1): the compact chatgpt-lane subscription quota snapshot. ONLY numeric and
+# enum x-codex-* fields are surfaced — never a free-text header such as a promo message
+# or limit name. Each pair maps one header to one stable grep-line key; an absent header
+# renders as "-". Values still pass the shared machine-field encoding, so a hostile
+# value cannot break the single-token grammar. Header names are lowercased because
+# httpx.Headers.get() is case-insensitive. (Live capture: notes/07 §8.)
+_QUOTA_SNAPSHOT_HEADER_FIELDS = (
+    ("plan_type", "x-codex-plan-type"),
+    ("active_limit", "x-codex-active-limit"),
+    ("primary_used_pct", "x-codex-primary-used-percent"),
+    ("primary_window_min", "x-codex-primary-window-minutes"),
+    ("primary_reset_s", "x-codex-primary-reset-after-seconds"),
+    ("secondary_used_pct", "x-codex-secondary-used-percent"),
+    ("secondary_window_min", "x-codex-secondary-window-minutes"),
+    ("secondary_reset_s", "x-codex-secondary-reset-after-seconds"),
+    ("credits_has", "x-codex-credits-has-credits"),
+    ("credits_balance", "x-codex-credits-balance"),
+    ("credits_unlimited", "x-codex-credits-unlimited"),
 )
 # Defense in depth: even though credentials and Authorization are architecturally
 # excluded from logs, upstream-controlled metadata and error text receive one shared
 # sensitive-text pass before any truncation or lifecycle-field encoding.
-import re
+# (re is imported at module top for the v1.2.14 rate-limit-delay pattern.)
 _SK_KEY_RE = re.compile(r"(?i)\b(?:sk|rk|org|proj|sess)[-_][A-Za-z0-9_-]{8,}")
 _AUTH_SCHEME_RE = re.compile(
     r"(?i)\b((?:authorization\s*:\s*)?(?:bearer|basic))"
@@ -1356,6 +2317,78 @@ def _scrub_log_token(value):
     # Non-strings pass through for existing %s rendering semantics.
     return _sanitize_sensitive_text(value) if isinstance(value, str) else value
 
+
+def _record_wire_divergence(kind):
+    # Process-level aggregation is protected even when validators run from multiple
+    # server tasks or test threads. Emit one discovery warning, then one bounded
+    # summary per fixed interval; no event IDs or payload values enter the record.
+    # The summary reports records suppressed strictly BETWEEN emitted records: the
+    # first summary at observation 100 therefore covers observations 2..99 (98),
+    # while later summaries cover 101..199, 201..299, and so on (99 each). Keep the
+    # warning writes inside the same lock so concurrent observations cannot reorder
+    # an emitted summary ahead of the discovery record it follows.
+    with _WIRE_DIVERGENCE_LOCK:
+        count = _WIRE_DIVERGENCE_COUNTS.get(kind, 0) + 1
+        _WIRE_DIVERGENCE_COUNTS[kind] = count
+        if count == 1:
+            log.warning("wire-divergence: %s observed=1", kind)
+            _WIRE_DIVERGENCE_LAST_EMITTED[kind] = count
+        elif count % _WIRE_DIVERGENCE_SUMMARY_INTERVAL == 0:
+            previous_emitted = _WIRE_DIVERGENCE_LAST_EMITTED.get(kind, 0)
+            suppressed = count - previous_emitted - 1
+            log.warning(
+                "wire-divergence-summary kind=%s observed=%d suppressed=%d",
+                kind, count, suppressed,
+            )
+            _WIRE_DIVERGENCE_LAST_EMITTED[kind] = count
+    return count
+
+
+def _record_unknown_wire(kind, name):
+    # v1.2.14 (R1): record one observation of an unmodeled wire shape.
+    # INTENT: make unknown SSE event types, unmodeled output_item types, and
+    #   unrecognized error envelopes VISIBLE instead of vanishing, without ever
+    #   logging event bodies or values. Three effects, in order: (a) bump the bounded
+    #   process aggregate, (b) route first/every-100th logging through the existing
+    #   wire-divergence channel, (c) bump the per-request terminal-record counter.
+    # REASONING: the process map is bounded and overflow-collapsed so a novel-name
+    #   flood cannot grow it; the name is scrubbed and length-bounded before it can
+    #   reach a log line. The behavior is observability-only — unknown shapes are
+    #   still not translated (there is nothing to translate them to).
+    # ASSUMES: kind is a source constant ("event_type"/"item_type"/"envelope");
+    #   only `name` is backend-influenced and therefore scrubbed.
+    safe_name = _sanitize_sensitive_text(name, max_len=64) if isinstance(
+        name, str) and name else "-"
+    with _UNKNOWN_WIRE_LOCK:
+        key = (kind, safe_name)
+        if key not in _UNKNOWN_WIRE_COUNTS and (
+                len(_UNKNOWN_WIRE_COUNTS) >= _UNKNOWN_WIRE_CAP):
+            key = (kind, "__overflow__")
+        _UNKNOWN_WIRE_COUNTS[key] = _UNKNOWN_WIRE_COUNTS.get(key, 0) + 1
+    _record_wire_divergence("unknown_%s:%s" % (kind, key[1]))
+    state = _request_state()
+    if state is not None:
+        if kind == "item_type":
+            state.unknown_items += 1
+        else:
+            state.unknown_events += 1
+
+
+def _request_shape_fields(payload):
+    # v1.2.14 (D5): capture only the SORTED top-level request key NAMES (plus
+    # text/reasoning sub-key names) for a possible invalid_request_error diagnosis
+    # line. Names only, never values; the outbound Responses payload keys are
+    # shim-constructed identifiers, and _lifecycle_event scrubs each value anyway.
+    if not isinstance(payload, dict):
+        return None
+    fields = {"keys": ",".join(sorted(str(k) for k in payload.keys()))}
+    for sub in ("text", "reasoning"):
+        val = payload.get(sub)
+        if isinstance(val, dict):
+            fields["%s_keys" % sub] = ",".join(sorted(str(k) for k in val.keys()))
+    return fields
+
+
 # v1.2.0: reasoning-item cache (module-level, bounded LRU).
 # INTENT: the Responses API pairs a `reasoning` output item with the
 #   function_call(s) that follow it. On store:false stateless replay the caller
@@ -1379,17 +2412,95 @@ def _scrub_log_token(value):
 _REASONING_CACHE = OrderedDict()   # call_id -> reasoning item dict (WITH encrypted_content)
 _REASONING_CACHE_CAP = 2048
 
+# v1.3.4 (V4-R1): call_ids whose reasoning blob was loaded from the persisted snapshot at
+# import (as opposed to populated by a live backend response this process). Defined BEFORE
+# _cache_reasoning so the write path below can reference it — Python resolves module globals
+# at call time, and the first call (the import-time restore) runs after this binding exists.
+# A restored blob is the one case v1.3.3 persistence can turn a graceful cache miss into a
+# hard failure (a stale encrypted_content of unknown backend-side validity is re-injected
+# and rejected with a 400); this set lets the stale-blob 400 insurance (V4-R2..R4) tell a
+# restored blob from a live-populated one at re-injection time. Contents are call_ids only.
+_REASONING_CACHE_RESTORED_IDS = set()
+
+# v1.3.4 (V4-R7): process-cumulative reasoning-cache hit counters for the /health restore-
+# effectiveness surface. _REASONING_CACHE_HITS_TOTAL counts every cache hit since process
+# start; _REASONING_CACHE_RESTORED_HITS_TOTAL counts the subset whose call_id was still in
+# _REASONING_CACHE_RESTORED_IDS at hit time (the direct measure of how often disk-restored
+# continuity is actually exercised, for the ~1-week cap/ceiling review). Counts only, never
+# content or call_ids. Ticked read-only alongside the .get() hit (never a move_to_end), so
+# hit-counting adds ZERO cache-file write amplification (the persist writer stays gated on
+# genuine cache mutations only).
+_REASONING_CACHE_HITS_TOTAL = 0
+_REASONING_CACHE_RESTORED_HITS_TOTAL = 0
+
+
+def _bump_reasoning_hit_counters(restored):
+    # v1.3.4 (V4-R7): tick the process-cumulative /health hit counters for one cache hit.
+    # `restored` is True iff this hit's call_id was in _REASONING_CACHE_RESTORED_IDS at hit
+    # time. This never touches the cache itself (the caller reads via .get(), never
+    # move_to_end), so it introduces no LRU mutation and no persist / write amplification.
+    global _REASONING_CACHE_HITS_TOTAL, _REASONING_CACHE_RESTORED_HITS_TOTAL
+    _REASONING_CACHE_HITS_TOTAL += 1
+    if restored:
+        _REASONING_CACHE_RESTORED_HITS_TOTAL += 1
+
+
+# v1.3.6 (V6-R4): process-cumulative prompt-cache observability counters for the /health
+# prompt_cache block. COUNTS ONLY — never prompt content or token material. Ticked once per
+# terminal (from _log_terminal_once, idempotent via terminal_logged) by
+# _bump_prompt_cache_counters. requests_with_usage counts terminals with a backend-parsed
+# usage; requests_with_cached is the subset reporting cached_tokens > 0; cached_tokens_total
+# and input_tokens_total are the cumulative sums (input_tokens_total is the OpenAI input
+# TOTAL) so the ~1-week review reads a cache hit-rate in ONE probe as
+# cached_tokens_total / input_tokens_total.
+_PROMPT_CACHE_REQUESTS_WITH_USAGE = 0
+_PROMPT_CACHE_REQUESTS_WITH_CACHED = 0
+_PROMPT_CACHE_CACHED_TOKENS_TOTAL = 0
+_PROMPT_CACHE_INPUT_TOKENS_TOTAL = 0
+
+
+def _bump_prompt_cache_counters(state):
+    # v1.3.6 (V6-R4): tick the /health prompt_cache counters for one terminal. Gated on a
+    # BACKEND-sourced usage (usage_source == "backend") so the estimated-fallback path
+    # (input_tokens defaulted to 0, no real cache detail) never pollutes the hit-rate
+    # denominator. The cached counters advance only on a valid, non-clamped cached detail
+    # (state.cached_tokens a real int > 0). Counts only; never raises.
+    global _PROMPT_CACHE_REQUESTS_WITH_USAGE, _PROMPT_CACHE_REQUESTS_WITH_CACHED
+    global _PROMPT_CACHE_CACHED_TOKENS_TOTAL, _PROMPT_CACHE_INPUT_TOKENS_TOTAL
+    if state is None or state.usage_source != "backend":
+        return
+    if isinstance(state.input_tokens, bool) or not isinstance(state.input_tokens, int):
+        return
+    _PROMPT_CACHE_REQUESTS_WITH_USAGE += 1
+    _PROMPT_CACHE_INPUT_TOKENS_TOTAL += state.input_tokens
+    cached = state.cached_tokens
+    if not isinstance(cached, bool) and isinstance(cached, int) and cached > 0:
+        _PROMPT_CACHE_REQUESTS_WITH_CACHED += 1
+        _PROMPT_CACHE_CACHED_TOKENS_TOTAL += cached
+
 
 def _cache_reasoning(call_id, reasoning_item):
     # INTENT: store one reasoning item under a function_call's call_id, LRU-style.
     # REASONING: move-to-end on write so the most recently paired call_ids evict
     #   last; a session's active tool loop stays warm.
+    # RETURNS: True iff the write actually landed (valid call_id + dict item), False
+    #   on a no-op reject. v1.3.3 (A2): the caller uses this to persist only on a real
+    #   mutation, and the restore path reuses it to rebuild the cache in file order.
     if not call_id or not isinstance(reasoning_item, dict):
-        return
+        return False
     _REASONING_CACHE[call_id] = reasoning_item
     _REASONING_CACHE.move_to_end(call_id)
+    # v1.3.4 (V4-R1): a write here is a LIVE (re-)population of this call_id — the blob is
+    # fresh from a backend response, so it is no longer a disk-restored entry. Drop it from
+    # the restored set. The import-time restore also routes through this function, so it
+    # re-adds the genuinely-restored ids AFTER its loop (see _restore_reasoning_cache); this
+    # discard therefore never races the restore's own bookkeeping.
+    _REASONING_CACHE_RESTORED_IDS.discard(call_id)
     while len(_REASONING_CACHE) > _REASONING_CACHE_CAP:
-        _REASONING_CACHE.popitem(last=False)  # evict oldest
+        evicted_id, _evicted_item = _REASONING_CACHE.popitem(last=False)  # evict oldest
+        # An evicted entry can no longer be injected, so it cannot be a stale-blob source.
+        _REASONING_CACHE_RESTORED_IDS.discard(evicted_id)
+    return True
 
 
 def _populate_reasoning_cache(output_items):
@@ -1406,7 +2517,11 @@ def _populate_reasoning_cache(output_items):
     #   the wire-format spec skeleton, notes file 04 §4). A function_call with no
     #   preceding reasoning item (current_reasoning is None) is simply not cached
     #   — nothing to inject, and the cache miss path handles the absence.
+    # RETURNS: the number of cache entries actually written/refreshed. v1.3.3 (A2):
+    #   the call sites persist the cache only when this is nonzero, so a populate that
+    #   binds nothing (no reasoning, or unpaired function_calls) triggers no disk write.
     current_reasoning = None
+    mutated = 0
     for item in output_items or []:
         if not isinstance(item, dict):
             continue
@@ -1415,7 +2530,186 @@ def _populate_reasoning_cache(output_items):
             current_reasoning = item
         elif itype == "function_call":
             if current_reasoning is not None:
-                _cache_reasoning(item.get("call_id"), current_reasoning)
+                if _cache_reasoning(item.get("call_id"), current_reasoning):
+                    mutated += 1
+    return mutated
+
+
+# --- v1.3.3 (A2): reasoning-cache persistence across shim restarts ---
+# INTENT: the in-memory _REASONING_CACHE above is module-global and unpersisted, so
+#   every restart discards it. A restart mid-session then replays the tool history
+#   WITHOUT its reasoning items — the miss path is graceful (omit the item, count the
+#   miss, proceed), but the model loses the reasoning context for the rest of a long
+#   tool loop. Persisting a bounded newest-first snapshot on each cache mutation and
+#   restoring it at import keeps reasoning continuity across a restart.
+# SECURITY: persisted values are EXACTLY the in-memory values — opaque backend-encrypted
+#   `encrypted_content` blobs plus item metadata. No plaintext reasoning, no key
+#   material (same posture as the live cache; Anthropic thinking blocks are consumed,
+#   never stored). Logging discipline is unchanged: names/counts only, never contents.
+# PLACEMENT (A2-R4, amended by the design checkpoint): the default lives on the
+#   per-container claude-config volume ($HOME/.claude/provider_shim/), DELIBERATELY
+#   outside the /daaf repo tree. Reasoning blobs are relatively private and must not sit
+#   in a directory that is shareable across containers or ever syncable to VCS. This is
+#   why the path is HOME-derived, NOT __file__-derived like quota_state.json (which is
+#   scrubbed operational telemetry, deliberately kept install-shared in logs/). Only the
+#   content-bearing artifact moves off the repo mount. Because the file is per-container,
+#   the install-shared last-writer-wins race that quota_state.json carries does not apply
+#   here; the supported topology is one running shim per container at a time.
+# SEAM (A2-R4): DAAF_REASONING_CACHE_FILE, resolved at MODULE IMPORT time exactly like
+#   DAAF_QUOTA_STATE_FILE (a post-import env change does NOT redirect a live shim). When
+#   set and non-empty it overrides both the path and its parent dir; when unset the
+#   HOME-derived default below applies. Hermetic tests provision this seam in every
+#   module-load context (spawned child env, in-process runner setdefault, per-test patch).
+_REASONING_CACHE_FILE_ENV = os.environ.get("DAAF_REASONING_CACHE_FILE", "")
+if _REASONING_CACHE_FILE_ENV:
+    _REASONING_CACHE_PATH = _REASONING_CACHE_FILE_ENV
+    _REASONING_CACHE_DIR = os.path.dirname(_REASONING_CACHE_PATH)
+else:
+    _REASONING_CACHE_DIR = os.path.join(
+        os.path.expanduser("~"), ".claude", "provider_shim"
+    )
+    _REASONING_CACHE_PATH = os.path.join(_REASONING_CACHE_DIR, "reasoning_cache.json")
+
+# Persistence bounds (A2-R2; Decision 3 as amended; v1.3.6 V6-R5 resize to 1024 / 8 MiB).
+# The entry/byte caps are the PRIMARY bound and intentionally mirror the in-memory LRU tail
+# — restart recovery only needs the recent tail (active tool loops), not all 2048 in-memory
+# entries, and the byte cap bounds the response-path write to low tens of ms at the 8 MiB
+# bound (measured 2026-07-22: ~19 ms median, ~25 ms worst over 20 full-snapshot serialize+
+# atomic-write iterations incl. fsync — a conservative upper bound; was "single-digit ms" at
+# the old 2 MiB cap). The TTL is only a 30-day SANITY CEILING against
+# replaying ancient blobs of unknown backend-side validity; it is deliberately NOT an
+# aggressive expiry, because the live cache has no age limit (LRU only) and multi-day
+# session gaps are normal (a short TTL would erase exactly the entries a resumed session
+# replays). Keep the NEWEST entries when either bound binds.
+_REASONING_PERSIST_MAX_ENTRIES = 1024      # v1.3.6 (V6-R5): 256 -> 1024 (4x headroom)
+_REASONING_PERSIST_MAX_BYTES = 8_388_608   # v1.3.6 (V6-R5): 2 MiB -> 8 MiB
+_REASONING_PERSIST_TTL_S = 2_592_000       # 30 days (sanity ceiling only)
+
+# Count of entries loaded from the persisted snapshot at startup (0 if none). Set by the
+# restore call below and surfaced read-only on /health. Never includes contents/call_ids.
+_REASONING_CACHE_RESTORED = 0
+
+
+def _write_reasoning_cache_state():
+    # Absolutely fail-open persistence, mirroring _write_quota_state (:1321): a persist
+    # must NEVER affect, delay, or raise on the response path. Every failure mode
+    # (unwritable dir, replace error, serialization surprise, bad seam value) is
+    # swallowed, leaving at most one debug line and no stale temp sibling.
+    tmp_path = None
+    try:
+        # Snapshot the NEWEST entries (the LRU tail). _REASONING_CACHE iterates
+        # oldest->newest, so the last N items are the most-recently-used; keeping the tail
+        # matches the in-memory eviction order and gives restore an oldest->newest list.
+        items = list(_REASONING_CACHE.items())
+        if not items:
+            return
+        entries = [[cid, item] for cid, item in items[-_REASONING_PERSIST_MAX_ENTRIES:]]
+        payload = {"captured_at": int(time.time()), "entries": entries}
+        data = json.dumps(payload).encode("utf-8")
+        # Byte cap: if oversize, drop OLDEST entries (front) until under the cap, keeping
+        # the newest. If even a single entry exceeds the cap, persist nothing this round.
+        while len(data) > _REASONING_PERSIST_MAX_BYTES and len(payload["entries"]) > 1:
+            payload["entries"] = payload["entries"][1:]
+            data = json.dumps(payload).encode("utf-8")
+        if len(data) > _REASONING_PERSIST_MAX_BYTES:
+            return
+        # The shim owns directory creation (the HOME-derived default dir may not exist yet
+        # in a fresh container). 0700 matches the logs/ dir discipline start_shim.sh uses.
+        os.makedirs(_REASONING_CACHE_DIR, mode=0o700, exist_ok=True)
+        # Atomic publish via a uniquely-named sibling temp + os.replace(): a reader sees
+        # either the old file or the fully-written new one, never a partial write. mkstemp
+        # creates the temp with mode 0600 already (matching the shim.log/quota_state
+        # permission discipline). os.replace onto a symlink replaces the symlink entry
+        # itself (rename(2) does not dereference the destination), so the atomic-publish
+        # path is not symlink-redirectable; the 0700 parent dir is the primary guard.
+        fd, tmp_path = tempfile.mkstemp(
+            prefix="reasoning_cache.", suffix=".tmp", dir=_REASONING_CACHE_DIR
+        )
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(data)
+        os.replace(tmp_path, _REASONING_CACHE_PATH)
+        tmp_path = None
+    except Exception:
+        try:
+            log.debug("reasoning_cache write skipped (fail-open)")
+        except Exception:
+            pass
+        if tmp_path is not None:
+            try:
+                os.unlink(tmp_path)
+            except Exception:
+                pass
+
+
+def _restore_reasoning_cache():
+    # Fail-open restore at import. Returns (restored_count, age_s) on a successful load,
+    # (0, None) on ANY failure or skip (missing file, unparseable JSON, bad shape, stale,
+    # oversize). Never raises. The next persist overwrites a file that failed to restore.
+    try:
+        if not os.path.exists(_REASONING_CACHE_PATH):
+            return (0, None)
+        # Defense-in-depth (A2 review INFO-2): bound the READ the same way the writer bounds
+        # its output. Check the on-disk size BEFORE reading the whole file into memory and
+        # skip an oversized file. A shim-written file can never exceed the byte cap (the
+        # writer refuses to publish above it at the `len(data) > _REASONING_PERSIST_MAX_BYTES`
+        # guard above), so this only trips on a hand-tampered/oversized file — fail-open like
+        # every other branch here (an OSError from getsize is caught by the outer except).
+        if os.path.getsize(_REASONING_CACHE_PATH) > _REASONING_PERSIST_MAX_BYTES:
+            return (0, None)
+        with open(_REASONING_CACHE_PATH, "rb") as handle:
+            payload = json.loads(handle.read().decode("utf-8"))
+        if not isinstance(payload, dict):
+            return (0, None)
+        captured_at = payload.get("captured_at")
+        entries = payload.get("entries")
+        # bool is an int subclass; reject it explicitly so a stray True/False captured_at
+        # cannot pass the numeric gate.
+        if isinstance(captured_at, bool) or not isinstance(captured_at, int):
+            return (0, None)
+        if not isinstance(entries, list):
+            return (0, None)
+        age_s = int(time.time()) - captured_at
+        # Reject a future timestamp (clock skew / tampering) and anything past the 30-day
+        # sanity ceiling.
+        if age_s < 0 or age_s > _REASONING_PERSIST_TTL_S:
+            return (0, None)
+        # Rebuild in file order (oldest->newest) so the LRU tail ends up most-recently-used;
+        # _cache_reasoning enforces the 2048 cap and skips malformed pairs. A single bad
+        # entry is skipped, not fatal — the rest of a well-formed file still restores.
+        restored = 0
+        restored_ids = set()
+        for pair in entries:
+            if not isinstance(pair, (list, tuple)) or len(pair) != 2:
+                continue
+            if _cache_reasoning(pair[0], pair[1]):
+                restored += 1
+                restored_ids.add(pair[0])
+        # v1.3.4 (V4-R1): record which call_ids came from disk so the stale-blob 400
+        # insurance can distinguish a restored blob from a live-populated one at
+        # re-injection. Built AFTER the loop because _cache_reasoning discards each id as it
+        # writes (treating every write as live population); we re-add the genuinely-restored
+        # ids here, intersected with what actually resides in the cache (a hand-tampered
+        # over-cap file could have evicted some during the loop). Mutated in place (clear +
+        # update) so no `global` rebinding is needed.
+        _REASONING_CACHE_RESTORED_IDS.clear()
+        _REASONING_CACHE_RESTORED_IDS.update(restored_ids & set(_REASONING_CACHE.keys()))
+        # A2 review INFO-1: report the number of entries actually RESIDENT after restore,
+        # not the raw insert count. A hand-tampered file with more entries than
+        # _REASONING_CACHE_CAP (or with duplicate call_ids) would make `restored` exceed
+        # what the cache actually holds (e.g. 5000 inserts -> cache caps at 2048),
+        # overstating /health.reasoning_cache.restored. Clamp against the live cache size
+        # (restore runs at import against an empty cache, so len == the resident restored
+        # count) so the surfaced number can never overstate what is truly loaded.
+        return (min(restored, len(_REASONING_CACHE)), age_s)
+    except Exception:
+        return (0, None)
+
+
+# Restore at import, adjacent to the cache definition. `log` is not configured yet here,
+# so the one-line restore log is DEFERRED to just after logging is set up below (mirroring
+# the _backend_mode_warn deferral). counts only — never entry contents or call_ids.
+_reasoning_restore_result = _restore_reasoning_cache()
+_REASONING_CACHE_RESTORED = _reasoning_restore_result[0]
 
 
 # HARDENING: structured logging to stderr ONLY. The manager script redirects
@@ -1438,6 +2732,16 @@ def _populate_reasoning_cache(output_items):
 if _backend_mode_warn is not None:
     log.warning(_backend_mode_warn)
 
+# v1.3.3 (A2-R3): emit the deferred reasoning-cache restore line now that `log` exists.
+# The restore itself ran at import above (before logging was configured). Silent when
+# nothing was restored (missing/stale/corrupt file all resolve to 0). counts only —
+# never entry contents or call_ids.
+if _REASONING_CACHE_RESTORED > 0:
+    log.info(
+        "event=reasoning_cache_restore entries=%d age_s=%s",
+        _REASONING_CACHE_RESTORED, _reasoning_restore_result[1],
+    )
+
 # v1.2.4: resolve the process-wide response verbosity now that `log` exists (the
 # resolver emits its one WARNING via `log` for an invalid value). Read once at
 # startup; the hot path just reads this constant into text:{"verbosity": ...}.
@@ -1447,51 +2751,56 @@ def _populate_reasoning_cache(output_items):
 _client = httpx.AsyncClient(timeout=httpx.Timeout(600.0, connect=30.0))
 
 
-# --- v1.2.5: ChatGPT-subscription OAuth token layer (chatgpt mode ONLY) ---
+# --- v1.3.0: ChatGPT-subscription auth layer — delegated to the codex CLI ---
 # INTENT: in chatgpt mode the Bearer is the OAuth access_token from
 #   $CODEX_HOME/auth.json, not an api.openai.com API key. The access_token TTL is
-#   ~10 days (notes/09 A), so within any DAAF session the shim refreshes ~never:
-#   this layer is READ-MOSTLY. It reads the access_token, sends it as Bearer, and
-#   refreshes ONLY when the JWT `exp` is within a 30-min safety margin OR on a
-#   backend 401 (lazy). Refresh rotates the refresh_token (notes/10) and MUST
-#   persist atomically; a guarded reload-before-refresh (notes/09 B2, codex
-#   manager.rs:2388) skips the refresh when another writer already produced a
-#   newer on-disk token. All own-refreshes are serialized by an asyncio.Lock.
-# CREDENTIAL SAFETY: no token value is ever logged. Writing token values INTO
-#   auth.json (0600) is the intended credential-store operation, not a leak.
-#   Presence is checked with `if not tok:` guards, never by printing.
-
-# OAuth refresh endpoint + client_id (first-party, notes/09 B). Both are the codex
-# constants; env-overridable purely for testing (the mock rig points them at a
-# local mock token endpoint). Real production leaves them unset -> these defaults.
-_OAUTH_TOKEN_URL = os.environ.get(
-    "SHIM_OAUTH_TOKEN_URL", "https://auth.openai.com/oauth/token"
-)
-_OAUTH_CLIENT_ID = os.environ.get(
-    "SHIM_OAUTH_CLIENT_ID", "app_EMoamEEZ73f0CkXaXp7hrann"
-)
-# Refresh when the access_token is within this many seconds of its `exp` (notes/09
-# F: 30-min safety margin — deliberately wider than codex's 5-min window because a
-# DAAF session is long and a mid-turn expiry is worse than a slightly-early refresh).
-_TOKEN_REFRESH_MARGIN_S = 30 * 60
-# Actionable message surfaced on a permanent refresh failure or a missing/unreadable
-# auth store. No secret content — just the recovery instruction (notes/09 B/F).
-_RELOGIN_MSG = ("ChatGPT OAuth token refresh failed permanently; run "
-                "'codex login --device-auth' inside the container to re-authenticate")
-
-# In-process serialization of our OWN refreshes (the shim is async; concurrent
-# requests must not each fire a refresh). Per-process only — cross-process
-# coordination is the guarded reload-before-refresh below (notes/09 B2).
+#   ~10 days (notes/09 A), so within any DAAF session refreshes are rare: this layer
+#   is READ-MOSTLY. It reads the access_token, sends it as Bearer, and — when the
+#   token is near expiry (proactive) or a backend 401 rejects it (reactive) —
+#   DELEGATES the refresh to the codex CLI. The codex CLI is the SINGLE WRITER of
+#   auth.json; the shim NEVER writes it. The shim invokes `codex login status`, then
+#   re-reads auth.json and judges validity from the JWT `exp` claim. Delegating the
+#   write structurally eliminates the refresh-token-rotation race a Python-side
+#   refresh had with any other codex-based tool sharing the same CODEX_HOME (the
+#   live-confirmed 2026-07-20 auth-lockout cause).
+# CREDENTIAL SAFETY: no token value is ever logged. The shim only READS auth.json;
+#   codex owns every write. Presence is checked with `if not tok:` guards, never by
+#   printing. The codex subprocess's stdout/stderr are captured (to keep them off the
+#   shim's own streams) but NEVER logged — codex may echo account detail. Only its
+#   exit code and a coarse event label are logged.
+
+# The codex binary used for delegated refresh. Default `codex` (on PATH in the DAAF
+# image); overridable for test injection (a fake-codex stub) and portability.
+SHIM_CODEX_BIN = os.environ.get("SHIM_CODEX_BIN", "").strip() or "codex"
+# Wall-clock bound on the `codex login status` subprocess. Float-tolerant: an
+# unparseable value falls back to the 30s default (mirrors the SHIM_PING_INTERVAL_S
+# convention). A hung codex must not stall a chatgpt-lane request indefinitely; on
+# timeout the child is killed and the re-read decides success/failure.
+try:
+    SHIM_CODEX_TIMEOUT_S = float(os.environ.get("SHIM_CODEX_TIMEOUT_S", "30"))
+except (ValueError, TypeError):
+    SHIM_CODEX_TIMEOUT_S = 30.0
+# Refresh when the access_token is within this many seconds of its `exp`. Mirrors
+# codex's own CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES (5 min, notes/05) so that
+# when the shim decides to refresh, codex — keying refresh on the same window —
+# actually performs it rather than treating `login status` as a no-op.
+_TOKEN_REFRESH_MARGIN_S = 5 * 60
+# Actionable message surfaced on ANY auth failure (a failed delegated refresh, a
+# post-retry 401, a missing/unreadable auth store, or codex reporting "Not logged
+# in"). No secret content — just the recovery instruction. It MUST literally contain
+# `codex login --device-auth` (A1-R5); every auth-failure surface reuses this string.
+_RELOGIN_MSG = ("ChatGPT OAuth token is invalid or expired and the codex CLI could "
+                "not refresh it; run 'codex login --device-auth' inside the container "
+                "to re-authenticate")
+
+# In-process single-flight serialization of delegated refreshes (the shim is async;
+# concurrent requests that all observe a stale/rejected token must not each spawn a
+# codex subprocess — the first refresh wins and the rest adopt its result).
+# Cross-process coordination is now codex's own domain as the single writer.
 _token_refresh_lock = asyncio.Lock()
 # The access_token currently held in memory. Seeded lazily from disk on first use.
 # Value is a secret string; never logged.
 _token_state = {"access_token": None, "exp": None}
-# Explicit ownership for the rotating-token commit. The task exists only while the
-# holder of _token_refresh_lock supervises one refresh exchange through persistence.
-# A bounded failure is retained for the process lifetime to prevent accidental reuse
-# of a possibly consumed refresh token. Neither field ever contains token values.
-_refresh_commit_task = None
-_refresh_commit_failure = None
 
 
 def _b64url_decode(seg):
@@ -1558,233 +2867,134 @@ def _read_auth_json():
     return data
 
 
-def _codex_last_refresh_now():
-    # INTENT: produce a `last_refresh` timestamp string matching codex's EXACT
-    #   format so an external codex reload treats our write as well-formed.
-    # REASONING: codex writes RFC3339 UTC with 9-digit (nanosecond) fractional
-    #   seconds + trailing "Z" (chrono's DateTime<Utc>::to_rfc3339() default,
-    #   notes/10). Python's datetime sources only microseconds (6 digits), so we
-    #   format to microseconds and zero-pad the fractional field to 9 digits.
-    # ASSUMES: nanosecond-precision beyond microseconds is not required for
-    #   correctness — codex only parses the field; the padding matches its STRING
-    #   shape (notes/10 wrote 2026-07-15T00:46:57.074803000Z this exact way).
-    from datetime import datetime, timezone
-    now = datetime.now(timezone.utc)
-    # e.g. 2026-07-15T00:46:57.074803 -> pad microseconds (6) to nanoseconds (9).
-    return now.strftime("%Y-%m-%dT%H:%M:%S.") + ("%06d000" % now.microsecond) + "Z"
-
-
-def _atomic_write_auth_json(new_data):
-    # INTENT: persist the updated auth.json ATOMICALLY, mode 0600, in the SAME
-    #   directory as the real file (same-fs rename requirement for os.replace).
-    # REASONING: temp file in the same dir -> chmod 0600 on the temp -> os.replace()
-    #   (atomic same-fs rename). This fixes the torn-write hazard codex itself has
-    #   (notes/09 B2) — a reader never sees a partial file. Live-validated write
-    #   path (notes/10). The temp is uniquely named to avoid colliding with a
-    #   concurrent writer's temp.
-    # CREDENTIAL SAFETY: writing token values into the 0600 store is the INTENDED
-    #   operation, not a leak. Nothing is logged here.
-    import tempfile
-    d = os.path.dirname(_CODEX_AUTH_PATH)
-    fd, tmp = tempfile.mkstemp(prefix=".auth.json.tmp.", dir=d)
+async def _run_codex_login_status():
+    # INTENT: invoke `{SHIM_CODEX_BIN} login status` so the codex CLI — the SINGLE
+    #   writer of auth.json — performs any needed token refresh in its own store.
+    # REASONING: async create_subprocess_exec keeps the event loop unblocked; the
+    #   subprocess inherits the shim's environ (CODEX_HOME already exported) so codex
+    #   targets the same per-install store the shim reads. Bounded by
+    #   SHIM_CODEX_TIMEOUT_S. This call's exit code and output are DIAGNOSTIC ONLY —
+    #   the authoritative refresh outcome is the auth.json re-read the caller performs
+    #   afterward, NEVER parsed from this subprocess's stdout/stderr (A1-R3). A spawn
+    #   failure (missing binary) or a timeout is non-fatal here; the re-read decides.
+    # CREDENTIAL SAFETY: stdout/stderr are captured (to keep them off the shim's own
+    #   streams) but NEVER logged — codex may echo account detail. Only the exit code
+    #   and a coarse event label are logged.
     try:
-        with os.fdopen(fd, "w", encoding="utf-8") as f:
-            json.dump(new_data, f)
-        os.chmod(tmp, 0o600)
-        os.replace(tmp, _CODEX_AUTH_PATH)  # atomic same-fs rename
-    except Exception:
-        # Best-effort cleanup of the temp on any failure so we never leave a
-        # partial credential file behind.
+        proc = await asyncio.create_subprocess_exec(
+            SHIM_CODEX_BIN, "login", "status",
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env=os.environ.copy(),
+        )
+    except (OSError, ValueError) as e:
+        # Missing binary (FileNotFoundError), permission error, bad argv, etc. Log the
+        # exception TYPE only; the caller's re-read surfaces the actionable error.
+        log.warning("event=codex_spawn_failed err=%s", type(e).__name__)
+        return
+    try:
+        await asyncio.wait_for(proc.communicate(), timeout=SHIM_CODEX_TIMEOUT_S)
+    except asyncio.TimeoutError:
+        log.warning("event=codex_login_status_timeout timeout_s=%s",
+                    SHIM_CODEX_TIMEOUT_S)
         try:
-            os.unlink(tmp)
-        except OSError:
+            proc.kill()
+        except ProcessLookupError:
             pass
-        raise
+        # Reap the killed child so it does not linger as a zombie or leak its pipes.
+        # Bound the reap: an unkillable child (e.g. stuck in uninterruptible sleep)
+        # must not stall the request path — log a coarse event and keep going.
+        try:
+            await asyncio.wait_for(proc.communicate(), timeout=5)
+        except asyncio.TimeoutError:
+            log.warning("event=codex_login_status_reap_timeout timeout_s=5")
+        except Exception:
+            pass
+        return
+    log.info("event=codex_login_status rc=%s", proc.returncode)
+
+
+async def delegated_refresh(rejected_token=None):
+    # INTENT: the single delegated-refresh primitive. Serialize (single-flight),
+    #   invoke the codex CLI to refresh, then re-read auth.json and judge validity by
+    #   the JWT `exp` — returning a currently-valid access_token or raising
+    #   RuntimeError(_RELOGIN_MSG). Success/failure is determined ONLY by the re-read
+    #   result, never by the subprocess's exit code or output (A1-R3).
+    # REASONING: the asyncio.Lock makes concurrent callers single-flight — the first
+    #   waiter refreshes; the rest, after acquiring the lock, adopt the now-fresh
+    #   in-memory token WITHOUT re-invoking codex (the short-circuit below).
+    # rejected_token: on the reactive (401) path this is the token the backend just
+    #   rejected. A token that merely LOOKS exp-valid but EQUALS rejected_token must
+    #   NOT short-circuit the codex invocation — the server has already rejected it,
+    #   so its exp margin cannot vouch for it. On the proactive path it is None.
+    # CREDENTIAL SAFETY: token values live in memory / auth.json only; never logged.
+    async with _token_refresh_lock:
+        now = time.time()
+        # Single-flight short-circuit: a concurrent waiter may have already refreshed
+        # to a comfortably-valid token. Adopt it without re-invoking codex — unless it
+        # is the very token we were told the backend rejected.
+        cached = _token_state["access_token"]
+        cached_exp = _token_state["exp"]
+        if (cached and cached_exp is not None
+                and cached_exp - now > _TOKEN_REFRESH_MARGIN_S
+                and (rejected_token is None or cached != rejected_token)):
+            return cached
 
+        # Delegate the refresh to codex (the single writer). Diagnostic only.
+        await _run_codex_login_status()
 
-async def _refresh_tokens(current):
-    # INTENT: exchange the current refresh_token for a fresh token set, persist the
-    #   rotated tokens atomically, and update in-memory state. Returns the new
-    #   access_token.
-    # REASONING: POST _OAUTH_TOKEN_URL with client_id + grant_type=refresh_token +
-    #   the current refresh_token. On HTTP 200 the response carries a ROTATED
-    #   refresh_token (notes/10) plus new access_token/id_token; we MUST persist the
-    #   rotation or a later reuse of the consumed refresh_token triggers a permanent
-    #   refresh_token_reused lockout (notes/09 B). Deserialize LENIENTLY — the live
-    #   response also carries undocumented fields (earliest_refresh_at, oai_is) that
-    #   we tolerate/ignore (notes/10). We do NOT honor earliest_refresh_at for
-    #   scheduling; the shim keys refresh decisions on the live JWT `exp` claim.
-    # FAST-FAIL: a non-200, or a 200 missing access_token, is a permanent failure
-    #   for this session — raise RuntimeError(_RELOGIN_MSG). We do NOT spin.
-    # CREDENTIAL SAFETY: the refresh_token/access_token/id_token are handled
-    #   in-memory and written into auth.json only; never logged. The request body
-    #   contains the refresh_token — httpx does not log bodies, and we never print it.
-    tokens = current.get("tokens") or {}
-    refresh_token = tokens.get("refresh_token")
-    if not refresh_token:
-        raise RuntimeError("auth.json has no refresh_token; " + _RELOGIN_MSG)
-    payload = {
-        "client_id": _OAUTH_CLIENT_ID,
-        "grant_type": "refresh_token",
-        "refresh_token": refresh_token,
-    }
-    try:
-        # TIMEOUT: this single OAuth POST gets a DEDICATED short timeout, NOT the
-        #   shared _client's 600s read window.
-        # REASONING: _refresh_tokens runs inside _token_refresh_lock; a hung
-        #   auth.openai.com would otherwise hold that lock for up to 600s and stall
-        #   every concurrent chatgpt-lane request behind it. The OAuth token
-        #   endpoint is a fast, small JSON exchange — 10s connect / 30s read is
-        #   generous for it while capping the worst-case lock hold. On timeout httpx
-        #   raises httpx.HTTPError (TimeoutException is a subclass), which the
-        #   existing except-clause converts to a clean RuntimeError(_RELOGIN_MSG),
-        #   releasing the lock via the `async with` in _get_access_token.
-        r = await _client.post(_OAUTH_TOKEN_URL, json=payload,
-                               headers={"Content-Type": "application/json"},
-                               timeout=httpx.Timeout(30.0, connect=10.0))
-    except httpx.HTTPError as e:
-        # A transport error is not necessarily permanent, but we do not retry-spin
-        # a refresh (rare path); surface it as a clean failure for this attempt.
-        raise RuntimeError("token refresh transport error (%s); %s"
-                           % (type(e).__name__, _RELOGIN_MSG))
-    if r.status_code != 200:
-        # Permanent: refresh_token_reused, invalid_grant, etc. Do NOT log the body
-        # (may echo token fragments); log only the status.
-        log.error("token refresh failed status=%d (permanent); %s",
-                  r.status_code, _RELOGIN_MSG)
-        raise RuntimeError(_RELOGIN_MSG)
-    try:
-        resp = r.json()
-    except ValueError:
-        raise RuntimeError("token refresh returned non-JSON; " + _RELOGIN_MSG)
-    new_access = resp.get("access_token")
-    new_refresh = resp.get("refresh_token")   # ROTATED — differs from the input
-    new_id = resp.get("id_token")
-    if not new_access:
-        raise RuntimeError("token refresh response missing access_token; " + _RELOGIN_MSG)
-
-    # Build the new auth.json preserving the fields codex owns, updating only the
-    # rotated tokens + last_refresh. Lenient: unknown response fields are ignored.
-    new_data = dict(current)  # shallow copy preserves OPENAI_API_KEY/auth_mode/etc.
-    new_tokens = dict(tokens)  # preserves tokens.account_id (not returned by refresh)
-    new_tokens["access_token"] = new_access
-    if new_refresh:
-        new_tokens["refresh_token"] = new_refresh
-    if new_id:
-        new_tokens["id_token"] = new_id
-    new_data["tokens"] = new_tokens
-    new_data["last_refresh"] = _codex_last_refresh_now()
-    _atomic_write_auth_json(new_data)
-
-    _token_state["access_token"] = new_access
-    _token_state["exp"] = _jwt_exp(new_access)
-    # SAFETY: log ONLY the fact of a refresh and the new expiry (a unix ts / ISO is
-    # NOT a secret); never the token itself.
-    log.info("chatgpt token refreshed (new exp=%s)", _token_state["exp"])
-    return new_access
-
-
-async def _await_refresh_commit(current):
-    # INTENT: supervise one rotating-token refresh from POST launch through atomic
-    # persistence and in-memory update, regardless of request disconnect/cancellation.
-    # REASONING: the OAuth server may consume the old refresh token before the response
-    # arrives. Cancelling at that point could strand auth.json permanently stale. The
-    # token-lock holder therefore creates one explicit task and awaits it to settlement
-    # with _settle_owned_task; request cancellation is remembered and propagated only
-    # after response validation, rotated-token extraction, atomic replace, and state
-    # update finish. A failed exchange is retained as a bounded process-lifetime
-    # failure so no waiter can retry a refresh token that might already be consumed.
-    # CREDENTIAL SAFETY: supervision stores only the task and a generic exception;
-    # token values remain solely inside _refresh_tokens/auth.json and are never logged.
-    global _refresh_commit_task, _refresh_commit_failure
-
-    if _refresh_commit_failure is not None:
+        # Authoritative outcome: re-read auth.json and judge validity from the JWT
+        # exp. A missing/unreadable/malformed store raises RuntimeError(_RELOGIN_MSG).
+        current = _read_auth_json()
+        disk_access = (current.get("tokens") or {}).get("access_token")
+        disk_exp = _jwt_exp(disk_access)
+        if disk_access and disk_exp is not None and disk_exp - now > _TOKEN_REFRESH_MARGIN_S:
+            _token_state["access_token"] = disk_access
+            _token_state["exp"] = disk_exp
+            log.info("chatgpt token refreshed via codex (new exp=%s)", disk_exp)
+            return disk_access
+        # Still invalid/absent after delegation -> actionable failure (A1-R5).
         raise RuntimeError(_RELOGIN_MSG)
-    if _refresh_commit_task is not None:
-        # _get_access_token owns _token_refresh_lock across this call, so a second live
-        # task would mean lock ownership was violated rather than useful deduplication.
-        raise RuntimeError("token refresh commit ownership conflict; " + _RELOGIN_MSG)
-
-    refresh_task = asyncio.create_task(_refresh_tokens(current))
-    _refresh_commit_task = refresh_task
-    kind, outcome, owner_cancellation = await _settle_owned_task(refresh_task)
-    _refresh_commit_task = None
-
-    if kind == "exception":
-        _refresh_commit_failure = outcome
-    elif kind == "cancelled":
-        _refresh_commit_failure = RuntimeError(_RELOGIN_MSG)
-
-    # Cancellation remains cancellation even when the commit itself failed. The task
-    # outcome has already been retrieved and the bounded failure remains for waiters.
-    if owner_cancellation is not None:
-        raise owner_cancellation
-    if kind == "result":
-        return outcome
-    if kind == "exception":
-        raise outcome
-    raise asyncio.CancelledError
 
 
 async def _get_access_token(force_refresh=False, rejected_token=None):
     # INTENT: return a currently-valid access_token for the chatgpt-lane Bearer.
-    #   Refresh (guarded reload -> POST -> rotate -> atomic persist) only when the
-    #   token is within _TOKEN_REFRESH_MARGIN_S of exp, OR when force_refresh is set
-    #   (the lazy-401 path forces one refresh regardless of exp).
-    # REASONING (read-mostly): the common path reads auth.json (or the cached
-    #   in-memory token), checks exp, and returns the Bearer with NO network call —
-    #   the ~10-day TTL means this is the path ~always taken. Only near-expiry or a
-    #   401 triggers the refresh branch, which is serialized by _token_refresh_lock.
-    # GUARDED RELOAD-BEFORE-REFRESH (notes/09 B2, codex manager.rs:2388): inside the
-    #   lock we re-read auth.json; if another writer (codex CLI/plugin) already
-    #   rotated the on-disk token, adopt it and SKIP our own refresh — this avoids
-    #   consuming (and rotating away) a refresh_token another process just replaced.
-    #   The comparison differs by path (see below): the proactive path keys on exp
-    #   margin; the lazy-401 path keys on TOKEN IDENTITY vs. the rejected token,
-    #   because a 401'd token can still be far from its nominal exp (it was rejected
-    #   server-side, so exp margin cannot decide whether a refresh is needed).
+    #   The common path is a pure READ (no subprocess): the ~10-day TTL means the
+    #   token is almost always comfortably valid. A refresh — DELEGATED to the codex
+    #   CLI — happens only proactively (token within _TOKEN_REFRESH_MARGIN_S of exp)
+    #   or reactively (force_refresh, the lazy-401 path).
+    # REASONING: the proactive path checks the cached token, then the authoritative
+    #   on-disk token; only if that is missing or near-expiry does it delegate. The
+    #   reactive path always delegates (passing the rejected token) because a 401'd
+    #   token can still be far from its nominal exp — exp margin cannot decide.
     # CREDENTIAL SAFETY: token values live in memory / auth.json only; never logged.
     now = time.time()
 
-    # Fast path (no lock): a cached in-memory token that is comfortably valid and no
-    # forced refresh -> return it directly.
+    # Fast path (no lock, no subprocess): a cached in-memory token that is comfortably
+    # valid and no forced refresh -> return it directly.
     if not force_refresh:
         cached = _token_state["access_token"]
         cached_exp = _token_state["exp"]
         if cached and cached_exp is not None and cached_exp - now > _TOKEN_REFRESH_MARGIN_S:
             return cached
 
-    async with _token_refresh_lock:
-        # Re-read from disk under the lock (this IS the guarded reload). This picks
-        # up any external writer's refresh and is the authoritative current state.
-        current = _read_auth_json()
-        disk_access = (current.get("tokens") or {}).get("access_token")
-        disk_exp = _jwt_exp(disk_access)
-
-        # Adopt the on-disk token into memory (it is at least as fresh as ours).
-        if disk_access:
-            _token_state["access_token"] = disk_access
-            _token_state["exp"] = disk_exp
-
-        if force_refresh:
-            # Lazy-401 path. Guarded reload by TOKEN IDENTITY (not exp margin): if the
-            # on-disk token DIFFERS from the token the backend just rejected, another
-            # writer already rotated it — adopt it and skip our refresh, retrying with
-            # the fresh on-disk token first. If the on-disk token is the SAME one that
-            # got 401'd (the common single-writer case), we MUST refresh — its exp
-            # margin is irrelevant because the server has already rejected it.
-            if (disk_access and rejected_token is not None
-                    and disk_access != rejected_token):
-                log.info("chatgpt 401 refresh skipped: on-disk token rotated by another writer (guarded reload)")
-                return disk_access
-            return await _await_refresh_commit(current)
-
-        # Proactive path: refresh only if the (authoritative on-disk) token is
-        # missing or within the safety margin of exp.
-        if disk_access and disk_exp is not None and disk_exp - now > _TOKEN_REFRESH_MARGIN_S:
-            # Guarded reload already adopted a fresh on-disk token — no refresh.
-            return disk_access
-        return await _await_refresh_commit(current)
+    if force_refresh:
+        # Reactive (lazy-401): delegate unconditionally, passing the rejected token so
+        # the single-flight short-circuit cannot hand back the just-rejected token.
+        return await delegated_refresh(rejected_token=rejected_token)
+
+    # Proactive: re-read the authoritative on-disk token (cheap). If it is present and
+    # comfortably valid, adopt and return it with no subprocess. Otherwise delegate.
+    # A missing/unreadable store raises RuntimeError(_RELOGIN_MSG) (A1-R5).
+    current = _read_auth_json()
+    disk_access = (current.get("tokens") or {}).get("access_token")
+    disk_exp = _jwt_exp(disk_access)
+    if disk_access:
+        _token_state["access_token"] = disk_access
+        _token_state["exp"] = disk_exp
+    if disk_access and disk_exp is not None and disk_exp - now > _TOKEN_REFRESH_MARGIN_S:
+        return disk_access
+    return await delegated_refresh()
 
 
 # --- Helpers: request translation (Anthropic -> OpenAI Responses) ---
@@ -1971,135 +3181,304 @@ def _system_to_text(system):
     return "\n".join(p for p in parts if p)
 
 
-def _flatten_tool_result_content(tr_content):
-    # tool_result content may be a string OR an array of blocks. Flatten to text.
-    # INTENT: the Responses `function_call_output.output` field is a plain string,
-    #   so we reduce the Anthropic tool_result content to text (same flattening
-    #   the chat lane used, preserved verbatim for behavioral continuity).
-    if isinstance(tr_content, list):
-        flat = []
-        for sub in tr_content:
-            if isinstance(sub, dict) and sub.get("type") == "text":
-                flat.append(sub.get("text", ""))
-            elif isinstance(sub, str):
-                flat.append(sub)
-        return "\n".join(flat)
+_IMAGE_MEDIA_TYPES = frozenset({
+    "image/jpeg", "image/png", "image/gif", "image/webp",
+})
+_BASE64_IMAGE_RE = re.compile(
+    r"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?\Z"
+)
+_CONTENT_LABEL_RE = re.compile(r"[^A-Za-z0-9_.-]+")
+
+
+def _content_label(value):
+    # Content errors may identify only structural coordinates and type labels. Keep
+    # arbitrary request text, URLs, file IDs, and image bytes structurally unreachable.
+    if not isinstance(value, str) or not value:
+        return "unknown"
+    return _CONTENT_LABEL_RE.sub("_", value)[:40] or "unknown"
+
+
+def _content_error(message_index, block_index, role, block_type, reason):
+    return _InvalidRequestError(
+        "message %d block %s role %s type %s: %s" % (
+            message_index, block_index, _content_label(role),
+            _content_label(block_type), reason,
+        )
+    )
+
+
+def _image_to_responses_part(block, message_index, block_index, role):
+    # INTENT: translate visual bytes without inspecting, decoding, or logging them.
+    # REASONING: MIME prefixes come only from an exact allowlist; strict RFC-4648
+    #   syntax is checked with a bounded-character regex so validation never creates
+    #   a second decoded image copy. GIF is accepted syntactically; this stdlib-only
+    #   shim does not claim animated-GIF detection, so the later live lane smoke is
+    #   the release gate for each provider endpoint.
+    if role != "user":
+        raise _content_error(
+            message_index, block_index, role, "image",
+            "assistant/history images are unsupported",
+        )
+    source = block.get("source")
+    if not isinstance(source, dict):
+        raise _content_error(
+            message_index, block_index, role, "image", "invalid image source",
+        )
+    source_type = source.get("type")
+    if source_type == "base64":
+        media_type = source.get("media_type")
+        data = source.get("data")
+        if media_type not in _IMAGE_MEDIA_TYPES:
+            raise _content_error(
+                message_index, block_index, role, "image",
+                "unsupported image media type",
+            )
+        if (
+            not isinstance(data, str)
+            or not data
+            or len(data) % 4 != 0
+            or _BASE64_IMAGE_RE.fullmatch(data) is None
+        ):
+            raise _content_error(
+                message_index, block_index, role, "image", "invalid base64 image data",
+            )
+        return {
+            "type": "input_image",
+            "image_url": "data:%s;base64,%s" % (media_type, data),
+            "detail": "auto",
+        }
+    if source_type == "url":
+        url = source.get("url")
+        valid = isinstance(url, str) and bool(url) and not any(
+            char.isspace() or ord(char) < 0x20 or ord(char) == 0x7f
+            for char in url
+        ) and "\\" not in url
+        if valid:
+            try:
+                parsed = urllib.parse.urlsplit(url)
+                valid = (
+                    parsed.scheme.lower() in {"http", "https"}
+                    and bool(parsed.netloc)
+                    and bool(parsed.hostname)
+                    and parsed.username is None
+                    and parsed.password is None
+                )
+                if valid:
+                    parsed.port  # force invalid-port validation
+            except (TypeError, ValueError):
+                valid = False
+        if not valid:
+            raise _content_error(
+                message_index, block_index, role, "image", "invalid image URL",
+            )
+        return {"type": "input_image", "image_url": url, "detail": "auto"}
+    if source_type == "file":
+        raise _content_error(
+            message_index, block_index, role, "image",
+            "provider-scoped file image sources are unsupported",
+        )
+    raise _content_error(
+        message_index, block_index, role, "image", "unsupported image source type",
+    )
+
+
+def _tool_result_output(tr_content, message_index, block_index, role):
+    # Preserve the historical string output for text-only results. The Responses
+    # function-call output item-list form is used only when an image is present.
+    # Other container/scalar types are malformed Anthropic history, not values to
+    # serialize opportunistically into a backend function-call output.
     if isinstance(tr_content, str):
         return tr_content
-    return json.dumps(tr_content)
+    if not isinstance(tr_content, list):
+        raise _content_error(
+            message_index, block_index, role, "tool_result",
+            "content must be a string or list (got %s)" % _content_label(
+                type(tr_content).__name__
+            ),
+        )
+    parts = []
+    flat_text = []
+    saw_image = False
+    for sub_index, sub in enumerate(tr_content):
+        nested_index = "%d.%d" % (block_index, sub_index)
+        if isinstance(sub, str):
+            text = sub
+            parts.append({"type": "input_text", "text": text})
+            flat_text.append(text)
+            continue
+        if not isinstance(sub, dict):
+            raise _content_error(
+                message_index, nested_index, role, "non_object",
+                "unsupported tool-result content block",
+            )
+        sub_type = sub.get("type")
+        if sub_type == "text":
+            text = sub.get("text", "")
+            if not isinstance(text, str):
+                raise _content_error(
+                    message_index, nested_index, role, "text", "invalid text block",
+                )
+            parts.append({"type": "input_text", "text": text})
+            flat_text.append(text)
+        elif sub_type == "image":
+            saw_image = True
+            parts.append(_image_to_responses_part(
+                sub, message_index, nested_index, role,
+            ))
+        else:
+            raise _content_error(
+                message_index, nested_index, role, sub_type,
+                "unsupported tool-result content block",
+            )
+    return parts if saw_image else "\n".join(flat_text)
 
 
 def _messages_to_input(messages):
-    # Translate Anthropic messages[] into a Responses `input[]` array, threading
-    # cached reasoning items in before the function_calls they justify.
-    #
-    # INTENT: produce the ordered list of Responses input items:
-    #   * user text          -> {"role":"user","content":[{"type":"input_text",...}]}
-    #   * assistant text      -> {"type":"message","role":"assistant",
-    #                             "content":[{"type":"output_text",...}]}
-    #   * assistant tool_use  -> [cached reasoning item?] then
-    #                             {"type":"function_call","call_id","name","arguments"}
-    #   * user tool_result    -> {"type":"function_call_output","call_id","output"}
-    # REASONING: assistant history content parts MUST be `output_text`, NOT
-    #   `input_text` — the Responses API rejects input_text on resent assistant
-    #   messages (spec file 04 §1 "Important deprecation"). Reasoning items are
-    #   injected from the cache (see _REASONING_CACHE) immediately before their
-    #   paired function_call so gpt-5.x's required-reasoning-item invariant holds
-    #   on stateless replay.
-    # ASSUMES: image/thinking/other unknown blocks are ignored gracefully (chat-
-    #   lane behavior preserved). Thinking blocks that Claude Code resends from
-    #   OUR own thinking emission are DROPPED here — the reasoning cache, not
-    #   resent thinking text, is the continuity mechanism.
+    # Translate in source order. User text/images remain adjacent content parts;
+    # assistant tool replay keeps reasoning-cache injection immediately before calls.
     input_items = []
-    injected_reasoning_ids = set()  # dedupe: a reasoning item shared by parallel
-                                    # calls is injected ONCE per request build.
-    missing_reasoning = 0           # count cache misses for the request log line.
-
-    for m in messages:
-        role = m.get("role", "user")
-        content = m.get("content", "")
-
-        # Plain string content -> a single message item for this role.
+    injected_reasoning_ids = set()
+    missing_reasoning = 0
+    # v1.3.4 (V4-R6): per-request reasoning-cache hits (parallel to missing_reasoning),
+    # surfaced on the terminal record and used to feed the process-cumulative /health
+    # counters via _bump_reasoning_hit_counters at each hit.
+    reasoning_cache_hits = 0
+    # v1.3.4 (V4-R1): track restored (disk-loaded) reasoning material injected this
+    # request. reasoning-item ids for the strip (R3), call_ids for the eviction (R4).
+    injected_restored_reasoning_ids = set()
+    injected_restored_call_ids = set()
+
+    for message_index, message in enumerate(messages):
+        role = message.get("role")
+        # v1.2.13: fold role:"system" messages to user-role input. Live Claude
+        # Code appends a system-role message to `messages`; pre-v1.2.12 code
+        # mapped every non-assistant role to user and that behavior is proven
+        # against the live Codex backend, so system reuses it verbatim rather
+        # than inventing untested native system/developer-role translation.
+        # ORDERING DEPENDENCY: the request-validation gauntlet checks RAW roles
+        # and pre-rejects system-role messages carrying tool_use/tool_result;
+        # this fold runs after it, so the post-fold tool checks below never see
+        # them. Callers must not invoke this translator without that gauntlet.
+        if role == "system":
+            role = "user"
+        if role not in ("user", "assistant"):
+            raise _InvalidRequestError(
+                "message %d role invalid: expected user or assistant" % message_index
+            )
+        content = message.get("content", "")
         if isinstance(content, str):
-            if role == "assistant":
-                input_items.append({
-                    "type": "message", "role": "assistant",
-                    "content": [{"type": "output_text", "text": content}],
-                })
-            else:
-                input_items.append({
-                    "role": "user",
-                    "content": [{"type": "input_text", "text": content}],
-                })
+            input_items.append({
+                **({"type": "message"} if role == "assistant" else {}),
+                "role": "assistant" if role == "assistant" else "user",
+                "content": [{
+                    "type": "output_text" if role == "assistant" else "input_text",
+                    "text": content,
+                }],
+            })
             continue
 
-        text_parts = []
-        for block in content:
-            if not isinstance(block, dict):
-                continue
-            btype = block.get("type")
-
-            if btype == "text":
-                text_parts.append(block.get("text", ""))
-
-        # Emit the message item (text) for this turn FIRST, so text precedes the
-        # function_call items within an assistant turn (mirrors output order).
-        if text_parts:
-            joined = "\n".join(text_parts)
-            if role == "assistant":
-                input_items.append({
-                    "type": "message", "role": "assistant",
-                    "content": [{"type": "output_text", "text": joined}],
-                })
-            else:
-                input_items.append({
-                    "role": "user",
-                    "content": [{"type": "input_text", "text": joined}],
-                })
+        pending_parts = []
 
-        # Second pass over blocks for tool_use / tool_result (order-preserving).
-        for block in content:
+        def flush_message_parts():
+            if not pending_parts:
+                return
+            input_items.append({
+                **({"type": "message"} if role == "assistant" else {}),
+                "role": "assistant" if role == "assistant" else "user",
+                "content": list(pending_parts),
+            })
+            pending_parts.clear()
+
+        for block_index, block in enumerate(content):
             if not isinstance(block, dict):
+                raise _content_error(
+                    message_index, block_index, role, "non_object",
+                    "unsupported content block",
+                )
+            block_type = block.get("type")
+            if block_type == "text":
+                text = block.get("text", "")
+                if not isinstance(text, str):
+                    raise _content_error(
+                        message_index, block_index, role, "text", "invalid text block",
+                    )
+                pending_parts.append({
+                    "type": "output_text" if role == "assistant" else "input_text",
+                    "text": text,
+                })
+            elif block_type == "image":
+                pending_parts.append(_image_to_responses_part(
+                    block, message_index, block_index, role,
+                ))
+            elif block_type in {"thinking", "redacted_thinking"}:
+                # Known Claude continuity blocks are intentionally consumed rather
+                # than forwarded. Encrypted Responses reasoning cache entries, not
+                # replayed Anthropic thinking prose/signatures, preserve continuity.
                 continue
-            btype = block.get("type")
-
-            if btype == "tool_use":
+            elif block_type == "tool_use":
+                if role != "assistant":
+                    raise _content_error(
+                        message_index, block_index, role, "tool_use",
+                        "tool_use is permitted only in assistant messages",
+                    )
+                flush_message_parts()
                 call_id = block.get("id", "")
-                # REASONING-CACHE INJECTION: if we have a cached reasoning item
-                # for this call_id, insert it immediately BEFORE the function_call
-                # (unless an equivalent reasoning item — same id — was already
-                # injected for this request build; parallel calls share one).
                 cached = _REASONING_CACHE.get(call_id)
                 if cached is not None:
-                    rs_id = cached.get("id")
-                    if rs_id not in injected_reasoning_ids:
+                    # v1.3.4 (V4-R6/R7): count this hit for the terminal record (per-request)
+                    # and the /health restore-effectiveness counters (process-cumulative). The
+                    # hit above used .get() — never move_to_end — so counting stays read-only
+                    # and adds no LRU mutation / persist / write amplification. The restored
+                    # flag reads the SAME membership V4-R1's tracking below keys off; the set
+                    # is not mutated within this translation, so the two reads agree.
+                    reasoning_cache_hits += 1
+                    _bump_reasoning_hit_counters(call_id in _REASONING_CACHE_RESTORED_IDS)
+                    reasoning_id = cached.get("id")
+                    if reasoning_id not in injected_reasoning_ids:
                         input_items.append(cached)
-                        injected_reasoning_ids.add(rs_id)
+                        injected_reasoning_ids.add(reasoning_id)
+                    # v1.3.4 (V4-R1): if this call_id's blob came from disk, record its
+                    # reasoning-item id (for the strip) and call_id (for the eviction). The
+                    # reasoning item is guaranteed present in input_items here — appended by
+                    # this hit or an earlier one sharing the same id — so recording its id
+                    # for a possible strip is always valid. reasoning_id must be truthy so a
+                    # malformed id-less item cannot broaden the strip to every id-less item.
+                    if reasoning_id and call_id in _REASONING_CACHE_RESTORED_IDS:
+                        injected_restored_reasoning_ids.add(reasoning_id)
+                        injected_restored_call_ids.add(call_id)
                 else:
-                    # Cache miss (e.g. shim restarted mid-session, or unknown
-                    # call_id). Omit the reasoning item and proceed — do NOT fail
-                    # the request. Live testing will establish whether the API
-                    # hard-rejects; the documented risk is the community-reported
-                    # "function_call was provided without its required 'reasoning'
-                    # item" error.
                     missing_reasoning += 1
                 input_items.append({
                     "type": "function_call",
                     "call_id": call_id,
                     "name": block.get("name", ""),
-                    # arguments is a JSON *string*, not an object.
                     "arguments": json.dumps(block.get("input", {})),
                 })
-
-            elif btype == "tool_result":
+            elif block_type == "tool_result":
+                if role != "user":
+                    raise _content_error(
+                        message_index, block_index, role, "tool_result",
+                        "tool_result is permitted only in user messages",
+                    )
+                flush_message_parts()
                 input_items.append({
                     "type": "function_call_output",
                     "call_id": block.get("tool_use_id", ""),
-                    "output": _flatten_tool_result_content(block.get("content", "")),
+                    "output": _tool_result_output(
+                        block.get("content", ""), message_index, block_index, role,
+                    ),
                 })
-            # Unknown block types (image, thinking) are ignored gracefully.
+            else:
+                raise _content_error(
+                    message_index, block_index, role, block_type,
+                    "unsupported content block",
+                )
+        flush_message_parts()
 
-    return input_items, missing_reasoning
+    return (
+        input_items, missing_reasoning, reasoning_cache_hits,
+        injected_restored_reasoning_ids, injected_restored_call_ids,
+    )
 
 
 def _tools_to_responses(tools):
@@ -2127,14 +3506,22 @@ def _tools_to_responses(tools):
     return out
 
 
-def _anthropic_to_responses_request(body, bare_model, slug_effort_raw):
+def _anthropic_to_responses_request(
+        body, bare_model, slug_effort_raw, requested_service_tier=None):
     # Build the OpenAI Responses payload from an Anthropic Messages body.
-    # Returns (payload, missing_reasoning_count, effort_value, effort_source).
+    # Returns (payload, missing_reasoning_count, reasoning_cache_hits, effort_value,
+    #   effort_source, injected_restored_reasoning_ids, injected_restored_call_ids).
+    #   v1.3.4 (V4-R1): the two restored-id sets are plumbed to the request state so the
+    #   retry loops' stale-blob 400 insurance can strip/evict exactly the disk-restored
+    #   blobs. v1.3.4 (V4-R6): reasoning_cache_hits is the per-request cache-hit count for
+    #   the terminal record (parallel to missing_reasoning).
     # v1.2.2: `bare_model` is the inbound model with any "#<effort>" suffix already
     # stripped (by _split_effort_suffix in the caller); `slug_effort_raw` is that
     # stripped suffix's raw token (tier 2). The suffix-free model is what reaches
     # the backend — a "#"-bearing model is never forwarded.
-    input_items, missing_reasoning = _messages_to_input(body.get("messages", []))
+    input_items, missing_reasoning, reasoning_cache_hits, \
+        injected_restored_reasoning_ids, injected_restored_call_ids = \
+        _messages_to_input(body.get("messages", []))
 
     payload = {
         "model": _map_model(bare_model),
@@ -2148,6 +3535,11 @@ def _anthropic_to_responses_request(body, bare_model, slug_effort_raw):
         # be re-injected (the API 404s on a bare reasoning id when store:false).
         "include": ["reasoning.encrypted_content"],
     }
+    # Only the locally validated Fast/Priority path supplies the canonical wire value.
+    # Ordinary requests and every noncanonical value omit the field; retries reuse this
+    # same payload and never downgrade it. In particular DAAF never emits raw `fast`.
+    if requested_service_tier == "priority":
+        payload["service_tier"] = "priority"
 
     # system -> top-level `instructions` (NOT a system message in input[]).
     system_text = _system_to_text(body.get("system"))
@@ -2234,7 +3626,10 @@ def _anthropic_to_responses_request(body, bare_model, slug_effort_raw):
     # and any unknown fields are intentionally dropped — output_config is an
     # Anthropic-inbound-only signal (its effort was consumed into reasoning.effort
     # above) and MUST NOT be forwarded to OpenAI.
-    return payload, missing_reasoning, effort_value, effort_source
+    return (
+        payload, missing_reasoning, reasoning_cache_hits, effort_value, effort_source,
+        injected_restored_reasoning_ids, injected_restored_call_ids,
+    )
 
 
 # --- Helpers: response translation (OpenAI Responses -> Anthropic) ---
@@ -2294,7 +3689,14 @@ def _validate_terminal_response(event_type, response):
     status = response.get("status")
     if not isinstance(status, str) or status != expected_status:
         raise _ProtocolError("backend terminal event/status mismatch")
-    if "output" in response and not isinstance(response["output"], list):
+    if (
+        "output" in response
+        and response["output"] is not None
+        and not isinstance(response["output"], list)
+    ):
+        # v1.2.14 (R3.3): `output: null` is a captured Codex quirk on a completed
+        # response after a tool turn. Tolerate it here (streamed/collected state is
+        # the fallback source); only a non-null, non-list output is a real violation.
         raise _ProtocolError("backend terminal response output is not a list")
     if "usage" in response:
         usage = response["usage"]
@@ -2415,6 +3817,11 @@ def _validate_stream_event_fields(event):
         _require_protocol_string(
             event.get("delta"), "function argument delta", allow_empty=True
         )
+        # v1.2.14 (R1): only item_id/delta are load-bearing here. Known-but-unmodeled
+        # extra fields (e.g. the live `obfuscation` string the Codex backend attaches
+        # to arguments.delta) are tolerated by design — validated-when-present is not
+        # required, and they are deliberately NOT counted as unknown wire (too noisy
+        # to flag a benign per-delta field).
     elif event_type == "response.function_call_arguments.done":
         _require_protocol_string(event.get("item_id"), "function item id")
         # v1.2.8 wire tolerance: the public API documents name/arguments on this
@@ -2425,8 +3832,7 @@ def _validate_stream_event_fields(event):
         if "name" in event:
             _require_protocol_string(event.get("name"), "function name")
         else:
-            log.warning("wire-divergence: arguments.done missing name (item %s)",
-                        _scrub_log_token(event.get("item_id")))
+            _record_wire_divergence("arguments.done_missing_name")
         if "arguments" in event:
             _require_protocol_string(
                 event.get("arguments"), "function arguments", allow_empty=True
@@ -2639,10 +4045,34 @@ def _diag_headers(headers):
         val = headers.get(name)
         if val is not None:
             parts.append(f"{name}={_sanitize_sensitive_text(val)}")
+    # v1.2.14 (D1): also surface any prefix-allowlisted header (e.g. x-codex-*). Iterate
+    # actual headers only for the prefix rule so the exact-match ordering above is
+    # unchanged; skip a name already emitted by the exact loop so it is never doubled.
+    for name, val in headers.items():
+        lname = name.lower()
+        if val is None or lname in DIAG_HEADER_ALLOWLIST:
+            continue
+        if lname.startswith(DIAG_HEADER_PREFIX_ALLOWLIST):
+            parts.append(f"{lname}={_sanitize_sensitive_text(val)}")
     return " ".join(parts) if parts else "(none)"
 
 
-# --- HARDENING: retry helper (UNCHANGED) ---
+# --- HARDENING: retry helper ---
+
+
+def _transport_failure_phase(error, post_stream_start=False):
+    if post_stream_start:
+        return "post_stream_start_body_read"
+    if isinstance(error, (httpx.ConnectTimeout, httpx.ConnectError)):
+        return "connect"
+    if isinstance(error, httpx.PoolTimeout):
+        return "connection_pool_wait"
+    if isinstance(error, (httpx.WriteTimeout, httpx.WriteError)):
+        return "request_body_write"
+    if isinstance(error, (httpx.ReadTimeout, httpx.ReadError)):
+        return "header_wait_or_body_read"
+    return "connect_or_header_wait"
+
 
 async def _discard_httpx_response(response):
     """Close a successful buffered POST result discarded by outer cancellation."""
@@ -2666,6 +4096,218 @@ def _retry_delay(attempt, retry_after):
     return random.uniform(0, base)
 
 
+def _parse_rate_limit_delay_seconds(message_text):
+    # v1.2.14 (R4): extract the numeric "try again in <n>" hint from a backend
+    # rate-limit message. Returns float seconds or None. The prose is inspected
+    # locally ONLY and is never logged, reflected, or persisted.
+    if not isinstance(message_text, str) or not message_text:
+        return None
+    match = _RATE_LIMIT_DELAY_RE.search(message_text)
+    if not match:
+        return None
+    try:
+        value = float(match.group(1))
+    except (ValueError, TypeError):
+        return None
+    if value < 0:
+        return None
+    return value / 1000.0 if match.group(2).lower() == "ms" else value
+
+
+def _numeric_retry_after_seconds(retry_after):
+    # Parse a Retry-After header value as non-negative seconds, else None (an
+    # HTTP-date form is intentionally treated as absent -> fall through to backoff).
+    if retry_after is None:
+        return None
+    try:
+        value = float(retry_after)
+    except (ValueError, TypeError):
+        return None
+    return value if value >= 0 else None
+
+
+def _retry_signals_from_body(raw_body):
+    # v1.2.14 (R4): classify a backend error body for retry gating. Returns
+    # (backend_code, backend_type, code_norm, message_text, signal_recognized).
+    # message_text is retained ONLY for the internal rate-limit delay regex.
+    try:
+        payload = json.loads(raw_body) if raw_body else {}
+    except (ValueError, TypeError, UnicodeDecodeError):
+        payload = {}
+    backend_type, backend_code, _recognized, _param = _backend_error_fields(payload)
+    code_norm = backend_code.strip().lower() if backend_code != "-" else ""
+    type_norm = backend_type.strip().lower() if backend_type != "-" else ""
+    root = payload if isinstance(payload, dict) else {}
+    nested = root.get("error") if isinstance(root.get("error"), dict) else root
+    message = nested.get("message") if isinstance(nested, dict) else None
+    message_text = message if isinstance(message, str) else ""
+    signal_recognized = bool(
+        (code_norm and code_norm in _BACKEND_SIGNAL_CLASSIFICATION)
+        or (type_norm and type_norm in _BACKEND_SIGNAL_CLASSIFICATION)
+    )
+    return backend_code, backend_type, code_norm, message_text, signal_recognized
+
+
+def _plan_retry(status, retry_after_header, raw_body, attempt):
+    # v1.2.14 (R4): classification-driven retry decision + delay selection for one
+    # non-2xx attempt. Returns (should_retry, delay_seconds, delay_source).
+    # INTENT: retry iff the classifier marks the failure retryable when a recognized
+    #   backend code/type is present; otherwise reproduce today's bare-status behavior
+    #   (RETRY_STATUSES, plus 408 as standard-retryable). A recognized deterministic
+    #   code OVERRIDES the status (e.g. insufficient_quota-coded 429 fails fast).
+    # REASONING: delay precedence per attempt is (1) parsed rate-limit message hint
+    #   (gated on code rate_limit_exceeded), (2) Retry-After header, (3) local backoff.
+    #   Rate-limit-class delays cap at 60s; a parsed/advertised delay beyond the cap
+    #   fails fast (should_retry False) so the client owns the long wait rather than a
+    #   silent shim stall. Non-rate-limit classes keep the 30s clamp.
+    # ASSUMES: caller has already handled the chatgpt lazy-401 path; message prose is
+    #   never logged (only its parsed number is used).
+    backend_code, backend_type, code_norm, message_text, signal_recognized = \
+        _retry_signals_from_body(raw_body)
+    anthropic_type, _client_message, retryable = _classify_backend_error(
+        status, backend_code, backend_type)
+    if signal_recognized:
+        should_retry = retryable
+    else:
+        # 408 is standard-retryable (retries up to MAX_RETRIES) — the once-only
+        # special case in the design was judged not worth its bookkeeping.
+        should_retry = (status in RETRY_STATUSES) or (status == 408)
+    if not should_retry or attempt >= MAX_RETRIES:
+        return False, 0.0, "-"
+    is_rate_limit_class = (anthropic_type == "rate_limit_error")
+    delay = None
+    source = "backoff"
+    if code_norm == "rate_limit_exceeded":
+        parsed = _parse_rate_limit_delay_seconds(message_text)
+        if parsed is not None:
+            delay, source = parsed, "parsed"
+    if delay is None:
+        header_delay = _numeric_retry_after_seconds(retry_after_header)
+        if header_delay is not None:
+            delay, source = header_delay, "header"
+    if delay is None:
+        base = min(BACKOFF_BASE * (2 ** attempt), BACKOFF_CAP)
+        return True, random.uniform(0, base), "backoff"
+    cap = RATE_LIMIT_RETRY_AFTER_CAP if is_rate_limit_class else RETRY_AFTER_CAP
+    if delay > cap:
+        if is_rate_limit_class:
+            # Fail fast: do not sleep a multi-minute wait internally. Record the
+            # advertised source so the terminal record explains the fast-fail.
+            return False, 0.0, source
+        delay = cap
+    return True, delay, source
+
+
+def _record_retry_delay_source(source):
+    # v1.2.14 (R4): persist the selected delay source on the request record (both a
+    # taken retry and a fail-fast-beyond-cap set it; a plain non-retryable keeps "-").
+    if source == "-":
+        return
+    state = _request_state()
+    if state is not None:
+        state.retry_delay_source = source
+
+
+# v1.3.4 (V4-R2): markers a stale/rejected reasoning blob's error body may name.
+_STALE_REASONING_MARKERS = ("reasoning", "encrypted_content")
+
+
+def _error_body_names_reasoning(raw_body):
+    # V4-R2 condition 3: does this backend error body name reasoning material? The exact
+    # backend rejection shape for a stale/expired encrypted reasoning blob is unobserved and
+    # undocumented, so the probe is deliberately BROAD — a case-insensitive search for
+    # "reasoning" or "encrypted_content" across the normalized error fields (type/code/param/
+    # message, plus a Codex-style top-level `detail`). _backend_error_fields already collapses
+    # both lane envelopes ({error:{}} openai, {status,error:{}} chatgpt) plus flat-root and
+    # {detail:} into the same fields, so this works identically on every observed shape.
+    # Breadth is safe: the caller gates on status==400 AND >=1 restored reasoning item
+    # actually injected this request AND a one-shot budget, so a false positive costs at most
+    # one extra attempt in today's graceful-miss shape. Body prose is scanned in memory ONLY
+    # and never logged (counts-only discipline). Returns False on any parse failure so an
+    # unreadable body preserves today's fail-fast contract.
+    try:
+        payload = json.loads(raw_body) if raw_body else {}
+    except (ValueError, TypeError, UnicodeDecodeError):
+        return False
+    if not isinstance(payload, dict):
+        return False
+    backend_type, backend_code, _recognized, param = _backend_error_fields(payload)
+    nested = payload.get("error") if isinstance(payload.get("error"), dict) else payload
+    message = nested.get("message") if isinstance(nested, dict) else None
+    detail = payload.get("detail")
+    haystack = " ".join(
+        part for part in (backend_type, backend_code, param, message, detail)
+        if isinstance(part, str) and part != "-"
+    ).lower()
+    return any(marker in haystack for marker in _STALE_REASONING_MARKERS)
+
+
+def _maybe_strip_restored_reasoning(payload, status, raw_body):
+    # V4-R2/R3/R4 shared entrypoint for both retry loops, called in the non-2xx block AFTER
+    # _plan_retry has declined to retry. Returns True iff it stripped the injected restored
+    # reasoning items and prepared a one-shot retry (the caller then performs its loop-local
+    # cleanup + `continue`); False leaves 400 handling byte-identical to v1.3.3 (fail-fast).
+    #
+    # Gate (ALL must hold): (1) status == 400; (2) >=1 restored reasoning item was injected
+    # this request; (3) the strip-retry has not already fired this request (one-shot, same
+    # discipline as the lazy-401 refresh); (4) the error body names reasoning material. The
+    # body-parsing condition (4) is checked LAST — the cheap request-scoped gates short-
+    # circuit it for the overwhelming majority of 400s (which injected no restored items), so
+    # a generic 400 (e.g. the pinned observability fixtures) never even parses the body.
+    if status != 400:
+        return False
+    state = _request_state()
+    if state is None or state.stale_strip_used:
+        return False
+    target_reasoning_ids = state.injected_restored_reasoning_ids
+    if not target_reasoning_ids:
+        return False
+    if not _error_body_names_reasoning(raw_body):
+        return False
+    original = payload.get("input")
+    if not isinstance(original, list):
+        return False
+    # R3: remove exactly the injected restored reasoning items from the reused payload IN
+    # PLACE (both loops reuse one payload object across attempts, with no per-attempt
+    # rebuild), matching by recorded reasoning-item id — never by positional index.
+    kept = [
+        item for item in original
+        if not (
+            isinstance(item, dict)
+            and item.get("type") == "reasoning"
+            and item.get("id") in target_reasoning_ids
+        )
+    ]
+    stripped = len(original) - len(kept)
+    if stripped == 0:
+        # Nothing matched (already gone) — do not burn the one-shot or spend a retry on an
+        # unchanged payload; fall through to today's fail-fast.
+        return False
+    original[:] = kept  # slice-assign so the object identity each loop closes over is kept
+    # v1.3.4 (V4-R6): record the stripped count for the terminal record (counts only). +=
+    # rather than = so the (one-shot-gated) figure would still accumulate correctly if the
+    # strip contract ever allowed more than one strip per request.
+    state.reasoning_cache_stripped += stripped
+    # R4: the stripped call_ids are proven stale — evict them from the live cache, drop them
+    # from the restored set, and rewrite the persisted snapshot via the existing fail-open
+    # writer so neither this process nor a future restart re-injects and re-trips. Eviction
+    # is not the populate path, so the persist call is explicit here.
+    for call_id in state.injected_restored_call_ids:
+        _REASONING_CACHE.pop(call_id, None)
+        _REASONING_CACHE_RESTORED_IDS.discard(call_id)
+    _write_reasoning_cache_state()
+    # One-shot: this request may strip-and-retry exactly once.
+    state.stale_strip_used = True
+    # Terminal-record plumbing via the existing retry recorder (sets retry_reason=
+    # stale_reasoning_400 / retry_source=body, increments the retry count, emits the
+    # upstream_retry lifecycle event) — same convention as every other retry.
+    _record_retry("stale_reasoning_400", source="body")
+    # Distinct counts-only event. NEVER the stripped content or the backend error prose.
+    _lifecycle_event(
+        "reasoning_cache_stale_strip", _fields_before_elapsed=True, stripped=stripped)
+    return True
+
+
 async def _post_with_retry(url, headers, payload, disconnect_event):
     # HARDENING: non-streaming POST with bounded retry on transient errors.
     # Each potentially blocking POST/sleep races this response's disconnect event;
@@ -2692,6 +4334,9 @@ async def _post_with_retry(url, headers, payload, disconnect_event):
             raise
         except httpx.HTTPError as e:
             last_exc = e
+            _record_transport_failure(
+                e, _transport_failure_phase(e), attempt < MAX_RETRIES,
+            )
             if attempt < MAX_RETRIES:
                 delay = _retry_delay(attempt, None)
                 _record_retry("transport")
@@ -2703,20 +4348,38 @@ async def _post_with_retry(url, headers, payload, disconnect_event):
                                   phase="upstream_request")
             raise
         _record_upstream_headers(r)
-        if r.status_code in RETRY_STATUSES and attempt < MAX_RETRIES:
-            delay = _retry_delay(attempt, r.headers.get("retry-after"))
-            _record_retry("status_%d" % r.status_code)
-            # Retry diagnostics retain status, attempt, delay, and allowlisted headers
-            # only. Backend body prose is neither needed for retry policy nor safe to
-            # persist because it can reflect request-derived content.
-            log.warning(
-                "backend %d (attempt %d/%d), retrying in %.2fs | headers: %s",
-                r.status_code, attempt + 1, MAX_RETRIES + 1, delay,
-                _diag_headers(r.headers),
-            )
-            await r.aclose()
-            await _await_or_disconnect(asyncio.sleep(delay), disconnect_event)
-            continue
+        if r.status_code >= 400 and attempt < MAX_RETRIES:
+            # v1.2.14 (R4): classify the error body ONCE (for gating + delay source),
+            # then decide. r.content is already buffered (non-streaming POST); the
+            # prose is parsed in memory for structural signals and never logged.
+            should_retry, delay, delay_source = _plan_retry(
+                r.status_code, r.headers.get("retry-after"), r.content, attempt)
+            if should_retry:
+                _record_retry_delay_source(delay_source)
+                _record_retry("status_%d" % r.status_code)
+                # Retry diagnostics retain status, attempt, delay, delay-source, and
+                # allowlisted headers only. Backend body prose is neither needed for
+                # retry policy nor safe to persist (it can reflect request content).
+                log.warning(
+                    "backend %d (attempt %d/%d), retrying in %.2fs (source=%s) | headers: %s",
+                    r.status_code, attempt + 1, MAX_RETRIES + 1, delay,
+                    delay_source, _diag_headers(r.headers),
+                )
+                await r.aclose()
+                await _await_or_disconnect(asyncio.sleep(delay), disconnect_event)
+                continue
+            # Not retrying: a non-retryable code (e.g. insufficient_quota-coded 429),
+            # a bare status outside RETRY_STATUSES, or a rate-limit delay beyond cap
+            # (fail fast). Record the advertised source when the cap forced the choice.
+            _record_retry_delay_source(delay_source)
+            # v1.3.4 (V4-R2/R3/R4): stale-blob insurance. A 400 that names reasoning material
+            # AND carried >=1 restored (disk-loaded) reasoning item is the one case v1.3.3
+            # persistence can turn a graceful miss into a hard failure — strip exactly those
+            # items from the reused payload, evict+persist them as proven stale, and retry
+            # once. Every non-triggering 400 stays fail-fast (byte-identical to v1.3.3).
+            if _maybe_strip_restored_reasoning(payload, r.status_code, r.content):
+                await r.aclose()
+                continue
         return r, attempt
     # Unreachable in practice (loop returns or raises), but keeps intent explicit.
     if last_exc:
@@ -2762,6 +4425,22 @@ async def _settle_request_resources(state):
         except asyncio.CancelledError as cancellation:
             owner_cancellation = cancellation
 
+    # v1.2.14 (R6): the downstream heartbeat watchdog is normally stopped before the
+    # terminal frames; this is the request-teardown safety net for the paths that
+    # return without a terminal (mid-stream disconnect, early exit). Settled exactly
+    # like the disconnect watcher.
+    heartbeat = state.heartbeat_task
+    state.heartbeat_task = None
+    if heartbeat is not None:
+        kind, outcome, heartbeat_cancellation = await _settle_owned_task(
+            heartbeat, cancel=True)
+        if kind == "exception":
+            _record_cleanup_result(False, type(outcome).__name__)
+        else:
+            _record_cleanup_result(True)
+        if heartbeat_cancellation is not None:
+            owner_cancellation = heartbeat_cancellation
+
     watcher = state.disconnect_watcher
     state.disconnect_watcher = None
     if watcher is not None:
@@ -2820,6 +4499,9 @@ async def _open_backend_stream(url, headers, payload, disconnect_event):
             raise cancellation
         except httpx.HTTPError as e:
             await _settle_stream_context(stream_cm)
+            _record_transport_failure(
+                e, _transport_failure_phase(e), attempt < MAX_RETRIES,
+            )
             if attempt >= MAX_RETRIES:
                 _record_backend_error(
                     "api_error", backend_type=type(e).__name__,
@@ -2859,13 +4541,13 @@ async def _open_backend_stream(url, headers, payload, disconnect_event):
             # preserve the retry budget and reconnect before semantic content.
             continue
 
-        if resp.status_code in RETRY_STATUSES and attempt < MAX_RETRIES:
-            delay = _retry_delay(attempt, resp.headers.get("retry-after"))
-            _record_retry("status_%d" % resp.status_code)
+        if resp.status_code >= 400 and attempt < MAX_RETRIES:
+            # v1.2.14 (R4): read the error body ONCE for classification-driven gating
+            # and delay-source selection. The body is parsed in memory for structural
+            # signals only (never decoded into a log line). On disconnect the read is
+            # cancelled and the owned context is settled before propagating.
             try:
-                # Drain for connection-pool behavior, but never decode or retain the
-                # free-form backend body: it can reflect request-derived content.
-                await _await_or_disconnect(
+                raw_err = await _await_or_disconnect(
                     resp.aread(),
                     disconnect_event,
                 )
@@ -2873,20 +4555,48 @@ async def _open_backend_stream(url, headers, payload, disconnect_event):
                 await _settle_stream_context(stream_cm)
                 raise
             except Exception:
-                pass
-            await _settle_stream_context(stream_cm)
-            attempt += 1
-            retry_count = attempt
-            # Keep the structural diagnostic adjacent to the raced delay. The
-            # real-subprocess regression uses the line plus a bounded scheduler turn
-            # as evidence that the target phase is retry sleep, not header acquisition.
-            log.warning(
-                "backend stream %d (attempt %d/%d), retrying in %.2fs | headers: %s",
-                resp.status_code, attempt, MAX_RETRIES + 1, delay,
-                _diag_headers(resp.headers),
-            )
-            await _await_or_disconnect(asyncio.sleep(delay), disconnect_event)
-            continue
+                raw_err = b""
+            # v1.2.14 (F3): bound the body handed to the classifier at MAX_ERROR_BODY_BYTES
+            # (1 MiB). resp.aread() caches the full body on resp for the caller's error
+            # re-read (comment below), so this truncation caps only the structural
+            # retry-classification parse — a pathologically large error body cannot drive
+            # an unbounded json.loads/scan. Beyond-cap bodies parse-fail on the truncated
+            # bytes and fall back to HTTP-status classification (RETRY_STATUSES).
+            if len(raw_err) > MAX_ERROR_BODY_BYTES:
+                raw_err = raw_err[:MAX_ERROR_BODY_BYTES]
+            should_retry, delay, delay_source = _plan_retry(
+                resp.status_code, resp.headers.get("retry-after"), raw_err, attempt)
+            if should_retry:
+                _record_retry_delay_source(delay_source)
+                _record_retry("status_%d" % resp.status_code)
+                await _settle_stream_context(stream_cm)
+                attempt += 1
+                retry_count = attempt
+                # Keep the structural diagnostic adjacent to the raced delay. The
+                # real-subprocess regression uses the line plus a bounded scheduler
+                # turn as evidence that the phase is retry sleep, not header acquisition.
+                log.warning(
+                    "backend stream %d (attempt %d/%d), retrying in %.2fs (source=%s) | headers: %s",
+                    resp.status_code, attempt, MAX_RETRIES + 1, delay,
+                    delay_source, _diag_headers(resp.headers),
+                )
+                await _await_or_disconnect(asyncio.sleep(delay), disconnect_event)
+                continue
+            # Not retrying: fall through to return this final non-2xx response. Its
+            # body is already cached on resp, so the caller's error path re-reads it
+            # without a second network round-trip. Record the advertised delay source
+            # when a rate-limit cap forced the fail-fast.
+            _record_retry_delay_source(delay_source)
+            # v1.3.4 (V4-R2/R3/R4): stale-blob insurance, mirroring the JSON loop. A 400 that
+            # names reasoning material AND carried >=1 restored reasoning item strips those
+            # items from the reused payload, evicts+persists them as stale, and retries once.
+            # raw_err is the bounded, already-read error body. Every non-triggering 400 stays
+            # fail-fast (byte-identical to v1.3.3), settling and returning this response.
+            if _maybe_strip_restored_reasoning(payload, resp.status_code, raw_err):
+                await _settle_stream_context(stream_cm)
+                attempt += 1
+                retry_count = attempt
+                continue
 
         # Transfer ownership to the request lifecycle before this tuple is visible to
         # caller code. The outer ASGI finalizer can therefore settle the context even if
@@ -2898,6 +4608,104 @@ async def _open_backend_stream(url, headers, payload, disconnect_event):
     raise httpx.HTTPError("stream retry loop exhausted")
 
 
+# --- Prompt-cache observability helpers (v1.3.6, V6-R1/R3) ---
+
+def _resolve_cached_tokens(usage_obj, input_total):
+    # V6-R1/R3: extract usage.input_tokens_details.cached_tokens from a Responses usage
+    # object with defensive typing AND the R3 clamp guard. Returns the effective cached
+    # count (a non-negative int) or None. None means ABSENT — deliberately
+    # indistinguishable from "no cache info", which is exactly how old backends and
+    # fixtures emit it (they carry no input_tokens_details at all). Accept ONLY a non-bool
+    # int >= 0; absent/null/string/negative/bool all resolve to None. The OpenAI Responses
+    # `input_tokens` INCLUDES the cached prefix, so cached is a subset of that total; a
+    # value exceeding the reported input total is malformed upstream and is treated as
+    # absent (fail-open — never a negative client-visible input_tokens). Never raises:
+    # usage parsing must not turn an otherwise-good response into a failure.
+    if not isinstance(usage_obj, dict):
+        return None
+    details = usage_obj.get("input_tokens_details")
+    if not isinstance(details, dict):
+        return None
+    cached = details.get("cached_tokens")
+    if isinstance(cached, bool) or not isinstance(cached, int) or cached < 0:
+        return None
+    if isinstance(input_total, bool) or not isinstance(input_total, int):
+        return None
+    if cached > input_total:
+        return None
+    return cached
+
+
+def _actual_speed_from_response(response):
+    # Only a validated terminal upstream object calls this helper. Requested policy,
+    # HTTP success, and latency never establish served service. Capture ordering before
+    # parsing so a slower earlier terminal cannot overwrite a later terminal after it.
+    global _LATEST_TERMINAL, _LATEST_TERMINAL_SEQUENCE, _LATEST_TERMINAL_ORDER
+    with _LATEST_TERMINAL_LOCK:
+        _LATEST_TERMINAL_SEQUENCE += 1
+        terminal_order = _LATEST_TERMINAL_SEQUENCE
+    raw_tier = response.get("service_tier") if isinstance(response, dict) else None
+    canonical_served = (
+        raw_tier
+        if isinstance(raw_tier, str)
+        and raw_tier in (_FAST_ACTUAL_SERVICE_TIERS | _STANDARD_ACTUAL_SERVICE_TIERS)
+        else None
+    )
+    state = _request_state()
+    if state is not None and isinstance(raw_tier, str):
+        state.served_service_tier = _scrub_metadata(raw_tier, 100)
+    raw_model = response.get("model") if isinstance(response, dict) else None
+    if not isinstance(raw_model, str) or not _HEALTH_MODEL_TOKEN_RE.fullmatch(raw_model):
+        raw_model = None
+    requested_tier = None
+    requested_source = "none"
+    if state is not None:
+        if state.requested_service_tier in _FAST_REQUEST_SERVICE_TIERS.values():
+            requested_tier = state.requested_service_tier
+        if state.requested_service_tier_source in _FAST_REQUEST_SOURCES:
+            requested_source = state.requested_service_tier_source
+    latest = {
+        "model": raw_model,
+        "requested_service_tier": requested_tier,
+        "requested_source": requested_source,
+        "served_service_tier": canonical_served,
+        "completed_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+    }
+    with _LATEST_TERMINAL_LOCK:
+        if terminal_order > _LATEST_TERMINAL_ORDER:
+            _LATEST_TERMINAL = latest
+            _LATEST_TERMINAL_ORDER = terminal_order
+    if raw_tier in _FAST_ACTUAL_SERVICE_TIERS:
+        return "fast"
+    if raw_tier in _STANDARD_ACTUAL_SERVICE_TIERS:
+        return "standard"
+    return None
+
+
+def _anthropic_usage_block(input_total, output_total, cached, speed=None):
+    # V6-R3 (Decision 1 + Decision 2 = always-emit): build the client-visible Anthropic
+    # usage block. Anthropic's `input_tokens` is the UNCACHED remainder only (unlike
+    # OpenAI's, which includes the cached prefix), and clients (incl. Claude Code context
+    # accounting) may sum input_tokens + cache_read_input_tokens + cache_creation_input_tokens
+    # for the prompt total. So the mapping SUBTRACTS the cached prefix from input_tokens and
+    # reports it as cache_read_input_tokens, preserving the sum invariant EXACTLY (the three
+    # token fields still sum to the OpenAI input total, so downstream context arithmetic is
+    # byte-equivalent whether or not caching fired). cache_read/cache_creation are ALWAYS
+    # present (0 when `cached` is None) for a deterministic usage shape that matches
+    # Anthropic's own responses. OpenAI reports no cache-WRITE count, so
+    # cache_creation_input_tokens is always 0. `cached` must already be the effective
+    # (typed, clamp-checked) value from _resolve_cached_tokens.
+    block = {
+        "input_tokens": input_total - cached if cached is not None else input_total,
+        "output_tokens": output_total,
+        "cache_read_input_tokens": cached if cached is not None else 0,
+        "cache_creation_input_tokens": 0,
+    }
+    if speed is not None:
+        block["speed"] = speed
+    return block
+
+
 # --- Non-streaming path: full Responses object -> full Anthropic message ---
 
 def _responses_to_anthropic(resp_obj, model):
@@ -2913,7 +4721,11 @@ def _responses_to_anthropic(resp_obj, model):
     output_items = resp_obj.get("output", [])
     for item in output_items:
         _validate_output_item(item)
-    _populate_reasoning_cache(output_items)
+    # v1.3.3 (A2-R1): persist only when the populate actually mutated the cache, so a
+    # reasoning-free or unpaired turn triggers no disk write. Fail-open; never on the hot
+    # path's critical section (the write is atomic-replace and swallows all errors).
+    if _populate_reasoning_cache(output_items):
+        _write_reasoning_cache_state()
 
     content = []
     saw_tool_use = False
@@ -2977,6 +4789,10 @@ def _responses_to_anthropic(resp_obj, model):
 
     usage = resp_obj.get("usage") or {}
     status = resp_obj.get("status", "completed")
+    input_total = usage.get("input_tokens", 0)
+    output_total = usage.get("output_tokens", 0)
+    cached = _resolve_cached_tokens(usage, input_total)
+    actual_speed = _actual_speed_from_response(resp_obj)
     return {
         "id": resp_obj.get("id") or f"msg_{uuid.uuid4().hex[:24]}",
         "type": "message",
@@ -2985,10 +4801,15 @@ def _responses_to_anthropic(resp_obj, model):
         "content": content,
         "stop_reason": _stop_reason_from_status(status, saw_tool_use),
         "stop_sequence": None,
-        "usage": {
-            "input_tokens": usage.get("input_tokens", 0),
-            "output_tokens": usage.get("output_tokens", 0),
-        },
+        "usage": _anthropic_usage_block(
+            input_total, output_total, cached, actual_speed),
+        # V6-R1: private carry of the effective cached count (or None) for the two
+        # non-stream lane consumers. Each pops it before the message is sent so it never
+        # reaches the wire. Carried SEPARATELY from cache_read_input_tokens because a
+        # mapped cache_read of 0 cannot distinguish ABSENT (terminal cached_tokens=-) from
+        # a genuine cached_tokens:0 (terminal cached_tokens=0) — a distinction the terminal
+        # record and the /health requests_with_cached counter both need.
+        "_cached_tokens": cached,
     }
 
 
@@ -3103,55 +4924,131 @@ def _backend_error_fields(payload):
     #   arbitrary prose is safe, so the durable boundary is structural extraction only.
     # ASSUMES: exact type/code strings remain approved bounded metadata and are scrubbed
     #   by lifecycle/log serializers before persistence.
+    # v1.2.14 (R2): recognize the four observed envelope shapes and report whether
+    # the payload was a structured error envelope at all. The four shapes:
+    #   1. {"error": {type, code, message, param}}        (openai lane, captured)
+    #   2. {"status": N, "error": {…}}                    (chatgpt lane, captured)
+    #   3. flat root {code, message, param}               (documented in-stream error)
+    #   4. {"detail": "…"}                                (Codex model-rejection, survey)
+    # Shape 2's top-level `status` is metadata only — the HTTP status is passed
+    # separately to the classifier; here we just descend into root["error"].
     root = payload if isinstance(payload, dict) else {}
     nested = root.get("error") if isinstance(root.get("error"), dict) else root
     if nested is root and isinstance(root.get("incomplete_details"), dict):
         nested = root["incomplete_details"]
     backend_type = nested.get("type") if isinstance(nested.get("type"), str) else "-"
     backend_code = nested.get("code") if isinstance(nested.get("code"), str) else "-"
+    param = nested.get("param") if isinstance(nested.get("param"), str) else "-"
     message = nested.get("message")
     if isinstance(message, dict):
         if backend_type == "-" and isinstance(message.get("type"), str):
             backend_type = message["type"]
         if backend_code == "-" and isinstance(message.get("code"), str):
             backend_code = message["code"]
-    return backend_type, backend_code
+    # "recognized" is about SHAPE, not whether the type/code VALUE is modeled: an
+    # unknown-valued type is still a recognized error envelope. A payload is
+    # recognized when it carries any structured error field (type/code/param), a
+    # string message, a Codex-style string `detail` (shape 4, code-less), or
+    # incomplete_details. Truly shapeless payloads ({} from an unparseable body, or
+    # a dict with no error-ish fields) are unrecognized and counted via R1.
+    recognized = (
+        backend_type != "-"
+        or backend_code != "-"
+        or param != "-"
+        or isinstance(nested.get("message"), str)
+        or isinstance(root.get("detail"), str)
+        or isinstance(root.get("incomplete_details"), dict)
+    )
+    return backend_type, backend_code, recognized, param
+
+
+def _status_fallback_classification(status):
+    # v1.2.14 (R2) pure HTTP-status fallback, used only when no recognized backend
+    # code/type is present. Type mapping per the R2 design table. Two deliberate
+    # points: (1) other-4xx -> invalid_request_error (non-retryable) is the
+    # intentional change from the prior retryable api_error, so a deterministic
+    # rejection is not client-retried; (2) overloaded_error is reserved for the
+    # recognized codes server_is_overloaded/slow_down and status 529 — a bare 503
+    # with an UNKNOWN code falls to the "unknown code + 5xx -> api_error" row (design
+    # table row 9), which also preserves the v1.2.10 pinned-status behavior. The
+    # client MESSAGE keeps the v1.2.11 fixed-message rule unchanged.
+    if status in _BACKEND_ERROR_MESSAGE_BY_STATUS:
+        client_message = _BACKEND_ERROR_MESSAGE_BY_STATUS[status]
+    elif status >= 500:
+        client_message = "backend server error"
+    else:
+        client_message = "backend request failed"
+    if status == 401:
+        return "authentication_error", client_message, False
+    if status == 429:
+        return "rate_limit_error", client_message, True
+    if status == 529:
+        return "overloaded_error", client_message, True
+    if status == 408:
+        return "api_error", client_message, True
+    if 400 <= status < 500:
+        return "invalid_request_error", client_message, False
+    return "api_error", client_message, True
+
+
+# v1.2.14 (R2): recognized backend code/type -> (anthropic_type, message, retryable).
+# Ordered checks inside the classifier; a code match beats a type match, and both
+# beat the HTTP status. Fixed messages only (v1.2.11 no-prose rule).
+_BACKEND_SIGNAL_CLASSIFICATION = {
+    "context_length_exceeded": (
+        "invalid_request_error", "backend context length exceeded", False),
+    "insufficient_quota": (
+        "invalid_request_error", "backend quota or plan limit reached", False),
+    "usage_not_included": (
+        "invalid_request_error", "backend quota or plan limit reached", False),
+    "invalid_prompt": ("invalid_request_error", "backend rejected the request", False),
+    "bio_policy": ("invalid_request_error", "backend rejected the request", False),
+    "cyber_policy": ("invalid_request_error", "backend rejected the request", False),
+    "token_invalidated": ("authentication_error", "backend authentication failed", False),
+    "rate_limit_exceeded": ("rate_limit_error", "backend rate limit exceeded", True),
+    "server_is_overloaded": ("overloaded_error", "backend overloaded", True),
+    "slow_down": ("overloaded_error", "backend overloaded", True),
+    "server_error": ("api_error", "backend server error", False),
+}
 
 
 def _classify_backend_error(status, backend_code, backend_type):
-    # INTENT: map status > code > type to an Anthropic type and a fixed client message.
-    # REASONING: fixed classification-derived text preserves useful failure families
-    #   without reflecting any free-form backend response prose to clients or logs.
-    # ASSUMES: callers without a real non-2xx status pass None; unknown structured
-    #   values keep the historical api_error mapping and use one fixed fallback.
-    if status is not None and status >= 400:
-        anthropic_type = _anthropic_error_type_for_status(status)
-        if status in _BACKEND_ERROR_MESSAGE_BY_STATUS:
-            client_message = _BACKEND_ERROR_MESSAGE_BY_STATUS[status]
-        elif status >= 500:
-            client_message = "backend server error"
-        else:
-            client_message = "backend request failed"
-        return anthropic_type, client_message
-
+    # v1.2.14 (R2): map a backend failure to (anthropic_type, client_message,
+    # retryable) with CODE/TYPE precedence over HTTP status.
+    # INTENT: one classifier for every failure path (pre-stream HTTP, in-band error,
+    #   response.failed, chatgpt inbound-nonstream). Returns a retryable hint.
+    # REASONING: known code/type first (most specific), else HTTP status, else the
+    #   historical bodyless api_error/retryable fallback. Code beats type (mirrors the
+    #   captured backend precedence, e.g. code=server_error over type=context_length).
+    # RETRYABLE: COMPUTED here but NOT yet consumed — A1 leaves the retry loops
+    #   (RETRY_STATUSES-gated in _post_with_retry/_open_backend_stream) byte-identical;
+    #   A2 rewires gating to consume this flag. Fixed messages preserve the v1.2.11
+    #   no-prose rule.
     code_norm = backend_code.strip().lower() if backend_code != "-" else ""
     type_norm = backend_type.strip().lower() if backend_type != "-" else ""
-    if code_norm == "context_length_exceeded":
-        return "invalid_request_error", "backend context length exceeded"
-    if code_norm == "server_error":
-        return "api_error", "backend server error"
-    if type_norm == "context_length_exceeded":
-        return "invalid_request_error", "backend context length exceeded"
-    if type_norm == "server_error":
-        return "api_error", "backend server error"
-    return "api_error", "backend request failed"
+    for signal in (code_norm, type_norm):
+        if signal and signal in _BACKEND_SIGNAL_CLASSIFICATION:
+            return _BACKEND_SIGNAL_CLASSIFICATION[signal]
+    if status is not None and status >= 400:
+        return _status_fallback_classification(status)
+    return "api_error", "backend request failed", True
 
 
 def _normalize_backend_error(payload, status=None, phase=None):
     # Extract and persist only approved structural metadata. The client message is
     # selected from local constants and never from payload.message or raw body text.
-    backend_type, backend_code = _backend_error_fields(payload)
-    anthropic_type, client_message = _classify_backend_error(
+    backend_type, backend_code, recognized, _param = _backend_error_fields(payload)
+    if not recognized:
+        # v1.2.14 (R1): an unrecognized error envelope is counted for observability
+        # and then classified by HTTP status. The tag is a bounded shape descriptor,
+        # never payload content: "empty" for a non-dict/empty body (typically an
+        # unparseable one collapsed to {}), "unstructured" for a dict with no
+        # error-ish fields.
+        tag = "empty" if not isinstance(payload, dict) or not payload else "unstructured"
+        _record_unknown_wire("envelope", tag)
+    # v1.2.14 (R2): retryable is returned by the classifier but intentionally dropped
+    # here — A1 does not consume it; A2 threads it through to the retry loops.
+    anthropic_type, client_message, _retryable = _classify_backend_error(
         status, backend_code, backend_type)
     _record_backend_error(
         anthropic_type, backend_type=backend_type, backend_code=backend_code,
@@ -3174,16 +5071,17 @@ def _bearer_of(headers):
 
 async def _build_backend_headers(force_token_refresh=False, rejected_token=None):
     # v1.2.5: assemble the backend request headers for the active lane.
-    # INTENT: openai mode -> {Authorization: Bearer <env key>, Content-Type}. chatgpt
-    #   mode -> the 3-header floor {authorization: Bearer <access_token>,
-    #   content-type: application/json, accept: text/event-stream} the Codex backend
-    #   gates on (notes/08); NO api-key/openai-specific headers.
+    # INTENT: both lanes add the local X-Client-Request-Id for safe correlation.
+    #   OpenAI mode otherwise sends Authorization + Content-Type; ChatGPT mode sends
+    #   its validated authorization/content-type/accept floor and no API-key header.
     # REASONING: keeping this in one helper means the lazy-401 retry path can rebuild
     #   the headers (with force_token_refresh=True + the rejected token for the
     #   guarded-reload identity check) identically to the first attempt.
     # CREDENTIAL SAFETY: returns a dict CONTAINING the Bearer; callers must never log
     #   it. In chatgpt mode a token-layer failure raises RuntimeError(_RELOGIN_MSG)
     #   (no secret content) for the caller to surface as a clean client error.
+    state = _request_state()
+    client_request_id = state.client_request_id if state is not None else uuid.uuid4().hex
     if SHIM_BACKEND_MODE == "chatgpt":
         access_token = await _get_access_token(
             force_refresh=force_token_refresh, rejected_token=rejected_token)
@@ -3191,14 +5089,34 @@ async def _build_backend_headers(force_token_refresh=False, rejected_token=None)
             "authorization": f"Bearer {access_token}",
             "content-type": "application/json",
             "accept": "text/event-stream",
+            "X-Client-Request-Id": client_request_id,
         }
-    # openai mode (unchanged behavior).
     return {
         "Authorization": f"Bearer {SHIM_BACKEND_API_KEY}",
         "Content-Type": "application/json",
+        "X-Client-Request-Id": client_request_id,
     }
 
 
+def _pending_sse_data_bytes(line_buffer):
+    # Return the logical payload bytes currently buffered for a data field, or None
+    # when the partial line is not a data field. SSE framing ("data:", one optional
+    # space, and a possible trailing CR awaiting LF) is deliberately excluded.
+    # This makes the event cap independent of where upstream transport chunks split,
+    # including splits inside the field prefix and immediately before CRLF.
+    logical_end = len(line_buffer)
+    if logical_end and line_buffer[-1] == 0x0D:
+        logical_end -= 1
+    if logical_end == 4 and line_buffer[:logical_end] == b"data":
+        return 0
+    if logical_end < 5 or line_buffer[:5] != b"data:":
+        return None
+    value_start = 5
+    if logical_end > value_start and line_buffer[value_start] == 0x20:
+        value_start += 1
+    return logical_end - value_start
+
+
 def _consume_sse_line(raw_line, data_lines, event_size, event_open):
     # v1.2.7 bounded SSE framing primitive. SSE joins repeated data fields with a
     # newline and dispatches only on a REAL blank line. Comments do not open an
@@ -3223,7 +5141,7 @@ def _consume_sse_line(raw_line, data_lines, event_size, event_open):
     return None, event_size, event_open
 
 
-async def _iter_bounded_sse_data(resp, disconnect_event):
+async def _iter_bounded_sse_data(resp, disconnect_event, terminal_seen=None):
     # v1.2.7 incremental SSE reader. Do not use aiter_lines(): it may allocate an
     # unbounded line before the caller can reject it. This parser retains only the
     # current line and current data event, each capped at 16 MiB, and never stores
@@ -3248,8 +5166,21 @@ async def _iter_bounded_sse_data(resp, disconnect_event):
         while True:
             newline_at = line_buffer.find(b"\n")
             if newline_at < 0:
-                if len(line_buffer) > MAX_RESPONSES_SSE_EVENT_BYTES:
-                    raise ValueError("upstream SSE line exceeded size limit")
+                pending_data_bytes = _pending_sse_data_bytes(line_buffer)
+                if pending_data_bytes is None:
+                    # Non-data fields still receive a raw-line bound. Data fields use
+                    # the logical event bound below so their fixed SSE framing does not
+                    # make an exactly-at-limit payload fail under one chunking pattern.
+                    if len(line_buffer) > MAX_RESPONSES_SSE_EVENT_BYTES:
+                        raise ValueError("upstream SSE line exceeded size limit")
+                else:
+                    joined_size = (
+                        event_size
+                        + (1 if data_lines else 0)
+                        + pending_data_bytes
+                    )
+                    if joined_size > MAX_RESPONSES_SSE_EVENT_BYTES:
+                        raise ValueError("upstream SSE event exceeded size limit")
                 break
             raw_line = bytes(line_buffer[:newline_at])
             del line_buffer[:newline_at + 1]
@@ -3257,9 +5188,36 @@ async def _iter_bounded_sse_data(resp, disconnect_event):
                 raw_line, data_lines, event_size, event_open)
             if payload is not None:
                 _record_upstream_first_event()
+                _record_upstream_event_gap()  # v1.2.14 (R6) idle-gap timestamp
                 yield payload
-    if line_buffer or event_open or data_lines:
-        raise ValueError("upstream SSE ended before a blank-line event boundary")
+    if not (line_buffer or event_open or data_lines):
+        return
+    # v1.2.14 (R5): a non-blank-terminated tail at EOF. If a complete, dispatchable
+    # event is pending (data lines were seen and any residual partial line is NOT a
+    # data-field continuation that would join into it), flush it as the final event.
+    # This recovers a fully generated terminal response whose trailing blank line a
+    # proxy trimmed (B7); downstream keeps its strict JSON/terminal validation, so a
+    # semantically bad flushed payload still fails there. Any residual non-data bytes
+    # after the complete event are a malformed tail: counted for observability, then
+    # dropped.
+    partial_data = _pending_sse_data_bytes(line_buffer)
+    if data_lines and partial_data is None:
+        if line_buffer:
+            _record_unknown_wire("event_type", "malformed_sse_tail")
+        payload = b"\n".join(data_lines)
+        data_lines.clear()
+        _record_upstream_first_event()
+        _record_upstream_event_gap()  # v1.2.14 (R6) idle-gap timestamp
+        yield payload
+        return
+    # Otherwise the residual is a genuinely incomplete event (a partial data line, or
+    # a dangling field with no dispatchable data). Tolerate it ONLY once a terminal
+    # semantic frame has already been accepted (the response is complete, so trailing
+    # junk is harmless); before the terminal frame it stays a fatal framing failure.
+    if terminal_seen is not None and terminal_seen[0]:
+        _record_unknown_wire("event_type", "malformed_sse_tail")
+        return
+    raise ValueError("upstream SSE ended before a blank-line event boundary")
 
 
 async def _accumulate_terminal_response(resp, disconnect_event):
@@ -3272,8 +5230,12 @@ async def _accumulate_terminal_response(resp, disconnect_event):
     # are validated in arrival order so malformed content cannot hide behind a later
     # superficially valid terminal object. The first valid terminal ends consumption.
     # Returns (terminal_response, failure_message). Exactly one is non-None.
+    # v1.2.14 (R5): a mutable one-slot flag lets the bounded SSE reader tolerate a
+    # malformed tail at EOF only after a terminal semantic frame was accepted.
+    terminal_seen = [False]
     try:
-        async for data_bytes in _iter_bounded_sse_data(resp, disconnect_event):
+        async for data_bytes in _iter_bounded_sse_data(
+                resp, disconnect_event, terminal_seen):
             if data_bytes.strip() == b"[DONE]":
                 return None, "backend stream ended without a terminal response"
             try:
@@ -3282,6 +5244,7 @@ async def _accumulate_terminal_response(resp, disconnect_event):
                 return None, "backend stream contained malformed SSE JSON"
             etype = _validate_stream_event_fields(ev)
             if etype in ("response.completed", "response.incomplete"):
+                terminal_seen[0] = True
                 terminal = _validate_terminal_response(etype, ev.get("response"))
                 return terminal, None
             if etype == "response.failed":
@@ -3305,6 +5268,17 @@ async def _accumulate_terminal_response(resp, disconnect_event):
                         phase="upstream_stream",
                     )
                 return None, message
+            # v1.2.14 (R1): terminal/error events above return; a non-terminal event
+            # reaching here is ignored (this adapter only extracts the terminal
+            # object). Count only genuinely unknown event types, not the known
+            # status/content events a normal stream interleaves before its terminal.
+            if etype not in _KNOWN_EVENT_TYPES:
+                _record_unknown_wire("event_type", etype)
+    except httpx.HTTPError as error:
+        _record_transport_failure(
+            error, _transport_failure_phase(error, post_stream_start=True), False,
+        )
+        raise
     except _ProtocolError as error:
         return None, _scrub_and_trim_body(str(error))[:200] or "backend protocol error"
     except ValueError as error:
@@ -3312,7 +5286,7 @@ async def _accumulate_terminal_response(resp, disconnect_event):
     return None, "backend stream ended without a terminal response"
 
 
-async def _handle_messages(body, receive, send):
+async def _handle_messages(body, receive, send, scope_headers=()):
     t0 = time.time()
 
     # HARDENING (client-disconnect): a response-local Event is both the lightweight
@@ -3328,10 +5302,19 @@ async def _watch_disconnect():
                 _record_disconnect("disconnect_watcher")
                 return
 
-    # Decode Anthropic request. Malformed JSON -> 400.
+    # Decode Anthropic request. Malformed JSON -> 400. Preserve raw object pairs just
+    # long enough to reject duplicate exact top-level `speed` before ordinary dict
+    # collapse; unrelated and nested duplicates retain last-key-wins compatibility.
     _set_phase("request_parse")
     try:
-        req = json.loads(body.decode("utf-8"))
+        req = _decode_anthropic_request_json(body)
+    except _DuplicateTopLevelSpeedError:
+        _mark_error(phase="request_validation", error_type="invalid_request_error")
+        await _send_json(send, 400, {"type": "error", "error": {
+            "type": "invalid_request_error",
+            "message": "duplicate top-level speed field",
+        }})
+        return
     except (ValueError, UnicodeDecodeError) as e:
         log.error("bad request json: %s", type(e).__name__)
         await _send_json(send, 400, {"type": "error", "error": {"type": "invalid_request_error", "message": "invalid JSON"}})
@@ -3347,12 +5330,42 @@ async def _watch_disconnect():
         invalid_structure = not isinstance(messages, list)
         if not invalid_structure:
             invalid_structure = any(not isinstance(message, dict) for message in messages)
+        if not invalid_structure:
+            # v1.2.13: "system" is admitted alongside user/assistant. Live Claude
+            # Code sends a trailing role:"system" message inside `messages`; the
+            # v1.2.12 two-role check rejected every real conversation turn with
+            # the static 400 (captured-payload repro: scripts/scratch/
+            # replay_captured_request.py). Translation folds system to user-role
+            # input, the pre-v1.2.12 behavior proven against the live backend.
+            invalid_structure = any(
+                message.get("role") not in ("user", "assistant", "system")
+                for message in messages
+            )
         if not invalid_structure:
             invalid_structure = any(
                 "content" in message
                 and not isinstance(message.get("content"), (str, list))
                 for message in messages
             )
+        if not invalid_structure:
+            invalid_structure = any(
+                isinstance(message.get("content"), list)
+                and any(
+                    isinstance(block, dict)
+                    and (
+                        (block.get("type") == "tool_use"
+                         and message.get("role") != "assistant")
+                        or (block.get("type") == "tool_result"
+                            and message.get("role") != "user")
+                        or (
+                            block.get("type") == "tool_result"
+                            and not isinstance(block.get("content", ""), (str, list))
+                        )
+                    )
+                    for block in message["content"]
+                )
+                for message in messages
+            )
         if not invalid_structure:
             invalid_structure = any(
                 isinstance(message.get("content"), list)
@@ -3393,6 +5406,21 @@ async def _watch_disconnect():
         }})
         return
 
+    # Validate the body/header Fast contract before authentication or any upstream call.
+    # A persistent Fast beta with no speed remains ordinary traffic.
+    try:
+        state = _request_state()
+        requested_service_tier, requested_service_tier_source = _requested_service_tier(
+            req, _anthropic_beta_tokens(scope_headers),
+            state.gpt_policy_snapshot if state is not None else None,
+        )
+    except _InvalidRequestError as error:
+        _mark_error(phase="request_validation", error_type="invalid_request_error")
+        await _send_json(send, 400, {"type": "error", "error": {
+            "type": "invalid_request_error", "message": str(error),
+        }})
+        return
+
     _set_phase("request_translation")
     stream = bool(req.get("stream", False))
     # v1.2.2: strip any "#<effort>" suffix from the inbound model up front, so the
@@ -3400,8 +5428,19 @@ async def _watch_disconnect():
     # every log line below, and the response echoed to Claude Code. `model` from
     # here on is suffix-free; `slug_effort_raw` is the parsed tier-2 token (or None).
     model, slug_effort_raw = _split_effort_suffix(req.get("model", ""))
-    responses_payload, missing_reasoning, effort_value, effort_source = \
-        _anthropic_to_responses_request(req, model, slug_effort_raw)
+    try:
+        responses_payload, missing_reasoning, reasoning_cache_hits, effort_value, \
+            effort_source, injected_restored_reasoning_ids, injected_restored_call_ids = \
+            _anthropic_to_responses_request(
+                req, model, slug_effort_raw, requested_service_tier)
+    except _InvalidRequestError as error:
+        # The exception text is constructed exclusively from structural indexes,
+        # bounded type labels, and local constants. Never log or reflect block data.
+        _mark_error(phase="request_translation", error_type="invalid_request_error")
+        await _send_json(send, 400, {"type": "error", "error": {
+            "type": "invalid_request_error", "message": str(error),
+        }})
+        return
     n_msgs = len(responses_payload["input"])
     n_tools = len(responses_payload.get("tools", []))
     state = _request_state()
@@ -3413,7 +5452,21 @@ async def _watch_disconnect():
         state.tool_count = n_tools
         state.effort_value = effort_value
         state.effort_source = effort_source
+        state.requested_service_tier = (
+            _scrub_metadata(requested_service_tier, 100)
+            if requested_service_tier is not None else "-"
+        )
+        state.requested_service_tier_source = requested_service_tier_source
         state.reasoning_cache_misses = missing_reasoning
+        # v1.3.4 (V4-R6): per-request cache-hit count for the terminal record.
+        state.reasoning_cache_hits = reasoning_cache_hits
+        # v1.3.4 (V4-R1): hand the restored-blob tracking to the request state so the retry
+        # loops' stale-blob 400 insurance (V4-R2..R4) can strip/evict exactly these items.
+        state.injected_restored_reasoning_ids = injected_restored_reasoning_ids
+        state.injected_restored_call_ids = injected_restored_call_ids
+        # v1.2.14 (D5): capture the request key-name shape once, for a possible
+        # backend invalid_request_error diagnosis line (emitted in _record_backend_error).
+        state.request_shape = _request_shape_fields(responses_payload)
     _lifecycle_event(
         "request_parsed", model=model, stream="y" if stream else "n",
         msgs=n_msgs, tools=n_tools,
@@ -3461,9 +5514,9 @@ async def _watch_disconnect():
             return
 
     # v1.2.5: build the backend auth headers by lane.
-    # INTENT: in openai mode, Bearer the env API key (unchanged). In chatgpt mode,
-    #   Bearer the OAuth access_token from auth.json and emit ONLY the 3-header floor
-    #   the Codex backend gates on (notes/08). Request translation, tools, and SSE
+    # INTENT: in openai mode, Bearer the env API key. In chatgpt mode, Bearer the
+    #   OAuth access_token from auth.json and emit its validated header floor. Both
+    #   lanes add the local X-Client-Request-Id for content-blind correlation. Tools and SSE
     #   block lifecycle stay shared. v1.2.7 makes chatgpt transport always-streaming
     #   (inbound non-stream callers are internally accumulated), while v1.2.6's one
     #   route-specific response-formatting rule preserves reliable reasoning-summary
@@ -3668,8 +5721,19 @@ async def _send_connected(message):
                 # the client. Accumulation/conversion failures after a 200 (no
                 # backend_status) retain the original 502 api_error shape.
                 if backend_status is not None:
+                    # v1.2.14 (R2): surface the CLASSIFIER type (code/type precedence
+                    # over status), set by _normalize_backend_error on the successful
+                    # parse. Fall back to the status-only mapping only when the body
+                    # was unparseable and no classifier type was recorded. Preserves
+                    # the real backend HTTP status passthrough.
+                    state = _request_state()
+                    passthrough_type = (
+                        state.anthropic_error_type
+                        if state is not None and state.anthropic_error_type != "-"
+                        else _anthropic_error_type_for_status(backend_status)
+                    )
                     await _send_json(send, backend_status, {"type": "error", "error": {
-                        "type": _anthropic_error_type_for_status(backend_status),
+                        "type": passthrough_type,
                         "message": safe_message}})
                 else:
                     state = _request_state()
@@ -3682,12 +5746,19 @@ async def _send_connected(message):
                         "type": normalized_type, "message": safe_message}})
                 return
             usage = anth["usage"]
-            _calibrate_count_ratio(usage["input_tokens"], len(body))
+            cached = anth.pop("_cached_tokens", None)
+            # V6-R1: reconstruct the OpenAI input TOTAL from the always-emit block
+            # (uncached remainder + cached prefix, 0 when absent). state.input_tokens and
+            # the count-token calibrator both stay on the OpenAI total (unchanged terminal
+            # semantics), NOT the subtracted client-visible remainder.
+            input_total = usage["input_tokens"] + (cached or 0)
+            _calibrate_count_ratio(input_total, len(body))
             state = _request_state()
             if state is not None:
                 state.stop_reason = anth["stop_reason"]
-                state.input_tokens = usage["input_tokens"]
+                state.input_tokens = input_total
                 state.output_tokens = usage["output_tokens"]
+                state.cached_tokens = cached
                 state.usage_source = "backend"
             await _send_json(send, 200, anth)
             return
@@ -3701,37 +5772,6 @@ async def _send_connected(message):
                 log.error("messages non-stream transport error: %s", type(e).__name__)
                 await _send_json(send, 502, {"type": "error", "error": {"type": "api_error", "message": "backend transport error"}})
                 return
-            # v1.2.5: lazy-401 refresh (chatgpt lane only). A 401 from the Codex
-            # backend means the access_token expired between our exp check and the
-            # request; refresh ONCE, rebuild the Authorization header, and retry the
-            # request a single time. A second 401 -> surface the fast-fail re-login
-            # message. openai mode is untouched (SHIM_BACKEND_MODE guard).
-            if SHIM_BACKEND_MODE == "chatgpt" and r.status_code == 401:
-                await r.aclose()
-                log.warning("chatgpt backend 401; attempting one token refresh + retry")
-                _record_retry("auth_401")
-                _rejected = _bearer_of(headers)
-                try:
-                    _set_phase("backend_authentication")
-                    headers = await _build_backend_headers(
-                        force_token_refresh=True, rejected_token=_rejected)
-                except RuntimeError as e:
-                    log.error("chatgpt lazy-401 refresh failed: %s", str(e))
-                    await _send_json(send, 401, {"type": "error", "error": {
-                        "type": "authentication_error", "message": str(e)}})
-                    return
-                try:
-                    r, retries = await _post_with_retry(url, headers, responses_payload, disconnect_event)
-                except httpx.HTTPError as e:
-                    log.error("messages non-stream transport error (post-refresh): %s", type(e).__name__)
-                    await _send_json(send, 502, {"type": "error", "error": {"type": "api_error", "message": "backend transport error"}})
-                    return
-                if r.status_code == 401:
-                    log.error("chatgpt backend still 401 after refresh; %s", _RELOGIN_MSG)
-                    await r.aclose()
-                    await _send_json(send, 401, {"type": "error", "error": {
-                        "type": "authentication_error", "message": _RELOGIN_MSG}})
-                    return
             if r.status_code >= 400:
                 # Retain only structural classification metadata plus allowlisted
                 # headers. Free-form backend body/message prose is parsed in memory for
@@ -3770,13 +5810,18 @@ async def _send_connected(message):
                     "message": "backend response conversion failed"}})
                 return
             usage = anth["usage"]
-            # v1.2.1: feed the count_tokens calibrator from successful usage.
-            _calibrate_count_ratio(usage["input_tokens"], len(body))
+            cached = anth.pop("_cached_tokens", None)
+            # v1.2.1: feed the count_tokens calibrator from successful usage — the OpenAI
+            # input TOTAL (uncached remainder + cached prefix), not the subtracted client-
+            # visible remainder. V6-R1: state.input_tokens likewise stays on the total.
+            input_total = usage["input_tokens"] + (cached or 0)
+            _calibrate_count_ratio(input_total, len(body))
             state = _request_state()
             if state is not None:
                 state.stop_reason = anth["stop_reason"]
-                state.input_tokens = usage["input_tokens"]
+                state.input_tokens = input_total
                 state.output_tokens = usage["output_tokens"]
+                state.cached_tokens = cached
                 state.usage_source = "backend"
             await _send_json(send, 200, anth)
             return
@@ -3812,6 +5857,11 @@ async def _send_connected(message):
         # this — notes file 05 §3c). So key tool routing state on item_id.
         # item_id -> lifecycle/canonical replay state for one function call.
         tool_state = {}
+        # v1.2.14 (R3): FIFO order of function_call item_ids as they were ADDED. The
+        # tolerant scheduler opens at most one tool_use block at a time and drains the
+        # rest in this order, so concurrently/interleaved-added tools still translate
+        # to non-overlapping Anthropic blocks in added order.
+        tool_added_order = []
         # Every output_item.added id is single-use, regardless of item kind. Completed
         # item values retain canonical JSON so identical replays are idempotent while
         # conflicting replays fail before duplicate stop/cache effects.
@@ -3831,32 +5881,93 @@ async def _send_connected(message):
         failure_message = "backend stream failed"   # fixed local/classification text only
         failure_error_type = "api_error"
         saw_terminal_response = False
+        # v1.2.14 (R5): one-slot mutable flag shared with the bounded SSE reader so it
+        # can tolerate a malformed tail at EOF only after a terminal frame was seen.
+        terminal_seen = [False]
         failure_finalized = False
         input_tokens = None
         output_tokens = None
+        cached_tokens = None         # V6-R1: cached-prefix count from terminal usage (None until parsed)
+        actual_speed = None          # v1.3.7: only terminal service_tier evidence sets this
         accumulated_text = ""        # for usage estimation fallback
         usage_estimated = False
         retries = 0
+        # v1.2.14 (R3): out-of-order text/reasoning that arrives while a tool (or, for
+        # text, another text) block is open is buffered here and flushed as a TRAILING
+        # text/thinking block once all preceding blocks close (ratified downstream
+        # shapes). This keeps Anthropic content blocks strictly non-overlapping while
+        # tolerating the interleaved-emission wire instead of failing the stream.
+        deferred_text = ""
+        deferred_thinking = ""
+
+        # v1.2.14 (R6): single-writer lock shared by every emit() call AND the ping
+        # watchdog below. Each downstream frame is written under this lock, so a
+        # heartbeat ping can never be interleaved into the middle of a partial content
+        # frame — the writer discipline stays exactly single-writer.
+        emit_lock = asyncio.Lock()
 
         async def emit(ev, data):
             state = _request_state()
             is_terminal = ev in ("message_stop", "error")
-            if is_terminal and state is not None:
-                state.terminal_frame_send = "attempted"
-            _record_downstream_first_content()
-            try:
-                await send({"type": "http.response.body", "body": _sse(ev, data), "more_body": True})
-            except _ClientDisconnected:
+            async with emit_lock:
                 if is_terminal and state is not None:
-                    state.terminal_frame_send = "skipped_disconnect"
-                _record_disconnect("terminal_frame_send" if is_terminal else "content_send")
-                raise
-            except Exception:
+                    state.terminal_frame_send = "attempted"
+                _record_downstream_first_content()
+                try:
+                    await send({"type": "http.response.body", "body": _sse(ev, data), "more_body": True})
+                except _ClientDisconnected:
+                    if is_terminal and state is not None:
+                        state.terminal_frame_send = "skipped_disconnect"
+                    _record_disconnect("terminal_frame_send" if is_terminal else "content_send")
+                    raise
+                except Exception:
+                    if is_terminal and state is not None:
+                        state.terminal_frame_send = "write_failed"
+                    raise
                 if is_terminal and state is not None:
-                    state.terminal_frame_send = "write_failed"
-                raise
-            if is_terminal and state is not None:
-                state.terminal_frame_send = "send_completed"
+                    state.terminal_frame_send = "send_completed"
+
+        async def _heartbeat_loop():
+            # v1.2.14 (R6): keep the downstream SSE connection warm during upstream
+            # silence and detect a dead client within one interval.
+            # INTENT: emit an Anthropic `ping` event every SHIM_PING_INTERVAL_S once
+            #   message_start is on the wire, through emit() (hence emit_lock) so a ping
+            #   shares the single-writer discipline and never splits a partial frame.
+            # REASONING: a failed ping write is positive evidence the client is gone.
+            #   emit() has already recorded the disconnect; we set disconnect_event so
+            #   the main reader loop tears down promptly (the fast dead-client-detection
+            #   benefit) and then stop pinging. CancelledError (normal teardown at the
+            #   terminal/failure boundary) is a BaseException and is intentionally NOT
+            #   caught by `except Exception`, so it propagates and cancels cleanly.
+            # ASSUMES: started only for a streaming response with SHIM_PING_INTERVAL_S
+            #   > 0; runs in the request's inherited context so _request_state() and the
+            #   downstream `send` resolve to this request.
+            while True:
+                await asyncio.sleep(SHIM_PING_INTERVAL_S)
+                try:
+                    await emit("ping", {"type": "ping"})
+                except _ClientDisconnected:
+                    disconnect_event.set()
+                    return
+                except Exception:
+                    # A non-disconnect write failure is still evidence the client is
+                    # gone; surface it as a disconnect and stop the heartbeat.
+                    disconnect_event.set()
+                    return
+
+        async def _stop_heartbeat():
+            # v1.2.14 (R6): tear the watchdog down exactly once, before the terminal
+            # frames (so no ping can follow message_delta/message_stop) and as the
+            # request-teardown safety net. Idempotent: a no-op once already stopped.
+            st = _request_state()
+            if st is None or st.heartbeat_task is None:
+                return
+            task = st.heartbeat_task
+            st.heartbeat_task = None
+            _kind, _outcome, owner_cancellation = await _settle_owned_task(
+                task, cancel=True)
+            if owner_cancellation is not None:
+                raise owner_cancellation
 
         def _reasoning_part_key(ev):
             # v1.2.6 chatgpt-only semantic identity extraction.
@@ -3978,6 +6089,96 @@ async def _ensure_text_open():
                     "index": text_index,
                     "content_block": {"type": "text", "text": ""}})
 
+        async def _flush_tool_args_sanitized(st, complete_args):
+            # v1.2.14 (R3): sanitize-mode single input_json_delta emission for one tool
+            # block. The caller guarantees the block is OPEN and its args have not been
+            # emitted yet; the sanitize/parse/fallback logic is identical to the
+            # pre-R3 inline sites — only the emission point (open, not pending) moved.
+            try:
+                parsed = json.loads(complete_args or "{}")
+                parsed, dropped = _sanitize_tool_args(st["name"], parsed)
+                if dropped:
+                    log.info("sanitize tool=%s dropped=%s", st["name"], ",".join(dropped))
+                out_json = json.dumps(parsed)
+            except (ValueError, TypeError):
+                # Fail-open: unparseable args pass through verbatim — sanitization must
+                # never break a working tool call.
+                log.warning("sanitize: unparseable args for tool=%s; passing through", st["name"])
+                out_json = complete_args or "{}"
+            await emit("content_block_delta", {"type": "content_block_delta",
+                "index": st["anth_index"],
+                "delta": {"type": "input_json_delta", "partial_json": out_json}})
+            st["args_emitted"] = True
+
+        async def _open_tool(st):
+            # v1.2.14 (R3): open one deferred/serialized tool_use block. anth_index is
+            # assigned HERE (not at output_item.added) so Anthropic block indices stay
+            # monotonic in EMISSION order. A serialized tool has no other tool open when
+            # it is added, so it opens immediately and its index/bytes equal what the
+            # pre-R3 single-slot reducer produced (byte-identical serialized path).
+            nonlocal next_index
+            st["anth_index"] = next_index
+            next_index += 1
+            st["opened"] = True
+            await emit("content_block_start", {"type": "content_block_start",
+                "index": st["anth_index"],
+                "content_block": {"type": "tool_use", "id": st["call_id"],
+                                  "name": st["name"], "input": {}}})
+            if not SHIM_SANITIZE_TOOLS:
+                # Flush any argument bytes buffered while this tool waited its turn as
+                # ONE input_json_delta. A serialized tool has nothing buffered at open
+                # (its deltas arrive after), so this is a no-op on the byte-identical
+                # path; a deferred tool flushes its whole buffer here.
+                pending = st["args_buf"][st["emitted_len"]:]
+                if pending:
+                    await emit("content_block_delta", {"type": "content_block_delta",
+                        "index": st["anth_index"],
+                        "delta": {"type": "input_json_delta", "partial_json": pending}})
+                    st["emitted_len"] = len(st["args_buf"])
+            elif st["arguments_done"] is not None and not st["args_emitted"]:
+                # Sanitize mode: the complete args already arrived while this tool was
+                # deferred — emit the single sanitized delta now that the block is open.
+                await _flush_tool_args_sanitized(st, st["arguments_done"][1])
+
+        async def _close_tool(st):
+            # v1.2.14 (R3): emit the terminal content_block_stop for one open tool.
+            await emit("content_block_stop", {
+                "type": "content_block_stop", "index": st["anth_index"]})
+            st["closed"] = True
+
+        async def _try_open_next_tool():
+            # v1.2.14 (R3): FIFO-drain deferred tools when the active tool closes. Open
+            # the next not-yet-opened tool in added order; if it is ALREADY fully
+            # finalized (its output_item.done arrived while it waited), close it
+            # contiguously and continue, so a run of finalized deferrals emits
+            # back-to-back start->delta->stop blocks. Stop at the first tool still
+            # awaiting its own events — that one becomes the active open block and its
+            # remaining deltas/done flow through the normal handlers.
+            while True:
+                nxt = None
+                for iid in tool_added_order:
+                    cand = tool_state[iid]
+                    if not cand["opened"] and not cand["closed"]:
+                        nxt = cand
+                        break
+                if nxt is None:
+                    return
+                await _open_tool(nxt)
+                if nxt["finalized"]:
+                    await _close_tool(nxt)
+                    continue
+                return
+
+        async def _drain_pending_tools():
+            # v1.2.14 (R3): terminal-success flush — open and close every still-deferred
+            # tool in added order so each becomes a complete non-overlapping tool_use
+            # block. Called after the single active tool (if any) has been closed.
+            for iid in tool_added_order:
+                st = tool_state[iid]
+                if not st["opened"] and not st["closed"]:
+                    await _open_tool(st)
+                    await _close_tool(st)
+
         async def _finalize_stream_failure(message, error_type="api_error"):
             # v1.2.7 common post-start failure finalizer.
             # INTENT: leave every emitted block structurally closed, then make the
@@ -3994,6 +6195,9 @@ async def _finalize_stream_failure(message, error_type="api_error"):
             # (mid-stream protocol/framing/transport failures with no backend status)
             # keeps the default api_error, preserving the v1.2.8 finalizer semantics.
             nonlocal text_block_open, thinking_block_open, failure_finalized
+            # v1.2.14 (R6): stop the heartbeat before emitting any terminal-failure
+            # frames so a ping can never interleave with the error/body-close sequence.
+            await _stop_heartbeat()
             _record_backend_error(error_type, phase="upstream_stream")
             if failure_finalized or disconnect_event.is_set():
                 return False
@@ -4011,9 +6215,16 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                     "delta": {"type": "signature_delta", "signature": ""}})
                 await emit("content_block_stop", {
                     "type": "content_block_stop", "index": thinking_index})
-            for item_id in sorted(tool_state, key=lambda key: tool_state[key]["anth_index"]):
+            # v1.2.14 (R3): only OPENED tools have a downstream block (and a real
+            # anth_index) to close; a still-deferred tool never emitted a
+            # content_block_start, so it is skipped here. Filtering to opened tools
+            # also keeps the sort key from comparing a pending tool's None index.
+            for item_id in sorted(
+                (key for key in tool_state if tool_state[key]["opened"]),
+                key=lambda key: tool_state[key]["anth_index"],
+            ):
                 st = tool_state[item_id]
-                if st["opened"] and not st.get("closed"):
+                if not st.get("closed"):
                     st["closed"] = True
                     await emit("content_block_stop", {
                         "type": "content_block_stop", "index": st["anth_index"]})
@@ -4122,7 +6333,8 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 await emit("message_start", {"type": "message_start", "message": {
                     "id": msg_id, "type": "message", "role": "assistant", "model": model,
                     "content": [], "stop_reason": None, "stop_sequence": None,
-                    "usage": {"input_tokens": 0, "output_tokens": 0}}})
+                    "usage": {"input_tokens": 0, "output_tokens": 0,
+                              "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0}}})
                 started = True
                 # v1.2.10: this is the ONLY finalizer caller that knows a real
                 # backend HTTP status (`status`). Map it to the Anthropic error type
@@ -4135,15 +6347,27 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 await _finalize_stream_failure(client_failure, error_type)
                 return
 
-            # message_start (usage filled with 0s; refined at message_delta).
+            # message_start (usage filled with 0s; refined at message_delta). V6-R3: the
+            # two cache fields are always present (0) for a deterministic usage shape.
             await emit("message_start", {"type": "message_start", "message": {
                 "id": msg_id, "type": "message", "role": "assistant", "model": model,
                 "content": [], "stop_reason": None, "stop_sequence": None,
-                "usage": {"input_tokens": 0, "output_tokens": 0}}})
+                "usage": {"input_tokens": 0, "output_tokens": 0,
+                          "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0}}})
             started = True
 
+            # v1.2.14 (R6): message_start is on the wire — start the downstream
+            # heartbeat. A `ping` every SHIM_PING_INTERVAL_S keeps the connection warm
+            # during upstream silence; SHIM_PING_INTERVAL_S <= 0 disables it. This is
+            # the ONLY start site, so the watchdog never runs for a non-streaming
+            # response or for the pre-content error branch above (which returns first).
+            if SHIM_PING_INTERVAL_S > 0:
+                _hb_state = _request_state()
+                if _hb_state is not None:
+                    _hb_state.heartbeat_task = asyncio.create_task(_heartbeat_loop())
+
             async for data_bytes in _iter_bounded_sse_data(
-                resp, disconnect_event
+                resp, disconnect_event, terminal_seen
             ):
                 # HARDENING (client-disconnect mid-stream): stop pulling from the
                 # backend the moment the client goes away.
@@ -4158,6 +6382,15 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 try:
                     ev = json.loads(data_bytes)
                 except (ValueError, UnicodeDecodeError):
+                    # v1.2.14 (R3.5): a malformed frame whose recoverable type is a
+                    # non-load-bearing status event is counted (R1) and skipped rather
+                    # than failing the whole stream — the frame carried nothing the
+                    # translation needs. Any other (or unrecoverable) type stays a
+                    # strict failure, so a malformed load-bearing frame still aborts.
+                    probed_type = _probe_malformed_event_type(data_bytes)
+                    if probed_type in _MALFORMED_TOLERANT_EVENT_TYPES:
+                        _record_unknown_wire("event_type", probed_type)
+                        continue
                     stream_failed = True
                     failure_message = "backend stream contained malformed SSE JSON"
                     break
@@ -4176,11 +6409,13 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                             for st in tool_state.values()
                         )
                         if text_block_open or unfinished_tool:
-                            stream_failed = True
-                            failure_message = (
-                                "backend emitted reasoning while a content block was open"
-                            )
-                            break
+                            # v1.2.14 (R3): tolerate out-of-order reasoning. A text or
+                            # tool block is open, so buffer this reasoning and emit it
+                            # as a TRAILING thinking block once those blocks close
+                            # (ratified shape) — keeps Anthropic blocks non-overlapping
+                            # instead of failing the stream as pre-R3 did.
+                            deferred_thinking += delta
+                            continue
                         await _ensure_thinking_open()
                         if SHIM_BACKEND_MODE == "chatgpt":
                             # v1.2.6: synthesize a boundary only before the first
@@ -4234,9 +6469,13 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                             for st in tool_state.values()
                         )
                         if unfinished_tool:
-                            raise _ProtocolError(
-                                "backend emitted text while a tool block was open"
-                            )
+                            # v1.2.14 (R3): tolerate text emitted while a tool block is
+                            # open. Buffer it and emit as a TRAILING text block once the
+                            # tool closes (ratified shape) — keeps Anthropic blocks
+                            # non-overlapping instead of failing the stream as pre-R3 did.
+                            deferred_text += delta
+                            accumulated_text += delta
+                            continue
                         await _ensure_text_open()
                         accumulated_text += delta
                         await emit("content_block_delta", {"type": "content_block_delta",
@@ -4255,50 +6494,57 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                             )
                         added_item_ids.add(item_id)
                     if item.get("type") == "function_call":
-                        # Before a tool opens, every prior tool must be fully closed.
-                        # A second concurrent tool would overlap Anthropic blocks and
-                        # must fail rather than silently overwrite/reroute state.
-                        unfinished_tool = any(
+                        if item_id in tool_state:
+                            raise _ProtocolError("backend reused a function item id")
+                        # v1.2.14 (R3): tolerant scheduler. A function_call added while
+                        # another tool block is still OPEN is DEFERRED (registered
+                        # pending, args buffered), not rejected as a protocol failure —
+                        # it opens later via _try_open_next_tool when the active tool
+                        # closes, producing non-overlapping Anthropic tool_use blocks in
+                        # added order (strict-emit downstream). On a SERIALIZED wire no
+                        # tool is ever open here, so `other_tool_open` is always False
+                        # and this reduces to the pre-R3 immediate-open path.
+                        other_tool_open = any(
                             st["opened"] and not st.get("closed")
                             for st in tool_state.values()
                         )
-                        if unfinished_tool:
-                            raise _ProtocolError(
-                                "backend opened a tool while another tool was unfinished"
-                            )
-                        if item_id in tool_state:
-                            raise _ProtocolError("backend reused a function item id")
-
-                        # Close ALL open non-tool blocks before opening tool_use. This
-                        # preserves strict Anthropic block serialization while still
-                        # supporting normal text -> tool transitions.
-                        if thinking_block_open:
-                            await emit("content_block_delta", {"type": "content_block_delta",
-                                "index": thinking_index,
-                                "delta": {"type": "signature_delta", "signature": ""}})
-                            await emit("content_block_stop", {"type": "content_block_stop", "index": thinking_index})
-                            thinking_block_open = False
-                        if text_block_open:
-                            await emit("content_block_stop", {"type": "content_block_stop", "index": text_index})
-                            text_block_open = False
-                        anth_index = next_index
-                        next_index += 1
                         st = {
-                            "anth_index": anth_index,
-                            "opened": True,
+                            "anth_index": None,        # assigned at open (emission order)
+                            "opened": False,
+                            "closed": False,
                             "call_id": item["call_id"],
                             "name": item["name"],
                             "args_buf": "",
+                            "emitted_len": 0,          # sanitize-off incremental cursor
                             "arguments_done": None,
+                            "args_emitted": False,     # sanitize-on single-delta guard
+                            "finalized": False,        # output_item.done seen
                             "completed_item": None,
-                            "closed": False,
                         }
                         tool_state[item_id] = st
+                        tool_added_order.append(item_id)
                         saw_tool_use = True
-                        await emit("content_block_start", {"type": "content_block_start",
-                            "index": anth_index,
-                            "content_block": {"type": "tool_use", "id": st["call_id"],
-                                              "name": st["name"], "input": {}}})
+                        if not other_tool_open:
+                            # Serialized path: close ALL open non-tool blocks before
+                            # opening tool_use (normal text/thinking -> tool transition),
+                            # then open immediately. While another tool IS open, text and
+                            # thinking are already closed, so the deferred branch has
+                            # nothing to close and emits nothing until it drains.
+                            if thinking_block_open:
+                                await emit("content_block_delta", {"type": "content_block_delta",
+                                    "index": thinking_index,
+                                    "delta": {"type": "signature_delta", "signature": ""}})
+                                await emit("content_block_stop", {"type": "content_block_stop", "index": thinking_index})
+                                thinking_block_open = False
+                            if text_block_open:
+                                await emit("content_block_stop", {"type": "content_block_stop", "index": text_index})
+                                text_block_open = False
+                            await _open_tool(st)
+                    elif item.get("type") not in _KNOWN_ITEM_TYPES:
+                        # v1.2.14 (R1): message/reasoning items are known and handled
+                        # elsewhere; any other output_item type is unmodeled and
+                        # counted for observability (still not translated).
+                        _record_unknown_wire("item_type", item.get("type"))
                     continue
 
                 # --- function_call argument deltas (route by item_id) ---
@@ -4321,10 +6567,14 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                     # in both sanitize modes. Sanitize mode still defers emission
                     # to .done; sanitize-off still forwards incrementally.
                     st["args_buf"] += frag
-                    if not SHIM_SANITIZE_TOOLS:
+                    # v1.2.14 (R3): forward incrementally only once the block is OPEN.
+                    # A still-deferred tool just buffers (emitted_len stays behind, and
+                    # _open_tool flushes args_buf[emitted_len:] as one delta on open).
+                    if not SHIM_SANITIZE_TOOLS and st["opened"]:
                         await emit("content_block_delta", {"type": "content_block_delta",
                             "index": st["anth_index"],
                             "delta": {"type": "input_json_delta", "partial_json": frag}})
+                        st["emitted_len"] = len(st["args_buf"])
                     continue
 
                 # --- function_call arguments finalized ---
@@ -4372,26 +6622,15 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                             "backend completed conflicting arguments after tool closure"
                         )
                     complete_args = canonical_done[1]
-                    if SHIM_SANITIZE_TOOLS:
-                        # SANITIZE MODE: parse the complete string, sanitize, and
-                        # emit as ONE input_json_delta. Identical replay is ignored
-                        # above, so downstream sees this exact delta at most once.
-                        try:
-                            parsed = json.loads(complete_args or "{}")
-                            parsed, dropped = _sanitize_tool_args(st["name"], parsed)
-                            if dropped:
-                                log.info("sanitize tool=%s dropped=%s", st["name"], ",".join(dropped))
-                            out_json = json.dumps(parsed)
-                        except (ValueError, TypeError):
-                            # Fail-open: unparseable args pass through verbatim —
-                            # sanitization must never break a working tool call.
-                            log.warning("sanitize: unparseable args for tool=%s; passing through", st["name"])
-                            out_json = complete_args or "{}"
-                        await emit("content_block_delta", {"type": "content_block_delta",
-                            "index": st["anth_index"],
-                            "delta": {"type": "input_json_delta", "partial_json": out_json}})
-                    # Sanitize-off already forwarded the deltas; nothing to emit.
                     st["arguments_done"] = canonical_done
+                    # v1.2.14 (R3): SANITIZE MODE emits the sanitized args as ONE
+                    # input_json_delta, but only once the block is OPEN. A still-deferred
+                    # tool records arguments_done now; _open_tool emits the sanitized
+                    # delta when it drains. Identical replay is ignored above, so
+                    # downstream sees this exact delta at most once. Sanitize-off already
+                    # forwarded (open) or buffered (deferred) the deltas — nothing to emit.
+                    if SHIM_SANITIZE_TOOLS and st["opened"] and not st["args_emitted"]:
+                        await _flush_tool_args_sanitized(st, complete_args)
                     continue
 
                 # --- an output item completed ---
@@ -4426,6 +6665,12 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                             "backend replayed a conflicting completed output item"
                         )
 
+                    # v1.2.14 (R1): count unmodeled completed item types for
+                    # observability. function_call/message/reasoning are known; any
+                    # other type is still cached below but not otherwise translated.
+                    if item.get("type") not in _KNOWN_ITEM_TYPES:
+                        _record_unknown_wire("item_type", item.get("type"))
+
                     # Validate all state relationships before adding the item to the
                     # completed/cache set or emitting a fallback delta/stop.
                     if item.get("type") == "function_call":
@@ -4452,28 +6697,23 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                                 "backend completed a tool after an inconsistent closure"
                             )
 
-                        # Fallback: if no arguments.done event fired, emit the full
-                        # item arguments once under sanitize mode.
-                        if SHIM_SANITIZE_TOOLS and prior_done is None:
-                            raw = item["arguments"]
-                            try:
-                                parsed = json.loads(raw or "{}")
-                                parsed, dropped = _sanitize_tool_args(st["name"], parsed)
-                                if dropped:
-                                    log.info("sanitize tool=%s dropped=%s", st["name"], ",".join(dropped))
-                                out_json = json.dumps(parsed)
-                            except (ValueError, TypeError):
-                                log.warning("sanitize: unparseable args for tool=%s; passing through", st["name"])
-                                out_json = raw or "{}"
-                            await emit("content_block_delta", {"type": "content_block_delta",
-                                "index": st["anth_index"],
-                                "delta": {"type": "input_json_delta", "partial_json": out_json}})
                         if prior_done is None:
                             st["arguments_done"] = item_done
-                        await emit("content_block_stop", {
-                            "type": "content_block_stop", "index": st["anth_index"]})
-                        st["closed"] = True
+                        # v1.2.14 (R3): the tool is now fully finalized on the wire.
+                        # finalized lets a still-deferred tool drain as a contiguous
+                        # start->delta->stop block when its turn comes.
+                        st["finalized"] = True
                         st["completed_item"] = item
+                        if st["opened"]:
+                            # Sanitize-mode fallback: if arguments.done never fired, emit
+                            # the single sanitized delta from the completed item's
+                            # arguments now, before the block closes.
+                            if SHIM_SANITIZE_TOOLS and not st["args_emitted"]:
+                                await _flush_tool_args_sanitized(st, st["arguments_done"][1])
+                            await _close_tool(st)
+                            # An active tool just closed — drain the next deferred tool.
+                            await _try_open_next_tool()
+                        # else: still deferred — it opens and closes on drain later.
 
                     completed_item_values[item_id] = item
                     completed_items.append(item)
@@ -4482,14 +6722,26 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 # --- terminal SUCCESS/TRUNCATION events ---
                 if etype in ("response.completed", "response.incomplete"):
                     r_obj = _validate_terminal_response(etype, ev.get("response"))
-                    terminal_output = r_obj.get("output", [])
+                    # v1.2.14 (R3.3): tolerate `output: null`/absent — fall back to the
+                    # streamed/collected state (cache_items below uses completed_items
+                    # when terminal_output_items is empty). `or []` covers both the
+                    # null (validated-tolerated) and the missing-key cases.
+                    terminal_output = r_obj.get("output") or []
                     for item in terminal_output:
                         _validate_output_item(item)
                     saw_terminal_response = True
+                    terminal_seen[0] = True
                     final_status = r_obj["status"]
                     usage = r_obj.get("usage", {})
                     input_tokens = usage.get("input_tokens", input_tokens)
                     output_tokens = usage.get("output_tokens", output_tokens)
+                    # V6-R1: capture the cached-prefix count alongside the token totals.
+                    # input_tokens is now resolved to the OpenAI total, so the clamp guard
+                    # inside _resolve_cached_tokens compares against the correct basis.
+                    cached_tokens = _resolve_cached_tokens(usage, input_tokens)
+                    # Actual service is terminal evidence. Never expose requested intent
+                    # in message_start or infer Standard from an absent/unknown tier.
+                    actual_speed = _actual_speed_from_response(r_obj)
                     # Retain only validated terminal output for one post-loop cache
                     # population. The first valid terminal is final: stop semantic
                     # consumption immediately and close the upstream context in the
@@ -4543,7 +6795,13 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                     )
                     stream_failed = True
                     break
-                # Any other event type is ignored gracefully.
+                # v1.2.14 (R1): every handled event type above continues or breaks,
+                # so anything reaching here is unhandled. Known status/lifecycle
+                # events (created, in_progress, content_part.*, *_text.done, reasoning
+                # summary part boundaries) are ignored silently; a genuinely unknown
+                # event type is counted for observability without translation.
+                if etype not in _KNOWN_EVENT_TYPES:
+                    _record_unknown_wire("event_type", etype)
 
             # v1.2.7 terminal invariant: [DONE] and clean EOF are framing signals,
             # never proof that generation completed. Only a parsed complete terminal
@@ -4567,7 +6825,10 @@ async def _finalize_stream_failure(message, error_type="api_error"):
             # from output_item.done events.
             cache_items = terminal_output_items or completed_items
             if cache_items:
-                _populate_reasoning_cache(cache_items)
+                # v1.3.3 (A2-R1): persist only on a real mutation (see the non-stream
+                # call site). Same fail-open, atomic-replace write.
+                if _populate_reasoning_cache(cache_items):
+                    _write_reasoning_cache_state()
 
             # Close any still-open text/thinking blocks (tools closed at .done).
             if text_block_open:
@@ -4581,12 +6842,45 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                     "delta": {"type": "signature_delta", "signature": ""}})
                 await emit("content_block_stop", {"type": "content_block_stop", "index": thinking_index})
                 thinking_block_open = False
-            # Close any tool blocks that never received an output_item.done.
-            for item_id in sorted(tool_state, key=lambda k: tool_state[k]["anth_index"]):
+            # Close the active tool that never received an output_item.done (at most one
+            # is open under the R3 scheduler), then drain any still-deferred tools so
+            # each becomes a complete non-overlapping tool_use block in added order.
+            for item_id in tool_added_order:
                 st = tool_state[item_id]
                 if st["opened"] and not st.get("closed"):
                     await emit("content_block_stop", {"type": "content_block_stop", "index": st["anth_index"]})
                     st["closed"] = True
+            await _drain_pending_tools()
+
+            # v1.2.14 (R3): flush reasoning/text that arrived out of order (while a tool
+            # or text block was open) as TRAILING thinking/text blocks (ratified shapes).
+            # By construction all preceding blocks are now closed, so these open with
+            # fresh monotonic indices and stay non-overlapping.
+            if deferred_thinking:
+                deferred_thinking_index = next_index
+                next_index += 1
+                await emit("content_block_start", {"type": "content_block_start",
+                    "index": deferred_thinking_index,
+                    "content_block": {"type": "thinking", "thinking": ""}})
+                await emit("content_block_delta", {"type": "content_block_delta",
+                    "index": deferred_thinking_index,
+                    "delta": {"type": "thinking_delta", "thinking": deferred_thinking}})
+                await emit("content_block_delta", {"type": "content_block_delta",
+                    "index": deferred_thinking_index,
+                    "delta": {"type": "signature_delta", "signature": ""}})
+                await emit("content_block_stop", {"type": "content_block_stop", "index": deferred_thinking_index})
+                deferred_thinking = ""
+            if deferred_text:
+                deferred_text_index = next_index
+                next_index += 1
+                await emit("content_block_start", {"type": "content_block_start",
+                    "index": deferred_text_index,
+                    "content_block": {"type": "text", "text": ""}})
+                await emit("content_block_delta", {"type": "content_block_delta",
+                    "index": deferred_text_index,
+                    "delta": {"type": "text_delta", "text": deferred_text}})
+                await emit("content_block_stop", {"type": "content_block_stop", "index": deferred_text_index})
+                deferred_text = ""
 
             # HARDENING (empty-response guard): if neither text, thinking, nor a
             # tool call was produced, emit an empty text block so Claude Code sees
@@ -4616,12 +6910,22 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 state.stop_reason = stop_reason
                 state.input_tokens = input_tokens
                 state.output_tokens = output_tokens
+                # V6-R1: None on the estimated path (no terminal usage parsed) -> the
+                # terminal record renders "-"; the /health prompt_cache counters only tick
+                # on a backend-sourced usage (usage_source == "backend").
+                state.cached_tokens = cached_tokens
                 state.usage_source = "estimated" if usage_estimated else "backend"
                 state.tools_called = len(tool_state)
 
+            # v1.2.14 (R6): stop the heartbeat before the terminal frames so no ping
+            # can be written after message_delta/message_stop.
+            await _stop_heartbeat()
             await emit("message_delta", {"type": "message_delta",
                 "delta": {"stop_reason": stop_reason, "stop_sequence": None},
-                "usage": {"input_tokens": input_tokens, "output_tokens": output_tokens}})
+                # V6-R3: always-emit Anthropic usage shape with the subtraction mapping.
+                # cached_tokens is already the effective (typed, clamp-checked) value.
+                "usage": _anthropic_usage_block(
+                    input_tokens, output_tokens, cached_tokens, actual_speed)})
             await emit("message_stop", {"type": "message_stop"})
             # A returned ASGI send marks only send_completed. It does not prove
             # client acknowledgment or receipt. Success is fixed at this semantic
@@ -4642,6 +6946,9 @@ async def _finalize_stream_failure(message, error_type="api_error"):
             elif isinstance(e, ValueError):
                 failure_kind = "backend SSE framing error"
             elif isinstance(e, httpx.HTTPError):
+                _record_transport_failure(
+                    e, _transport_failure_phase(e, post_stream_start=True), False,
+                )
                 failure_kind = "backend transport error"
             else:
                 failure_kind = "backend stream translation error"
@@ -4655,7 +6962,9 @@ async def _finalize_stream_failure(message, error_type="api_error"):
                 await emit("message_start", {"type": "message_start", "message": {
                     "id": msg_id, "type": "message", "role": "assistant", "model": model,
                     "content": [], "stop_reason": None, "stop_sequence": None,
-                    "usage": {"input_tokens": 0, "output_tokens": 0}}})
+                    # V6-R3: always-emit cache fields (0) for a deterministic usage shape.
+                    "usage": {"input_tokens": 0, "output_tokens": 0,
+                              "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0}}})
                 started = True
             try:
                 await _finalize_stream_failure(failure_kind)
@@ -4725,9 +7034,113 @@ async def _handle_models(send):
     ]})
 
 
+# A1-R4 (v1.3.0): read-only auth-validity snapshot for /health. Derived ENTIRELY from
+# auth.json presence + the access_token's JWT `exp` claim (payload decoded, never
+# verified, never the signature). It NEVER returns token material — only a coarse
+# state, the decoded expiry, a day count, and (for actionable states) the literal
+# recovery command. This is a REPORTING mirror of the auth store: it never writes,
+# never refreshes, and never touches the delegation path (delegated_refresh's domain).
+# The "expiring" horizon is deliberately WIDER than the internal 5-min refresh margin
+# (_TOKEN_REFRESH_MARGIN_S): that margin governs when the shim asks codex to refresh;
+# this window is a USER heads-up ("subscription auth expires in N days") surfaced by
+# start_shim.sh readiness and deploy-smoke, so it warns 48h ahead — enough lead time to
+# run `codex login --device-auth` before work is blocked.
+_AUTH_EXPIRING_WINDOW_S = 48 * 3600
+_AUTH_RECOVERY_CMD = "codex login --device-auth"
+
+
+def _auth_health_block():
+    # INTENT: return the /health "auth" block: {state, expires_at, days_left, recovery?}.
+    #   state is valid|expiring|expired|absent|unreadable on the chatgpt lane, and "n/a"
+    #   on the openai (API-key) lane, which does not use the codex OAuth store.
+    # REASONING: absent = no readable auth.json (CODEX_HOME unset, or the file missing/
+    #   unreadable); unreadable = the file reads but yields no decodable access_token exp
+    #   (malformed JSON, missing tokens/access_token, or a non-JWT/undecodable token);
+    #   otherwise the exp decides expired (exp <= now) / expiring (within
+    #   _AUTH_EXPIRING_WINDOW_S) / valid. `recovery` (the literal re-login command) is
+    #   present ONLY for the four actionable states, never for valid or n/a.
+    # CREDENTIAL SAFETY: never returns token material — only the coarse state, the
+    #   decoded expiry timestamp, a day count, and a static command string. Never raises
+    #   (a /health probe must not 500); every failure path degrades to absent/unreadable.
+    if SHIM_BACKEND_MODE != "chatgpt":
+        return {"state": "n/a"}
+    if not _CODEX_AUTH_PATH or not os.access(_CODEX_AUTH_PATH, os.R_OK):
+        return {"state": "absent", "expires_at": None, "days_left": None,
+                "recovery": _AUTH_RECOVERY_CMD}
+    try:
+        with open(_CODEX_AUTH_PATH, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        access = (data.get("tokens") or {}).get("access_token") if isinstance(data, dict) else None
+    except (OSError, ValueError):
+        access = None
+    exp = _jwt_exp(access) if access else None
+    if exp is None:
+        return {"state": "unreadable", "expires_at": None, "days_left": None,
+                "recovery": _AUTH_RECOVERY_CMD}
+    now = time.time()
+    try:
+        remaining = exp - now
+        if remaining <= 0:
+            state = "expired"
+        elif remaining <= _AUTH_EXPIRING_WINDOW_S:
+            state = "expiring"
+        else:
+            state = "valid"
+        block = {
+            "state": state,
+            "expires_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(exp)),
+            "days_left": round(remaining / 86400, 1),
+        }
+    except (OverflowError, OSError, ValueError):
+        # A pathological numeric exp (corrupt/partial-write auth.json, or a non-codex
+        # writer yielding a garbage-but-numeric exp) can overflow the platform time_t
+        # inside time.gmtime/strftime. The file reached us and parsed, but the auth
+        # data is unusable -> classify "unreadable" (an actionable state, recovery
+        # command included), preserving this function's "never raises" contract.
+        return {"state": "unreadable", "expires_at": None, "days_left": None,
+                "recovery": _AUTH_RECOVERY_CMD}
+    if state != "valid":
+        block["recovery"] = _AUTH_RECOVERY_CMD
+    return block
+
+
+def _gpt_service_tier_health_block():
+    # Stable bounded v1.3.8 health contract. Current policy is a fresh strict read and is
+    # explicitly global requested state, while latest_terminal is process-local historical
+    # evidence from one genuine terminal upstream object. Neither is per-session proof.
+    native_fast_disabled = _GPT_FAST_NATIVE_DISABLED
+    try:
+        snapshot = _GPT_FAST_STORE.read(
+            SHIM_BACKEND_MODE if _GPT_FAST_ROUTE_VALID else None
+        )
+        policy = snapshot.health_dict()
+        # Preserve the persisted `enabled` fact while projecting request-effective state
+        # honestly. Failed reconciliation of an unsafe/invalid state, or any missing exact
+        # process boundary, cannot leave health claiming stored ON is currently active.
+        if (not _GPT_FAST_ROUTE_VALID or not native_fast_disabled) and policy["effective"]:
+            policy["effective"] = False
+    except Exception:
+        policy = {
+            "status": "unreadable",
+            "backend_mode": None,
+            "enabled": False,
+            "effective": False,
+        }
+    with _LATEST_TERMINAL_LOCK:
+        latest = dict(_LATEST_TERMINAL) if _LATEST_TERMINAL is not None else None
+    return {
+        "backend_mode": SHIM_BACKEND_MODE,
+        "requested_tier_vocabulary": _FAST_REQUEST_SERVICE_TIERS[SHIM_BACKEND_MODE],
+        "policy": policy,
+        "native_fast_disabled": native_fast_disabled,
+        "latest_terminal": latest,
+    }
+
+
 async def _handle_health(send):
     # HARDENING: health endpoint for the manager's idempotency + --status checks.
     await _send_json(send, 200, {
+        "service": SHIM_SERVICE_ID,
         "status": "ok",
         "backend": SHIM_BACKEND_BASE_URL,
         "backend_mode": SHIM_BACKEND_MODE,
@@ -4748,6 +7161,38 @@ async def _handle_health(send):
         "sanitize_tools": SHIM_SANITIZE_TOOLS,
         "reasoning_effort": SHIM_REASONING_EFFORT,
         "text_verbosity": SHIM_TEXT_VERBOSITY,
+        # A1-R4 (v1.3.0): read-only auth-validity snapshot (chatgpt lane; "n/a" on the
+        # openai lane). Derived from auth.json presence + JWT exp only — never token
+        # material. start_shim.sh readiness/--status and deploy-smoke T0.9 consume it.
+        "auth": _auth_health_block(),
+        # v1.3.3 (A2-R6): reasoning-cache continuity surface — COUNTS ONLY (never entry
+        # contents or call_ids). entries = current in-memory cache size; restored =
+        # entries loaded from the persisted snapshot at startup (0 if none). This file is
+        # shim-internal continuity state, so no reader outside the shim consumes it — the
+        # surface exists for operator triage (start_shim --status, deploy-smoke).
+        # v1.3.4 (V4-R7): restore-effectiveness — hits = process-cumulative reasoning-cache
+        # hits since start; restored_hits = the subset whose call_id was still disk-restored
+        # at hit time (direct evidence for the ~1-week cap/ceiling review). Both counts only,
+        # nested here (NOT new top-level keys) so the /health top-level key set is unchanged.
+        "reasoning_cache": {
+            "entries": len(_REASONING_CACHE),
+            "restored": _REASONING_CACHE_RESTORED,
+            "hits": _REASONING_CACHE_HITS_TOTAL,
+            "restored_hits": _REASONING_CACHE_RESTORED_HITS_TOTAL,
+        },
+        # v1.3.6 (V6-R4): prompt-cache observability — a NEW top-level block. Unlike the
+        # v1.3.4 reasoning_cache fold-in, prompt_cache has no natural parent (reasoning_cache
+        # is a DIFFERENT cache — reasoning-continuity blobs), so it is added as its own key.
+        # This DOES change the pinned top-level key set, so _HEALTH_KEYS + the version pin
+        # move in the same commit (the sanctioned, review-visible money-test extension).
+        # Counts only, never content. hit-rate = cached_tokens_total / input_tokens_total.
+        "prompt_cache": {
+            "requests_with_usage": _PROMPT_CACHE_REQUESTS_WITH_USAGE,
+            "requests_with_cached": _PROMPT_CACHE_REQUESTS_WITH_CACHED,
+            "cached_tokens_total": _PROMPT_CACHE_CACHED_TOKENS_TOTAL,
+            "input_tokens_total": _PROMPT_CACHE_INPUT_TOKENS_TOTAL,
+        },
+        "gpt_service_tier": _gpt_service_tier_health_block(),
     })
 
 
@@ -4775,13 +7220,23 @@ async def app(scope, receive, send):
         # Establish correlation before the first body read so body-read disconnects
         # and every nested task/log record belong to this request lifecycle.
         state = _RequestLifecycleState()
+        # v1.3.8 request-boundary snapshot: exactly one lock-free read, immediately after
+        # lifecycle creation and before request_start/body read/auth. The resulting object
+        # is the sole global-policy input used to build the one retry-stable payload.
+        try:
+            state.gpt_policy_snapshot = _GPT_FAST_STORE.read(
+                SHIM_BACKEND_MODE if _GPT_FAST_ROUTE_VALID else None
+            )
+        except Exception:
+            state.gpt_policy_snapshot = None
         token = _REQUEST_STATE.set(state)
         _lifecycle_event("request_start", method="POST", path="/v1/messages")
         try:
             body = await _read_body(receive)
             if not state.disconnect_observed:
                 # Pass `receive` through so the handler can watch for disconnect.
-                await _handle_messages(body, receive, send)
+                await _handle_messages(
+                    body, receive, send, scope.get("headers", ()))
         except _ClientDisconnected:
             _record_disconnect(state.phase)
         except asyncio.CancelledError:
diff --git a/scripts/provider_shim/gpt_fast.py b/scripts/provider_shim/gpt_fast.py
new file mode 100644
index 00000000..b95615e1
--- /dev/null
+++ b/scripts/provider_shim/gpt_fast.py
@@ -0,0 +1,941 @@
+#!/usr/bin/env python3
+"""Strict persistent GPT service-tier policy and operator CLI.
+
+The production policy path is fixed at
+``~/.claude/provider_shim/gpt_fast_policy.json``.  Callers may inject an
+explicit home directory through :class:`PolicyStore` for hermetic tests; there
+is deliberately no production state-path environment variable.
+"""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import json
+import os
+import re
+import stat
+import sys
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Callable, Optional
+
+POLICY_VERSION = 1
+SUPPORTED_BACKENDS = frozenset({"chatgpt", "openai"})
+# Both exact GPT backends use the one canonical OpenAI Responses request value.
+# ChatGPT presents it as Fast; OpenAI API presents it as Priority.
+REQUEST_TIERS = {"chatgpt": "priority", "openai": "priority"}
+MAX_STATE_BYTES = 256
+STATE_FILENAME = "gpt_fast_policy.json"
+LOCK_FILENAME = "gpt_fast_policy.lock"
+HEALTH_SERVICE_ID = "daaf-anthropic-openai-shim"
+HEALTH_TIMEOUT_SECONDS = 0.6
+HEALTH_BODY_LIMIT = 16_384
+REQUEST_SOURCES = frozenset({"none", "anthropic", "shim_global", "both"})
+# Exact served `fast` is compatibility-only terminal parser vocabulary; it is never
+# valid requested vocabulary or emitted by DAAF.
+SERVED_TIERS = frozenset({"fast", "priority", "default", "flex", "scale", "auto"})
+UTC_SECOND_RE = re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z")
+LOOPBACK_HEALTH_RE = re.compile(r"http://127\.0\.0\.1:([1-9][0-9]{0,4})/health")
+
+
+class PolicyError(RuntimeError):
+    """A bounded, user-safe policy operation failure."""
+
+
+class PolicyDurabilityUncertain(PolicyError):
+    """Atomic publication is visible, but directory durability is unconfirmed."""
+
+    def __init__(self, backend_mode: str, enabled: bool) -> None:
+        super().__init__(
+            "the requested policy state is visible, but directory durability "
+            "could not be confirmed"
+        )
+        self.backend_mode = backend_mode
+        self.enabled = enabled
+
+
+class _DuplicateKeyError(ValueError):
+    pass
+
+
+class _RejectRedirects(urllib.request.HTTPRedirectHandler):
+    """Reject loopback health redirects rather than following their Location."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+@dataclass(frozen=True)
+class PolicySnapshot:
+    """One strict persisted-policy observation.
+
+    ``enabled`` is the persisted boolean only when the state is valid.  A
+    non-``ok`` status always has ``enabled=False`` and ``backend_mode=None``.
+    ``effective`` additionally requires an exact match to the requested lane.
+    """
+
+    status: str
+    backend_mode: Optional[str]
+    enabled: bool
+    effective: bool
+
+    def health_dict(self) -> dict[str, Any]:
+        return {
+            "status": self.status,
+            "backend_mode": self.backend_mode,
+            "enabled": self.enabled,
+            "effective": self.effective,
+        }
+
+
+@dataclass(frozen=True)
+class NormalizationResult:
+    status: str
+    changed: bool
+    snapshot: PolicySnapshot
+
+
+def _reject_duplicate_keys(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise _DuplicateKeyError("duplicate key")
+        result[key] = value
+    return result
+
+
+def _strict_policy_object(raw: bytes) -> Optional[dict[str, Any]]:
+    try:
+        text = raw.decode("utf-8")
+        value = json.loads(text, object_pairs_hook=_reject_duplicate_keys)
+    except (UnicodeDecodeError, ValueError, TypeError, _DuplicateKeyError):
+        return None
+    if not isinstance(value, dict):
+        return None
+    if set(value) != {"version", "backend_mode", "enabled"}:
+        return None
+    version = value.get("version")
+    backend_mode = value.get("backend_mode")
+    enabled = value.get("enabled")
+    if isinstance(version, bool) or not isinstance(version, int) or version != 1:
+        return None
+    if type(backend_mode) is not str or backend_mode not in SUPPORTED_BACKENDS:
+        return None
+    if type(enabled) is not bool:
+        return None
+    return value
+
+
+def _mode_bits(metadata: os.stat_result) -> int:
+    return stat.S_IMODE(metadata.st_mode)
+
+
+def _safe_parent_directory_metadata(metadata: os.stat_result) -> bool:
+    return (
+        stat.S_ISDIR(metadata.st_mode)
+        and metadata.st_uid == os.getuid()
+        and (_mode_bits(metadata) & 0o022) == 0
+    )
+
+
+def _safe_directory_metadata(metadata: os.stat_result) -> bool:
+    return (
+        _safe_parent_directory_metadata(metadata)
+        and _mode_bits(metadata) == 0o700
+    )
+
+
+def _safe_file_metadata(metadata: os.stat_result) -> bool:
+    return (
+        stat.S_ISREG(metadata.st_mode)
+        and metadata.st_uid == os.getuid()
+        and _mode_bits(metadata) == 0o600
+        and metadata.st_nlink == 1
+    )
+
+
+class PolicyStore:
+    """Lock-free strict reader plus serialized atomic writer."""
+
+    def __init__(
+        self,
+        home: Optional[os.PathLike[str] | str] = None,
+        *,
+        fsync: Callable[[int], None] = os.fsync,
+        replace: Callable[..., None] = os.replace,
+    ) -> None:
+        # Capture the home once.  Shim requests must not be redirected by a later
+        # environment mutation, and production has no path override variable.
+        resolved_home = Path(home) if home is not None else Path.home()
+        self.home = resolved_home.expanduser().absolute()
+        self.claude_dir = self.home / ".claude"
+        self.state_dir = self.claude_dir / "provider_shim"
+        self.state_path = self.state_dir / STATE_FILENAME
+        self.lock_path = self.state_dir / LOCK_FILENAME
+        self._fsync = fsync
+        self._replace = replace
+
+    def _open_safe_home(self) -> tuple[Optional[int], str]:
+        flags = (
+            os.O_RDONLY
+            | getattr(os, "O_DIRECTORY", 0)
+            | getattr(os, "O_NOFOLLOW", 0)
+        )
+        try:
+            before = os.lstat(self.home)
+            home_fd = os.open(self.home, flags)
+        except FileNotFoundError:
+            return None, "missing"
+        except PermissionError:
+            return None, "unreadable"
+        except OSError:
+            return None, "unsafe"
+        try:
+            opened = os.fstat(home_fd)
+            if (
+                not _safe_parent_directory_metadata(opened)
+                or (before.st_dev, before.st_ino) != (opened.st_dev, opened.st_ino)
+            ):
+                os.close(home_fd)
+                return None, "unsafe"
+        except Exception:
+            os.close(home_fd)
+            return None, "unreadable"
+        return home_fd, "ok"
+
+    def _open_safe_directory(self) -> tuple[Optional[int], str]:
+        # Traverse every security-relevant component by descriptor. O_NOFOLLOW on
+        # each open forbids a symlink at HOME, .claude, or provider_shim, and no
+        # validated pathname is reopened later.
+        home_fd, status = self._open_safe_home()
+        if home_fd is None:
+            return None, status
+        flags = (
+            os.O_RDONLY
+            | getattr(os, "O_DIRECTORY", 0)
+            | getattr(os, "O_NOFOLLOW", 0)
+        )
+        try:
+            try:
+                claude_fd = os.open(".claude", flags, dir_fd=home_fd)
+            except FileNotFoundError:
+                return None, "missing"
+            except PermissionError:
+                return None, "unreadable"
+            except OSError:
+                return None, "unsafe"
+            try:
+                if not _safe_parent_directory_metadata(os.fstat(claude_fd)):
+                    return None, "unsafe"
+                try:
+                    directory_fd = os.open(
+                        "provider_shim", flags, dir_fd=claude_fd
+                    )
+                except FileNotFoundError:
+                    return None, "missing"
+                except PermissionError:
+                    return None, "unreadable"
+                except OSError:
+                    return None, "unsafe"
+                try:
+                    if not _safe_directory_metadata(os.fstat(directory_fd)):
+                        os.close(directory_fd)
+                        return None, "unsafe"
+                except Exception:
+                    os.close(directory_fd)
+                    return None, "unreadable"
+                return directory_fd, "ok"
+            finally:
+                os.close(claude_fd)
+        finally:
+            os.close(home_fd)
+
+    def _read_from_open_directory(self, directory_fd: int, backend_mode: Optional[str]) -> PolicySnapshot:
+        flags = os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            fd = os.open(STATE_FILENAME, flags, dir_fd=directory_fd)
+        except FileNotFoundError:
+            return PolicySnapshot("missing", None, False, False)
+        except PermissionError:
+            return PolicySnapshot("unreadable", None, False, False)
+        except OSError:
+            return PolicySnapshot("unsafe", None, False, False)
+        try:
+            metadata = os.fstat(fd)
+            if not _safe_file_metadata(metadata):
+                return PolicySnapshot("unsafe", None, False, False)
+            if metadata.st_size > MAX_STATE_BYTES:
+                return PolicySnapshot("invalid", None, False, False)
+            raw = b""
+            while len(raw) <= MAX_STATE_BYTES:
+                chunk = os.read(fd, MAX_STATE_BYTES + 1 - len(raw))
+                if not chunk:
+                    break
+                raw += chunk
+            if len(raw) > MAX_STATE_BYTES:
+                return PolicySnapshot("invalid", None, False, False)
+        except PermissionError:
+            return PolicySnapshot("unreadable", None, False, False)
+        except OSError:
+            return PolicySnapshot("unreadable", None, False, False)
+        finally:
+            os.close(fd)
+        policy = _strict_policy_object(raw)
+        if policy is None:
+            return PolicySnapshot("invalid", None, False, False)
+        bound_backend = policy["backend_mode"]
+        enabled = policy["enabled"]
+        effective = bool(enabled and backend_mode == bound_backend)
+        return PolicySnapshot("ok", bound_backend, enabled, effective)
+
+    def read(self, backend_mode: Optional[str] = None) -> PolicySnapshot:
+        directory_fd, status = self._open_safe_directory()
+        if directory_fd is None:
+            return PolicySnapshot(status, None, False, False)
+        try:
+            return self._read_from_open_directory(directory_fd, backend_mode)
+        finally:
+            os.close(directory_fd)
+
+    def _open_or_create_claude_parent(self) -> int:
+        # Anchor creation at the captured HOME directory descriptor. Path-based
+        # lstat-then-mkdir would permit a rename/symlink swap between validation and
+        # creation of provider_shim. Every descendant operation below remains relative
+        # to the opened, identity-checked descriptor.
+        home_flags = (
+            os.O_RDONLY
+            | getattr(os, "O_DIRECTORY", 0)
+            | getattr(os, "O_NOFOLLOW", 0)
+        )
+        try:
+            home_before = os.lstat(self.home)
+            home_fd = os.open(self.home, home_flags)
+        except OSError as error:
+            raise PolicyError("cannot open the policy home directory safely") from error
+        try:
+            home_opened = os.fstat(home_fd)
+            if (
+                not _safe_parent_directory_metadata(home_opened)
+                or (home_before.st_dev, home_before.st_ino)
+                != (home_opened.st_dev, home_opened.st_ino)
+            ):
+                raise PolicyError("the policy home directory is unsafe")
+            try:
+                os.mkdir(".claude", 0o700, dir_fd=home_fd)
+            except FileExistsError:
+                pass
+            except OSError as error:
+                raise PolicyError(
+                    "cannot create the private policy parent directory"
+                ) from error
+            claude_fd = os.open(".claude", home_flags, dir_fd=home_fd)
+            try:
+                if not _safe_parent_directory_metadata(os.fstat(claude_fd)):
+                    raise PolicyError("the policy parent directory is unsafe")
+            except Exception:
+                os.close(claude_fd)
+                raise
+            return claude_fd
+        except PolicyError:
+            raise
+        except OSError as error:
+            raise PolicyError("cannot inspect the policy parent directory") from error
+        finally:
+            os.close(home_fd)
+
+    def _ensure_private_directory(self) -> int:
+        claude_fd = self._open_or_create_claude_parent()
+        try:
+            try:
+                os.mkdir("provider_shim", 0o700, dir_fd=claude_fd)
+            except FileExistsError:
+                pass
+            except OSError as error:
+                raise PolicyError("cannot create the private policy directory") from error
+            flags = (
+                os.O_RDONLY
+                | getattr(os, "O_DIRECTORY", 0)
+                | getattr(os, "O_NOFOLLOW", 0)
+            )
+            try:
+                directory_fd = os.open("provider_shim", flags, dir_fd=claude_fd)
+            except OSError as error:
+                raise PolicyError("cannot open the private policy directory") from error
+            try:
+                if not _safe_directory_metadata(os.fstat(directory_fd)):
+                    raise PolicyError("the policy directory is unsafe")
+            except Exception:
+                os.close(directory_fd)
+                raise
+            return directory_fd
+        finally:
+            os.close(claude_fd)
+
+    def _open_writer_lock(self, directory_fd: int) -> int:
+        flags = (
+            os.O_RDWR
+            | os.O_CREAT
+            | os.O_NONBLOCK
+            | getattr(os, "O_NOFOLLOW", 0)
+        )
+        try:
+            lock_fd = os.open(LOCK_FILENAME, flags, 0o600, dir_fd=directory_fd)
+        except OSError as error:
+            raise PolicyError("cannot open the private policy writer lock") from error
+        try:
+            if not _safe_file_metadata(os.fstat(lock_fd)):
+                raise PolicyError("the policy writer lock is unsafe")
+            fcntl.flock(lock_fd, fcntl.LOCK_EX)
+            if not _safe_file_metadata(os.fstat(lock_fd)):
+                raise PolicyError("the policy writer lock became unsafe")
+            return lock_fd
+        except PolicyError:
+            os.close(lock_fd)
+            raise
+        except OSError as error:
+            os.close(lock_fd)
+            raise PolicyError("cannot acquire the private policy writer lock") from error
+
+    def _validate_replace_target(self, directory_fd: int) -> None:
+        flags = os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            fd = os.open(STATE_FILENAME, flags, dir_fd=directory_fd)
+        except FileNotFoundError:
+            return
+        except OSError as error:
+            raise PolicyError("the existing policy state is unsafe") from error
+        try:
+            if not _safe_file_metadata(os.fstat(fd)):
+                raise PolicyError("the existing policy state is unsafe")
+        finally:
+            os.close(fd)
+
+    def _publish_locked(self, directory_fd: int, backend_mode: str, enabled: bool) -> None:
+        self._validate_replace_target(directory_fd)
+        payload = json.dumps(
+            {"version": POLICY_VERSION, "backend_mode": backend_mode, "enabled": enabled},
+            separators=(",", ":"),
+            sort_keys=False,
+        ).encode("utf-8")
+        if len(payload) > MAX_STATE_BYTES:
+            raise PolicyError("internal policy serialization exceeded its size bound")
+        temp_name: Optional[str] = None
+        try:
+            # Create by directory descriptor, not a pathname traversal. The random
+            # O_EXCL sibling is unique in exactly the opened/validated filesystem.
+            for _attempt in range(8):
+                candidate = f".gpt_fast_policy.{os.urandom(16).hex()}.tmp"
+                try:
+                    temp_fd = os.open(
+                        candidate,
+                        os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0),
+                        0o600,
+                        dir_fd=directory_fd,
+                    )
+                    temp_name = candidate
+                    break
+                except FileExistsError:
+                    continue
+            else:
+                raise PolicyError("could not allocate a unique policy temporary file")
+            try:
+                os.fchmod(temp_fd, 0o600)
+                if not _safe_file_metadata(os.fstat(temp_fd)):
+                    raise PolicyError("the policy temporary file is unsafe")
+                with os.fdopen(temp_fd, "wb", closefd=True) as handle:
+                    handle.write(payload)
+                    handle.flush()
+                    self._fsync(handle.fileno())
+            except Exception:
+                try:
+                    os.close(temp_fd)
+                except OSError:
+                    pass
+                raise
+            # Re-check after the complete temp write so an unsafe pre-existing
+            # target is never silently replaced. Both source and destination are
+            # resolved relative to the same validated open directory descriptor.
+            self._validate_replace_target(directory_fd)
+            self._replace(
+                temp_name,
+                STATE_FILENAME,
+                src_dir_fd=directory_fd,
+                dst_dir_fd=directory_fd,
+            )
+            # os.replace() is the atomic visibility/commit point. Once it returns,
+            # the destination already names the new complete state and the temporary
+            # name no longer exists. A later directory-fsync failure is therefore not
+            # a publication rollback and must be reported distinctly.
+            temp_name = None
+            try:
+                self._fsync(directory_fd)
+            except OSError as error:
+                raise PolicyDurabilityUncertain(backend_mode, enabled) from error
+        except PolicyError:
+            raise
+        except OSError as error:
+            raise PolicyError("could not publish the policy atomically") from error
+        finally:
+            if temp_name is not None:
+                try:
+                    os.unlink(temp_name, dir_fd=directory_fd)
+                except OSError:
+                    pass
+
+    def write(self, backend_mode: str, enabled: bool) -> PolicySnapshot:
+        if backend_mode not in SUPPORTED_BACKENDS:
+            raise PolicyError("backend mode must be exactly chatgpt or openai")
+        if type(enabled) is not bool:
+            raise PolicyError("enabled must be a real boolean")
+        directory_fd = self._ensure_private_directory()
+        lock_fd: Optional[int] = None
+        try:
+            lock_fd = self._open_writer_lock(directory_fd)
+            self._publish_locked(directory_fd, backend_mode, enabled)
+        finally:
+            if lock_fd is not None:
+                try:
+                    fcntl.flock(lock_fd, fcntl.LOCK_UN)
+                finally:
+                    os.close(lock_fd)
+            os.close(directory_fd)
+        return self.read(backend_mode)
+
+    def normalize_backend(
+        self,
+        backend_mode: str,
+        *,
+        route_boundary_valid: bool = True,
+        native_fast_disabled: bool = True,
+    ) -> NormalizationResult:
+        """Atomically reconcile route binding and global-policy boundaries.
+
+        A valid other-route policy is reset to OFF for this route. A valid
+        current-route ON policy is also reset when either the complete exact GPT
+        provider/backend pair or the exact native-Fast disable boundary is absent.
+        Missing/invalid/unsafe state remains effective OFF and is not replaced.
+        The shared writer lock gives the operation compare-and-set semantics:
+        whichever writer acquires the lock first publishes first, and the later
+        operation re-observes that complete result. ``route_boundary_valid``
+        defaults true so existing CLI/controller callers retain their exact-route
+        behavior; the shim passes its separately computed raw-pair boundary.
+        """
+
+        if backend_mode not in SUPPORTED_BACKENDS:
+            return NormalizationResult(
+                "invalid_backend", False, PolicySnapshot("invalid", None, False, False)
+            )
+        try:
+            directory_fd = self._ensure_private_directory()
+            lock_fd: Optional[int] = None
+            try:
+                lock_fd = self._open_writer_lock(directory_fd)
+                current = self._read_from_open_directory(directory_fd, backend_mode)
+                route_changed = (
+                    current.status == "ok" and current.backend_mode != backend_mode
+                )
+                current_route_on = (
+                    current.status == "ok"
+                    and current.backend_mode == backend_mode
+                    and current.enabled
+                )
+                route_boundary_missing = (
+                    current_route_on and route_boundary_valid is not True
+                )
+                native_boundary_missing = (
+                    current_route_on and native_fast_disabled is not True
+                )
+                if route_changed or route_boundary_missing or native_boundary_missing:
+                    self._publish_locked(directory_fd, backend_mode, False)
+                    current = PolicySnapshot("ok", backend_mode, False, False)
+                    if route_changed:
+                        status = "reset"
+                    elif route_boundary_missing:
+                        status = "reset_route_boundary"
+                    else:
+                        status = "reset_native_boundary"
+                    return NormalizationResult(status, True, current)
+                return NormalizationResult(current.status, False, current)
+            finally:
+                if lock_fd is not None:
+                    try:
+                        fcntl.flock(lock_fd, fcntl.LOCK_UN)
+                    finally:
+                        os.close(lock_fd)
+                os.close(directory_fd)
+        except PolicyDurabilityUncertain:
+            # Publication crossed os.replace(): the reconciled state is visible even
+            # though crash-durability could not be confirmed. Preserve that distinction
+            # for startup diagnostics instead of misclassifying it as an unchanged read.
+            snapshot = self.read(backend_mode)
+            return NormalizationResult("durability_uncertain", True, snapshot)
+        except PolicyError:
+            snapshot = self.read(backend_mode)
+            return NormalizationResult(snapshot.status, False, snapshot)
+
+
+def resolve_exact_route(environment: Optional[dict[str, str]] = None) -> str:
+    env = os.environ if environment is None else environment
+    if env.get("DAAF_PROVIDER_SHIM") != "openai":
+        raise PolicyError("DAAF_PROVIDER_SHIM must be exactly 'openai'")
+    backend_mode = env.get("SHIM_BACKEND_MODE")
+    if backend_mode not in SUPPORTED_BACKENDS:
+        raise PolicyError("SHIM_BACKEND_MODE must be exactly 'chatgpt' or 'openai'")
+    return backend_mode
+
+
+def native_fast_is_disabled(environment: Optional[dict[str, str]] = None) -> bool:
+    """Return true only for the exact supported native-Fast disable boundary."""
+
+    env = os.environ if environment is None else environment
+    return env.get("CLAUDE_CODE_DISABLE_FAST_MODE") == "1"
+
+
+def _bounded_model(value: Any) -> Optional[str]:
+    if not isinstance(value, str) or not value or len(value) > 160:
+        return None
+    if any(ord(character) < 0x20 or ord(character) == 0x7F for character in value):
+        return None
+    allowed = set("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._/:")
+    if any(character not in allowed for character in value):
+        return None
+    return value
+
+
+def _configured_model(environment: dict[str, str]) -> tuple[Optional[str], Optional[str]]:
+    for name in (
+        "ANTHROPIC_DEFAULT_OPUS_MODEL",
+        "ANTHROPIC_DEFAULT_SONNET_MODEL",
+        "CLAUDE_CODE_SUBAGENT_MODEL",
+    ):
+        model = _bounded_model(environment.get(name))
+        if model is not None:
+            return model, name
+    return None, None
+
+
+def _canonical_utc_second(value: Any) -> bool:
+    if not isinstance(value, str) or UTC_SECOND_RE.fullmatch(value) is None:
+        return False
+    try:
+        datetime.strptime(value, "%Y-%m-%dT%H:%M:%SZ")
+    except (OverflowError, ValueError):
+        return False
+    return True
+
+
+def _valid_latest_terminal(value: Any, backend: str) -> bool:
+    if not isinstance(value, dict) or set(value) != {
+        "model",
+        "requested_service_tier",
+        "requested_source",
+        "served_service_tier",
+        "completed_at",
+    }:
+        return False
+    model = value.get("model")
+    if model is not None and _bounded_model(model) is None:
+        return False
+    requested = value.get("requested_service_tier")
+    source = value.get("requested_source")
+    served = value.get("served_service_tier")
+    if requested is not None and requested != REQUEST_TIERS[backend]:
+        return False
+    if type(source) is not str or source not in REQUEST_SOURCES:
+        return False
+    if (source == "none") is not (requested is None):
+        return False
+    if served is not None and (
+        type(served) is not str or served not in SERVED_TIERS
+    ):
+        return False
+    return _canonical_utc_second(value.get("completed_at"))
+
+
+def _bounded_health(url: str) -> Optional[dict[str, Any]]:
+    target = LOOPBACK_HEALTH_RE.fullmatch(url)
+    if target is None or int(target.group(1)) > 65_535:
+        return None
+    try:
+        request = urllib.request.Request(url, method="GET")
+        opener = urllib.request.build_opener(
+            urllib.request.ProxyHandler({}), _RejectRedirects()
+        )
+        with opener.open(request, timeout=HEALTH_TIMEOUT_SECONDS) as response:
+            if response.status != 200:
+                return None
+            raw = response.read(HEALTH_BODY_LIMIT + 1)
+            if len(raw) > HEALTH_BODY_LIMIT:
+                return None
+        payload = json.loads(
+            raw.decode("utf-8"), object_pairs_hook=_reject_duplicate_keys
+        )
+    except (
+        OSError,
+        ValueError,
+        UnicodeDecodeError,
+        _DuplicateKeyError,
+        urllib.error.URLError,
+    ):
+        return None
+    if not isinstance(payload, dict):
+        return None
+    if payload.get("service") != HEALTH_SERVICE_ID:
+        return None
+    if _bounded_model(payload.get("version")) is None:
+        return None
+    if payload.get("backend_mode") not in SUPPORTED_BACKENDS:
+        return None
+    block = payload.get("gpt_service_tier")
+    if not isinstance(block, dict):
+        return None
+    if set(block) != {
+        "backend_mode",
+        "requested_tier_vocabulary",
+        "policy",
+        "native_fast_disabled",
+        "latest_terminal",
+    }:
+        return None
+    backend = block.get("backend_mode")
+    if backend not in SUPPORTED_BACKENDS or backend != payload.get("backend_mode"):
+        return None
+    if block.get("requested_tier_vocabulary") != REQUEST_TIERS[backend]:
+        return None
+    if type(block.get("native_fast_disabled")) is not bool:
+        return None
+    policy = block.get("policy")
+    if not isinstance(policy, dict) or set(policy) != {
+        "status", "backend_mode", "enabled", "effective"
+    }:
+        return None
+    policy_status = policy.get("status")
+    policy_backend = policy.get("backend_mode")
+    policy_enabled = policy.get("enabled")
+    policy_effective = policy.get("effective")
+    if type(policy_status) is not str or policy_status not in {
+        "ok", "missing", "invalid", "unreadable", "unsafe"
+    }:
+        return None
+    if policy_backend is not None and (
+        type(policy_backend) is not str or policy_backend not in SUPPORTED_BACKENDS
+    ):
+        return None
+    if type(policy_enabled) is not bool or type(policy_effective) is not bool:
+        return None
+    if policy_status != "ok" and (
+        policy_backend is not None or policy_enabled or policy_effective
+    ):
+        return None
+    if policy_status == "ok" and policy_backend is None:
+        return None
+    if policy_effective and (not policy_enabled or policy_backend != backend):
+        return None
+    latest = block.get("latest_terminal")
+    if latest is not None and not _valid_latest_terminal(latest, backend):
+        return None
+    # Return only the validated bounded projection consumed by status output. The
+    # production health document also carries URLs and other unrelated fields; keeping
+    # them out of this object prevents accidental future reflection by the CLI.
+    return {
+        "service": HEALTH_SERVICE_ID,
+        "version": payload["version"],
+        "backend_mode": payload["backend_mode"],
+        "gpt_service_tier": {
+            "backend_mode": backend,
+            "requested_tier_vocabulary": block["requested_tier_vocabulary"],
+            "policy": dict(policy),
+            "native_fast_disabled": block["native_fast_disabled"],
+            "latest_terminal": dict(latest) if latest is not None else None,
+        },
+    }
+
+
+def _display_route(backend_mode: str) -> str:
+    return "ChatGPT subscription" if backend_mode == "chatgpt" else "OpenAI API"
+
+
+def _display_tier(backend_mode: str) -> str:
+    return "Fast" if backend_mode == "chatgpt" else "Priority"
+
+
+def _status_lines(
+    store: PolicyStore,
+    backend_mode: str,
+    environment: dict[str, str],
+) -> list[str]:
+    snapshot = store.read(backend_mode)
+    native_fast_disabled = native_fast_is_disabled(environment)
+    effective = bool(snapshot.effective and native_fast_disabled)
+    tier_label = _display_tier(backend_mode)
+    tier_value = REQUEST_TIERS[backend_mode]
+    tier_semantics = (
+        "friendly ChatGPT Fast label; ChatGPT plan/credit semantics, not API Priority billing"
+        if backend_mode == "chatgpt"
+        else "OpenAI API Priority label; API Priority billing/cost semantics"
+    )
+    model, model_source = _configured_model(environment)
+    port = environment.get("SHIM_PORT", "4141")
+    if not port.isdigit() or not 1 <= int(port) <= 65535:
+        port = "4141"
+    health = _bounded_health(f"http://127.0.0.1:{port}/health")
+    lines = [
+        f"Route: {_display_route(backend_mode)} ({backend_mode})",
+        "Scope: shim-wide; applies to newly accepted /v1/messages requests.",
+        (
+            f"Requested service vocabulary: {tier_label} ({tier_semantics}; "
+            f"canonical wire service_tier={tier_value!r})."
+        ),
+        (
+            f"Persisted requested policy: "
+            f"{'ON' if snapshot.status == 'ok' and snapshot.enabled else 'OFF'} "
+            f"(state={snapshot.status}, bound_backend={snapshot.backend_mode or 'unknown'})."
+        ),
+        (
+            f"Effective requested policy: {'ON' if effective else 'OFF'} "
+            "(requires persisted ON, exact route binding, and exact "
+            "CLAUDE_CODE_DISABLE_FAST_MODE=1)."
+        ),
+        (
+            "Native Claude Code Fast disabled: yes"
+            if native_fast_disabled
+            else "Native Claude Code Fast disabled: no (exact CLAUDE_CODE_DISABLE_FAST_MODE=1 is absent)."
+        ),
+    ]
+    if model is None:
+        lines.append("Configured model: unknown (no bounded model mapping found in environment).")
+    else:
+        lines.append(f"Configured model: {model} (from {model_source}).")
+    if health is None or health.get("backend_mode") != backend_mode:
+        lines.append("Shim: unavailable or identity/schema mismatch.")
+        lines.append("Latest terminal: unknown.")
+    else:
+        lines.append(
+            f"Shim: available, version={health.get('version', 'unknown')}, backend={health.get('backend_mode')}."
+        )
+        latest = health["gpt_service_tier"]["latest_terminal"]
+        if latest is None:
+            lines.append("Latest terminal: unknown (no completed upstream terminal in this process).")
+        else:
+            lines.append(
+                "Latest terminal: model={model}; requested={requested}; source={source}; "
+                "served={served}; completed_at={completed}.".format(
+                    model=latest.get("model") or "unknown",
+                    requested=latest.get("requested_service_tier") or "none",
+                    source=latest.get("requested_source"),
+                    served=latest.get("served_service_tier") or "unknown",
+                    completed=latest.get("completed_at"),
+                )
+            )
+    lines.append(
+        f"Caution: requested {tier_label} service is not proof that the provider served {tier_label} service."
+    )
+    return lines
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="gpt_fast.py",
+        description="Control the shim-wide route-bound GPT service-tier request policy.",
+    )
+    parser.add_argument("command", choices=("on", "off", "status"))
+    return parser
+
+
+def main(argv: Optional[list[str]] = None, *, store: Optional[PolicyStore] = None) -> int:
+    parser = _build_parser()
+    args = parser.parse_args(argv)
+    environment = os.environ
+    try:
+        backend_mode = resolve_exact_route(environment)
+    except PolicyError as error:
+        print(f"ERROR: {error}.", file=sys.stderr)
+        print("  Fix: run this command only inside an exact DAAF GPT provider-shim route.", file=sys.stderr)
+        return 20
+    policy_store = store or PolicyStore()
+    tier_label = _display_tier(backend_mode)
+    tier_value = REQUEST_TIERS[backend_mode]
+
+    if args.command == "on":
+        if not native_fast_is_disabled(environment):
+            print(
+                "ERROR: 'on' requires exact CLAUDE_CODE_DISABLE_FAST_MODE=1.",
+                file=sys.stderr,
+            )
+            print(
+                "  Fix: disable Claude Code native Fast mode for the GPT shim route before opting in.",
+                file=sys.stderr,
+            )
+            return 20
+        if backend_mode == "openai":
+            print(
+                "WARNING: OpenAI API Priority Processing can change API cost and depends on account/model eligibility.",
+                file=sys.stderr,
+            )
+        try:
+            snapshot = policy_store.write(backend_mode, True)
+        except PolicyDurabilityUncertain:
+            print(
+                "ERROR: requested policy ON is visible, but durability is uncertain "
+                "because the policy directory could not be synchronized.",
+                file=sys.stderr,
+            )
+            print(
+                "  The committed destination was not rolled back; inspect status and "
+                "repair storage before retrying.",
+                file=sys.stderr,
+            )
+            return 1
+        except PolicyError as error:
+            print(f"ERROR: could not enable the policy: {error}.", file=sys.stderr)
+            print("  Fix: repair the private policy directory/state permissions, then retry.", file=sys.stderr)
+            return 1
+        if not snapshot.effective:
+            print("ERROR: the enabled policy could not be verified safely.", file=sys.stderr)
+            return 1
+        print(
+            f"Requested {tier_label} service is ON for all newly accepted shim requests "
+            f"on {_display_route(backend_mode)} (service_tier={tier_value!r})."
+        )
+        print(f"Requested {tier_label} service is not proof that the provider served it.")
+        return 0
+
+    if args.command == "off":
+        try:
+            snapshot = policy_store.write(backend_mode, False)
+        except PolicyDurabilityUncertain:
+            print(
+                "ERROR: requested policy OFF is visible, but durability is uncertain "
+                "because the policy directory could not be synchronized.",
+                file=sys.stderr,
+            )
+            print(
+                "  The committed destination was not rolled back; inspect status and "
+                "repair storage before retrying.",
+                file=sys.stderr,
+            )
+            return 1
+        except PolicyError as error:
+            print(f"ERROR: could not disable the policy: {error}.", file=sys.stderr)
+            print("  Fix: repair the private policy directory/state permissions, then retry.", file=sys.stderr)
+            return 1
+        if snapshot.status != "ok" or snapshot.enabled:
+            print("ERROR: the disabled policy could not be verified safely.", file=sys.stderr)
+            return 1
+        print(
+            f"Requested {tier_label} service is OFF for all newly accepted shim requests "
+            f"on {_display_route(backend_mode)}; service_tier will be omitted unless valid inbound Anthropic Fast requests it."
+        )
+        return 0
+
+    for line in _status_lines(policy_store, backend_mode, environment):
+        print(line)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/provider_shim/gpt_fast.sh b/scripts/provider_shim/gpt_fast.sh
new file mode 100755
index 00000000..e7399210
--- /dev/null
+++ b/scripts/provider_shim/gpt_fast.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Thin operator entry point for the route-bound GPT service-tier controller.
+if ! command -v readlink >/dev/null 2>&1; then
+    echo "ERROR: readlink is required but was not found." >&2
+    echo "  Fix: run this command inside the DAAF container." >&2
+    exit 30
+fi
+SCRIPT_PATH=""
+if ! SCRIPT_PATH="$(readlink -f -- "${BASH_SOURCE[0]}")"; then
+    echo "ERROR: could not resolve the GPT Fast controller path safely." >&2
+    echo "  Fix: invoke the checked-in wrapper from the DAAF installation." >&2
+    exit 20
+fi
+readonly SCRIPT_PATH
+SCRIPT_DIR=""
+SCRIPT_DIR="$(cd "$(dirname "$SCRIPT_PATH")" && pwd -P)"
+readonly SCRIPT_DIR
+readonly PYTHON_CLI="${SCRIPT_DIR}/gpt_fast.py"
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: bash ${SCRIPT_DIR}/gpt_fast.sh {on|off|status}" >&2
+    exit 20
+fi
+
+case "$1" in
+    on|off|status)
+        ;;
+    *)
+        echo "ERROR: unsupported command." >&2
+        echo "  Fix: use exactly one of: on, off, status." >&2
+        exit 20
+        ;;
+esac
+
+if ! command -v python3 >/dev/null 2>&1; then
+    echo "ERROR: python3 is required but was not found." >&2
+    echo "  Fix: run this command inside the DAAF container." >&2
+    exit 30
+fi
+
+exec python3 "$PYTHON_CLI" "$1"
diff --git a/scripts/provider_shim/start_shim.sh b/scripts/provider_shim/start_shim.sh
index 346c87d7..701cf517 100755
--- a/scripts/provider_shim/start_shim.sh
+++ b/scripts/provider_shim/start_shim.sh
@@ -4,29 +4,44 @@
 #
 # The shim (anthropic_openai_shim.py) translates Anthropic Messages API calls
 # from Claude Code into OpenAI Responses API calls (POST /v1/responses) to a
-# configured backend.
-# This script starts it, stops it, reports status, and — under --auto — silently
-# no-ops unless the user has opted in via DAAF_PROVIDER_SHIM=openai.
+# configured backend. This manager starts it, atomically restarts it, stops it,
+# reports status, rotates its local log, and supervises unexpected exits.
 #
 # Modes:
 #   --auto     Silent no-op unless DAAF_PROVIDER_SHIM=openai. If opted in,
 #              start-if-not-running with a keepalive supervisor. Boot-safe:
-#              never fatal, never blocks (used by the container entrypoint).
+#              never fatal and never blocks container startup indefinitely.
 #   --start    Start the shim (with keepalive supervisor) if not already running.
+#   --restart  Under one lifecycle lock: stop any identity-verified generation,
+#              wait for exit, launch one replacement, and require strict readiness.
 #   --stop     Stop the shim and its supervisor.
-#   --status   Print running/stopped + health JSON.
+#   --status   Print running/stopped + strictly validated health JSON. A stop
+#              caused by the supervisor giving up after a restart storm is
+#              reported distinctly (with timestamp) via the supervisor.state file.
+#   --help     Print public action usage.
 #
 # Config (env, all optional — defaults mirror the shim's own):
 #   DAAF_PROVIDER_SHIM      activation switch; must equal "openai" to auto-start
 #   SHIM_PORT               default 4141
-#   SHIM_BACKEND_MODE       backend lane (v1.2.5): "openai" (default) API-key lane,
-#                           or "chatgpt" ChatGPT-subscription Codex lane. In chatgpt
-#                           mode the shim reads the OAuth access_token from
-#                           $CODEX_HOME/auth.json (NOT an API key) and routes to
-#                           https://chatgpt.com/backend-api/codex/responses with the
-#                           3-header floor. REQUIRES CODEX_HOME set + a readable
-#                           auth.json (this manager warns loudly at start if absent;
-#                           the shim itself fails fast per request).
+#   CLAUDE_CODE_DISABLE_FAST_MODE
+#                           REQUIRED as exact `CLAUDE_CODE_DISABLE_FAST_MODE=1` on
+#                           GPT provider-shim installations/routes. This is Claude
+#                           Code's supported native `/fast` disable/hide control.
+#                           Control the shim-native route tier with:
+#                             bash /daaf/scripts/provider_shim/gpt_fast.sh {on|off|status}
+#                           Both exact backends request canonical wire
+#                           `service_tier:"priority"` when ON. ChatGPT calls this Fast
+#                           under plan/credit semantics; OpenAI API calls it Priority
+#                           under API Priority billing/cost semantics. Setting changes
+#                           require container recreation and a new Claude session,
+#                           not a daemon restart or image rebuild. In-container DAAF
+#                           code does not mutate the private host configuration.
+#   SHIM_BACKEND_MODE       backend lane selector: exact "openai" for the API-key
+#                           provider-shim route, or exact "chatgpt" for the
+#                           ChatGPT-subscription Codex route. The legacy shim process
+#                           still normalizes case/whitespace and defaults/falls back to
+#                           "openai", but route detection and the GPT service-tier
+#                           controller deliberately require an explicit exact token.
 #   SHIM_BACKEND_BASE_URL   default is mode-conditional: openai ->
 #                           https://api.openai.com/v1; chatgpt ->
 #                           https://chatgpt.com/backend-api/codex. Explicit value
@@ -35,48 +50,48 @@
 #                           ignored in chatgpt mode)
 #   CODEX_HOME              (chatgpt mode) directory holding auth.json, the codex
 #                           OAuth token store (mode 0600). Compose sets it to
-#                           /home/appuser/.claude/codex-daaf.
-#   SHIM_OAUTH_TOKEN_URL    (chatgpt mode) TEST/STAGING OVERRIDE only. Production
-#                           default is the hardcoded auth.openai.com/oauth/token;
-#                           set only to point the token refresh at a mock/staging
-#                           endpoint. Leave unset in production.
-#   SHIM_OAUTH_CLIENT_ID    (chatgpt mode) TEST/STAGING OVERRIDE only. Production
-#                           default is the hardcoded codex first-party client_id;
-#                           set only for a mock/staging endpoint expecting a
-#                           different client_id. Leave unset in production.
+#                           /home/appuser/.claude/codex-daaf. As of v1.3.0 the shim
+#                           only READS this store; codex is the single writer and
+#                           performs any token refresh (see SHIM_CODEX_BIN).
+#   SHIM_CODEX_BIN          (chatgpt mode) codex binary the shim spawns to delegate
+#                           token refresh (`codex login status`). Default "codex"
+#                           (on PATH in the DAAF image). v1.3.0.
+#   SHIM_CODEX_TIMEOUT_S    (chatgpt mode) wall-clock bound (float seconds) on the
+#                           delegated `codex login status` subprocess. Default 30;
+#                           an unparseable value falls back to 30. v1.3.0.
 #   SHIM_STRIP_MODEL_PREFIX default ""
-#   SHIM_SANITIZE_TOOLS     default "1" (enabled); strips known GPT tool-call
-#                           quirks — set to 0 (and restart the shim) for
+#   SHIM_SANITIZE_TOOLS     default "1" (enabled); set to 0 and restart for
 #                           DAAFBench runs of shim-routed models
-#   SHIM_REASONING_EFFORT   tier 3 of the v1.2.3 effort precedence chain
-#                           (per-request signal > "#<effort>" slug suffix > this
-#                           env var > default "high"); sets reasoning.effort only
-#                           when no per-request signal or slug suffix is present.
-#                           An inbound per-request "high" is treated as unset
-#                           since v1.2.3 (the client pins it for GPT slugs).
-#                           Valid: none|low|medium|high|xhigh|max ("max" is
-#                           gpt-5.6-only). Unset -> default "high" (the shim
-#                           always sends an effort since v1.2.2)
-#   SHIM_TEXT_VERBOSITY     response verbosity (v1.2.4+); the outbound request
-#                           always carries text.verbosity. Valid low|medium|high;
-#                           default "high" (warmth/volume, parity with DAAF's
-#                           posture). Read once at startup like the flags above.
+#   SHIM_REASONING_EFFORT   tier 3 of the effort precedence chain (per-request
+#                           signal > "#<effort>" slug suffix > env > high)
+#   SHIM_TEXT_VERBOSITY     low|medium|high; default high
 #
-# Keepalive: a background supervisor restarts the shim if it exits, with a short
-# sleep between restarts. A restart-storm guard stops after 10 crashes in 60s
-# and logs loudly, so a misconfigured shim can't spin forever.
+# Keepalive: the supervisor restarts the shim after an unexpected exit. A guard
+# stops after 10 crashes in 60 seconds so a broken configuration cannot spin.
+# On every lifecycle transition the supervisor records its phase
+# (running|gave_up_storm|stopped) in logs/supervisor.state next to the PID file,
+# so a storm give-up stays visible to --status instead of looking like a clean
+# stop. The state file carries the PID file's safety conventions (symlink
+# refusal, mode 0600, atomic write, cleanup on stop).
 #
-# Logging: the shim's stderr and the supervisor's own messages are appended to
-#   logs/shim.log. The log dir is created on demand and is gitignored.
+# Logging: shim stderr and supervisor records share logs/shim.log. Supervisor
+# records are emitted once to stderr; the supervisor's single outer redirect is
+# the only writer, avoiding the historical tee + redirect duplicate. Before a
+# new supervisor starts, a >25 MiB log rotates to shim.log.1 with five retained
+# generations. The 25 MiB / five-generation policy is fixed deliberately: the
+# observed 12.7 MiB over nine days remains comfortably below one generation,
+# while worst-case retained supervisor history stays bounded near 150 MiB.
+# Rotation is serialized with lifecycle start/restart/stop, rejects symlink/non-regular
+# targets, and creates the replacement log (0600) before the first new record.
 # =============================================================================
 
 set -uo pipefail
-# Deliberately omit -e: several paths (health probe, stale-pid cleanup) inspect
-# failures and decide what to do rather than aborting. This is a lifecycle
-# manager, not a safety hook — it must degrade gracefully, especially under
-# --auto where it runs at container boot.
+umask 077
+# Deliberately omit -e: health probes, stale-state cleanup, and process teardown
+# inspect failures and choose an explicit recovery path. --auto must degrade
+# gracefully rather than aborting container boot.
 
-# --- Config ---
+# --- Config -----------------------------------------------------------------
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 readonly SCRIPT_DIR
 readonly SHIM_PY="${SCRIPT_DIR}/anthropic_openai_shim.py"
@@ -84,292 +99,1176 @@ readonly LOG_DIR="${SCRIPT_DIR}/logs"
 readonly LOG_FILE="${LOG_DIR}/shim.log"
 readonly PID_FILE="${LOG_DIR}/shim.pid"
 readonly SUP_PID_FILE="${LOG_DIR}/supervisor.pid"
-# Records the supervisor's process-group id so --stop can reap the supervisor
-# AND its shim child atomically (they share a session/group via setsid). A plain
-# per-pid kill races the supervisor's restart loop, which can respawn a child in
-# the kill window and orphan it — observed during live validation.
+readonly SUP_STATE_FILE="${LOG_DIR}/supervisor.state"
 readonly PGID_FILE="${LOG_DIR}/pgid"
-# Sentinel written by --stop, polled by the supervisor loop, so a stop can never
-# race a restart.
 readonly STOP_FILE="${LOG_DIR}/stop.requested"
+readonly QUOTA_STATE_FILE="${LOG_DIR}/quota_state.json"
+readonly LOCK_DIR="${LOG_DIR}/lifecycle.lock"
+readonly LOCK_OWNER_FILE="${LOCK_DIR}/owner.pid"
+readonly LOG_WRITE_LOCK_DIR="${LOG_DIR}/log-write.lock"
+readonly LOG_WRITE_OWNER_FILE="${LOG_WRITE_LOCK_DIR}/owner.pid"
+readonly SHIM_SERVICE_ID="daaf-anthropic-openai-shim"
 
 SHIM_PORT="${SHIM_PORT:-4141}"
+readonly SHIM_PORT
 readonly HEALTH_URL="http://127.0.0.1:${SHIM_PORT}/health"
 
-# Restart-storm guard.
-readonly STORM_LIMIT=10      # crashes...
-readonly STORM_WINDOW=60     # ...within this many seconds -> give up
+readonly LOG_MAX_BYTES=26214400  # 25 MiB; rotate only when strictly greater.
+readonly LOG_GENERATIONS=5
+readonly STORM_LIMIT=10
+readonly STORM_WINDOW=60
+readonly RESTART_DELAY=2
+readonly READINESS_WAIT=15
 
-# --- Helpers ---
-log_line() {
-    # Timestamped supervisor/manager line -> log file and stderr.
-    printf '%s SUPERVISOR %s\n' "$(date -u '+%Y-%m-%d %H:%M:%S')" "$*" | tee -a "$LOG_FILE" >&2
+# Test-only timing controls are intentionally outside the SHIM_* user-config
+# namespace and activate only when the isolated Bats harness opts in. Production
+# always uses the fixed policy above.
+storm_limit="$STORM_LIMIT"
+storm_window="$STORM_WINDOW"
+restart_delay="$RESTART_DELAY"
+readiness_wait="$READINESS_WAIT"
+if [ "${DAAF_SHIM_TEST_MODE:-0}" = "1" ]; then
+    storm_limit="${DAAF_SHIM_TEST_STORM_LIMIT:-$STORM_LIMIT}"
+    storm_window="${DAAF_SHIM_TEST_STORM_WINDOW:-$STORM_WINDOW}"
+    restart_delay="${DAAF_SHIM_TEST_RESTART_DELAY:-$RESTART_DELAY}"
+    readiness_wait="${DAAF_SHIM_TEST_READINESS_WAIT:-$READINESS_WAIT}"
+fi
+
+HEALTH_JSON=""
+HEALTH_REASON="not_probed"
+EXPECTED_SHIM_VERSION=""
+EXPECTED_BACKEND_MODE="openai"
+START_FAILURE_KIND="not_started"
+ACTIVE_LAUNCH_PID=""
+LIFECYCLE_LOCK_HELD=0
+
+# --- Filesystem and logging helpers -----------------------------------------
+path_is_safe_file_target() {
+    # Missing is safe; an existing target must be a regular, non-symlink file.
+    local target="$1"
+    [ ! -L "$target" ] || return 1
+    [ ! -e "$target" ] || [ -f "$target" ]
 }
 
 ensure_log_dir() {
-    mkdir -p "$LOG_DIR" 2>/dev/null || true
+    if [ -L "$LOG_DIR" ]; then
+        printf 'ERROR: shim log directory is a symlink: %s\n' "$LOG_DIR" >&2
+        printf '  Fix: replace it with a real directory owned by the container user.\n' >&2
+        return 1
+    fi
+    if [ -e "$LOG_DIR" ] && [ ! -d "$LOG_DIR" ]; then
+        printf 'ERROR: shim log path exists but is not a directory: %s\n' "$LOG_DIR" >&2
+        printf '  Fix: move that object aside and recreate a private directory.\n' >&2
+        return 1
+    fi
+    mkdir -p "$LOG_DIR" || return 1
+    chmod 0700 "$LOG_DIR" || return 1
+    return 0
+}
+
+state_targets_are_safe() {
+    # quota_state.json is a shim-written state file that lives in this same LOG_DIR
+    # (install-shared, read by any install's statusline), so it belongs in the
+    # symlink/non-regular hijack checklist alongside the other named state targets.
+    # The reasoning-cache file is deliberately NOT covered here: it lives under
+    # $HOME/.claude/provider_shim/, outside start_shim's domain — the shim owns that
+    # path and its atomic publish uses os.replace, which does not dereference a
+    # destination symlink (rename(2) replaces the symlink entry itself).
+    local target generation
+    for target in "$LOG_FILE" "$PID_FILE" "$SUP_PID_FILE" "$SUP_STATE_FILE" "$PGID_FILE" "$STOP_FILE" "$QUOTA_STATE_FILE"; do
+        if ! path_is_safe_file_target "$target"; then
+            printf 'ERROR: refusing unsafe shim state target: %s\n' "$target" >&2
+            printf '  Fix: remove the symlink/non-regular object and retry.\n' >&2
+            return 1
+        fi
+    done
+    generation=1
+    while [ "$generation" -le "$LOG_GENERATIONS" ]; do
+        target="${LOG_FILE}.${generation}"
+        if ! path_is_safe_file_target "$target"; then
+            printf 'ERROR: refusing unsafe shim log-generation target: %s\n' "$target" >&2
+            printf '  Fix: remove the symlink/non-regular object and retry.\n' >&2
+            return 1
+        fi
+        generation=$((generation + 1))
+    done
+    if [ -L "$LOCK_DIR" ] || { [ -e "$LOCK_DIR" ] && [ ! -d "$LOCK_DIR" ]; }; then
+        printf 'ERROR: refusing unsafe shim lifecycle-lock target: %s\n' "$LOCK_DIR" >&2
+        printf '  Fix: remove the symlink/non-directory object and retry.\n' >&2
+        return 1
+    fi
+    if [ -L "$LOG_WRITE_LOCK_DIR" ] || {
+        [ -e "$LOG_WRITE_LOCK_DIR" ] && [ ! -d "$LOG_WRITE_LOCK_DIR" ]
+    }; then
+        printf 'ERROR: refusing unsafe shim log-write-lock target: %s\n' \
+            "$LOG_WRITE_LOCK_DIR" >&2
+        printf '  Fix: remove the symlink/non-directory object and retry.\n' >&2
+        return 1
+    fi
+    return 0
+}
+
+acquire_log_write_lock() {
+    local owner attempts=0
+    while [ "$attempts" -lt 200 ]; do
+        if mkdir "$LOG_WRITE_LOCK_DIR" 2>/dev/null; then
+            printf '%s\n' "${BASHPID:-$$}" > "$LOG_WRITE_OWNER_FILE" || return 1
+            chmod 0700 "$LOG_WRITE_LOCK_DIR" || return 1
+            chmod 0600 "$LOG_WRITE_OWNER_FILE" || return 1
+            return 0
+        fi
+        owner="$(read_pid_file "$LOG_WRITE_OWNER_FILE")" || owner=""
+        if [ -z "$owner" ] || ! kill -0 "$owner" 2>/dev/null; then
+            rm -f "$LOG_WRITE_OWNER_FILE" 2>/dev/null || true
+            rmdir "$LOG_WRITE_LOCK_DIR" 2>/dev/null || true
+        else
+            sleep 0.01
+        fi
+        attempts=$((attempts + 1))
+    done
+    printf 'ERROR: timed out acquiring shim log-write lock: %s\n' \
+        "$LOG_WRITE_LOCK_DIR" >&2
+    return 1
+}
+
+release_log_write_lock() {
+    rm -f "$LOG_WRITE_OWNER_FILE" 2>/dev/null || true
+    rmdir "$LOG_WRITE_LOCK_DIR" 2>/dev/null || true
+}
+
+# --- Supervisor state file (lifecycle status honesty) -----------------------
+write_supervisor_state() {
+    # Record the supervisor's lifecycle phase (running|gave_up_storm|stopped) so
+    # --status can distinguish a storm give-up from a clean stop or a never-started
+    # daemon. Written by the supervisor directly — like the PID files it also
+    # writes, and unlike the log records, it is not serialized under the
+    # log-write lock; the lifecycle lock already serializes the manager actions
+    # that would race with it. It carries the same safety conventions as the PID
+    # file: symlink/non-regular refusal before any write, mode 0600, and an atomic
+    # rename so --status never observes a half-written record.
+    #
+    # Shared-workspace note: in shared-workspace deployments two containers may
+    # share /daaf, including this state directory, so supervisor.state — exactly
+    # like the PID file today — is install-shared, not per-container; docs advise
+    # running one active pipeline at a time.
+    local phase="$1" record tmp
+    case "$phase" in
+        running|gave_up_storm|stopped) ;;
+        *) return 1 ;;
+    esac
+    path_is_safe_file_target "$SUP_STATE_FILE" || return 1
+    tmp="${SUP_STATE_FILE}.tmp.${BASHPID:-$$}"
+    path_is_safe_file_target "$tmp" || return 1
+    record="$(printf '%s %s' "$phase" "$(date -u '+%Y-%m-%d %H:%M:%S')")"
+    printf '%s\n' "$record" > "$tmp" || { rm -f "$tmp" 2>/dev/null || true; return 1; }
+    chmod 0600 "$tmp" 2>/dev/null || true
+    # Atomic replace: SUP_STATE_FILE was preflighted as a non-symlink, so mv
+    # cannot be redirected through a planted link.
+    mv "$tmp" "$SUP_STATE_FILE" || { rm -f "$tmp" 2>/dev/null || true; return 1; }
+    return 0
+}
+
+read_supervisor_state() {
+    # Emit "phase<TAB>timestamp" for a valid, non-symlink state file, or fail
+    # quietly. Only the three known phase tokens are honored; anything else (a
+    # truncated or garbage file) is treated as absent so --status falls back to
+    # plain "stopped" rather than trusting an unrecognized record.
+    local line phase rest
+    path_is_safe_file_target "$SUP_STATE_FILE" || return 1
+    [ -f "$SUP_STATE_FILE" ] || return 1
+    line="$(awk 'NR == 1 { print; exit }' "$SUP_STATE_FILE" 2>/dev/null)" || return 1
+    phase="${line%% *}"
+    rest="${line#* }"
+    case "$phase" in
+        running|gave_up_storm|stopped) ;;
+        *) return 1 ;;
+    esac
+    [ "$rest" != "$line" ] || rest=""
+    printf '%s\t%s' "$phase" "$rest"
+}
+
+append_log_record() {
+    local record="$1" rc=0
+    acquire_log_write_lock || return 1
+    state_targets_are_safe || rc=1
+    if [ "$rc" -eq 0 ]; then
+        if [ ! -e "$LOG_FILE" ]; then
+            : > "$LOG_FILE" || rc=1
+            [ "$rc" -ne 0 ] || chmod 0600 "$LOG_FILE" || rc=1
+        fi
+    fi
+    if [ "$rc" -eq 0 ] && [ "${DAAF_SHIM_TEST_MODE:-0}" = "1" ] && \
+        [ "${DAAF_SHIM_TEST_RESULT_APPEND_FAILURE:-0}" = "1" ]; then
+        case "$record" in
+            *' MANAGER SHIM_RESTART_RESULT '*) rc=1 ;;
+        esac
+    fi
+    if [ "$rc" -eq 0 ]; then
+        printf '%s\n' "$record" >> "$LOG_FILE" || rc=1
+    fi
+    release_log_write_lock
+    return "$rc"
+}
+
+log_line() {
+    # Every supervisor event has one authoritative append. A separate terminal
+    # write occurs only when stderr is an interactive TTY; it never feeds back
+    # through the log writer and therefore cannot duplicate the stored record.
+    local record
+    record="$(printf '%s SUPERVISOR %s' "$(date -u '+%Y-%m-%d %H:%M:%S')" "$*")"
+    append_log_record "$record" || return 1
+    [ -t 2 ] && printf '%s\n' "$record" >&2
+    return 0
+}
+
+manager_log_line() {
+    # Foreground manager events append once and remain visible to their caller.
+    local record
+    record="$(printf '%s MANAGER %s' "$(date -u '+%Y-%m-%d %H:%M:%S')" "$*")"
+    append_log_record "$record" || return 1
+    printf '%s\n' "$record" >&2
+}
+
+write_stream_to_log() {
+    # Preserve Python's structured records byte-for-byte while serializing each
+    # physical line through the same append lock as supervisor/manager records.
+    local line
+    while IFS= read -r line || [ -n "$line" ]; do
+        append_log_record "$line" || return 1
+    done
+}
+
+rotate_log_if_needed_unlocked() {
+    ensure_log_dir || return 1
+    state_targets_are_safe || return 1
+
+    if [ ! -e "$LOG_FILE" ]; then
+        : > "$LOG_FILE" || return 1
+        chmod 0600 "$LOG_FILE" || return 1
+        return 0
+    fi
+
+    local size generation previous
+    size="$(wc -c < "$LOG_FILE" 2>/dev/null)" || return 1
+    case "$size" in
+        ''|*[!0-9]*)
+            printf 'ERROR: could not determine shim log size safely: %s\n' "$LOG_FILE" >&2
+            return 1
+            ;;
+    esac
+
+    if [ "$size" -le "$LOG_MAX_BYTES" ]; then
+        chmod 0600 "$LOG_FILE" || return 1
+        return 0
+    fi
+
+    # All targets were preflighted before mutation. Descending renames preserve
+    # generations deterministically; the oldest regular file is removed first.
+    if [ -e "${LOG_FILE}.${LOG_GENERATIONS}" ]; then
+        rm -f "${LOG_FILE}.${LOG_GENERATIONS}" || return 1
+    fi
+    generation="$LOG_GENERATIONS"
+    while [ "$generation" -gt 1 ]; do
+        previous=$((generation - 1))
+        if [ -e "${LOG_FILE}.${previous}" ]; then
+            mv "${LOG_FILE}.${previous}" "${LOG_FILE}.${generation}" || return 1
+            chmod 0600 "${LOG_FILE}.${generation}" || return 1
+        fi
+        generation=$((generation - 1))
+    done
+    mv "$LOG_FILE" "${LOG_FILE}.1" || return 1
+    chmod 0600 "${LOG_FILE}.1" || return 1
+    : > "$LOG_FILE" || return 1
+    chmod 0600 "$LOG_FILE" || return 1
+    return 0
+}
+
+rotate_log_if_needed() {
+    local rc
+    acquire_log_write_lock || return 1
+    rotate_log_if_needed_unlocked
+    rc=$?
+    release_log_write_lock
+    return "$rc"
+}
+
+# --- Configuration and health helpers --------------------------------------
+source_shim_version() {
+    local version
+    version="$(awk -F'"' '/^SHIM_VERSION = "/ { print $2; exit }' "$SHIM_PY" 2>/dev/null)"
+    case "$version" in
+        ''|*[!0-9A-Za-z._+-]*) return 1 ;;
+    esac
+    printf '%s' "$version"
 }
 
-health_json() {
-    # Print the health JSON to stdout, or nothing. Returns 0 iff healthy.
-    local out
-    out="$(curl -fsS --max-time 2 "$HEALTH_URL" 2>/dev/null)" || return 1
-    printf '%s' "$out"
+resolve_backend_mode() {
+    local raw normalized
+    raw="${SHIM_BACKEND_MODE:-openai}"
+    # Match the shim's practical startup semantics: trim surrounding whitespace,
+    # lowercase, accept the two known values, otherwise fall back to openai.
+    normalized="${raw#"${raw%%[![:space:]]*}"}"
+    normalized="${normalized%"${normalized##*[![:space:]]}"}"
+    normalized="$(printf '%s' "$normalized" | tr '[:upper:]' '[:lower:]')"
+    case "$normalized" in
+        openai|chatgpt) EXPECTED_BACKEND_MODE="$normalized" ;;
+        *) EXPECTED_BACKEND_MODE="openai" ;;
+    esac
+}
+
+load_expected_contract() {
+    EXPECTED_SHIM_VERSION="$(source_shim_version)" || {
+        printf 'ERROR: could not derive SHIM_VERSION from %s.\n' "$SHIM_PY" >&2
+        printf '  Fix: restore the provider-shim source file and retry.\n' >&2
+        return 1
+    }
+    resolve_backend_mode
+    return 0
+}
+
+probe_health() {
+    HEALTH_JSON=""
+    HEALTH_REASON="unreachable"
+    local response http_status out
+    response="$(curl -sS --max-time 2 --write-out $'\n%{http_code}' \
+        "$HEALTH_URL" 2>/dev/null)"
+    http_status="${response##*$'\n'}"
+    case "$http_status" in
+        [0-9][0-9][0-9]) ;;
+        *) return 1 ;;
+    esac
+    if [ "$http_status" = "000" ]; then
+        return 1
+    fi
+    if [ "$http_status" != "200" ]; then
+        HEALTH_REASON="http_status_${http_status}"
+        return 1
+    fi
+    # Any received 200 is reachable. Validate only its captured body and never
+    # expose that body in diagnostics, even if curl reported a transfer anomaly.
+    out="${response%$'\n'*}"
+    HEALTH_JSON="$out"
+
+    if ! printf '%s' "$out" | jq -e 'type == "object"' >/dev/null 2>&1; then
+        HEALTH_REASON="malformed_json"
+        return 1
+    fi
+    if ! printf '%s' "$out" | jq -e --arg service "$SHIM_SERVICE_ID" \
+        '.service == $service and .status == "ok"' >/dev/null 2>&1; then
+        HEALTH_REASON="wrong_identity_or_status"
+        return 1
+    fi
+    if ! printf '%s' "$out" | jq -e --arg version "$EXPECTED_SHIM_VERSION" \
+        '.version == $version' >/dev/null 2>&1; then
+        HEALTH_REASON="version_mismatch"
+        return 1
+    fi
+    if ! printf '%s' "$out" | jq -e --arg mode "$EXPECTED_BACKEND_MODE" \
+        '.backend_mode == $mode' >/dev/null 2>&1; then
+        HEALTH_REASON="backend_mode_mismatch"
+        return 1
+    fi
+    HEALTH_REASON="ready"
     return 0
 }
 
 is_healthy() {
-    curl -fsS --max-time 2 "$HEALTH_URL" >/dev/null 2>&1
+    probe_health >/dev/null
+}
+
+emit_readiness_failure() {
+    printf 'SHIM_READINESS_FAILURE status=failed reason=%s expected_service=%s expected_version=%s expected_backend_mode=%s port=%s\n' \
+        "$HEALTH_REASON" "$SHIM_SERVICE_ID" "${EXPECTED_SHIM_VERSION:--}" \
+        "$EXPECTED_BACKEND_MODE" "$SHIM_PORT" >&2
+}
+
+# A1-R6a (v1.3.0): surface the /health auth block's validity as a human-readable line
+# so an expiring/dead ChatGPT subscription is visible BEFORE work starts (and via
+# --status). Reads the auth block already captured in HEALTH_JSON by probe_health — no
+# extra request. Prints nothing when the block is absent or "n/a" (the openai API-key
+# lane does not use the codex OAuth store). Both fields are sanitized to bounded,
+# single-line tokens (the D4 injection convention, mirroring do_auto's `observed`)
+# before reaching the terminal: they originate from our own /health but are DERIVED
+# from the on-disk token store, so they are treated as untrusted for output.
+print_auth_line() {
+    command -v jq >/dev/null 2>&1 || return 0
+    [ -n "$HEALTH_JSON" ] || return 0
+    local state days
+    state="$(printf '%s' "$HEALTH_JSON" | jq -r '.auth.state // empty' 2>/dev/null \
+        | tr -cd 'a-z/' | cut -c1-16)"
+    [ -n "$state" ] && [ "$state" != "n/a" ] || return 0
+    days="$(printf '%s' "$HEALTH_JSON" | jq -r '.auth.days_left // empty' 2>/dev/null \
+        | tr -cd '0-9.-' | cut -c1-16)"
+    case "$state" in
+        valid)
+            printf 'AUTH: ChatGPT subscription auth is valid (expires in %s days).\n' \
+                "${days:-?}" >&2
+            ;;
+        expiring)
+            printf 'WARNING: ChatGPT subscription auth expires in %s days. Run `codex login --device-auth` inside the container to re-authenticate before it lapses.\n' \
+                "${days:-?}" >&2
+            ;;
+        expired|absent|unreadable)
+            printf 'WARNING: ChatGPT subscription auth is dead (%s) — run `codex login --device-auth` inside the container to re-authenticate.\n' \
+                "$state" >&2
+            ;;
+        *)
+            printf 'AUTH: ChatGPT subscription auth state: %s.\n' "$state" >&2
+            ;;
+    esac
+}
+
+# --- Process identity helpers ----------------------------------------------
+is_decimal_pid() {
+    case "${1:-}" in
+        ''|*[!0-9]*) return 1 ;;
+        *) [ "$1" -gt 1 ] 2>/dev/null ;;
+    esac
+}
+
+read_pid_file() {
+    local path="$1" value
+    value="$(awk 'NR == 1 { print; exit }' "$path" 2>/dev/null)"
+    is_decimal_pid "$value" || return 1
+    printf '%s' "$value"
+}
+
+pid_has_exact_arg() {
+    local pid="$1" expected="$2" arg
+    [ -r "/proc/${pid}/cmdline" ] || return 1
+    while IFS= read -r -d '' arg; do
+        [ "$arg" = "$expected" ] && return 0
+    done < "/proc/${pid}/cmdline"
+    return 1
+}
+
+pid_is_supervisor() {
+    local pid="$1"
+    is_decimal_pid "$pid" || return 1
+    kill -0 "$pid" 2>/dev/null || return 1
+    pid_has_exact_arg "$pid" "$SHIM_PY" && return 1
+    pid_has_exact_arg "$pid" "${BASH_SOURCE[0]}" || return 1
+    pid_has_exact_arg "$pid" "__supervise"
+}
+
+pid_is_shim() {
+    local pid="$1"
+    is_decimal_pid "$pid" || return 1
+    kill -0 "$pid" 2>/dev/null || return 1
+    pid_has_exact_arg "$pid" "$SHIM_PY"
 }
 
 supervisor_running() {
-    # 0 iff a live supervisor process is recorded and still alive.
-    [ -f "$SUP_PID_FILE" ] || return 1
     local sp
-    sp="$(cat "$SUP_PID_FILE" 2>/dev/null || true)"
-    [ -n "$sp" ] || return 1
-    kill -0 "$sp" 2>/dev/null
+    sp="$(read_pid_file "$SUP_PID_FILE")" || return 1
+    pid_is_supervisor "$sp"
+}
+
+process_group_is_owned() {
+    local pgid="$1" supervisor_pid="$2" actual
+    is_decimal_pid "$pgid" || return 1
+    [ "$pgid" = "$supervisor_pid" ] || return 1
+    pid_is_supervisor "$supervisor_pid" || return 1
+    actual="$(ps -o pgid= -p "$supervisor_pid" 2>/dev/null | tr -d ' ')"
+    [ "$actual" = "$pgid" ]
 }
 
-# --- Keepalive supervisor -----------------------------------------------------
-# Runs in the background (invoked as: this_script __supervise). Loops: launch
-# the shim, wait for it, restart on exit, honoring the storm guard. Writes the
-# shim's PID to PID_FILE each cycle and its own PID to SUP_PID_FILE.
+terminate_verified_pid() {
+    local role="$1" pid="$2" waited=0
+    case "$role" in
+        supervisor) pid_is_supervisor "$pid" || return 1 ;;
+        shim) pid_is_shim "$pid" || return 1 ;;
+        *) return 1 ;;
+    esac
+    kill -TERM "$pid" 2>/dev/null || true
+    while [ "$waited" -lt 5 ]; do
+        if [ "$role" = "supervisor" ]; then
+            pid_is_supervisor "$pid" || return 0
+        else
+            pid_is_shim "$pid" || return 0
+        fi
+        sleep 1
+        waited=$((waited + 1))
+    done
+    if [ "$role" = "supervisor" ]; then
+        pid_is_supervisor "$pid" && kill -KILL "$pid" 2>/dev/null || true
+    else
+        pid_is_shim "$pid" && kill -KILL "$pid" 2>/dev/null || true
+    fi
+    return 0
+}
+
+# --- Lifecycle lock ---------------------------------------------------------
+acquire_lifecycle_lock() {
+    local wait_mode="${1:-wait}" owner attempts=0
+    ensure_log_dir || return 1
+    state_targets_are_safe || return 1
+
+    # Public lifecycle actions serialize by waiting for the current live owner.
+    # This lock is deliberately acquired only by outer action wrappers; helpers
+    # with a _locked suffix never recurse into this non-reentrant lock.
+    # Sixty seconds exceeds the manager's five-second stop plus 15-second
+    # readiness budget while remaining bounded if an owner is wedged.
+    while [ "$attempts" -lt 6000 ]; do
+        if mkdir "$LOCK_DIR" 2>/dev/null; then
+            LIFECYCLE_LOCK_HELD=1
+            trap release_lifecycle_lock EXIT
+            trap 'exit 130' INT TERM HUP
+            if ! printf '%s\n' "$$" > "$LOCK_OWNER_FILE"; then
+                release_lifecycle_lock
+                return 1
+            fi
+            if ! chmod 0700 "$LOCK_DIR" || ! chmod 0600 "$LOCK_OWNER_FILE"; then
+                release_lifecycle_lock
+                return 1
+            fi
+            return 0
+        fi
+
+        owner="$(read_pid_file "$LOCK_OWNER_FILE")" || owner=""
+        if [ -z "$owner" ] || ! kill -0 "$owner" 2>/dev/null; then
+            # A dead/malformed owner means a prior manager died while holding the
+            # lock. Remove only the known owner file and empty lock directory.
+            rm -f "$LOCK_OWNER_FILE" 2>/dev/null || true
+            rmdir "$LOCK_DIR" 2>/dev/null || true
+        else
+            if [ "$wait_mode" = "no_wait" ]; then
+                printf 'ERROR: another shim lifecycle action is active (pid %s).\n' "$owner" >&2
+                printf '  Fix: let it finish; boot will continue and a later health check can retry.\n' >&2
+                return 1
+            fi
+            sleep 0.01
+        fi
+        attempts=$((attempts + 1))
+    done
+
+    printf 'ERROR: timed out acquiring shim lifecycle lock: %s\n' "$LOCK_DIR" >&2
+    printf '  Fix: wait for the active lifecycle action to finish, then retry.\n' >&2
+    return 1
+}
+
+release_lifecycle_lock() {
+    local owner=""
+    if [ "$LIFECYCLE_LOCK_HELD" -eq 1 ]; then
+        owner="$(read_pid_file "$LOCK_OWNER_FILE")" || owner=""
+        if [ "$owner" = "$$" ]; then
+            rm -f "$LOCK_OWNER_FILE" 2>/dev/null || true
+            rmdir "$LOCK_DIR" 2>/dev/null || true
+        fi
+        LIFECYCLE_LOCK_HELD=0
+    fi
+    trap - EXIT INT TERM HUP
+}
+
+# --- Keepalive supervisor ---------------------------------------------------
 run_supervisor() {
-    ensure_log_dir
-    echo "$$" > "$SUP_PID_FILE"
-    # Record our process-group id. When launched via `setsid` the supervisor is a
-    # group leader, so its PGID == its PID and the shim child inherits the group.
-    # --stop signals the whole group by this id.
-    local pgid
+    ensure_log_dir || exit 1
+    state_targets_are_safe || exit 1
+    printf '%s\n' "$$" > "$SUP_PID_FILE" || exit 1
+    chmod 0600 "$SUP_PID_FILE" || exit 1
+
+    local pgid child_pid logger_pid log_pipe window_start crashes rc now gave_up_storm
     pgid="$(ps -o pgid= -p "$$" 2>/dev/null | tr -d ' ')"
-    [ -n "$pgid" ] && echo "$pgid" > "$PGID_FILE"
+    if [ "$pgid" = "$$" ]; then
+        printf '%s\n' "$pgid" > "$PGID_FILE" || exit 1
+        chmod 0600 "$PGID_FILE" || exit 1
+    else
+        # nohup fallback may share the caller's process group. Never record or kill
+        # that broad group; verified per-pid teardown is safer.
+        rm -f "$PGID_FILE" 2>/dev/null || true
+        log_line "process-group isolation unavailable; using verified per-pid stop"
+    fi
 
-    # A stop sentinel lets --stop tell the supervisor to quit WITHOUT racing the
-    # restart loop: the loop checks for it before every (re)launch and sleep tick.
     rm -f "$STOP_FILE" 2>/dev/null || true
+    child_pid=""
+    logger_pid=""
+    gave_up_storm=0
+    log_pipe="${LOG_DIR}/shim.stream.$$"
+    if [ -e "$log_pipe" ] || [ -L "$log_pipe" ]; then
+        printf 'ERROR: refusing existing shim log-stream target: %s\n' "$log_pipe" >&2
+        exit 1
+    fi
+    mkfifo "$log_pipe" || exit 1
+    chmod 0600 "$log_pipe" || exit 1
 
-    # Clean up the shim child on supervisor termination.
-    local child_pid=""
-    cleanup_sup() {
-        if [ -n "$child_pid" ]; then
-            kill "$child_pid" 2>/dev/null || true
+    cleanup_supervisor() {
+        if [ -n "$child_pid" ] && pid_is_shim "$child_pid"; then
+            kill -TERM "$child_pid" 2>/dev/null || true
+        fi
+        if [ -n "$logger_pid" ] && kill -0 "$logger_pid" 2>/dev/null; then
+            kill -TERM "$logger_pid" 2>/dev/null || true
+            wait "$logger_pid" 2>/dev/null || true
+        fi
+        rm -f "$log_pipe" "$PID_FILE" "$SUP_PID_FILE" "$PGID_FILE" 2>/dev/null || true
+        # A storm give-up already recorded gave_up_storm and must persist so
+        # --status can report it distinctly; every other exit is a clean stop.
+        if [ "$gave_up_storm" -eq 0 ]; then
+            write_supervisor_state stopped || true
         fi
-        rm -f "$PID_FILE" "$SUP_PID_FILE" "$PGID_FILE" 2>/dev/null || true
-        log_line "supervisor exiting"
+        log_line "supervisor exiting" || true
     }
-    trap cleanup_sup EXIT INT TERM
+    stop_supervisor_signal() {
+        trap - INT TERM
+        exit 0
+    }
+    trap cleanup_supervisor EXIT
+    trap stop_supervisor_signal INT TERM
 
-    local window_start crashes
     window_start="$(date +%s)"
     crashes=0
+    write_supervisor_state running || true
+    log_line "starting shim on port ${SHIM_PORT} backend_mode=${EXPECTED_BACKEND_MODE} version=${EXPECTED_SHIM_VERSION} (keepalive on)"
 
-    log_line "starting shim on port ${SHIM_PORT} (backend from env; keepalive on)"
     while true; do
-        # Honor a stop request that arrived before (re)launch.
         if [ -f "$STOP_FILE" ]; then
             log_line "stop requested; supervisor loop ending"
             exit 0
         fi
-        # Launch the shim; its stderr (structured logs) appends to the log file.
-        python3 "$SHIM_PY" >>"$LOG_FILE" 2>&1 &
+
+        write_stream_to_log < "$log_pipe" &
+        logger_pid=$!
+        python3 "$SHIM_PY" > "$log_pipe" 2>&1 &
         child_pid=$!
-        echo "$child_pid" > "$PID_FILE"
+        printf '%s\n' "$child_pid" > "$PID_FILE"
+        chmod 0600 "$PID_FILE" 2>/dev/null || true
         wait "$child_pid"
-        local rc=$?
+        rc=$?
         child_pid=""
+        wait "$logger_pid" 2>/dev/null || true
+        logger_pid=""
+        rm -f "$PID_FILE" 2>/dev/null || true
 
-        # If a stop was requested while the shim ran, do not restart.
         if [ -f "$STOP_FILE" ]; then
             log_line "stop requested; not restarting shim"
             exit 0
         fi
 
-        # Storm guard: count crashes within a rolling window.
-        local now
         now="$(date +%s)"
-        if [ $((now - window_start)) -gt "$STORM_WINDOW" ]; then
+        if [ $((now - window_start)) -gt "$storm_window" ]; then
             window_start="$now"
             crashes=0
         fi
         crashes=$((crashes + 1))
-        log_line "shim exited rc=${rc} (crash ${crashes}/${STORM_LIMIT} in ${STORM_WINDOW}s window)"
-        if [ "$crashes" -ge "$STORM_LIMIT" ]; then
-            log_line "RESTART STORM: ${STORM_LIMIT} crashes in ${STORM_WINDOW}s — giving up. Check config (SHIM_BACKEND_API_KEY, SHIM_PORT) and ${LOG_FILE}."
+        log_line "shim exited rc=${rc} (crash ${crashes}/${storm_limit} in ${storm_window}s window)"
+        if [ "$crashes" -ge "$storm_limit" ]; then
+            # Record the give-up transition and mark it so cleanup_supervisor
+            # preserves (rather than overwrites) this terminal state for --status.
+            gave_up_storm=1
+            write_supervisor_state gave_up_storm || true
+            log_line "RESTART_STORM crashes=${crashes} window_s=${storm_window} action=give_up log=${LOG_FILE}"
             exit 1
         fi
-        sleep 2
+
+        # Sleep in short, sentinel-aware ticks so --stop does not wait for the full
+        # restart delay. TERM also interrupts the sleep and exits via the trap.
+        local slept=0
+        while [ "$slept" -lt 20 ]; do
+            [ -f "$STOP_FILE" ] && break
+            sleep "$(awk -v delay="$restart_delay" 'BEGIN { printf "%.3f", delay / 20 }')"
+            slept=$((slept + 1))
+        done
     done
 }
 
-# --- Public actions -----------------------------------------------------------
-do_start() {
-    ensure_log_dir
+# --- Stop implementation (caller holds lifecycle lock) ---------------------
+stop_processes_locked() {
+    local stopped=0 failed=0 pgid sp pp waited
 
-    if [ ! -f "$SHIM_PY" ]; then
-        echo "ERROR: shim not found at ${SHIM_PY}" >&2
-        echo "  Fix: ensure the provider_shim directory is intact." >&2
-        return 1
+    # Sentinel first: the supervisor checks it before every launch and sleep tick.
+    : > "$STOP_FILE" || return 2
+    chmod 0600 "$STOP_FILE" 2>/dev/null || true
+
+    sp="$(read_pid_file "$SUP_PID_FILE")" || sp=""
+    pp="$(read_pid_file "$PID_FILE")" || pp=""
+    pgid="$(read_pid_file "$PGID_FILE")" || pgid=""
+
+    # Deterministic failure injection is confined to explicitly isolated tests.
+    if [ "${DAAF_SHIM_TEST_MODE:-0}" = "1" ] && \
+        [ "${DAAF_SHIM_TEST_STOP_FAILURE:-0}" = "1" ] && \
+        { { [ -n "$sp" ] && pid_is_supervisor "$sp"; } || \
+          { [ -n "$pp" ] && pid_is_shim "$pp"; }; }; then
+        return 2
+    fi
+
+    if [ -n "$sp" ] && [ -n "$pgid" ] && process_group_is_owned "$pgid" "$sp"; then
+        kill -TERM "-${pgid}" 2>/dev/null || true
+        stopped=1
+        waited=0
+        while [ "$waited" -lt 5 ]; do
+            if ! pid_is_supervisor "$sp" && { [ -z "$pp" ] || ! pid_is_shim "$pp"; }; then
+                break
+            fi
+            sleep 1
+            waited=$((waited + 1))
+        done
+        if pid_is_supervisor "$sp" && process_group_is_owned "$pgid" "$sp"; then
+            kill -KILL "-${pgid}" 2>/dev/null || true
+        fi
+    fi
+
+    # Missing/no-setsid PGID and stale-file cases use exact cmdline identity. A PID
+    # recycled by an unrelated process is never signalled.
+    if [ -n "$pp" ] && pid_is_shim "$pp"; then
+        terminate_verified_pid shim "$pp" || true
+        stopped=1
+    fi
+    if [ -n "$sp" ] && pid_is_supervisor "$sp"; then
+        terminate_verified_pid supervisor "$sp" || true
+        stopped=1
+    fi
+
+    # A stop is successful only after every originally verified identity is gone.
+    # Preserve the sentinel and pid evidence on failure so a restart cannot launch
+    # a second generation while the first may still be live.
+    if [ -n "$pp" ] && pid_is_shim "$pp"; then
+        failed=1
+    fi
+    if [ -n "$sp" ] && pid_is_supervisor "$sp"; then
+        failed=1
     fi
-    if ! command -v python3 >/dev/null 2>&1; then
-        echo "ERROR: python3 not found on PATH; cannot start shim." >&2
+    if [ "$failed" -eq 1 ]; then
+        return 2
+    fi
+
+    rm -f "$PID_FILE" "$SUP_PID_FILE" "$SUP_STATE_FILE" "$PGID_FILE" "$STOP_FILE" 2>/dev/null || return 2
+    if [ "$stopped" -eq 1 ]; then
+        return 0
+    fi
+    return 3
+}
+
+# --- Public actions ---------------------------------------------------------
+preflight_start_contract() {
+    if [ ! -f "$SHIM_PY" ] || [ -L "$SHIM_PY" ]; then
+        printf 'ERROR: shim source is missing or unsafe: %s\n' "$SHIM_PY" >&2
+        printf '  Fix: restore the provider_shim directory from the DAAF repository.\n' >&2
         return 1
     fi
+    local dependency
+    for dependency in python3 curl jq ps awk wc; do
+        if ! command -v "$dependency" >/dev/null 2>&1; then
+            printf 'ERROR: required shim-manager dependency is unavailable: %s\n' "$dependency" >&2
+            printf '  Fix: rebuild from the current DAAF Dockerfile.\n' >&2
+            return 1
+        fi
+    done
+    load_expected_contract
+}
+
+do_start_locked() {
+    local launch_kind="${1:-explicit}" waited=0 spawned=0 supervisor_pid=""
+    START_FAILURE_KIND="launch"
+    ACTIVE_LAUNCH_PID=""
 
-    # v1.2.5: surface the backend mode, and in chatgpt mode preflight the OAuth
-    # auth store. This is a WARNING, not a hard stop — the shim itself fails fast
-    # per request with the re-login message, and a transient auth.json (e.g. mid
-    # codex login) should not block the manager. But surfacing it here gives the
-    # operator an immediate, actionable signal instead of a per-request 401.
-    local backend_mode="${SHIM_BACKEND_MODE:-openai}"
-    echo "Shim backend mode: ${backend_mode}." >&2
-    if [ "${backend_mode}" = "chatgpt" ]; then
+    preflight_start_contract || return 1
+
+    printf 'Shim backend mode: %s.\n' "$EXPECTED_BACKEND_MODE" >&2
+    if [ "$EXPECTED_BACKEND_MODE" = "chatgpt" ]; then
         if [ -z "${CODEX_HOME:-}" ]; then
-            echo "WARNING: SHIM_BACKEND_MODE=chatgpt but CODEX_HOME is unset." >&2
-            echo "  The shim needs \$CODEX_HOME/auth.json for the OAuth Bearer." >&2
-            echo "  Fix: set CODEX_HOME and run 'codex login --device-auth' inside the container." >&2
+            printf 'WARNING: SHIM_BACKEND_MODE=chatgpt but CODEX_HOME is unset.\n' >&2
+            printf '  Fix: set CODEX_HOME and run codex login --device-auth.\n' >&2
         elif [ ! -r "${CODEX_HOME}/auth.json" ]; then
-            echo "WARNING: chatgpt mode auth store not found/readable at \$CODEX_HOME/auth.json." >&2
-            echo "  Fix: run 'codex login --device-auth' inside the container to authenticate." >&2
+            printf 'WARNING: chatgpt auth store is missing/unreadable at $CODEX_HOME/auth.json.\n' >&2
+            printf '  Fix: run codex login --device-auth inside the container.\n' >&2
         else
-            echo "chatgpt auth store present at \$CODEX_HOME/auth.json." >&2
+            printf 'chatgpt auth store present at $CODEX_HOME/auth.json.\n' >&2
         fi
     fi
 
-    # Idempotency: already healthy? Nothing to do.
     if is_healthy; then
-        echo "Shim already running and healthy on port ${SHIM_PORT}." >&2
+        START_FAILURE_KIND="none"
+        printf 'Shim already running and strictly ready on port %s.\n' "$SHIM_PORT" >&2
+        print_auth_line
         return 0
     fi
-    # Supervisor alive but not yet healthy (still booting)? Leave it.
     if supervisor_running; then
-        echo "Shim supervisor already running (pid $(cat "$SUP_PID_FILE" 2>/dev/null))." >&2
-        return 0
+        START_FAILURE_KIND="readiness"
+        printf 'WARNING: shim supervisor is running but strict readiness failed.\n' >&2
+        emit_readiness_failure
+        return 1
+    fi
+    # If another HTTP service answered /health, do not start a crash loop against
+    # its occupied port. Only an unreachable endpoint is eligible for launch.
+    if [ "$HEALTH_REASON" != "unreachable" ]; then
+        START_FAILURE_KIND="readiness"
+        printf 'ERROR: port %s answered /health but not with this shim contract.\n' "$SHIM_PORT" >&2
+        emit_readiness_failure
+        return 1
     fi
 
-    # Clean any stale pidfiles/sentinel from a prior crash or stop.
-    rm -f "$PID_FILE" "$SUP_PID_FILE" "$PGID_FILE" "$STOP_FILE" 2>/dev/null || true
+    rm -f "$PID_FILE" "$SUP_PID_FILE" "$SUP_STATE_FILE" "$PGID_FILE" "$STOP_FILE" 2>/dev/null || true
+    rotate_log_if_needed || return 1
 
-    # Launch the supervisor in its OWN session/process-group via setsid, fully
-    # detached so it survives this shell returning. Being a group leader lets
-    # --stop reap the supervisor and its shim child together by process group,
-    # which is what closes the orphan-child race a plain per-pid kill leaves open.
-    if command -v setsid >/dev/null 2>&1; then
-        setsid "${BASH_SOURCE[0]}" __supervise >>"$LOG_FILE" 2>&1 &
+    if command -v setsid >/dev/null 2>&1 && [ "${DAAF_SHIM_TEST_NO_SETSID:-0}" != "1" ]; then
+        setsid "${BASH_SOURCE[0]}" __supervise >/dev/null 2>&1 &
     else
-        # Fallback: nohup + disown. --stop still works via the recorded PGID,
-        # which the supervisor derives from its own `ps` lookup either way.
-        nohup "${BASH_SOURCE[0]}" __supervise >>"$LOG_FILE" 2>&1 &
+        nohup "${BASH_SOURCE[0]}" __supervise >/dev/null 2>&1 &
     fi
+    supervisor_pid=$!
+    ACTIVE_LAUNCH_PID="$supervisor_pid"
+    spawned=1
     disown 2>/dev/null || true
 
-    # Wait (bounded) for health.
-    local waited=0
-    while [ "$waited" -lt 15 ]; do
+    while [ "$waited" -lt "$readiness_wait" ]; do
         if is_healthy; then
-            echo "Shim started and healthy on port ${SHIM_PORT}." >&2
+            START_FAILURE_KIND="none"
+            ACTIVE_LAUNCH_PID=""
+            printf 'Shim started and strictly ready on port %s.\n' "$SHIM_PORT" >&2
+            print_auth_line
             return 0
         fi
+        # The detached process needs a scheduling turn to create supervisor.pid.
+        # Keep waiting while the exact PID returned by the launch is alive; once
+        # the pidfile exists, supervisor_running adds the cmdline identity check.
+        if ! supervisor_running && ! kill -0 "$supervisor_pid" 2>/dev/null; then
+            break
+        fi
         sleep 1
         waited=$((waited + 1))
     done
-    echo "WARNING: shim did not report healthy within 15s. Check ${LOG_FILE}." >&2
+
+    if [ "$HEALTH_REASON" = "unreachable" ] && ! supervisor_running; then
+        START_FAILURE_KIND="launch"
+    else
+        START_FAILURE_KIND="readiness"
+    fi
+    printf 'WARNING: shim failed strict readiness within %ss. Check %s.\n' \
+        "$readiness_wait" "$LOG_FILE" >&2
+    emit_readiness_failure
+    if [ "$launch_kind" != "auto" ] && [ "$spawned" -eq 1 ]; then
+        stop_processes_locked >/dev/null 2>&1 || true
+    fi
+    ACTIVE_LAUNCH_PID=""
     return 1
 }
 
+do_start() {
+    local launch_kind="${1:-explicit}" rc
+    if [ "$launch_kind" = "auto" ]; then
+        acquire_lifecycle_lock no_wait || return 1
+    else
+        acquire_lifecycle_lock wait || return 1
+    fi
+    do_start_locked "$launch_kind"
+    rc=$?
+    release_lifecycle_lock
+    return "$rc"
+}
+
 do_stop() {
-    local stopped=0
-
-    # 1. Raise the stop sentinel FIRST so the supervisor's restart loop will not
-    #    respawn a child while we tear things down (closes the observed race).
-    ensure_log_dir
-    : > "$STOP_FILE" 2>/dev/null || true
-
-    # 2. Signal the whole process group if we recorded one. `kill -- -PGID`
-    #    delivers to every member (supervisor + shim child + any sleep), so the
-    #    child cannot outlive the supervisor.
-    local pgid
-    pgid="$(cat "$PGID_FILE" 2>/dev/null || true)"
-    if [ -n "$pgid" ] && kill -0 "-${pgid}" 2>/dev/null; then
-        kill -TERM "-${pgid}" 2>/dev/null || true
-        stopped=1
-        # Give the group a moment to exit, then escalate if anything survives.
-        local waited=0
-        while [ "$waited" -lt 5 ]; do
-            if ! kill -0 "-${pgid}" 2>/dev/null; then
-                break
-            fi
-            sleep 1
-            waited=$((waited + 1))
-        done
-        if kill -0 "-${pgid}" 2>/dev/null; then
-            kill -KILL "-${pgid}" 2>/dev/null || true
-        fi
+    local stop_rc
+    ensure_log_dir || return 1
+    state_targets_are_safe || return 1
+    acquire_lifecycle_lock || return 1
+    stop_processes_locked
+    stop_rc=$?
+    release_lifecycle_lock
+    case "$stop_rc" in
+        0)
+            printf 'Shim stopped.\n' >&2
+            return 0
+            ;;
+        3)
+            printf 'Shim was not running.\n' >&2
+            return 0
+            ;;
+        *)
+            printf 'ERROR: shim stop did not terminate every verified process.\n' >&2
+            printf '  Fix: inspect %s and retry --stop before starting another generation.\n' \
+                "$LOG_FILE" >&2
+            return 1
+            ;;
+    esac
+}
+
+# Restart exit codes are intentionally distinct for automation:
+# 40 stop failure, 41 launch failure, 42 strict-readiness failure,
+# 43 manager-record failure, and 130 interruption.
+RESTART_PHASE="not_started"
+RESTART_RESULT_WRITE_IN_PROGRESS=0
+RESTART_RESULT_WRITTEN=0
+RESTART_OLD_SUPERVISOR_PID="-"
+RESTART_OLD_SHIM_PID="-"
+
+emit_restart_result_locked() {
+    local status="$1" stage="$2" reason="$3" exit_code="$4" new_supervisor_pid="${5:--}"
+    local record
+    [ "$RESTART_RESULT_WRITTEN" -eq 0 ] || return 0
+    if [ "$RESTART_RESULT_WRITE_IN_PROGRESS" -eq 1 ]; then
+        printf 'SHIM_RESTART_RESULT status=failed stage=record reason=write_interrupted exit_code=130 old_supervisor_pid=%s old_shim_pid=%s new_supervisor_pid=%s port=%s record_persisted=unknown\n' \
+            "$RESTART_OLD_SUPERVISOR_PID" "$RESTART_OLD_SHIM_PID" \
+            "$new_supervisor_pid" "$SHIM_PORT" >&2
+        return 1
     fi
 
-    # 3. Fallback / belt-and-suspenders: also target the recorded individual pids
-    #    in case the PGID file is missing (e.g. setsid unavailable at start).
-    local sp pp
-    sp="$(cat "$SUP_PID_FILE" 2>/dev/null || true)"
-    if [ -n "$sp" ] && kill -0 "$sp" 2>/dev/null; then
-        kill -TERM "$sp" 2>/dev/null || true
-        stopped=1
+    record="SHIM_RESTART_RESULT status=${status} stage=${stage} reason=${reason} exit_code=${exit_code} old_supervisor_pid=${RESTART_OLD_SUPERVISOR_PID} old_shim_pid=${RESTART_OLD_SHIM_PID} new_supervisor_pid=${new_supervisor_pid} port=${SHIM_PORT}"
+    RESTART_RESULT_WRITE_IN_PROGRESS=1
+    if [ "${DAAF_SHIM_TEST_MODE:-0}" = "1" ] && \
+        [ "${DAAF_SHIM_TEST_SIGNAL_RESULT_IN_PROGRESS:-0}" = "1" ]; then
+        DAAF_SHIM_TEST_SIGNAL_RESULT_IN_PROGRESS=0
+        kill -TERM "$$"
     fi
-    pp="$(cat "$PID_FILE" 2>/dev/null || true)"
-    if [ -n "$pp" ] && kill -0 "$pp" 2>/dev/null; then
-        kill -TERM "$pp" 2>/dev/null || true
-        stopped=1
+    if ! manager_log_line "$record"; then
+        RESTART_RESULT_WRITE_IN_PROGRESS=0
+        printf 'SHIM_RESTART_RESULT status=failed stage=record reason=manager_log_write exit_code=43 old_supervisor_pid=%s old_shim_pid=%s new_supervisor_pid=%s port=%s record_persisted=no\n' \
+            "$RESTART_OLD_SUPERVISOR_PID" "$RESTART_OLD_SHIM_PID" \
+            "$new_supervisor_pid" "$SHIM_PORT" >&2
+        return 1
     fi
+    RESTART_RESULT_WRITE_IN_PROGRESS=0
+    RESTART_RESULT_WRITTEN=1
+    return 0
+}
 
-    rm -f "$PID_FILE" "$SUP_PID_FILE" "$PGID_FILE" "$STOP_FILE" 2>/dev/null || true
+handle_restart_interrupt() {
+    local signal_name="$1" launch_waited=0 interrupted_during_write=0
+    trap - INT TERM HUP
+    RESTART_PHASE="interrupted_${RESTART_PHASE}"
+    if [ "$RESTART_RESULT_WRITE_IN_PROGRESS" -eq 1 ]; then
+        interrupted_during_write=1
+        printf 'SHIM_RESTART_RESULT status=failed stage=record reason=write_interrupted exit_code=130 old_supervisor_pid=%s old_shim_pid=%s new_supervisor_pid=- port=%s record_persisted=unknown\n' \
+            "$RESTART_OLD_SUPERVISOR_PID" "$RESTART_OLD_SHIM_PID" "$SHIM_PORT" >&2
+    fi
+    # Once an atomic restart has begun, interruption never leaves a newly launched
+    # unverified generation behind. The direct launch PID closes the short window
+    # before supervisor.pid is written; cmdline verification still precedes signal.
+    while [ -n "$ACTIVE_LAUNCH_PID" ] && kill -0 "$ACTIVE_LAUNCH_PID" 2>/dev/null && \
+        ! pid_is_supervisor "$ACTIVE_LAUNCH_PID" && [ "$launch_waited" -lt 100 ]; do
+        sleep 0.01
+        launch_waited=$((launch_waited + 1))
+    done
+    if [ -n "$ACTIVE_LAUNCH_PID" ] && pid_is_supervisor "$ACTIVE_LAUNCH_PID"; then
+        terminate_verified_pid supervisor "$ACTIVE_LAUNCH_PID" || true
+    fi
+    stop_processes_locked >/dev/null 2>&1 || true
+    if [ "$interrupted_during_write" -eq 0 ]; then
+        emit_restart_result_locked failed interrupt "signal_${signal_name}" 130 - || true
+    fi
+    release_lifecycle_lock
+    exit 130
+}
 
-    if [ "$stopped" -eq 1 ]; then
-        echo "Shim stopped." >&2
-    else
-        echo "Shim was not running." >&2
+do_restart() {
+    local prior="stopped" stop_rc start_rc new_supervisor_pid="-"
+
+    ensure_log_dir || return 43
+    state_targets_are_safe || return 43
+    acquire_lifecycle_lock || return 43
+    preflight_start_contract || {
+        manager_log_line "SHIM_RESTART_BEGIN status=begin prior=unknown old_supervisor_pid=- old_shim_pid=- port=${SHIM_PORT}" || true
+        emit_restart_result_locked failed launch launch_preflight_failed 41 - || true
+        release_lifecycle_lock
+        return 41
+    }
+
+    RESTART_PHASE="inspect"
+    RESTART_RESULT_WRITE_IN_PROGRESS=0
+    RESTART_RESULT_WRITTEN=0
+    RESTART_OLD_SUPERVISOR_PID="$(read_pid_file "$SUP_PID_FILE")" || \
+        RESTART_OLD_SUPERVISOR_PID="-"
+    RESTART_OLD_SHIM_PID="$(read_pid_file "$PID_FILE")" || RESTART_OLD_SHIM_PID="-"
+
+    if is_healthy; then
+        prior="running_ready"
+    elif supervisor_running; then
+        prior="running_unready"
+    elif [ "$HEALTH_REASON" != "unreachable" ]; then
+        prior="unexpected_service"
+    fi
+
+    if ! manager_log_line "SHIM_RESTART_BEGIN status=begin prior=${prior} old_supervisor_pid=${RESTART_OLD_SUPERVISOR_PID} old_shim_pid=${RESTART_OLD_SHIM_PID} port=${SHIM_PORT}"; then
+        printf 'SHIM_RESTART_RESULT status=failed stage=record reason=manager_log_write exit_code=43 old_supervisor_pid=%s old_shim_pid=%s new_supervisor_pid=- port=%s record_persisted=no\n' \
+            "$RESTART_OLD_SUPERVISOR_PID" "$RESTART_OLD_SHIM_PID" "$SHIM_PORT" >&2
+        release_lifecycle_lock
+        return 43
+    fi
+
+    trap 'handle_restart_interrupt INT' INT
+    trap 'handle_restart_interrupt TERM' TERM
+    trap 'handle_restart_interrupt HUP' HUP
+
+    # A healthy endpoint without manager-owned process identity must never be
+    # signalled or mistaken for a generation this manager may replace.
+    if [ "$prior" = "running_ready" ] && \
+        [ "$RESTART_OLD_SUPERVISOR_PID" = "-" ] && \
+        [ "$RESTART_OLD_SHIM_PID" = "-" ]; then
+        emit_restart_result_locked failed stop unmanaged_ready_service 40 - || true
+        release_lifecycle_lock
+        return 40
+    fi
+
+    RESTART_PHASE="stop"
+    stop_processes_locked
+    stop_rc=$?
+    case "$stop_rc" in
+        0|3)
+            ;;
+        *)
+            emit_restart_result_locked failed stop termination_failed 40 - || true
+            release_lifecycle_lock
+            return 40
+            ;;
+    esac
+
+    RESTART_PHASE="launch"
+    do_start_locked restart
+    start_rc=$?
+    if [ "$start_rc" -ne 0 ]; then
+        stop_processes_locked >/dev/null 2>&1 || true
+        if [ "$START_FAILURE_KIND" = "launch" ]; then
+            emit_restart_result_locked failed launch launch_failed 41 - || true
+            release_lifecycle_lock
+            return 41
+        fi
+        emit_restart_result_locked failed readiness strict_readiness_failed 42 - || true
+        release_lifecycle_lock
+        return 42
     fi
+
+    RESTART_PHASE="verify"
+    if ! probe_health; then
+        emit_readiness_failure
+        stop_processes_locked >/dev/null 2>&1 || true
+        emit_restart_result_locked failed readiness strict_readiness_failed 42 - || true
+        release_lifecycle_lock
+        return 42
+    fi
+
+    new_supervisor_pid="$(read_pid_file "$SUP_PID_FILE")" || new_supervisor_pid="-"
+    if [ "$new_supervisor_pid" = "-" ] || ! pid_is_supervisor "$new_supervisor_pid" || \
+        { [ "$RESTART_OLD_SUPERVISOR_PID" != "-" ] && \
+          [ "$new_supervisor_pid" = "$RESTART_OLD_SUPERVISOR_PID" ]; }; then
+        stop_processes_locked >/dev/null 2>&1 || true
+        emit_restart_result_locked failed readiness supervisor_identity_invalid 42 \
+            "$new_supervisor_pid" || true
+        release_lifecycle_lock
+        return 42
+    fi
+
+    RESTART_PHASE="ready"
+    if ! emit_restart_result_locked ready readiness ready 0 "$new_supervisor_pid"; then
+        release_lifecycle_lock
+        return 43
+    fi
+    release_lifecycle_lock
+    printf 'Shim restarted and strictly ready on port %s.\n' "$SHIM_PORT" >&2
     return 0
 }
 
 do_status() {
+    if ! command -v curl >/dev/null 2>&1 || ! command -v jq >/dev/null 2>&1; then
+        printf 'STATUS: unavailable (curl and jq are required for strict readiness)\n'
+        return 1
+    fi
+    if [ ! -f "$SHIM_PY" ] || ! load_expected_contract; then
+        printf 'STATUS: unavailable (shim source/version contract missing)\n'
+        return 1
+    fi
     if is_healthy; then
-        echo "STATUS: running (port ${SHIM_PORT})"
-        echo "HEALTH: $(health_json)"
+        printf 'STATUS: running and strictly ready (port %s)\n' "$SHIM_PORT"
+        printf 'HEALTH: %s\n' "$HEALTH_JSON"
+        print_auth_line
         return 0
     fi
     if supervisor_running; then
-        echo "STATUS: supervisor up but shim not yet healthy (port ${SHIM_PORT})"
-        return 0
+        printf 'STATUS: supervisor up but shim not strictly ready (port %s)\n' "$SHIM_PORT"
+        emit_readiness_failure
+        return 1
+    fi
+    if [ "$HEALTH_REASON" != "unreachable" ]; then
+        printf 'STATUS: unexpected service on shim port %s\n' "$SHIM_PORT"
+        emit_readiness_failure
+        return 1
     fi
-    echo "STATUS: stopped"
+    # A supervisor that exhausted its restart-storm budget exits and removes its
+    # PID files, leaving a state otherwise indistinguishable from "never started".
+    # The persisted supervisor.state record makes that terminal condition visible.
+    local state_line state_phase state_ts
+    state_line="$(read_supervisor_state)" || state_line=""
+    if [ -n "$state_line" ]; then
+        state_phase="${state_line%%$'\t'*}"
+        state_ts="${state_line#*$'\t'}"
+        if [ "$state_phase" = "gave_up_storm" ]; then
+            printf 'STATUS: stopped (supervisor gave up after restart storm at %s)\n' \
+                "${state_ts:-unknown}"
+            return 0
+        fi
+    fi
+    printf 'STATUS: stopped\n'
     return 0
 }
 
 do_auto() {
-    # Silent no-op unless the user opted in. This is the container-boot path, so
-    # it must never be noisy or fatal.
-    if [ "${DAAF_PROVIDER_SHIM:-}" != "openai" ]; then
-        # Not opted in — exit silently, success.
+    local requested="${DAAF_PROVIDER_SHIM:-}" observed
+    # Empty/unset stays a silent no-op: the shim is opt-in and must not announce
+    # itself on every boot where it was never requested.
+    if [ -z "$requested" ]; then
+        exit 0
+    fi
+    # An unrecognized non-empty value is almost always a config footgun (e.g. a
+    # user who set the switch to a lane label like "chatgpt"). Make it visible
+    # instead of silently not starting, but still exit 0 so a misconfiguration
+    # never blocks container startup. ensure_log_dir runs first so the MANAGER
+    # record is never lost to the early return the old code took before it.
+    if [ "$requested" != "openai" ]; then
+        # Sanitize the observed value to a bounded single-line token before it
+        # reaches the grep-stable log format or the terminal: it is user-supplied
+        # and could otherwise inject a newline/space and forge a second record.
+        observed="$(printf '%s' "$requested" | tr -c 'A-Za-z0-9._-' '_' | cut -c1-64)"
+        if ensure_log_dir; then
+            manager_log_line "SHIM_AUTO_SKIPPED status=skipped reason=unrecognized_provider_shim observed=${observed} accepted=openai continuing_boot=y" || \
+                printf 'SHIM_AUTO_SKIPPED status=skipped reason=unrecognized_provider_shim observed=%s accepted=openai continuing_boot=y\n' "$observed" >&2
+        fi
+        printf 'WARNING: DAAF_PROVIDER_SHIM=%s is not a recognized shim auto-start value; the only accepted value is "openai". Leaving the shim stopped and continuing boot.\n' \
+            "$observed" >&2
+        exit 0
+    fi
+    ensure_log_dir || {
+        printf 'SHIM_AUTO_FAILURE status=failed reason=unsafe_log_directory\n' >&2
         exit 0
+    }
+    if ! do_start auto; then
+        manager_log_line "SHIM_AUTO_FAILURE status=failed reason=start_or_readiness_check continuing_boot=y" || \
+            printf 'SHIM_AUTO_FAILURE status=failed reason=manager_log_write continuing_boot=y\n' >&2
+    else
+        manager_log_line "SHIM_AUTO_READY status=ready continuing_boot=y" || \
+            printf 'SHIM_AUTO_FAILURE status=failed reason=manager_log_write continuing_boot=y\n' >&2
     fi
-    ensure_log_dir
-    log_line "--auto: DAAF_PROVIDER_SHIM=openai detected; ensuring shim is running."
-    # start-if-not-running; swallow failures so boot always proceeds.
-    do_start || log_line "--auto: do_start reported non-zero; continuing boot anyway."
     exit 0
 }
 
-# --- Dispatch ---
+# --- Internal deterministic-test action ------------------------------------
+do_rotate_only() {
+    acquire_lifecycle_lock || return 1
+    rotate_log_if_needed
+    local rc=$?
+    release_lifecycle_lock
+    return "$rc"
+}
+
+# --- Dispatch ---------------------------------------------------------------
+print_usage() {
+    printf 'Usage: %s {--auto|--start|--restart|--stop|--status|--help}\n' \
+        "$(basename "${BASH_SOURCE[0]}")"
+}
+
 ACTION="${1:-}"
 case "$ACTION" in
     __supervise)
+        load_expected_contract || exit 1
         run_supervisor
         ;;
+    __rotate_logs)
+        do_rotate_only
+        ;;
     --auto)
         do_auto
         ;;
     --start)
-        do_start
+        do_start explicit
+        ;;
+    --restart)
+        do_restart
         ;;
     --stop)
         do_stop
@@ -377,8 +1276,11 @@ case "$ACTION" in
     --status)
         do_status
         ;;
+    --help|-h)
+        print_usage
+        ;;
     *)
-        echo "Usage: $(basename "${BASH_SOURCE[0]}") {--auto|--start|--stop|--status}" >&2
+        print_usage >&2
         exit 1
         ;;
 esac
diff --git a/scripts/smoke_tests/smoke_imports.py b/scripts/smoke_tests/smoke_imports.py
index a536a7b1..58d38e86 100644
--- a/scripts/smoke_tests/smoke_imports.py
+++ b/scripts/smoke_tests/smoke_imports.py
@@ -1,21 +1,28 @@
 # scripts/smoke_tests/smoke_imports.py
-# Import-smoke test: verifies every pinned Python analysis package from the
-# Dockerfile pip install blocks imports cleanly and reports its version.
+# Package smoke test: verifies all 52 explicitly pinned Python distributions from
+# the Dockerfile pip install blocks. Fifty import targets must import cleanly and
+# report their installed versions; two distributions without supported import
+# targets are checked through package metadata only.
 # Sequential inline script (DAAF code style): no functions, section separators,
-# print + assert for validation. Exits nonzero on any import failure.
+# print + assert for validation. Exits nonzero on any failed check.
 #
-# Package list is derived from the five `uv pip install --system` blocks in
-# /daaf/Dockerfile (core data science, econometrics, geospatial, visualization,
-# ML interpretation/fairness). When the Dockerfile pins change, update this list
-# to match. Entries are (import_name, pip_name) because several import names
-# differ from their pip package name (e.g. scikit-learn -> sklearn).
+# The inventory is derived from every explicit Python pin in the
+# `uv pip install --system` blocks in /daaf/Dockerfile (analysis packages plus
+# direct provider-shim runtime dependencies). When the Dockerfile pins change,
+# update both inventories to match. Import entries are (import_name, pip_name)
+# because several import names differ from their pip package name (e.g.
+# scikit-learn -> sklearn). The provider shim's direct runtime dependencies carry
+# exact version assertions, as do the two metadata-only distributions, making
+# those pins image-identity gates rather than only presence checks.
 
 # --- Config ---
 import importlib
+import importlib.metadata
 import sys
 
-# (import_name, pip_name) for every pinned package in the Dockerfile pip blocks.
-# pip_name is only used for reporting so a failure names the installable package.
+# (import_name, pip_name) for the 50 pins with supported import targets.
+# pip_name is used for metadata lookup and reporting so failures name the
+# installable distribution.
 packages = [
     # Block 1: core data science
     ("numpy", "numpy"),
@@ -68,9 +75,33 @@
     ("shap", "shap"),
     ("fairlearn", "fairlearn"),
     ("lightgbm", "lightgbm"),
+    # Block 6: network analysis
+    ("igraph", "igraph"),
+    # Block 7: synthetic data generation
+    ("faker", "faker"),
+    # Late direct provider-shim runtime dependency layer
+    ("httpx", "httpx"),
+    ("uvicorn", "uvicorn"),
 ]
 
-print(f"--- Python import smoke: {len(packages)} pinned packages ---")
+required_versions = {
+    "httpx": "0.28.1",
+    "uvicorn": "0.51.0",
+}
+
+# These distributions intentionally have no fabricated import target. Their
+# installed presence and exact pins are validated through distribution metadata.
+metadata_only_distributions = {
+    "svy-rs": "0.10.0",
+    "svy-io": "0.1.1",
+}
+
+explicit_distribution_total = len(packages) + len(metadata_only_distributions)
+print(
+    f"--- Python package smoke: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions ---"
+)
 
 # --- Import & Report ---
 # INTENT: import each package and capture its version so a version-visible
@@ -83,22 +114,145 @@
 for import_name, pip_name in packages:
     try:
         mod = importlib.import_module(import_name)
-        version = getattr(mod, "__version__", "no __version__ attr")
-        print(f"OK   {pip_name:<16} (import {import_name}) version {version}")
+        version = importlib.metadata.version(pip_name)
+        expected_version = required_versions.get(pip_name)
+        if expected_version is not None and version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        pin_note = f" [pinned={expected_version}]" if expected_version else ""
+        print(
+            f"OK   {pip_name:<16} (import {import_name}) "
+            f"version {version}{pin_note}"
+        )
     except Exception as exc:  # noqa: BLE001 -- report any import-time failure
         failures.append((pip_name, import_name, repr(exc)))
         print(f"FAIL {pip_name:<16} (import {import_name}) -> {exc!r}")
 
+# INTENT: verify presence and exact versions for distributions that do not expose
+#   supported import targets.
+# REASONING: inventing module names would turn an image-inventory check into a
+#   false import contract; distribution metadata verifies the pins directly.
+# ASSUMES: importlib.metadata.version() raises PackageNotFoundError when an
+#   expected distribution is absent.
+metadata_failures = []
+for pip_name, expected_version in metadata_only_distributions.items():
+    try:
+        version = importlib.metadata.version(pip_name)
+        if version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        print(
+            f"OK   {pip_name:<16} (metadata only) "
+            f"version {version} [pinned={expected_version}]"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report every metadata failure
+        metadata_failures.append((pip_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (metadata only) -> {exc!r}")
+
 # --- Validate ---
-# Every listed package must import. Report the full failure list before asserting
-# so the execution log names all broken packages, not just the first.
+# Every import target and metadata-only distribution must pass. Report complete
+# failure lists before asserting so one broken distribution does not mask others.
 if failures:
     print(f"--- {len(failures)} package(s) failed to import ---")
     for pip_name, import_name, err in failures:
         print(f"  - {pip_name} (import {import_name}): {err}")
 
+if metadata_failures:
+    print(
+        f"--- {len(metadata_failures)} metadata-only distribution(s) failed ---"
+    )
+    for pip_name, err in metadata_failures:
+        print(f"  - {pip_name} (metadata only): {err}")
+
 assert not failures, f"{len(failures)} pinned package(s) failed to import"
+assert not metadata_failures, (
+    f"{len(metadata_failures)} metadata-only distribution(s) failed"
+)
 
 # --- Summary ---
-print(f"All {len(packages)} pinned Python packages imported successfully.")
+print(f"All {len(packages)} import targets imported successfully.")
+print(
+    f"All {len(metadata_only_distributions)} metadata-only distributions "
+    "were present at their exact pinned versions."
+)
+print(
+    f"PASS: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions verified."
+)
 sys.exit(0)
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-18 23:56:14
+# Command: python3 /daaf/scripts/smoke_tests/smoke_imports.py
+# Duration: 18s
+# Exit code: 0
+#
+# --- STDOUT ---
+# --- Python package smoke: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions ---
+# OK   numpy            (import numpy) version 2.4.2
+# OK   pandas           (import pandas) version 3.0.0
+# OK   polars           (import polars) version 1.39.3
+# OK   scipy            (import scipy) version 1.17.0
+# OK   openpyxl         (import openpyxl) version 3.1.5
+# OK   fastexcel        (import fastexcel) version 0.19.0
+# OK   xlrd             (import xlrd) version 2.0.2
+# OK   requests         (import requests) version 2.32.5
+# OK   pyarrow          (import pyarrow) version 23.0.0
+# OK   urllib3          (import urllib3) version 2.6.3
+# OK   pre-commit       (import pre_commit) version 4.5.1
+# OK   scikit-learn     (import sklearn) version 1.8.0
+# OK   umap-learn       (import umap) version 0.5.11
+# OK   pyyaml           (import yaml) version 6.0.3
+# OK   statsmodels      (import statsmodels) version 0.14.6
+# OK   pyfixest         (import pyfixest) version 0.40.0
+# OK   tabulate         (import tabulate) version 0.10.0
+# OK   great-tables     (import great_tables) version 0.21.0
+# OK   wildboottest     (import wildboottest) version 0.3.2
+# OK   linearmodels     (import linearmodels) version 7.0
+# OK   rdrobust         (import rdrobust) version 1.3.0
+# OK   marginaleffects  (import marginaleffects) version 0.5.0
+# OK   arch             (import arch) version 8.0.0
+# OK   pydynpd          (import pydynpd) version 0.2.1
+# OK   svy              (import svy) version 0.19.0
+# OK   geopandas        (import geopandas) version 1.1.3
+# OK   rasterio         (import rasterio) version 1.5.0
+# OK   xarray           (import xarray) version 2026.2.0
+# OK   rioxarray        (import rioxarray) version 0.22.0
+# OK   contextily       (import contextily) version 1.7.0
+# OK   folium           (import folium) version 0.20.0
+# OK   libpysal         (import libpysal) version 4.14.1
+# OK   esda             (import esda) version 2.9.0
+# OK   spreg            (import spreg) version 1.9.0
+# OK   mapclassify      (import mapclassify) version 2.10.0
+# OK   rasterstats      (import rasterstats) version 0.20.0
+# OK   geopy            (import geopy) version 2.4.1
+# OK   osmnx            (import osmnx) version 2.1.0
+# OK   matplotlib       (import matplotlib) version 3.10.8
+# OK   seaborn          (import seaborn) version 0.13.2
+# OK   plotnine         (import plotnine) version 0.15.3
+# OK   plotly           (import plotly) version 6.5.2
+# OK   marimo           (import marimo) version 0.19.11
+# OK   shap             (import shap) version 0.51.0
+# OK   fairlearn        (import fairlearn) version 0.12.0
+# OK   lightgbm         (import lightgbm) version 4.6.0
+# OK   igraph           (import igraph) version 1.0.0
+# OK   faker            (import faker) version 40.31.0
+# OK   httpx            (import httpx) version 0.28.1 [pinned=0.28.1]
+# OK   uvicorn          (import uvicorn) version 0.51.0 [pinned=0.51.0]
+# OK   svy-rs           (metadata only) version 0.10.0 [pinned=0.10.0]
+# OK   svy-io           (metadata only) version 0.1.1 [pinned=0.1.1]
+# All 50 import targets imported successfully.
+# All 2 metadata-only distributions were present at their exact pinned versions.
+# PASS: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions verified.
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/scripts/smoke_tests/smoke_imports_a.py b/scripts/smoke_tests/smoke_imports_a.py
new file mode 100644
index 00000000..7720f774
--- /dev/null
+++ b/scripts/smoke_tests/smoke_imports_a.py
@@ -0,0 +1,258 @@
+# scripts/smoke_tests/smoke_imports.py
+# Package smoke test: verifies all 52 explicitly pinned Python distributions from
+# the Dockerfile pip install blocks. Fifty import targets must import cleanly and
+# report their installed versions; two distributions without supported import
+# targets are checked through package metadata only.
+# Sequential inline script (DAAF code style): no functions, section separators,
+# print + assert for validation. Exits nonzero on any failed check.
+#
+# The inventory is derived from every explicit Python pin in the
+# `uv pip install --system` blocks in /daaf/Dockerfile (analysis packages plus
+# direct provider-shim runtime dependencies). When the Dockerfile pins change,
+# update both inventories to match. Import entries are (import_name, pip_name)
+# because several import names differ from their pip package name (e.g.
+# scikit-learn -> sklearn). The provider shim's direct runtime dependencies carry
+# exact version assertions, as do the two metadata-only distributions, making
+# those pins image-identity gates rather than only presence checks.
+
+# --- Config ---
+import importlib
+import importlib.metadata
+import sys
+
+# (import_name, pip_name) for the 50 pins with supported import targets.
+# pip_name is used for metadata lookup and reporting so failures name the
+# installable distribution.
+packages = [
+    # Block 1: core data science
+    ("numpy", "numpy"),
+    ("pandas", "pandas"),
+    ("polars", "polars"),
+    ("scipy", "scipy"),
+    ("openpyxl", "openpyxl"),
+    ("fastexcel", "fastexcel"),
+    ("xlrd", "xlrd"),
+    ("requests", "requests"),
+    ("pyarrow", "pyarrow"),
+    ("urllib3", "urllib3"),
+    ("pre_commit", "pre-commit"),
+    ("sklearn", "scikit-learn"),
+    ("umap", "umap-learn"),
+    ("yaml", "pyyaml"),
+    ("statsmodels", "statsmodels"),
+    ("pyfixest", "pyfixest"),
+    ("tabulate", "tabulate"),
+    ("great_tables", "great-tables"),
+    ("wildboottest", "wildboottest"),
+    # Block 2: econometrics & statistical modeling
+    ("linearmodels", "linearmodels"),
+    ("rdrobust", "rdrobust"),
+    ("marginaleffects", "marginaleffects"),
+    ("arch", "arch"),
+    ("pydynpd", "pydynpd"),
+    ("svy", "svy"),
+    # Block 3: geospatial
+    ("geopandas", "geopandas"),
+    ("rasterio", "rasterio"),
+    ("xarray", "xarray"),
+    ("rioxarray", "rioxarray"),
+    ("contextily", "contextily"),
+    ("folium", "folium"),
+    ("libpysal", "libpysal"),
+    ("esda", "esda"),
+    ("spreg", "spreg"),
+    ("mapclassify", "mapclassify"),
+    ("rasterstats", "rasterstats"),
+    ("geopy", "geopy"),
+    ("osmnx", "osmnx"),
+    # Block 4: visualization
+    ("matplotlib", "matplotlib"),
+    ("seaborn", "seaborn"),
+    ("plotnine", "plotnine"),
+    ("plotly", "plotly"),
+    ("marimo", "marimo"),
+    # Block 5: ML interpretation & fairness
+    ("shap", "shap"),
+    ("fairlearn", "fairlearn"),
+    ("lightgbm", "lightgbm"),
+    # Block 6: network analysis
+    ("igraph", "igraph"),
+    # Block 7: synthetic data generation
+    ("faker", "faker"),
+    # Late direct provider-shim runtime dependency layer
+    ("httpx", "httpx"),
+    ("uvicorn", "uvicorn"),
+]
+
+required_versions = {
+    "httpx": "0.28.1",
+    "uvicorn": "0.51.0",
+}
+
+# These distributions intentionally have no fabricated import target. Their
+# installed presence and exact pins are validated through distribution metadata.
+metadata_only_distributions = {
+    "svy-rs": "0.10.0",
+    "svy-io": "0.1.1",
+}
+
+explicit_distribution_total = len(packages) + len(metadata_only_distributions)
+print(
+    f"--- Python package smoke: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions ---"
+)
+
+# --- Import & Report ---
+# INTENT: import each package and capture its version so a version-visible
+#   record lands in the appended execution log.
+# REASONING: a bare import check hides which build was tested; printing the
+#   version makes the smoke result auditable against the Dockerfile pins.
+# ASSUMES: import failures raise ImportError/ModuleNotFoundError, which we
+#   collect rather than let abort the loop, so one failure does not mask others.
+failures = []
+for import_name, pip_name in packages:
+    try:
+        mod = importlib.import_module(import_name)
+        version = importlib.metadata.version(pip_name)
+        expected_version = required_versions.get(pip_name)
+        if expected_version is not None and version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        pin_note = f" [pinned={expected_version}]" if expected_version else ""
+        print(
+            f"OK   {pip_name:<16} (import {import_name}) "
+            f"version {version}{pin_note}"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report any import-time failure
+        failures.append((pip_name, import_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (import {import_name}) -> {exc!r}")
+
+# INTENT: verify presence and exact versions for distributions that do not expose
+#   supported import targets.
+# REASONING: inventing module names would turn an image-inventory check into a
+#   false import contract; distribution metadata verifies the pins directly.
+# ASSUMES: importlib.metadata.version() raises PackageNotFoundError when an
+#   expected distribution is absent.
+metadata_failures = []
+for pip_name, expected_version in metadata_only_distributions.items():
+    try:
+        version = importlib.metadata.version(pip_name)
+        if version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        print(
+            f"OK   {pip_name:<16} (metadata only) "
+            f"version {version} [pinned={expected_version}]"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report every metadata failure
+        metadata_failures.append((pip_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (metadata only) -> {exc!r}")
+
+# --- Validate ---
+# Every import target and metadata-only distribution must pass. Report complete
+# failure lists before asserting so one broken distribution does not mask others.
+if failures:
+    print(f"--- {len(failures)} package(s) failed to import ---")
+    for pip_name, import_name, err in failures:
+        print(f"  - {pip_name} (import {import_name}): {err}")
+
+if metadata_failures:
+    print(
+        f"--- {len(metadata_failures)} metadata-only distribution(s) failed ---"
+    )
+    for pip_name, err in metadata_failures:
+        print(f"  - {pip_name} (metadata only): {err}")
+
+assert not failures, f"{len(failures)} pinned package(s) failed to import"
+assert not metadata_failures, (
+    f"{len(metadata_failures)} metadata-only distribution(s) failed"
+)
+
+# --- Summary ---
+print(f"All {len(packages)} import targets imported successfully.")
+print(
+    f"All {len(metadata_only_distributions)} metadata-only distributions "
+    "were present at their exact pinned versions."
+)
+print(
+    f"PASS: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions verified."
+)
+sys.exit(0)
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-19 00:42:48
+# Command: python3 /daaf/scripts/smoke_tests/smoke_imports_a.py
+# Duration: 11s
+# Exit code: 0
+#
+# --- STDOUT ---
+# --- Python package smoke: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions ---
+# OK   numpy            (import numpy) version 2.4.2
+# OK   pandas           (import pandas) version 3.0.0
+# OK   polars           (import polars) version 1.39.3
+# OK   scipy            (import scipy) version 1.17.0
+# OK   openpyxl         (import openpyxl) version 3.1.5
+# OK   fastexcel        (import fastexcel) version 0.19.0
+# OK   xlrd             (import xlrd) version 2.0.2
+# OK   requests         (import requests) version 2.32.5
+# OK   pyarrow          (import pyarrow) version 23.0.0
+# OK   urllib3          (import urllib3) version 2.6.3
+# OK   pre-commit       (import pre_commit) version 4.5.1
+# OK   scikit-learn     (import sklearn) version 1.8.0
+# OK   umap-learn       (import umap) version 0.5.11
+# OK   pyyaml           (import yaml) version 6.0.3
+# OK   statsmodels      (import statsmodels) version 0.14.6
+# OK   pyfixest         (import pyfixest) version 0.40.0
+# OK   tabulate         (import tabulate) version 0.10.0
+# OK   great-tables     (import great_tables) version 0.21.0
+# OK   wildboottest     (import wildboottest) version 0.3.2
+# OK   linearmodels     (import linearmodels) version 7.0
+# OK   rdrobust         (import rdrobust) version 1.3.0
+# OK   marginaleffects  (import marginaleffects) version 0.5.0
+# OK   arch             (import arch) version 8.0.0
+# OK   pydynpd          (import pydynpd) version 0.2.1
+# OK   svy              (import svy) version 0.19.0
+# OK   geopandas        (import geopandas) version 1.1.3
+# OK   rasterio         (import rasterio) version 1.5.0
+# OK   xarray           (import xarray) version 2026.2.0
+# OK   rioxarray        (import rioxarray) version 0.22.0
+# OK   contextily       (import contextily) version 1.7.0
+# OK   folium           (import folium) version 0.20.0
+# OK   libpysal         (import libpysal) version 4.14.1
+# OK   esda             (import esda) version 2.9.0
+# OK   spreg            (import spreg) version 1.9.0
+# OK   mapclassify      (import mapclassify) version 2.10.0
+# OK   rasterstats      (import rasterstats) version 0.20.0
+# OK   geopy            (import geopy) version 2.4.1
+# OK   osmnx            (import osmnx) version 2.1.0
+# OK   matplotlib       (import matplotlib) version 3.10.8
+# OK   seaborn          (import seaborn) version 0.13.2
+# OK   plotnine         (import plotnine) version 0.15.3
+# OK   plotly           (import plotly) version 6.5.2
+# OK   marimo           (import marimo) version 0.19.11
+# OK   shap             (import shap) version 0.51.0
+# OK   fairlearn        (import fairlearn) version 0.12.0
+# OK   lightgbm         (import lightgbm) version 4.6.0
+# OK   igraph           (import igraph) version 1.0.0
+# OK   faker            (import faker) version 40.31.0
+# OK   httpx            (import httpx) version 0.28.1 [pinned=0.28.1]
+# OK   uvicorn          (import uvicorn) version 0.51.0 [pinned=0.51.0]
+# OK   svy-rs           (metadata only) version 0.10.0 [pinned=0.10.0]
+# OK   svy-io           (metadata only) version 0.1.1 [pinned=0.1.1]
+# All 50 import targets imported successfully.
+# All 2 metadata-only distributions were present at their exact pinned versions.
+# PASS: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions verified.
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/scripts/smoke_tests/smoke_imports_b.py b/scripts/smoke_tests/smoke_imports_b.py
new file mode 100644
index 00000000..89f65201
--- /dev/null
+++ b/scripts/smoke_tests/smoke_imports_b.py
@@ -0,0 +1,258 @@
+# scripts/smoke_tests/smoke_imports.py
+# Package smoke test: verifies all 52 explicitly pinned Python distributions from
+# the Dockerfile pip install blocks. Fifty import targets must import cleanly and
+# report their installed versions; two distributions without supported import
+# targets are checked through package metadata only.
+# Sequential inline script (DAAF code style): no functions, section separators,
+# print + assert for validation. Exits nonzero on any failed check.
+#
+# The inventory is derived from every explicit Python pin in the
+# `uv pip install --system` blocks in /daaf/Dockerfile (analysis packages plus
+# direct provider-shim runtime dependencies). When the Dockerfile pins change,
+# update both inventories to match. Import entries are (import_name, pip_name)
+# because several import names differ from their pip package name (e.g.
+# scikit-learn -> sklearn). The provider shim's direct runtime dependencies carry
+# exact version assertions, as do the two metadata-only distributions, making
+# those pins image-identity gates rather than only presence checks.
+
+# --- Config ---
+import importlib
+import importlib.metadata
+import sys
+
+# (import_name, pip_name) for the 50 pins with supported import targets.
+# pip_name is used for metadata lookup and reporting so failures name the
+# installable distribution.
+packages = [
+    # Block 1: core data science
+    ("numpy", "numpy"),
+    ("pandas", "pandas"),
+    ("polars", "polars"),
+    ("scipy", "scipy"),
+    ("openpyxl", "openpyxl"),
+    ("fastexcel", "fastexcel"),
+    ("xlrd", "xlrd"),
+    ("requests", "requests"),
+    ("pyarrow", "pyarrow"),
+    ("urllib3", "urllib3"),
+    ("pre_commit", "pre-commit"),
+    ("sklearn", "scikit-learn"),
+    ("umap", "umap-learn"),
+    ("yaml", "pyyaml"),
+    ("statsmodels", "statsmodels"),
+    ("pyfixest", "pyfixest"),
+    ("tabulate", "tabulate"),
+    ("great_tables", "great-tables"),
+    ("wildboottest", "wildboottest"),
+    # Block 2: econometrics & statistical modeling
+    ("linearmodels", "linearmodels"),
+    ("rdrobust", "rdrobust"),
+    ("marginaleffects", "marginaleffects"),
+    ("arch", "arch"),
+    ("pydynpd", "pydynpd"),
+    ("svy", "svy"),
+    # Block 3: geospatial
+    ("geopandas", "geopandas"),
+    ("rasterio", "rasterio"),
+    ("xarray", "xarray"),
+    ("rioxarray", "rioxarray"),
+    ("contextily", "contextily"),
+    ("folium", "folium"),
+    ("libpysal", "libpysal"),
+    ("esda", "esda"),
+    ("spreg", "spreg"),
+    ("mapclassify", "mapclassify"),
+    ("rasterstats", "rasterstats"),
+    ("geopy", "geopy"),
+    ("osmnx", "osmnx"),
+    # Block 4: visualization
+    ("matplotlib", "matplotlib"),
+    ("seaborn", "seaborn"),
+    ("plotnine", "plotnine"),
+    ("plotly", "plotly"),
+    ("marimo", "marimo"),
+    # Block 5: ML interpretation & fairness
+    ("shap", "shap"),
+    ("fairlearn", "fairlearn"),
+    ("lightgbm", "lightgbm"),
+    # Block 6: network analysis
+    ("igraph", "igraph"),
+    # Block 7: synthetic data generation
+    ("faker", "faker"),
+    # Late direct provider-shim runtime dependency layer
+    ("httpx", "httpx"),
+    ("uvicorn", "uvicorn"),
+]
+
+required_versions = {
+    "httpx": "0.28.1",
+    "uvicorn": "0.51.0",
+}
+
+# These distributions intentionally have no fabricated import target. Their
+# installed presence and exact pins are validated through distribution metadata.
+metadata_only_distributions = {
+    "svy-rs": "0.10.0",
+    "svy-io": "0.1.1",
+}
+
+explicit_distribution_total = len(packages) + len(metadata_only_distributions)
+print(
+    f"--- Python package smoke: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions ---"
+)
+
+# --- Import & Report ---
+# INTENT: import each package and capture its version so a version-visible
+#   record lands in the appended execution log.
+# REASONING: a bare import check hides which build was tested; printing the
+#   version makes the smoke result auditable against the Dockerfile pins.
+# ASSUMES: import failures raise ImportError/ModuleNotFoundError, which we
+#   collect rather than let abort the loop, so one failure does not mask others.
+failures = []
+for import_name, pip_name in packages:
+    try:
+        mod = importlib.import_module(import_name)
+        version = importlib.metadata.version(pip_name)
+        expected_version = required_versions.get(pip_name)
+        if expected_version is not None and version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        pin_note = f" [pinned={expected_version}]" if expected_version else ""
+        print(
+            f"OK   {pip_name:<16} (import {import_name}) "
+            f"version {version}{pin_note}"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report any import-time failure
+        failures.append((pip_name, import_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (import {import_name}) -> {exc!r}")
+
+# INTENT: verify presence and exact versions for distributions that do not expose
+#   supported import targets.
+# REASONING: inventing module names would turn an image-inventory check into a
+#   false import contract; distribution metadata verifies the pins directly.
+# ASSUMES: importlib.metadata.version() raises PackageNotFoundError when an
+#   expected distribution is absent.
+metadata_failures = []
+for pip_name, expected_version in metadata_only_distributions.items():
+    try:
+        version = importlib.metadata.version(pip_name)
+        if version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        print(
+            f"OK   {pip_name:<16} (metadata only) "
+            f"version {version} [pinned={expected_version}]"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report every metadata failure
+        metadata_failures.append((pip_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (metadata only) -> {exc!r}")
+
+# --- Validate ---
+# Every import target and metadata-only distribution must pass. Report complete
+# failure lists before asserting so one broken distribution does not mask others.
+if failures:
+    print(f"--- {len(failures)} package(s) failed to import ---")
+    for pip_name, import_name, err in failures:
+        print(f"  - {pip_name} (import {import_name}): {err}")
+
+if metadata_failures:
+    print(
+        f"--- {len(metadata_failures)} metadata-only distribution(s) failed ---"
+    )
+    for pip_name, err in metadata_failures:
+        print(f"  - {pip_name} (metadata only): {err}")
+
+assert not failures, f"{len(failures)} pinned package(s) failed to import"
+assert not metadata_failures, (
+    f"{len(metadata_failures)} metadata-only distribution(s) failed"
+)
+
+# --- Summary ---
+print(f"All {len(packages)} import targets imported successfully.")
+print(
+    f"All {len(metadata_only_distributions)} metadata-only distributions "
+    "were present at their exact pinned versions."
+)
+print(
+    f"PASS: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions verified."
+)
+sys.exit(0)
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-23 21:45:09
+# Command: python3 /daaf/scripts/smoke_tests/smoke_imports_b.py
+# Duration: 11s
+# Exit code: 0
+#
+# --- STDOUT ---
+# --- Python package smoke: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions ---
+# OK   numpy            (import numpy) version 2.4.2
+# OK   pandas           (import pandas) version 3.0.0
+# OK   polars           (import polars) version 1.39.3
+# OK   scipy            (import scipy) version 1.17.0
+# OK   openpyxl         (import openpyxl) version 3.1.5
+# OK   fastexcel        (import fastexcel) version 0.19.0
+# OK   xlrd             (import xlrd) version 2.0.2
+# OK   requests         (import requests) version 2.32.5
+# OK   pyarrow          (import pyarrow) version 23.0.0
+# OK   urllib3          (import urllib3) version 2.6.3
+# OK   pre-commit       (import pre_commit) version 4.5.1
+# OK   scikit-learn     (import sklearn) version 1.8.0
+# OK   umap-learn       (import umap) version 0.5.11
+# OK   pyyaml           (import yaml) version 6.0.3
+# OK   statsmodels      (import statsmodels) version 0.14.6
+# OK   pyfixest         (import pyfixest) version 0.60.0
+# OK   tabulate         (import tabulate) version 0.10.0
+# OK   great-tables     (import great_tables) version 0.21.0
+# OK   wildboottest     (import wildboottest) version 0.3.2
+# OK   linearmodels     (import linearmodels) version 7.0
+# OK   rdrobust         (import rdrobust) version 1.3.0
+# OK   marginaleffects  (import marginaleffects) version 0.5.0
+# OK   arch             (import arch) version 8.0.0
+# OK   pydynpd          (import pydynpd) version 0.2.1
+# OK   svy              (import svy) version 0.19.0
+# OK   geopandas        (import geopandas) version 1.1.3
+# OK   rasterio         (import rasterio) version 1.5.0
+# OK   xarray           (import xarray) version 2026.2.0
+# OK   rioxarray        (import rioxarray) version 0.22.0
+# OK   contextily       (import contextily) version 1.7.0
+# OK   folium           (import folium) version 0.20.0
+# OK   libpysal         (import libpysal) version 4.14.1
+# OK   esda             (import esda) version 2.9.0
+# OK   spreg            (import spreg) version 1.9.0
+# OK   mapclassify      (import mapclassify) version 2.10.0
+# OK   rasterstats      (import rasterstats) version 0.20.0
+# OK   geopy            (import geopy) version 2.4.1
+# OK   osmnx            (import osmnx) version 2.1.0
+# OK   matplotlib       (import matplotlib) version 3.10.8
+# OK   seaborn          (import seaborn) version 0.13.2
+# OK   plotnine         (import plotnine) version 0.15.3
+# OK   plotly           (import plotly) version 6.5.2
+# OK   marimo           (import marimo) version 0.19.11
+# OK   shap             (import shap) version 0.51.0
+# OK   fairlearn        (import fairlearn) version 0.12.0
+# OK   lightgbm         (import lightgbm) version 4.6.0
+# OK   igraph           (import igraph) version 1.0.0
+# OK   faker            (import faker) version 40.31.0
+# OK   httpx            (import httpx) version 0.28.1 [pinned=0.28.1]
+# OK   uvicorn          (import uvicorn) version 0.51.0 [pinned=0.51.0]
+# OK   svy-rs           (metadata only) version 0.10.0 [pinned=0.10.0]
+# OK   svy-io           (metadata only) version 0.1.1 [pinned=0.1.1]
+# All 50 import targets imported successfully.
+# All 2 metadata-only distributions were present at their exact pinned versions.
+# PASS: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions verified.
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/scripts/smoke_tests/smoke_imports_c.py b/scripts/smoke_tests/smoke_imports_c.py
new file mode 100644
index 00000000..9b05d523
--- /dev/null
+++ b/scripts/smoke_tests/smoke_imports_c.py
@@ -0,0 +1,378 @@
+# scripts/smoke_tests/smoke_imports.py
+# Package smoke test: verifies all 52 explicitly pinned Python distributions from
+# the Dockerfile pip install blocks. Fifty import targets must import cleanly and
+# report their installed versions; two distributions without supported import
+# targets are checked through package metadata only.
+# Sequential inline script (DAAF code style): no functions, section separators,
+# print + assert for validation. Exits nonzero on any failed check.
+#
+# The inventory is derived from every explicit Python pin in the
+# `uv pip install --system` blocks in /daaf/Dockerfile (analysis packages plus
+# direct provider-shim runtime dependencies). When the Dockerfile pins change,
+# update both inventories to match. Import entries are (import_name, pip_name)
+# because several import names differ from their pip package name (e.g.
+# scikit-learn -> sklearn). The provider shim's direct runtime dependencies carry
+# exact version assertions, as do the two metadata-only distributions, making
+# those pins image-identity gates rather than only presence checks.
+#
+# Revision _c adds a metadata-sanity check: every pinned distribution must
+# declare a non-empty runtime-dependency list (importlib.metadata.requires),
+# except a verified allowlist of genuinely dependency-free packages. Motivated
+# by pyfixest 0.40.0, whose wheel shipped with NO Requires-Dist metadata
+# (packaging bug) — it installed "successfully" with none of its dependencies
+# and only worked because unrelated pins supplied them transitively. A wheel
+# whose declared deps silently vanish in a future bump now fails the smoke
+# test at rebuild-validation time instead of failing in an analysis session.
+
+# --- Config ---
+import importlib
+import importlib.metadata
+import sys
+
+# (import_name, pip_name) for the 50 pins with supported import targets.
+# pip_name is used for metadata lookup and reporting so failures name the
+# installable distribution.
+packages = [
+    # Block 1: core data science
+    ("numpy", "numpy"),
+    ("pandas", "pandas"),
+    ("polars", "polars"),
+    ("scipy", "scipy"),
+    ("openpyxl", "openpyxl"),
+    ("fastexcel", "fastexcel"),
+    ("xlrd", "xlrd"),
+    ("requests", "requests"),
+    ("pyarrow", "pyarrow"),
+    ("urllib3", "urllib3"),
+    ("pre_commit", "pre-commit"),
+    ("sklearn", "scikit-learn"),
+    ("umap", "umap-learn"),
+    ("yaml", "pyyaml"),
+    ("statsmodels", "statsmodels"),
+    ("pyfixest", "pyfixest"),
+    ("tabulate", "tabulate"),
+    ("great_tables", "great-tables"),
+    ("wildboottest", "wildboottest"),
+    # Block 2: econometrics & statistical modeling
+    ("linearmodels", "linearmodels"),
+    ("rdrobust", "rdrobust"),
+    ("marginaleffects", "marginaleffects"),
+    ("arch", "arch"),
+    ("pydynpd", "pydynpd"),
+    ("svy", "svy"),
+    # Block 3: geospatial
+    ("geopandas", "geopandas"),
+    ("rasterio", "rasterio"),
+    ("xarray", "xarray"),
+    ("rioxarray", "rioxarray"),
+    ("contextily", "contextily"),
+    ("folium", "folium"),
+    ("libpysal", "libpysal"),
+    ("esda", "esda"),
+    ("spreg", "spreg"),
+    ("mapclassify", "mapclassify"),
+    ("rasterstats", "rasterstats"),
+    ("geopy", "geopy"),
+    ("osmnx", "osmnx"),
+    # Block 4: visualization
+    ("matplotlib", "matplotlib"),
+    ("seaborn", "seaborn"),
+    ("plotnine", "plotnine"),
+    ("plotly", "plotly"),
+    ("marimo", "marimo"),
+    # Block 5: ML interpretation & fairness
+    ("shap", "shap"),
+    ("fairlearn", "fairlearn"),
+    ("lightgbm", "lightgbm"),
+    # Block 6: network analysis
+    ("igraph", "igraph"),
+    # Block 7: synthetic data generation
+    ("faker", "faker"),
+    # Late direct provider-shim runtime dependency layer
+    ("httpx", "httpx"),
+    ("uvicorn", "uvicorn"),
+]
+
+required_versions = {
+    "httpx": "0.28.1",
+    "uvicorn": "0.51.0",
+}
+
+# These distributions intentionally have no fabricated import target. Their
+# installed presence and exact pins are validated through distribution metadata.
+metadata_only_distributions = {
+    "svy-rs": "0.10.0",
+    "svy-io": "0.1.1",
+}
+
+explicit_distribution_total = len(packages) + len(metadata_only_distributions)
+print(
+    f"--- Python package smoke: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions ---"
+)
+
+# --- Import & Report ---
+# INTENT: import each package and capture its version so a version-visible
+#   record lands in the appended execution log.
+# REASONING: a bare import check hides which build was tested; printing the
+#   version makes the smoke result auditable against the Dockerfile pins.
+# ASSUMES: import failures raise ImportError/ModuleNotFoundError, which we
+#   collect rather than let abort the loop, so one failure does not mask others.
+failures = []
+for import_name, pip_name in packages:
+    try:
+        mod = importlib.import_module(import_name)
+        version = importlib.metadata.version(pip_name)
+        expected_version = required_versions.get(pip_name)
+        if expected_version is not None and version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        pin_note = f" [pinned={expected_version}]" if expected_version else ""
+        print(
+            f"OK   {pip_name:<16} (import {import_name}) "
+            f"version {version}{pin_note}"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report any import-time failure
+        failures.append((pip_name, import_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (import {import_name}) -> {exc!r}")
+
+# INTENT: verify presence and exact versions for distributions that do not expose
+#   supported import targets.
+# REASONING: inventing module names would turn an image-inventory check into a
+#   false import contract; distribution metadata verifies the pins directly.
+# ASSUMES: importlib.metadata.version() raises PackageNotFoundError when an
+#   expected distribution is absent.
+metadata_failures = []
+for pip_name, expected_version in metadata_only_distributions.items():
+    try:
+        version = importlib.metadata.version(pip_name)
+        if version != expected_version:
+            raise AssertionError(
+                f"expected pinned version {expected_version}, found {version}"
+            )
+        print(
+            f"OK   {pip_name:<16} (metadata only) "
+            f"version {version} [pinned={expected_version}]"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report every metadata failure
+        metadata_failures.append((pip_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (metadata only) -> {exc!r}")
+
+# --- Metadata Sanity ---
+# INTENT: assert every pinned distribution declares a non-empty runtime-
+#   dependency list, except a verified allowlist of genuinely dependency-free
+#   packages.
+# REASONING: pyfixest 0.40.0 shipped a wheel with zero Requires-Dist entries (a
+#   packaging bug) — installers resolved it "successfully" without any of its
+#   real dependencies, and the import only worked because unrelated pins
+#   supplied them transitively. requires() returning None/empty for a package
+#   known to have dependencies is exactly that failure mode; catching it here
+#   turns a latent, environment-dependent break into a rebuild-time failure.
+# ASSUMES: the allowlist below is verified against the current image (probed
+#   2026-07-24: numpy, pyarrow, and pyyaml are the only pinned distributions
+#   whose requires() is legitimately empty — all three are famously
+#   self-contained). If a future pin is genuinely dependency-free, add it here
+#   with a comment; do NOT allowlist a package just to silence this check
+#   without confirming upstream that it truly has no runtime deps.
+dependency_free_allowlist = {"numpy", "pyarrow", "pyyaml"}
+
+metadata_sanity_failures = []
+all_pinned_distributions = [pip_name for _, pip_name in packages] + list(
+    metadata_only_distributions
+)
+for pip_name in all_pinned_distributions:
+    try:
+        declared = importlib.metadata.requires(pip_name)
+        if pip_name in dependency_free_allowlist:
+            print(f"OK   {pip_name:<16} (metadata sanity) allowlisted dependency-free")
+            continue
+        if not declared:
+            raise AssertionError(
+                "declares NO runtime dependencies (pyfixest-0.40.0-style "
+                "metadata bug, or a newly dependency-free release — verify "
+                "upstream before allowlisting)"
+            )
+        print(
+            f"OK   {pip_name:<16} (metadata sanity) "
+            f"{len(declared)} declared dependency spec(s)"
+        )
+    except Exception as exc:  # noqa: BLE001 -- report every sanity failure
+        metadata_sanity_failures.append((pip_name, repr(exc)))
+        print(f"FAIL {pip_name:<16} (metadata sanity) -> {exc!r}")
+
+# --- Validate ---
+# Every import target and metadata-only distribution must pass. Report complete
+# failure lists before asserting so one broken distribution does not mask others.
+if failures:
+    print(f"--- {len(failures)} package(s) failed to import ---")
+    for pip_name, import_name, err in failures:
+        print(f"  - {pip_name} (import {import_name}): {err}")
+
+if metadata_failures:
+    print(
+        f"--- {len(metadata_failures)} metadata-only distribution(s) failed ---"
+    )
+    for pip_name, err in metadata_failures:
+        print(f"  - {pip_name} (metadata only): {err}")
+
+if metadata_sanity_failures:
+    print(
+        f"--- {len(metadata_sanity_failures)} distribution(s) failed metadata sanity ---"
+    )
+    for pip_name, err in metadata_sanity_failures:
+        print(f"  - {pip_name} (metadata sanity): {err}")
+
+assert not failures, f"{len(failures)} pinned package(s) failed to import"
+assert not metadata_failures, (
+    f"{len(metadata_failures)} metadata-only distribution(s) failed"
+)
+assert not metadata_sanity_failures, (
+    f"{len(metadata_sanity_failures)} distribution(s) failed the "
+    "declared-dependency metadata sanity check"
+)
+
+# --- Summary ---
+print(f"All {len(packages)} import targets imported successfully.")
+print(
+    f"All {len(metadata_only_distributions)} metadata-only distributions "
+    "were present at their exact pinned versions."
+)
+print(
+    f"All {explicit_distribution_total} pinned distributions passed the "
+    f"declared-dependency metadata sanity check "
+    f"({len(dependency_free_allowlist)} verified dependency-free)."
+)
+print(
+    f"PASS: {len(packages)} import targets + "
+    f"{len(metadata_only_distributions)} metadata-only distributions = "
+    f"{explicit_distribution_total} explicit pinned distributions verified."
+)
+sys.exit(0)
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-24 20:48:34
+# Command: python3 /daaf/scripts/smoke_tests/smoke_imports_c.py
+# Duration: 14s
+# Exit code: 0
+#
+# --- STDOUT ---
+# --- Python package smoke: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions ---
+# OK   numpy            (import numpy) version 2.4.2
+# OK   pandas           (import pandas) version 3.0.0
+# OK   polars           (import polars) version 1.39.3
+# OK   scipy            (import scipy) version 1.17.0
+# OK   openpyxl         (import openpyxl) version 3.1.5
+# OK   fastexcel        (import fastexcel) version 0.19.0
+# OK   xlrd             (import xlrd) version 2.0.2
+# OK   requests         (import requests) version 2.32.5
+# OK   pyarrow          (import pyarrow) version 23.0.0
+# OK   urllib3          (import urllib3) version 2.6.3
+# OK   pre-commit       (import pre_commit) version 4.5.1
+# OK   scikit-learn     (import sklearn) version 1.8.0
+# OK   umap-learn       (import umap) version 0.5.11
+# OK   pyyaml           (import yaml) version 6.0.3
+# OK   statsmodels      (import statsmodels) version 0.14.6
+# OK   pyfixest         (import pyfixest) version 0.60.0
+# OK   tabulate         (import tabulate) version 0.10.0
+# OK   great-tables     (import great_tables) version 0.21.0
+# OK   wildboottest     (import wildboottest) version 0.3.2
+# OK   linearmodels     (import linearmodels) version 7.0
+# OK   rdrobust         (import rdrobust) version 1.3.0
+# OK   marginaleffects  (import marginaleffects) version 0.5.0
+# OK   arch             (import arch) version 8.0.0
+# OK   pydynpd          (import pydynpd) version 0.2.1
+# OK   svy              (import svy) version 0.19.0
+# OK   geopandas        (import geopandas) version 1.1.3
+# OK   rasterio         (import rasterio) version 1.5.0
+# OK   xarray           (import xarray) version 2026.2.0
+# OK   rioxarray        (import rioxarray) version 0.22.0
+# OK   contextily       (import contextily) version 1.7.0
+# OK   folium           (import folium) version 0.20.0
+# OK   libpysal         (import libpysal) version 4.14.1
+# OK   esda             (import esda) version 2.9.0
+# OK   spreg            (import spreg) version 1.9.0
+# OK   mapclassify      (import mapclassify) version 2.10.0
+# OK   rasterstats      (import rasterstats) version 0.20.0
+# OK   geopy            (import geopy) version 2.4.1
+# OK   osmnx            (import osmnx) version 2.1.0
+# OK   matplotlib       (import matplotlib) version 3.10.8
+# OK   seaborn          (import seaborn) version 0.13.2
+# OK   plotnine         (import plotnine) version 0.15.3
+# OK   plotly           (import plotly) version 6.5.2
+# OK   marimo           (import marimo) version 0.19.11
+# OK   shap             (import shap) version 0.51.0
+# OK   fairlearn        (import fairlearn) version 0.12.0
+# OK   lightgbm         (import lightgbm) version 4.6.0
+# OK   igraph           (import igraph) version 1.0.0
+# OK   faker            (import faker) version 40.31.0
+# OK   httpx            (import httpx) version 0.28.1 [pinned=0.28.1]
+# OK   uvicorn          (import uvicorn) version 0.51.0 [pinned=0.51.0]
+# OK   svy-rs           (metadata only) version 0.10.0 [pinned=0.10.0]
+# OK   svy-io           (metadata only) version 0.1.1 [pinned=0.1.1]
+# OK   numpy            (metadata sanity) allowlisted dependency-free
+# OK   pandas           (metadata sanity) 84 declared dependency spec(s)
+# OK   polars           (metadata sanity) 31 declared dependency spec(s)
+# OK   scipy            (metadata sanity) 38 declared dependency spec(s)
+# OK   openpyxl         (metadata sanity) 1 declared dependency spec(s)
+# OK   fastexcel        (metadata sanity) 5 declared dependency spec(s)
+# OK   xlrd             (metadata sanity) 5 declared dependency spec(s)
+# OK   requests         (metadata sanity) 6 declared dependency spec(s)
+# OK   pyarrow          (metadata sanity) allowlisted dependency-free
+# OK   urllib3          (metadata sanity) 5 declared dependency spec(s)
+# OK   pre-commit       (metadata sanity) 5 declared dependency spec(s)
+# OK   scikit-learn     (metadata sanity) 53 declared dependency spec(s)
+# OK   umap-learn       (metadata sanity) 18 declared dependency spec(s)
+# OK   pyyaml           (metadata sanity) allowlisted dependency-free
+# OK   statsmodels      (metadata sanity) 28 declared dependency spec(s)
+# OK   pyfixest         (metadata sanity) 17 declared dependency spec(s)
+# OK   tabulate         (metadata sanity) 1 declared dependency spec(s)
+# OK   great-tables     (metadata sanity) 30 declared dependency spec(s)
+# OK   wildboottest     (metadata sanity) 5 declared dependency spec(s)
+# OK   linearmodels     (metadata sanity) 67 declared dependency spec(s)
+# OK   rdrobust         (metadata sanity) 6 declared dependency spec(s)
+# OK   marginaleffects  (metadata sanity) 22 declared dependency spec(s)
+# OK   arch             (metadata sanity) 59 declared dependency spec(s)
+# OK   pydynpd          (metadata sanity) 4 declared dependency spec(s)
+# OK   svy              (metadata sanity) 11 declared dependency spec(s)
+# OK   geopandas        (metadata sanity) 23 declared dependency spec(s)
+# OK   rasterio         (metadata sanity) 26 declared dependency spec(s)
+# OK   xarray           (metadata sanity) 41 declared dependency spec(s)
+# OK   rioxarray        (metadata sanity) 7 declared dependency spec(s)
+# OK   contextily       (metadata sanity) 8 declared dependency spec(s)
+# OK   folium           (metadata sanity) 6 declared dependency spec(s)
+# OK   libpysal         (metadata sanity) 36 declared dependency spec(s)
+# OK   esda             (metadata sanity) 27 declared dependency spec(s)
+# OK   spreg            (metadata sanity) 20 declared dependency spec(s)
+# OK   mapclassify      (metadata sanity) 33 declared dependency spec(s)
+# OK   rasterstats      (metadata sanity) 18 declared dependency spec(s)
+# OK   geopy            (metadata sanity) 24 declared dependency spec(s)
+# OK   osmnx            (metadata sanity) 13 declared dependency spec(s)
+# OK   matplotlib       (metadata sanity) 13 declared dependency spec(s)
+# OK   seaborn          (metadata sanity) 22 declared dependency spec(s)
+# OK   plotnine         (metadata sanity) 33 declared dependency spec(s)
+# OK   plotly           (metadata sanity) 34 declared dependency spec(s)
+# OK   marimo           (metadata sanity) 33 declared dependency spec(s)
+# OK   shap             (metadata sanity) 63 declared dependency spec(s)
+# OK   fairlearn        (metadata sanity) 4 declared dependency spec(s)
+# OK   lightgbm         (metadata sanity) 8 declared dependency spec(s)
+# OK   igraph           (metadata sanity) 27 declared dependency spec(s)
+# OK   faker            (metadata sanity) 2 declared dependency spec(s)
+# OK   httpx            (metadata sanity) 12 declared dependency spec(s)
+# OK   uvicorn          (metadata sanity) 9 declared dependency spec(s)
+# OK   svy-rs           (metadata sanity) 1 declared dependency spec(s)
+# OK   svy-io           (metadata sanity) 1 declared dependency spec(s)
+# All 50 import targets imported successfully.
+# All 2 metadata-only distributions were present at their exact pinned versions.
+# All 52 pinned distributions passed the declared-dependency metadata sanity check (3 verified dependency-free).
+# PASS: 50 import targets + 2 metadata-only distributions = 52 explicit pinned distributions verified.
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/scripts/smoke_tests/smoke_pyfixest.py b/scripts/smoke_tests/smoke_pyfixest.py
new file mode 100644
index 00000000..a5a54451
--- /dev/null
+++ b/scripts/smoke_tests/smoke_pyfixest.py
@@ -0,0 +1,196 @@
+# scripts/smoke_tests/smoke_pyfixest.py
+# Functional smoke test for pyfixest after the 0.40.0 -> 0.60.0 Dockerfile pin bump.
+#
+#   Expected versions (post-rebuild target):
+#     pyfixest == 0.60.0  (Dockerfile core data-science block)
+#
+# Background: the pyfixest 0.40.0 wheel declared ZERO runtime dependencies
+# (packaging bug — no Requires-Dist in METADATA), so the old pin only worked
+# because numba/formulaic/etc. arrived transitively via umap-learn, wildboottest,
+# and linearmodels. 0.60.0 declares correct metadata and swaps the etable
+# rendering backend from great-tables to maketables; numba is now an optional
+# extra (default demeaning reportedly uses a compiled extension in the wheel).
+# See research/2026-07-23_FrameworkDev_Pyfixest-Pin-Bump/SESSION_NOTES.md.
+#
+# What this validates:
+#   1. HARD: version == 0.60.0 and non-empty declared dependency metadata
+#      (the metadata-sanity check that would have caught the 0.40.0 bug)
+#   2. HARD: feols() fit with fixed effects — finite coefficient, finite SE,
+#      tidy() returns a well-formed frame
+#   3. HARD: fepois() fit runs and returns finite coefficients
+#   4. PROBE: etable() render — records the observed output type under the new
+#      maketables backend (evidence for the pyfixest skill refresh; API details
+#      across 0.41-0.60 not assumed)
+#   5. PROBE: ritest() randomization inference — numba is now an optional extra;
+#      it is still present transitively (umap-learn/wildboottest), so this
+#      records whether the numba-accelerated path works in this image
+#
+# WHY THIS SCRIPT EXISTS: it is the evidence-generating instrument for the
+# pyfixest skill refresh (0.40.0 -> 0.60.0) — the skill cites observed behavior
+# recorded here, not online docs alone. HARD sections use bare assert (failure
+# crashes the script, exit nonzero) for claims the skill states as fact. PROBE
+# sections wrap uncertain 0.60.0 claims in try/except and print the observed
+# structure or the full exception; a probe failure must NOT crash the script.
+#
+# Sequential inline script (DAAF code style): no functions, no classes, no type
+# annotations, section separators, print + assert. Seeded synthetic data comes
+# from pf.get_data() (deterministic default seed).
+
+# --- Config ---
+import importlib.metadata as im
+import traceback
+
+import numpy as np
+import pyfixest as pf
+
+# INTENT: echo versions of pyfixest and its formerly-shadow dependencies so the
+#   appended execution log is auditable against the Dockerfile pins.
+# REASONING: the 0.40.0 failure mode was invisible at install time and only
+#   detectable via metadata/import — recording the full stack here makes any
+#   future drift diagnosable from the log alone.
+print("pyfixest :", pf.__version__)
+for _pkg in ("numpy", "pandas", "scipy", "formulaic", "narwhals", "joblib",
+             "tabulate", "seaborn", "tqdm", "maketables", "numba"):
+    try:
+        print(f"{_pkg:10s}:", im.version(_pkg))
+    except im.PackageNotFoundError:
+        print(f"{_pkg:10s}: NOT INSTALLED")
+
+hard_pass = 0
+probe_ok = 0
+probe_fail = 0
+
+# --- Validate: version and dependency metadata (HARD) ---
+# INTENT: pin-assert the exact version and require non-empty declared deps.
+# REASONING: requires() returning None/empty is exactly the 0.40.0 packaging bug
+#   this bump fixed — asserting non-empty metadata here catches any future
+#   broken-metadata wheel at rebuild-validation time.
+# ASSUMES: the Dockerfile pin is the single source of the installed version.
+assert pf.__version__ == "0.60.0", f"expected 0.60.0, got {pf.__version__}"
+_reqs = im.requires("pyfixest")
+assert _reqs, "pyfixest declares NO runtime dependencies (0.40.0-style metadata bug)"
+_req_names = [r.split(" ")[0].split(">=")[0].split("==")[0] for r in _reqs]
+assert any("maketables" in r for r in _req_names), \
+    f"maketables missing from declared deps: {_req_names}"
+print(f"HARD PASS: version 0.60.0, {len(_reqs)} declared dependency specs (incl. maketables)")
+hard_pass += 1
+
+# --- Validate: feols with fixed effects (HARD) ---
+# INTENT: fit the canonical single-FE regression on the bundled example data and
+#   assert the estimate and SE are finite.
+# REASONING: this exercises the demeaning backend (the component that moved off
+#   numba), formulaic parsing, and the inference stack in one call.
+# ASSUMES: pf.get_data() default seed is deterministic, so the coefficient is
+#   stable across runs on the same version.
+data = pf.get_data()
+fit = pf.feols("Y ~ X1 | f1", data=data)
+coef = fit.coef()
+se = fit.se()
+assert len(coef) == 1 and np.isfinite(coef.iloc[0]), f"bad coef: {coef}"
+assert np.isfinite(se.iloc[0]) and se.iloc[0] > 0, f"bad se: {se}"
+tidy = fit.tidy()
+assert len(tidy) >= 1, "tidy() returned empty frame"
+print(f"HARD PASS: feols Y ~ X1 | f1 -> coef={coef.iloc[0]:.6f}, se={se.iloc[0]:.6f}")
+hard_pass += 1
+
+# --- Validate: fepois (HARD) ---
+# INTENT: confirm the Poisson FE estimator also runs on 0.60.0.
+# REASONING: fepois shares the backend but exercises the IRLS path; a bump that
+#   silently broke non-OLS estimators would pass the feols check alone.
+fit_pois = pf.fepois("Y2 ~ X1 | f1", data=data.assign(Y2=np.abs(np.round(data["Y"])).astype(int)))
+assert np.isfinite(fit_pois.coef().iloc[0]), "fepois coef not finite"
+print(f"HARD PASS: fepois -> coef={fit_pois.coef().iloc[0]:.6f}")
+hard_pass += 1
+
+# --- Probe: etable under the maketables backend (PROBE) ---
+# INTENT: record what etable() returns in 0.60.0 without asserting API details.
+# REASONING: the rendering backend changed great-tables -> maketables somewhere
+#   in 0.41-0.60; the skill refresh needs the observed output type and a smoke
+#   signal that default rendering does not raise.
+try:
+    tbl = pf.etable([fit])
+    print(f"PROBE OK: etable([fit]) -> type={type(tbl).__module__}.{type(tbl).__name__}")
+    probe_ok += 1
+except Exception:
+    print("PROBE FAIL: etable([fit]) raised:")
+    traceback.print_exc()
+    probe_fail += 1
+
+# --- Probe: ritest randomization inference (PROBE) ---
+# INTENT: exercise the path that formerly hard-required numba.
+# REASONING: numba is now an optional extra but remains installed transitively
+#   (umap-learn, wildboottest) — this records whether ritest works in this image
+#   and what it returns, so the skill can state it accurately.
+# ASSUMES: small reps keeps runtime trivial; statistical output is not asserted.
+try:
+    ri = fit.ritest(resampvar="X1", reps=100)
+    print(f"PROBE OK: ritest(reps=100) -> type={type(ri).__name__}, repr head: {str(ri)[:200]}")
+    probe_ok += 1
+except Exception:
+    print("PROBE FAIL: ritest raised:")
+    traceback.print_exc()
+    probe_fail += 1
+
+# --- Summary ---
+print("=" * 60)
+print(f"HARD PASS {hard_pass}/3 | PROBES: {probe_ok} succeeded, {probe_fail} failed")
+print("smoke_pyfixest: COMPLETE")
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-23 21:44:19
+# Command: python3 /daaf/scripts/smoke_tests/smoke_pyfixest.py
+# Duration: 2s
+# Exit code: 1
+#
+# --- STDOUT ---
+# pyfixest : 0.60.0
+# numpy     : 2.4.2
+# pandas    : 3.0.0
+# scipy     : 1.17.0
+# formulaic : 1.2.2
+# narwhals  : 2.24.0
+# joblib    : 1.5.3
+# tabulate  : 0.10.0
+# seaborn   : 0.13.2
+# tqdm      : 4.69.0
+# maketables: 0.1.8
+# numba     : 0.66.0
+# HARD PASS: version 0.60.0, 17 declared dependency specs (incl. maketables)
+# HARD PASS: feols Y ~ X1 | f1 -> coef=-0.949441, se=0.069627
+# Traceback (most recent call last):
+#   File "/daaf/scripts/smoke_tests/smoke_pyfixest.py", line 100, in <module>
+#     fit_pois = pf.fepois("Y2 ~ X1 | f1", data=data.assign(Y2=np.abs(np.round(data["Y"])).astype(int)))
+#                                                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/generic.py", line 6541, in astype
+#     new_data = self._mgr.astype(dtype=dtype, errors=errors)
+#                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/internals/managers.py", line 611, in astype
+#     return self.apply("astype", dtype=dtype, errors=errors)
+#            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/internals/managers.py", line 442, in apply
+#     applied = getattr(b, f)(**kwargs)
+#               ^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/internals/blocks.py", line 607, in astype
+#     new_values = astype_array_safe(values, dtype, errors=errors)
+#                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/dtypes/astype.py", line 240, in astype_array_safe
+#     new_values = astype_array(values, dtype, copy=copy)
+#                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/dtypes/astype.py", line 185, in astype_array
+#     values = _astype_nansafe(values, dtype, copy=copy)
+#              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/dtypes/astype.py", line 102, in _astype_nansafe
+#     return _astype_float_to_int_nansafe(arr, dtype, copy)
+#            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+#   File "/usr/local/lib/python3.12/dist-packages/pandas/core/dtypes/astype.py", line 146, in _astype_float_to_int_nansafe
+#     raise IntCastingNaNError(
+# pandas.errors.IntCastingNaNError: Cannot convert non-finite values (NA or inf) to integer.Replace or remove non-finite values or cast to an integer typethat supports these values (e.g. 'Int64')
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/scripts/smoke_tests/smoke_pyfixest_a.py b/scripts/smoke_tests/smoke_pyfixest_a.py
new file mode 100644
index 00000000..3a1d4a58
--- /dev/null
+++ b/scripts/smoke_tests/smoke_pyfixest_a.py
@@ -0,0 +1,184 @@
+# scripts/smoke_tests/smoke_pyfixest.py
+# Functional smoke test for pyfixest after the 0.40.0 -> 0.60.0 Dockerfile pin bump.
+#
+#   Expected versions (post-rebuild target):
+#     pyfixest == 0.60.0  (Dockerfile core data-science block)
+#
+# Background: the pyfixest 0.40.0 wheel declared ZERO runtime dependencies
+# (packaging bug — no Requires-Dist in METADATA), so the old pin only worked
+# because numba/formulaic/etc. arrived transitively via umap-learn, wildboottest,
+# and linearmodels. 0.60.0 declares correct metadata and swaps the etable
+# rendering backend from great-tables to maketables; numba is now an optional
+# extra (default demeaning reportedly uses a compiled extension in the wheel).
+# See research/2026-07-23_FrameworkDev_Pyfixest-Pin-Bump/SESSION_NOTES.md.
+#
+# What this validates:
+#   1. HARD: version == 0.60.0 and non-empty declared dependency metadata
+#      (the metadata-sanity check that would have caught the 0.40.0 bug)
+#   2. HARD: feols() fit with fixed effects — finite coefficient, finite SE,
+#      tidy() returns a well-formed frame
+#   3. HARD: fepois() fit runs and returns finite coefficients
+#   4. PROBE: etable() render — records the observed output type under the new
+#      maketables backend (evidence for the pyfixest skill refresh; API details
+#      across 0.41-0.60 not assumed)
+#   5. PROBE: ritest() randomization inference — numba is now an optional extra;
+#      it is still present transitively (umap-learn/wildboottest), so this
+#      records whether the numba-accelerated path works in this image
+#
+# WHY THIS SCRIPT EXISTS: it is the evidence-generating instrument for the
+# pyfixest skill refresh (0.40.0 -> 0.60.0) — the skill cites observed behavior
+# recorded here, not online docs alone. HARD sections use bare assert (failure
+# crashes the script, exit nonzero) for claims the skill states as fact. PROBE
+# sections wrap uncertain 0.60.0 claims in try/except and print the observed
+# structure or the full exception; a probe failure must NOT crash the script.
+#
+# Sequential inline script (DAAF code style): no functions, no classes, no type
+# annotations, section separators, print + assert. Seeded synthetic data comes
+# from pf.get_data() (deterministic default seed).
+
+# --- Config ---
+import importlib.metadata as im
+import traceback
+
+import numpy as np
+import pyfixest as pf
+
+# INTENT: echo versions of pyfixest and its formerly-shadow dependencies so the
+#   appended execution log is auditable against the Dockerfile pins.
+# REASONING: the 0.40.0 failure mode was invisible at install time and only
+#   detectable via metadata/import — recording the full stack here makes any
+#   future drift diagnosable from the log alone.
+print("pyfixest :", pf.__version__)
+for _pkg in ("numpy", "pandas", "scipy", "formulaic", "narwhals", "joblib",
+             "tabulate", "seaborn", "tqdm", "maketables", "numba"):
+    try:
+        print(f"{_pkg:10s}:", im.version(_pkg))
+    except im.PackageNotFoundError:
+        print(f"{_pkg:10s}: NOT INSTALLED")
+
+hard_pass = 0
+probe_ok = 0
+probe_fail = 0
+
+# --- Validate: version and dependency metadata (HARD) ---
+# INTENT: pin-assert the exact version and require non-empty declared deps.
+# REASONING: requires() returning None/empty is exactly the 0.40.0 packaging bug
+#   this bump fixed — asserting non-empty metadata here catches any future
+#   broken-metadata wheel at rebuild-validation time.
+# ASSUMES: the Dockerfile pin is the single source of the installed version.
+assert pf.__version__ == "0.60.0", f"expected 0.60.0, got {pf.__version__}"
+_reqs = im.requires("pyfixest")
+assert _reqs, "pyfixest declares NO runtime dependencies (0.40.0-style metadata bug)"
+_req_names = [r.split(" ")[0].split(">=")[0].split("==")[0] for r in _reqs]
+assert any("maketables" in r for r in _req_names), \
+    f"maketables missing from declared deps: {_req_names}"
+print(f"HARD PASS: version 0.60.0, {len(_reqs)} declared dependency specs (incl. maketables)")
+hard_pass += 1
+
+# --- Validate: feols with fixed effects (HARD) ---
+# INTENT: fit the canonical single-FE regression on the bundled example data and
+#   assert the estimate and SE are finite.
+# REASONING: this exercises the demeaning backend (the component that moved off
+#   numba), formulaic parsing, and the inference stack in one call.
+# ASSUMES: pf.get_data() default seed is deterministic, so the coefficient is
+#   stable across runs on the same version.
+data = pf.get_data()
+fit = pf.feols("Y ~ X1 | f1", data=data)
+coef = fit.coef()
+se = fit.se()
+assert len(coef) == 1 and np.isfinite(coef.iloc[0]), f"bad coef: {coef}"
+assert np.isfinite(se.iloc[0]) and se.iloc[0] > 0, f"bad se: {se}"
+tidy = fit.tidy()
+assert len(tidy) >= 1, "tidy() returned empty frame"
+print(f"HARD PASS: feols Y ~ X1 | f1 -> coef={coef.iloc[0]:.6f}, se={se.iloc[0]:.6f}")
+hard_pass += 1
+
+# --- Validate: fepois (HARD) ---
+# INTENT: confirm the Poisson FE estimator also runs on 0.60.0.
+# REASONING: fepois shares the backend but exercises the IRLS path; a bump that
+#   silently broke non-OLS estimators would pass the feols check alone.
+# ASSUMES: pf.get_data(model="Fepois") provides count-valued Y (NaN-bearing
+#   float Y from the default OLS data cannot be cast to int under pandas 3.0
+#   strict casting — cause of the v1 script failure).
+data_pois = pf.get_data(model="Fepois")
+fit_pois = pf.fepois("Y ~ X1 | f1", data=data_pois)
+assert np.isfinite(fit_pois.coef().iloc[0]), "fepois coef not finite"
+print(f"HARD PASS: fepois -> coef={fit_pois.coef().iloc[0]:.6f}")
+hard_pass += 1
+
+# --- Probe: etable under the maketables backend (PROBE) ---
+# INTENT: record what etable() returns in 0.60.0 without asserting API details.
+# REASONING: the rendering backend changed great-tables -> maketables somewhere
+#   in 0.41-0.60; the skill refresh needs the observed output type and a smoke
+#   signal that default rendering does not raise.
+try:
+    tbl = pf.etable([fit])
+    print(f"PROBE OK: etable([fit]) -> type={type(tbl).__module__}.{type(tbl).__name__}")
+    probe_ok += 1
+except Exception:
+    print("PROBE FAIL: etable([fit]) raised:")
+    traceback.print_exc()
+    probe_fail += 1
+
+# --- Probe: ritest randomization inference (PROBE) ---
+# INTENT: exercise the path that formerly hard-required numba.
+# REASONING: numba is now an optional extra but remains installed transitively
+#   (umap-learn, wildboottest) — this records whether ritest works in this image
+#   and what it returns, so the skill can state it accurately.
+# ASSUMES: small reps keeps runtime trivial; statistical output is not asserted.
+try:
+    ri = fit.ritest(resampvar="X1", reps=100)
+    print(f"PROBE OK: ritest(reps=100) -> type={type(ri).__name__}, repr head: {str(ri)[:200]}")
+    probe_ok += 1
+except Exception:
+    print("PROBE FAIL: ritest raised:")
+    traceback.print_exc()
+    probe_fail += 1
+
+# --- Summary ---
+print("=" * 60)
+print(f"HARD PASS {hard_pass}/3 | PROBES: {probe_ok} succeeded, {probe_fail} failed")
+print("smoke_pyfixest: COMPLETE")
+
+
+# =============================================================================
+# EXECUTION LOG
+# =============================================================================
+#
+# Executed: 2026-07-23 21:44:45
+# Command: python3 /daaf/scripts/smoke_tests/smoke_pyfixest_a.py
+# Duration: 11s
+# Exit code: 0
+#
+# --- STDOUT ---
+# /usr/local/lib/python3.12/dist-packages/pyfixest/estimation/formula/model_matrix.py:151: UserWarning: 1 singleton fixed effect(s) dropped from the model.
+#   warnings.warn(
+# pyfixest : 0.60.0
+# numpy     : 2.4.2
+# pandas    : 3.0.0
+# scipy     : 1.17.0
+# formulaic : 1.2.2
+# narwhals  : 2.24.0
+# joblib    : 1.5.3
+# tabulate  : 0.10.0
+# seaborn   : 0.13.2
+# tqdm      : 4.69.0
+# maketables: 0.1.8
+# numba     : 0.66.0
+# HARD PASS: version 0.60.0, 17 declared dependency specs (incl. maketables)
+# HARD PASS: feols Y ~ X1 | f1 -> coef=-0.949441, se=0.069627
+# HARD PASS: fepois -> coef=0.002262
+# PROBE OK: etable([fit]) -> type=great_tables.gt.GT
+# PROBE OK: ritest(reps=100) -> type=Series, repr head: H0                                      X1=0
+# ri-type                      randomization-c
+# Estimate                 -0.9494410591286256
+# Pr(>|t|)                                 0.0
+# Std. Error (Pr(>|t|)
+# ============================================================
+# HARD PASS 3/3 | PROBES: 2 succeeded, 0 failed
+# smoke_pyfixest: COMPLETE
+#
+# --- STDERR ---
+# (captured in STDOUT above via 2>&1)
+#
+# =============================================================================
diff --git a/tests/bash/backup_daaf.bats b/tests/bash/backup_daaf.bats
index a9f3e1e9..7e2ae55f 100755
--- a/tests/bash/backup_daaf.bats
+++ b/tests/bash/backup_daaf.bats
@@ -772,19 +772,22 @@ teardown() {
     assert_output --partial "ERROR"
 }
 
-@test "backup: copy partially succeeds with non-zero exit but files copied shows warning" {
+@test "backup: copy reports non-zero exit but full file count shows Note not error" {
     export DAAF_NESTED=1
 
-    # Custom docker mock: staging succeeds; the `docker cp` copy returns non-zero
-    # but still creates files.
+    # Regression anchor for the Note path: a nonzero `docker cp` exit is NOT fatal
+    # when the full expected file count still landed (no shortfall). The scan reports
+    # 3 files and the mock copies exactly 3 -- so the corroborated short-copy fatal
+    # branch (nonzero exit AND count short) does NOT fire; execution falls through to
+    # the informational Note and completes successfully.
     docker() {
         case "$1" in
             info)   return 0 ;;
             volume) return 0 ;;
             run)
                 if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 0; fi
-                # Scan output
-                printf '5\n512\t/source\n500K\t/source\n500\n'
+                # Scan output -- 3 files, matching the 3 the copy creates below.
+                printf '3\n512\t/source\n500K\t/source\n500\n'
                 return 0
                 ;;
             wait) echo "0"; return 0 ;;
@@ -796,7 +799,7 @@ teardown() {
                     mkdir -p "${dest_dir}"
                     touch "${dest_dir}/file1" "${dest_dir}/file2" "${dest_dir}/file3"
                 fi
-                # Non-zero exit (partial failure)
+                # Non-zero exit, but the full count still landed
                 return 1
                 ;;
             rm) return 0 ;;
@@ -806,9 +809,137 @@ teardown() {
     export -f docker
 
     run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
-    # Should succeed (files were copied) but note the warnings
+    # Should succeed (full count copied) but note the warnings -- NOT the fatal error.
     assert_output --partial "warnings"
     assert_output --partial "files were transferred"
+    refute_output --partial "must not be relied on"
+}
+
+@test "backup: non-zero copy exit with short file count is a fatal error" {
+    export DAAF_NESTED=1
+
+    # Corroborated short copy: the `docker cp` copy returns non-zero AND fewer files
+    # land (2) than the scan counted (5). The two signals agree the backup is
+    # truncated, so the script must abort fatally, naming the partial folder and
+    # telling the user to delete it -- not pass it off as usable.
+    docker() {
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 0; fi
+                # Scan reports 5 files; the copy below lands only 2.
+                printf '5\n512\t/source\n500K\t/source\n500\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)
+                local dest_dir=""
+                for arg in "$@"; do dest_dir="${arg}"; done
+                dest_dir="${dest_dir%/}"
+                if [ -n "${dest_dir}" ]; then
+                    mkdir -p "${dest_dir}"
+                    touch "${dest_dir}/file1" "${dest_dir}/file2"
+                fi
+                # Non-zero exit with a short count -> fatal
+                return 1
+                ;;
+            rm) return 0 ;;
+            *)  return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_failure
+    assert_output --partial "ERROR"
+    assert_output --partial "only 2 of 5 expected files were copied"
+    assert_output --partial "must not be relied on"
+    # Names the partial backup folder so the user can delete it.
+    assert_output --partial "Location:"
+    assert_output --partial "_daaf_backup"
+}
+
+@test "backup: zero-exit short file count warns (not fatal) and banner notes warnings" {
+    export DAAF_NESTED=1
+
+    # A clean ZERO copy exit that still lands too few files must NOT be fatal (the
+    # fatal branch requires a corroborating nonzero exit). It is a WARNING: the scan
+    # reports 100 files, the copy lands 2, the exit is 0. The file-count-mismatch
+    # WARNING fires and the completion banner reads WITH WARNINGS, but the script
+    # still exits 0 and never prints the fatal short-copy error. Logical KB is 0 so
+    # the size check is skipped, isolating the file-count signal.
+    docker() {
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 0; fi
+                # 100 files, logical KB 0 (skips size verification)
+                printf '100\n512\t/source\n500K\t/source\n0\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)
+                local dest_dir=""
+                for arg in "$@"; do dest_dir="${arg}"; done
+                dest_dir="${dest_dir%/}"
+                if [ -n "${dest_dir}" ]; then
+                    mkdir -p "${dest_dir}"
+                    touch "${dest_dir}/file1" "${dest_dir}/file2"
+                fi
+                return 0
+                ;;
+            rm) return 0 ;;
+            *)  return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_success
+    assert_output --partial "file-count mismatch"
+    assert_output --partial "Backup completed WITH WARNINGS -- verify before relying on it"
+    refute_output --partial "must not be relied on"
+}
+
+@test "backup: completion banner reads plain 'Backup complete!' on a clean run" {
+    export DAAF_NESTED=1
+
+    # A fully clean run -- full file count, no size drift (logical KB 0 skips the
+    # size check), Claude state and permission manifest both succeed -- must print
+    # the plain "Backup complete!" banner and NOT the WITH-WARNINGS variant.
+    docker() {
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 0; fi
+                # 2 files, logical KB 0 (skips size verification)
+                printf '2\n512\t/source\n500K\t/source\n0\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)
+                local dest_dir=""
+                for arg in "$@"; do dest_dir="${arg}"; done
+                dest_dir="${dest_dir%/}"
+                if [ -n "${dest_dir}" ]; then
+                    mkdir -p "${dest_dir}"
+                    touch "${dest_dir}/file1" "${dest_dir}/file2"
+                fi
+                return 0
+                ;;
+            rm) return 0 ;;
+            *)  return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_success
+    assert_output --partial "Backup complete!"
+    refute_output --partial "WITH WARNINGS"
 }
 
 @test "backup: volume scan outputs unexpected format triggers error" {
@@ -834,3 +965,137 @@ teardown() {
     assert_failure
     assert_output --partial "ERROR"
 }
+
+# =========================================================================
+# --- Helper-container reap on staging launch failure ---
+# =========================================================================
+# `docker run -d` can fail AFTER creating the container (Created/Exited) while
+# still printing its CID to stdout, which the command substitution captures. The
+# launch guards must reap that captured CID (docker rm -f <cid>) so a launch
+# failure does not leak a helper container. These mocks log every docker call to a
+# file so the reap can be asserted after `run` (the DOCKER_CALLS array does not
+# survive bats's `run` subshell). Each test would FAIL against the pre-fix code
+# (main branch: no reap before exit 1; Claude branch: `|| CLAUDE_STAGE_CID=""`
+# blanked the CID before any cleanup).
+
+@test "backup: main staging launch failure reaps the captured helper container" {
+    export DAAF_NESTED=1
+
+    # The data-volume `docker run -d` prints a CID but exits nonzero. The error
+    # branch must run `docker rm -f stagecid0000` before `exit 1`.
+    docker() {
+        printf '%s\n' "$*" >> "${TEST_DIR}/docker_calls.log"
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 1; fi
+                printf '5\n512\t/source\n500K\t/source\n500\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)   return 0 ;;
+            logs) echo ""; return 0 ;;
+            rm)   return 0 ;;
+            *)    return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_failure
+    assert_output --partial "Could not start the staging container"
+    # The captured CID must have been reaped in the error branch.
+    run grep -F 'rm -f stagecid0000' "${TEST_DIR}/docker_calls.log"
+    assert_success
+}
+
+@test "backup: Claude staging launch failure preserves and reaps the captured CID (WARNING, not fatal)" {
+    export DAAF_NESTED=1
+
+    # Data-volume backup succeeds; the Claude-volume `docker run -d` prints a CID but
+    # exits nonzero. The fix keeps the captured CID (not `|| CLAUDE_STAGE_CID=""`) so
+    # the end-of-block `docker rm -f claudestagecid` reaps it. Claude failure stays a
+    # WARNING; the script still completes (the data backup is valid). Logical KB 0
+    # skips the size check. The `run -d` arm distinguishes the two volumes by the
+    # "claude-config" substring in the volume mount argument.
+    docker() {
+        printf '%s\n' "$*" >> "${TEST_DIR}/docker_calls.log"
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then
+                    if printf '%s' "$*" | grep -q 'claude-config'; then
+                        echo "claudestagecid"; return 1
+                    fi
+                    echo "stagecid0000"; return 0
+                fi
+                printf '2\n512\t/source\n500K\t/source\n0\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)
+                local dest_dir=""
+                for arg in "$@"; do dest_dir="${arg}"; done
+                dest_dir="${dest_dir%/}"
+                if [ -n "${dest_dir}" ]; then
+                    mkdir -p "${dest_dir}"
+                    touch "${dest_dir}/file1" "${dest_dir}/file2"
+                fi
+                return 0
+                ;;
+            logs) echo ""; return 0 ;;
+            rm)   return 0 ;;
+            *)    return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_success
+    assert_output --partial "Failed to back up the Claude Code state volume"
+    # The captured Claude CID must be reaped -- proving it was NOT blanked before cleanup.
+    run grep -F 'rm -f claudestagecid' "${TEST_DIR}/docker_calls.log"
+    assert_success
+}
+
+@test "backup: file-count tolerance floors to 1 for a small backup (clamp parity with PS)" {
+    export DAAF_NESTED=1
+
+    # For <100 files, TOTAL_FILES/100 truncates to 0; the clamp raises it to 1 so a
+    # 1-file difference is tolerated (parity with the PS [math]::Max(1, ...) floor).
+    # Scan reports 2 files; the data copy lands 3 files (diff = 1). With the clamp the
+    # difference is within tolerance -> NO file-count-mismatch WARNING. Without the
+    # clamp (tolerance 0) a diff of 1 would warn. Logical KB 0 skips the size check,
+    # isolating the count signal.
+    docker() {
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            run)
+                if [ "${2:-}" = "-d" ]; then echo "stagecid0000"; return 0; fi
+                printf '2\n512\t/source\n500K\t/source\n0\n'
+                return 0
+                ;;
+            wait) echo "0"; return 0 ;;
+            cp)
+                local dest_dir=""
+                for arg in "$@"; do dest_dir="${arg}"; done
+                dest_dir="${dest_dir%/}"
+                if [ -n "${dest_dir}" ]; then
+                    mkdir -p "${dest_dir}"
+                    touch "${dest_dir}/file1" "${dest_dir}/file2" "${dest_dir}/file3"
+                fi
+                return 0
+                ;;
+            rm) return 0 ;;
+            *)  return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash "${REPO_ROOT}/scripts/host/backup_daaf.sh"
+    assert_success
+    refute_output --partial "file-count mismatch"
+}
diff --git a/tests/bash/backup_twin_parity.bats b/tests/bash/backup_twin_parity.bats
index 8c9b4ca3..efbf3394 100755
--- a/tests/bash/backup_twin_parity.bats
+++ b/tests/bash/backup_twin_parity.bats
@@ -285,3 +285,88 @@ dquote_count() { tr -cd '"' | wc -c | tr -d '[:space:]'; }
     run diff "${TEST_DIR}/ref_r_sh.txt" "${TEST_DIR}/drift_r_ps1.txt"
     assert_failure
 }
+
+# ===========================================================================
+# 5. HOST-SIDE LAUNCH-FAILURE REAP: both twins reap a captured staging CID
+# ===========================================================================
+# A `docker run -d` can fail AFTER creating the container (Created/Exited) while
+# still printing its CID. Both twins must reap that captured CID on a launch
+# failure rather than leaking a helper container. This is a host-side control-flow
+# parity concern the container-program diffs above do not cover -- the historical
+# gap where the .ps1 already reaped but the .sh did not.
+
+@test "twin-parity: both backup twins reap the captured MAIN staging CID on a launch failure" {
+    # .sh main launch: the `if ! STAGE_CID="$(docker run -d ...)"` error branch reaps
+    # the captured CID before `exit 1` (also used by the traps -- presence suffices).
+    run grep -F 'docker rm -f "${STAGE_CID:-}"' "${REPO_ROOT}/${BACKUP_SH}"
+    assert_success
+    # .ps1 main launch: the stage-start guard reaps $StageCid when the launch failed.
+    run grep -F 'docker rm -f $StageCid' "${REPO_ROOT}/${BACKUP_PS1}"
+    assert_success
+}
+
+@test "twin-parity: both backup twins preserve + reap the CLAUDE staging CID (no blanking)" {
+    # .sh: the launch OUTCOME is captured in a separate flag so the CID stays intact
+    # for the end-of-block reap. The old `|| CLAUDE_STAGE_CID=""` blanked the CID
+    # before any cleanup could run and MUST be gone.
+    run grep -F 'CLAUDE_STAGE_START_OK=1' "${REPO_ROOT}/${BACKUP_SH}"
+    assert_success
+    run grep -F 'docker rm -f "${CLAUDE_STAGE_CID}"' "${REPO_ROOT}/${BACKUP_SH}"
+    assert_success
+    # The fixed launch uses an `if CLAUDE_STAGE_CID="$(docker run -d ...)"` guard. The
+    # buggy version was a `CLAUDE_STAGE_CID="$(...)" || CLAUDE_STAGE_CID=""` one-liner
+    # with NO leading `if ` -- so this positive assertion discriminates fix from bug.
+    # (A negative grep for the old `|| CLAUDE_STAGE_CID=""` idiom would false-match the
+    # explanatory comment that documents the historical pattern.)
+    run grep -F 'if CLAUDE_STAGE_CID="$(docker run -d' "${REPO_ROOT}/${BACKUP_SH}"
+    assert_success
+    # .ps1: the finally block reaps $ClaudeStageCid on every exit path.
+    run grep -F 'docker rm -f $ClaudeStageCid' "${REPO_ROOT}/${BACKUP_PS1}"
+    assert_success
+}
+
+# ===========================================================================
+# 6. RESTORE-PAIR LAUNCH-FAILURE REAP: both twins reap a captured create CID
+# ===========================================================================
+# Same host-side control-flow parity concern as section 5, applied to the restore
+# pair's `docker create` helper-container guards. `docker create` is single-phase
+# so a fail-with-CID is near-theoretical, but the .ps1 twin already reaps the CID in
+# a try/finally at BOTH volumes, so the .sh must match: reap the captured CID on a
+# create failure rather than leaking a helper container. These are source-anchor
+# pins (fix-specific, comment-safe positive anchors), complementing the behavioral
+# reap tests in restore_from_backup.bats.
+
+@test "twin-parity: both restore twins reap the captured MAIN helper CID on a create failure" {
+    # .sh main guard: the `${CID:-}` reap form must appear EXACTLY twice -- once in
+    # the INT/TERM trap and once in the `if ! CID="$(docker create ...)"` error branch
+    # (the fix). Pre-fix the trap alone gave a single occurrence, so a bare presence
+    # grep would not discriminate; the count of 2 is fix-specific. (The cp-failure and
+    # post-copy cleanups use the unguarded `${CID}` form, so they are not counted.)
+    local n
+    n="$(grep -cF 'docker rm -f "${CID:-}"' "${REPO_ROOT}/${RESTORE_SH}")"
+    [ "${n}" -eq 2 ] || { echo "FAIL: restore_from_backup.sh has ${n} \${CID:-} reap sites, expected 2 (INT/TERM trap + create-failure error branch). A missing error-branch reap leaks the helper container."; return 1; }
+    # .ps1 main guard: the try/finally reaps $Cid on every exit path (incl. a create
+    # that failed after emitting a CID).
+    run grep -F 'docker rm -f $Cid' "${REPO_ROOT}/${RESTORE_PS1}"
+    assert_success
+}
+
+@test "twin-parity: both restore twins preserve + reap the CLAUDE helper CID (no blanking)" {
+    # .sh: the create OUTCOME is captured in a separate flag so the CID stays intact
+    # for the end-of-block reap. The old `|| CLAUDE_CID=""` blanked the CID before any
+    # cleanup could run and MUST be gone.
+    run grep -F 'CLAUDE_CREATE_OK=1' "${REPO_ROOT}/${RESTORE_SH}"
+    assert_success
+    run grep -F 'docker rm -f "${CLAUDE_CID}"' "${REPO_ROOT}/${RESTORE_SH}"
+    assert_success
+    # The fixed guard uses an `if CLAUDE_CID="$(docker create ...)"` form. The buggy
+    # version was a `CLAUDE_CID="$(...)" || CLAUDE_CID=""` one-liner with NO leading
+    # `if ` -- so this positive assertion discriminates fix from bug. (A negative grep
+    # for the old `|| CLAUDE_CID=""` idiom would false-match the explanatory comment
+    # that documents the historical pattern.)
+    run grep -F 'if CLAUDE_CID="$(docker create' "${REPO_ROOT}/${RESTORE_SH}"
+    assert_success
+    # .ps1: the finally block reaps $ClaudeCid on every exit path.
+    run grep -F 'docker rm -f $ClaudeCid' "${REPO_ROOT}/${RESTORE_PS1}"
+    assert_success
+}
diff --git a/tests/bash/context_bar.bats b/tests/bash/context_bar.bats
index f3bf1edb..56172a64 100755
--- a/tests/bash/context_bar.bats
+++ b/tests/bash/context_bar.bats
@@ -5,7 +5,9 @@
 # These tests are deterministic and network-independent. Static cases keep the
 # OpenRouter branch disabled; dynamic cases prepend a fake curl executable that
 # serves a controlled catalogue from project scratch. No live provider call is
-# possible, and fake catalogue/cache data never writes to /tmp.
+# possible, and all catalogue, cache, health, and quota seams stay in project scratch.
+# Synthetic health fixtures are local contract evidence only; they make no claim
+# that either provider route accepts or serves a requested tier.
 # ============================================================================
 
 load 'test_helper'
@@ -19,20 +21,99 @@ setup() {
     MOCK_BIN="${SCRATCH_DIR}/bin"
     DAAF_CONTEXT_BAR_CACHE_DIR="${SCRATCH_DIR}/cache"
     CTX_CACHE="${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-ctx-window-${FAKE_SESSION}"
+    MODEL_CACHE="${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-model-${FAKE_SESSION}"
     OR_CACHE="${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-or-models-${FAKE_SESSION}"
+    QUOTA_STATE_FILE="${SCRATCH_DIR}/quota_state.json"
+    DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE"
+    HEALTH_FILE="${SCRATCH_DIR}/health.json"
+    MOCK_CURL_LOG="${SCRATCH_DIR}/curl.log"
     mkdir -p "$MOCK_BIN" "$DAAF_CONTEXT_BAR_CACHE_DIR"
     cat > "${MOCK_BIN}/curl" <<'MOCK_CURL'
 #!/usr/bin/env bash
-printf '{"data":[{"id":"z-ai/glm-5.2","context_length":%s}]}' \
-    "${MOCK_OPENROUTER_CONTEXT:?MOCK_OPENROUTER_CONTEXT must be set}"
+printf '%s\n' "$*" >> "${MOCK_CURL_LOG:?MOCK_CURL_LOG must be set}"
+url="${!#}"
+case "$url" in
+    https://openrouter.ai/api/v1/models)
+        printf '{"data":[{"id":"z-ai/glm-5.2","context_length":%s}]}' \
+            "${MOCK_OPENROUTER_CONTEXT:?MOCK_OPENROUTER_CONTEXT must be set}"
+        ;;
+    http://127.0.0.1:*/health)
+        [[ "${MOCK_HEALTH_UNAVAILABLE:-0}" == "1" ]] && exit 22
+        [[ -f "${MOCK_HEALTH_FILE:?MOCK_HEALTH_FILE must be set}" ]] || exit 22
+        if [[ "${MOCK_HEALTH_REDIRECTED:-0}" == "1" ]]; then
+            cat "$MOCK_HEALTH_FILE"
+            exit 47
+        fi
+        if [[ "${MOCK_HEALTH_OVERSIZED:-0}" == "1" ]]; then
+            printf '%17000s' x
+            exit 63
+        fi
+        cat "$MOCK_HEALTH_FILE"
+        ;;
+    *)
+        exit 97
+        ;;
+esac
 MOCK_CURL
     chmod +x "${MOCK_BIN}/curl"
+    PATH="${MOCK_BIN}:${PATH}"
     unset ANTHROPIC_BASE_URL
     unset CLAUDE_CODE_MAX_CONTEXT_TOKENS
+    unset CLAUDE_CODE_DISABLE_FAST_MODE
     unset DAAF_PROVIDER_SHIM
     unset SHIM_BACKEND_MODE
-    export CONTEXT_BAR_SH FAKE_SESSION SCRATCH_DIR MOCK_BIN
-    export DAAF_CONTEXT_BAR_CACHE_DIR CTX_CACHE OR_CACHE
+    unset SHIM_PORT
+    unset MOCK_HEALTH_UNAVAILABLE
+    unset MOCK_HEALTH_REDIRECTED
+    unset MOCK_HEALTH_OVERSIZED
+    export CONTEXT_BAR_SH FAKE_SESSION SCRATCH_DIR MOCK_BIN PATH
+    export DAAF_CONTEXT_BAR_CACHE_DIR CTX_CACHE MODEL_CACHE OR_CACHE QUOTA_STATE_FILE
+    export DAAF_QUOTA_STATE_FILE
+    export HEALTH_FILE MOCK_HEALTH_FILE="$HEALTH_FILE" MOCK_CURL_LOG
+}
+
+# Write a quota_state.json fixture. Args: captured_at, primary_used_pct,
+# primary_window_min, primary_reset_s, secondary_used_pct, secondary_window_min,
+# secondary_reset_s. The five snapshot fields the reader never consults are fixed
+# constants here (plan_type, active_limit, credits_has, credits_balance,
+# credits_unlimited -- credits_balance is numeric-looking but still reader-ignored).
+# Mirrors the shim's _write_quota_state output shape.
+_write_quota_state() {
+    printf '{"captured_at":%s,"plan_type":"pro","active_limit":"premium","primary_used_pct":"%s","primary_window_min":"%s","primary_reset_s":"%s","secondary_used_pct":"%s","secondary_window_min":"%s","secondary_reset_s":"%s","credits_has":"False","credits_balance":"0","credits_unlimited":"False"}' \
+        "$1" "$2" "$3" "$4" "$5" "$6" "$7" > "$QUOTA_STATE_FILE"
+}
+
+# Write the exact v1.3.9 gpt_service_tier /health contract. Args: route,
+# policy status, policy backend (JSON scalar), enabled, effective,
+# native_fast_disabled, latest_terminal (JSON value).
+_write_gpt_health() {
+    local vocabulary
+    case "$1" in
+        chatgpt|openai) vocabulary="priority" ;;
+        *) fail "unsupported test route: $1" ;;
+    esac
+    printf '{"service":"daaf-anthropic-openai-shim","status":"ok","backend":"https://example.invalid","backend_mode":"%s","codex_home_present":true,"version":"1.3.9","sanitize_tools":true,"reasoning_effort":"high","text_verbosity":"medium","auth":{"state":"n/a"},"reasoning_cache":{"entries":0,"restored":0,"hits":0,"restored_hits":0},"prompt_cache":{"requests_with_usage":0,"requests_with_cached":0,"cached_tokens_total":0,"input_tokens_total":0},"gpt_service_tier":{"backend_mode":"%s","requested_tier_vocabulary":"%s","policy":{"status":"%s","backend_mode":%s,"enabled":%s,"effective":%s},"native_fast_disabled":%s,"latest_terminal":%s}}' \
+        "$1" "$1" "$vocabulary" "$2" "$3" "$4" "$5" "$6" "$7" > "$HEALTH_FILE"
+}
+
+_refute_legacy_gpt_status_text() {
+    refute_output --partial "GPT Fast req"
+    refute_output --partial "GPT Priority req"
+    refute_output --partial "req OFF"
+    refute_output --partial "req unavailable"
+    refute_output --partial "[global]"
+    refute_output --partial "last global"
+    refute_output --partial "served="
+}
+
+_assert_gpt_fast_on() {
+    assert_output --partial $'\033[38;5;245mGPT Fast On\033[0m'
+    _refute_legacy_gpt_status_text
+}
+
+_refute_gpt_fast_segment() {
+    refute_output --partial "GPT Fast On"
+    _refute_legacy_gpt_status_text
 }
 
 teardown() {
@@ -51,6 +132,182 @@ _payload() {
     assert_success
 }
 
+@test "setup pins every quota read to the per-test scratch seam" {
+    [[ "$DAAF_QUOTA_STATE_FILE" == "$QUOTA_STATE_FILE" ]]
+    [[ "$DAAF_QUOTA_STATE_FILE" == "${SCRATCH_DIR}/"* ]]
+    run test ! -e "$DAAF_QUOTA_STATE_FILE"
+    assert_success
+}
+
+@test "authoritative statusline model id is cached atomically for the session" {
+    run bash "$CONTEXT_BAR_SH" < <(_payload "openrouter/openai/gpt-5.6-terra[1m]")
+    assert_success
+
+    run cat "$MODEL_CACHE"
+    assert_success
+    assert_output "openrouter/openai/gpt-5.6-terra[1m]"
+
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -maxdepth 1 -name 'claude-model-*.tmp.*' -print
+    assert_success
+    assert_output ""
+}
+
+@test "empty authoritative model id replaces a stale model cache with unresolved identity" {
+    printf '%s' 'gpt-5.6-sol' > "$MODEL_CACHE"
+    run bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"display_name":"Unknown"},"cwd":"$TEST_DIR","transcript_path":"","session_id":"$FAKE_SESSION","context_window":{"context_window_size":200000}}
+JSON
+    assert_success
+
+    run test -f "$MODEL_CACHE"
+    assert_success
+    run test ! -s "$MODEL_CACHE"
+    assert_success
+}
+
+@test "unsafe session ids skip all session-scoped cache writes while statusline stays fail-open" {
+    local unsafe_session
+    for unsafe_session in \
+        '../escape' \
+        'nested/session' \
+        'session with spaces' \
+        '-leading-dash' \
+        "$(printf 'a%.0s' {1..129})"; do
+        run bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"cwd":"$TEST_DIR","transcript_path":"","session_id":"$unsafe_session","context_window":{"context_window_size":200000}}
+JSON
+        assert_success
+        assert_output --partial "gpt-5.6-sol"
+    done
+
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+}
+
+@test "newline NUL and unit-separator session identities cannot alias or poison caches" {
+    printf '%s' 'seed-safe-model' > "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-model-safe"
+    printf '%s' '111111' > "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-ctx-window-safe"
+    printf '%s' 'seed-victim-model' > "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-model-victim"
+    printf '%s' '222222' > "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-ctx-window-victim"
+
+    local payload
+    for payload in \
+        '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"session_id":"safe\nid","context_window":{"context_window_size":1000000}}' \
+        '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"session_id":"safe\n","context_window":{"context_window_size":1000000}}'; do
+        run bash "$CONTEXT_BAR_SH" <<< "$payload"
+        assert_success
+        assert_output --partial "Fable 5"
+        refute_output --partial "of 1050k tokens"
+    done
+
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"session_id":"victim\\u%04x","context_window":{"context_window_size":1000000}}' 0
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "Fable 5"
+    refute_output --partial "of 1050k tokens"
+
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"session_id":"victim\\u%04xgpt-5.6-sol","context_window":{"context_window_size":1000000}}' 31
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "Fable 5"
+    refute_output --partial "of 1050k tokens"
+
+    run cat "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-model-safe"
+    assert_success
+    assert_output "seed-safe-model"
+    run cat "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-ctx-window-safe"
+    assert_success
+    assert_output "111111"
+    run cat "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-model-victim"
+    assert_success
+    assert_output "seed-victim-model"
+    run cat "${DAAF_CONTEXT_BAR_CACHE_DIR}/claude-ctx-window-victim"
+    assert_success
+    assert_output "222222"
+}
+
+@test "controls in earlier display and path fields cannot shift later identity or rate fields" {
+    local payload
+    printf -v payload '{"model":{"id":"gpt-5.6-sol","display_name":"GPT\\u%04xDisplay\\u%04xName"},"cwd":"bad\\u%04xpath","transcript_path":"bad\\u%04xtranscript","session_id":"%s","context_window":{"context_window_size":1050000},"effort":{"level":"high\\u%04xshift"},"rate_limits":{"five_hour":{"used_percentage":"42\\u%04xgpt","resets_at":"bad\\u%04xreset"},"seven_day":{"used_percentage":13,"resets_at":0}}}' 10 31 10 31 "$FAKE_SESSION" 10 31 10
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "GPTDisplayName"
+    assert_output --partial "of 1050k tokens"
+    assert_output --partial "Plan usage:"
+    assert_output --partial "7d:13%"
+    refute_output --partial "5h:"
+
+    run cat "$MODEL_CACHE"
+    assert_success
+    assert_output "gpt-5.6-sol"
+    run cat "$CTX_CACHE"
+    assert_success
+    assert_output "1050000"
+}
+
+@test "control-bearing model identity is unresolved and cannot poison a stale cache" {
+    local payload
+    printf '%s' 'gpt-5.6-sol' > "$MODEL_CACHE"
+    printf -v payload '{"model":{"id":"claude-fable-5\\u%04xgpt-5.6-sol","display_name":"Fable 5"},"cwd":"%s","transcript_path":"","session_id":"%s","context_window":{"context_window_size":200000}}' 31 "$TEST_DIR" "$FAKE_SESSION"
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "Fable 5"
+    assert_output --partial "of 200k tokens"
+    refute_output --partial "of 1050k tokens"
+
+    run test ! -s "$MODEL_CACHE"
+    assert_success
+}
+
+@test "missing null empty and non-string session ids never use a shared default cache" {
+    local payload
+    for payload in \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":null,"context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":"","context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":42,"context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":true,"context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":{"value":"object-id"},"context_window":{"context_window_size":200000}}' \
+        '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"session_id":["array-id"],"context_window":{"context_window_size":200000}}'; do
+        run bash "$CONTEXT_BAR_SH" <<< "$payload"
+        assert_success
+        assert_output --partial "gpt-5.6-sol"
+    done
+
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+}
+
+@test "malformed statusline input exits successfully without writing session caches" {
+    run bash "$CONTEXT_BAR_SH" <<< 'not-json {{{'
+    assert_success
+
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+}
+
+@test "missing jq leaves statusline fail-open and creates no session or default cache" {
+    local bindir="${SCRATCH_DIR}/nojq-bin"
+    mkdir -p "$bindir"
+    ln -s "$(command -v bash)" "${bindir}/bash"
+    ln -s "$(command -v cat)" "${bindir}/cat"
+    ln -s "$(command -v basename)" "${bindir}/basename"
+
+    run env -i \
+        PATH="$bindir" \
+        DAAF_CONTEXT_BAR_CACHE_DIR="$DAAF_CONTEXT_BAR_CACHE_DIR" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "of 200k tokens"
+
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+}
+
 @test "gpt-5.6-sol[1m] displays 1050k and caches the 1050000 physical window" {
     run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]")
     assert_success
@@ -191,28 +448,634 @@ _payload() {
     assert_output "1050000"
 }
 
-@test "each missing lane signal leaves the 1,050,000 flagship window unchanged" {
-    run env SHIM_BACKEND_MODE=chatgpt \
+# =========================================================================
+# GPT Fast ON-only indicator and bounded /health projection (v1.3.9)
+# -------------------------------------------------------------------------
+# The exact GPT routes query only the loopback health endpoint through the fake
+# curl above. Tests prove the route-neutral ON label and silence for every other
+# state; no running daemon, port 4141, proxy, or live provider is contacted.
+# =========================================================================
+
+@test "exact ChatGPT ON state renders only the route-neutral GPT Fast On segment" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
+    assert_success
+    assert_output --partial "gpt-5.6-sol[1m]"
+    _assert_gpt_fast_on
+}
+
+@test "exact OpenAI API ON state uses the same route-neutral GPT Fast On segment" {
+    _write_gpt_health openai ok '"openai"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=openai \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
+    assert_success
+    assert_output --partial "gpt-5.6-sol[1m]"
+    _assert_gpt_fast_on
+}
+
+@test "legacy requested fast vocabulary is silent on both exact GPT shim routes" {
+    local route
+    local canonical_health
+    for route in chatgpt openai; do
+        _write_gpt_health "$route" ok "\"${route}\"" true true true null
+        canonical_health="$(<"$HEALTH_FILE")"
+        printf '%s' "${canonical_health/\"requested_tier_vocabulary\":\"priority\"/\"requested_tier_vocabulary\":\"fast\"}" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE="$route" \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "root health status must be the exact string ok" {
+    local root_status
+    local canonical_health
+    local mutated_health
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    canonical_health="$(<"$HEALTH_FILE")"
+
+    for root_status in '__missing__' '42' '"OK"' '" ok"' '"ok "' '"error"'; do
+        if [[ "$root_status" == "__missing__" ]]; then
+            mutated_health="${canonical_health/\"status\":\"ok\",/}"
+        else
+            mutated_health="${canonical_health/\"status\":\"ok\"/\"status\":${root_status}}"
+        fi
+        printf '%s' "$mutated_health" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "root health version accepts plus and exact 1 and 64 character boundaries" {
+    local canonical_health
+    local mutated_health
+    local version
+    local version_64
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    canonical_health="$(<"$HEALTH_FILE")"
+    version_64="$(printf 'a%.0s' {1..64})"
+
+    # Positive control: the otherwise-canonical effective-ON document renders.
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    for version in 'a' '+' 'v1.3.9+fast' "$version_64"; do
+        mutated_health="${canonical_health/\"version\":\"1.3.9\"/\"version\":\"${version}\"}"
+        printf '%s' "$mutated_health" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _assert_gpt_fast_on
+    done
+}
+
+@test "root health version rejects slash empty and length 65 non-vacuously" {
+    local canonical_health
+    local mutated_health
+    local version
+    local version_65
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    canonical_health="$(<"$HEALTH_FILE")"
+    version_65="$(printf 'a%.0s' {1..65})"
+
+    # Positive control: each negative fixture below changes only root version.
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    for version in '/' '' "$version_65"; do
+        mutated_health="${canonical_health/\"version\":\"1.3.9\"/\"version\":\"${version}\"}"
+        printf '%s' "$mutated_health" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "terminal model accepts exact 1 and 160 character boundaries and canonical punctuation" {
+    local canonical_latest
+    local latest
+    local model
+    local model_160
+    canonical_latest='{"model":"gpt-5.6-sol","requested_service_tier":"priority","requested_source":"shim_global","served_service_tier":"default","completed_at":"2026-07-25T19:20:30Z"}'
+    model_160="a$(printf -- '-%.0s' {1..159})"
+
+    for model in 'a' 'a._:/-Z' "$model_160"; do
+        latest="${canonical_latest/\"model\":\"gpt-5.6-sol\"/\"model\":\"${model}\"}"
+        _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _assert_gpt_fast_on
+    done
+}
+
+@test "terminal model rejects empty length 161 leading hyphen and plus non-vacuously" {
+    local canonical_latest
+    local latest
+    local model
+    local model_161
+    canonical_latest='{"model":"gpt-5.6-sol","requested_service_tier":"priority","requested_source":"shim_global","served_service_tier":"default","completed_at":"2026-07-25T19:20:30Z"}'
+    model_161="a$(printf -- '-%.0s' {1..160})"
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true "$canonical_latest"
+
+    # Positive control: each negative fixture below changes only latest_terminal.model.
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    for model in '' "$model_161" '-bad' 'a+bad'; do
+        latest="${canonical_latest/\"model\":\"gpt-5.6-sol\"/\"model\":\"${model}\"}"
+        _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "duplicate health object members at any depth are rejected before jq semantics" {
+    local canonical_health
+    local fixture
+    local -a fixtures
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    canonical_health="$(<"$HEALTH_FILE")"
+
+    # Positive control: canonical ON survives the duplicate-rejecting prefilter.
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    fixtures=(
+        "${canonical_health/\"status\":\"ok\"/\"status\":\"ok\",\"status\":\"ok\"}"
+        "${canonical_health/\"status\":\"ok\"/\"status\":\"ok\",\"status\":\"error\"}"
+        "${canonical_health/\"enabled\":true/\"enabled\":true,\"enabled\":true}"
+        "${canonical_health/\"enabled\":true/\"enabled\":true,\"enabled\":false}"
+        "${canonical_health/\"effective\":true/\"effective\":true,\"effective\":true}"
+        "${canonical_health/\"effective\":true/\"effective\":true,\"effective\":false}"
+        "${canonical_health/\"reasoning_cache\":{\"entries\":0/\"reasoning_cache\":{\"entries\":0,\"entries\":0}"
+        "${canonical_health/\"reasoning_cache\":{\"entries\":0/\"reasoning_cache\":{\"entries\":0,\"entries\":1}"
+        '{"service":"daaf-anthropic-openai-shim","status":"ok"'
+    )
+    for fixture in "${fixtures[@]}"; do
+        printf '%s' "$fixture" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+        refute_output --partial "duplicate object member"
+        refute_output --partial "JSONDecodeError"
+    done
+}
+
+@test "explicit OFF is silent on both exact GPT shim routes" {
+    local route
+    for route in chatgpt openai; do
+        _write_gpt_health "$route" ok "\"${route}\"" false false true null
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE="$route" \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "missing reset invalid unreadable and unsafe policy states are silent" {
+    local state
+    for state in missing invalid unreadable unsafe; do
+        _write_gpt_health chatgpt "$state" null false false true null
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "route mismatch and enabled-but-ineffective policy are silent" {
+    _write_gpt_health chatgpt ok '"openai"' true false true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _refute_gpt_fast_segment
+
+    _write_gpt_health chatgpt ok '"chatgpt"' true false true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _refute_gpt_fast_segment
+}
+
+@test "missing or incoherent native Fast disablement is silent" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _refute_gpt_fast_segment
+
+    _write_gpt_health chatgpt ok '"chatgpt"' true true false null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _refute_gpt_fast_segment
+}
+
+@test "valid terminal history never appears even when the ON indicator renders" {
+    local latest
+    latest='{"model":"gpt-5.6-sol","requested_service_tier":"priority","requested_source":"shim_global","served_service_tier":"default","completed_at":"2026-07-25T19:20:30Z"}'
+    _write_gpt_health openai ok '"openai"' true true true "$latest"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=openai \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-terra[1m]" 1050000)
+    assert_success
+    assert_output --partial "gpt-5.6-terra[1m]"
+    _assert_gpt_fast_on
+    refute_output --partial "gpt-5.6-sol served"
+    refute_output --partial "completed_at"
+    refute_output --partial "requested=priority"
+}
+
+@test "compatibility terminal served fast permits ON without becoming requested vocabulary" {
+    local latest
+    latest='{"model":"gpt-5.6-sol","requested_service_tier":"priority","requested_source":"shim_global","served_service_tier":"fast","completed_at":"2026-07-25T19:20:30Z"}'
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+    refute_output --partial "requested=fast"
+    refute_output --partial "served=fast"
+}
+
+@test "malformed semantic-invalid and extra-key nested health blocks are silent non-vacuously" {
+    local fixture
+    local prefix
+    local canonical_nested
+    prefix='{"service":"daaf-anthropic-openai-shim","status":"ok","version":"1.3.9","backend_mode":"chatgpt","gpt_service_tier":'
+    canonical_nested='{"backend_mode":"chatgpt","requested_tier_vocabulary":"priority","policy":{"status":"ok","backend_mode":"chatgpt","enabled":true,"effective":true},"native_fast_disabled":true,"latest_terminal":null}'
+
+    # Control: the same manually constructed root and a canonical nested block
+    # reach the literal ON projection, so each loop case fails only at its nested defect.
+    printf '%s%s}' "$prefix" "$canonical_nested" > "$HEALTH_FILE"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    for fixture in \
+        '[' \
+        '{"backend_mode":"chatgpt","requested_tier_vocabulary":"priority","policy":{"status":"ok","backend_mode":"chatgpt","enabled":true,"effective":true},"native_fast_disabled":true,"latest_terminal":null,"extra":"forbidden"}' \
+        '{"backend_mode":"chatgpt","requested_tier_vocabulary":"priority","policy":{"status":"ok","backend_mode":"chatgpt","enabled":false,"effective":true},"native_fast_disabled":true,"latest_terminal":null}' \
+        '{"backend_mode":"chatgpt","requested_tier_vocabulary":"priority","policy":{"status":"ok","backend_mode":"chatgpt","enabled":true,"effective":true},"native_fast_disabled":true,"latest_terminal":{"model":"gpt-5.6-sol","requested_service_tier":"priority","requested_source":"shim_global","served_service_tier":"fast","completed_at":"2026-07-25T19:20:30Z","extra":1}}'; do
+        printf '%s%s}' "$prefix" "$fixture" > "$HEALTH_FILE"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        assert_output --partial "gpt-5.6-sol"
+        _refute_gpt_fast_segment
+        refute_output --partial "extra"
+    done
+}
+
+@test "invalid terminal history keeps strict health validation and is silent" {
+    local latest
+    local requested
+    local source
+    local served
+    local completed
+    local case_spec
+    for case_spec in \
+        'fast|shim_global|default|2026-07-25T19:20:30Z' \
+        ' priority|shim_global|default|2026-07-25T19:20:30Z' \
+        'priority|Shim_Global|default|2026-07-25T19:20:30Z' \
+        'priority| shim_global|default|2026-07-25T19:20:30Z' \
+        'priority|shim_global|FAST|2026-07-25T19:20:30Z' \
+        'priority|shim_global|fast |2026-07-25T19:20:30Z' \
+        'priority|shim_global|default|2026-02-30T19:20:30Z'; do
+        IFS='|' read -r requested source served completed <<< "$case_spec"
+        latest=$(printf '{"model":"gpt-5.6-sol","requested_service_tier":"%s","requested_source":"%s","served_service_tier":"%s","completed_at":"%s"}' \
+            "$requested" "$source" "$served" "$completed")
+        _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+        assert_success
+        _refute_gpt_fast_segment
+    done
+
+    latest='{"model":"gpt-5.6-sol","requested_service_tier":null,"requested_source":"shim_global","served_service_tier":null,"completed_at":"2026-07-25T19:20:30Z"}'
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _refute_gpt_fast_segment
+}
+
+@test "coherent null terminal history permits ON without rendering history" {
+    local latest
+    latest='{"model":"gpt-5.6-sol","requested_service_tier":null,"requested_source":"none","served_service_tier":null,"completed_at":"2026-07-25T19:20:30Z"}'
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true "$latest"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+}
+
+@test "unavailable oversized and redirected health are silent while the bar remains intact" {
+    local failure_var
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    for failure_var in MOCK_HEALTH_UNAVAILABLE MOCK_HEALTH_OVERSIZED MOCK_HEALTH_REDIRECTED; do
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 "${failure_var}=1" \
+            bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
+        assert_success
+        assert_output --partial "gpt-5.6-sol[1m]"
+        assert_output --partial "of 370k tokens"
+        _refute_gpt_fast_segment
+    done
+}
+
+@test "missing curl jq or duplicate parser is silent and confined to scratch seams" {
+    local bindir="${SCRATCH_DIR}/missing-tool-bin"
+    local unsafe_session="-missing-tools-invalid-session"
+    local unsafe_payload
+    local isolated_quota="${SCRATCH_DIR}/guaranteed-missing-quota-state.json"
+    unsafe_payload=$(printf '{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"cwd":"%s","transcript_path":"","session_id":"%s","context_window":{"context_window_size":200000}}' \
+        "$TEST_DIR" "$unsafe_session")
+    mkdir -p "$bindir"
+    ln -s "$(command -v bash)" "${bindir}/bash"
+    ln -s "$(command -v cat)" "${bindir}/cat"
+    ln -s "$(command -v basename)" "${bindir}/basename"
+    ln -s "$(command -v jq)" "${bindir}/jq"
+    ln -s "$(command -v python3)" "${bindir}/python3"
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run test ! -e "$isolated_quota"
+    assert_success
+
+    # Missing curl only.
+    run env -i PATH="$bindir" \
+        DAAF_CONTEXT_BAR_CACHE_DIR="$DAAF_CONTEXT_BAR_CACHE_DIR" \
+        DAAF_QUOTA_STATE_FILE="$isolated_quota" \
+        DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" <<< "$unsafe_payload"
+    assert_success
+    _refute_gpt_fast_segment
+    refute_output --partial "Plan usage:"
+    run test ! -e "$isolated_quota"
+    assert_success
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+
+    # Missing jq only.
+    rm -f "${bindir}/jq"
+    ln -s "${MOCK_BIN}/curl" "${bindir}/curl"
+    run env -i PATH="$bindir" \
+        DAAF_CONTEXT_BAR_CACHE_DIR="$DAAF_CONTEXT_BAR_CACHE_DIR" \
+        DAAF_QUOTA_STATE_FILE="$isolated_quota" \
+        DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        MOCK_CURL_LOG="$MOCK_CURL_LOG" MOCK_HEALTH_FILE="$HEALTH_FILE" \
+        bash "$CONTEXT_BAR_SH" <<< "$unsafe_payload"
+    assert_success
+    _refute_gpt_fast_segment
+    refute_output --partial "Plan usage:"
+    run test ! -e "$isolated_quota"
+    assert_success
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+
+    # Missing duplicate-rejecting parser only.
+    ln -s "$(command -v jq)" "${bindir}/jq"
+    rm -f "${bindir}/python3"
+    run env -i PATH="$bindir" \
+        DAAF_CONTEXT_BAR_CACHE_DIR="$DAAF_CONTEXT_BAR_CACHE_DIR" \
+        DAAF_QUOTA_STATE_FILE="$isolated_quota" \
+        DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        MOCK_CURL_LOG="$MOCK_CURL_LOG" MOCK_HEALTH_FILE="$HEALTH_FILE" \
+        bash "$CONTEXT_BAR_SH" <<< "$unsafe_payload"
+    assert_success
+    _refute_gpt_fast_segment
+    refute_output --partial "Plan usage:"
+    run test ! -e "$isolated_quota"
+    assert_success
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -mindepth 1 -maxdepth 1 -print
+    assert_success
+    assert_output ""
+}
+
+@test "health probe disables ambient curl config first and keeps all bounded transport controls" {
+    _write_gpt_health openai ok '"openai"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=openai \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 SHIM_PORT=' 4141 ' \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    _assert_gpt_fast_on
+
+    run cat "$MOCK_CURL_LOG"
+    assert_success
+    [[ "$output" == "-q "* ]]
+    assert_output --partial "-q --fail"
+    assert_output --partial "--location"
+    assert_output --partial "--max-redirs 0"
+    assert_output --partial "--noproxy *"
+    assert_output --partial "--proxy"
+    assert_output --partial "--connect-timeout 0.2"
+    assert_output --partial "--max-time 0.6"
+    assert_output --partial "--max-filesize 16384"
+    assert_output --partial "http://127.0.0.1:4141/health"
+}
+
+@test "anchored GPT indicator classification rejects near-miss model IDs without probing health" {
+    local model
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    for model in vendor/notgpt-5.6-sol xgpt-5.6-sol foo-gpt-5.6-sol; do
+        rm -f "$MOCK_CURL_LOG"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" < <(_payload "$model")
+        assert_success
+        assert_output --partial "$model"
+        _refute_gpt_fast_segment
+        run test ! -e "$MOCK_CURL_LOG"
+        assert_success
+    done
+}
+
+@test "provider-prefixed terminal GPT slug remains eligible for the ON indicator" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "openrouter/openai/gpt-5.6-sol" 1050000)
+    assert_success
+    assert_output --partial "openrouter/openai/gpt-5.6-sol"
+    _assert_gpt_fast_on
+}
+
+@test "bounded display-name fallback remains eligible only when model id is absent" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"display_name":"gpt-5.6-sol[1m]#xhigh[1m]"},"cwd":"$TEST_DIR","transcript_path":"","session_id":"$FAKE_SESSION","context_window":{"context_window_size":200000}}
+JSON
+    assert_success
+    assert_output --partial "gpt-5.6-sol[1m]"
+    _assert_gpt_fast_on
+
+    rm -f "$MOCK_CURL_LOG"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"id":"claude-fable-5","display_name":"gpt-5.6-sol"},"cwd":"$TEST_DIR","transcript_path":"","session_id":"$FAKE_SESSION","context_window":{"context_window_size":200000}}
+JSON
+    assert_success
+    _refute_gpt_fast_segment
+    run test ! -e "$MOCK_CURL_LOG"
+    assert_success
+}
+
+@test "present invalid model ids cannot unlock GPT display-name fallback" {
+    local oversized_id
+    local payload
+    local json_escape='\'
+    local -a payloads
+    oversized_id="gpt-$(printf 'a%.0s' {1..157})"
+    payloads=(
+        '{"model":{"id":42,"display_name":"gpt-5.6-sol"},"session_id":"bats-invalid-id-number","context_window":{"context_window_size":200000}}'
+        '{"model":{"id":{"value":"gpt-5.6-sol"},"display_name":"gpt-5.6-sol"},"session_id":"bats-invalid-id-object","context_window":{"context_window_size":200000}}'
+        '{"model":{"id":["gpt-5.6-sol"],"display_name":"gpt-5.6-sol"},"session_id":"bats-invalid-id-array","context_window":{"context_window_size":200000}}'
+        "{\"model\":{\"id\":\"bad${json_escape}u001fgpt-5.6-sol\",\"display_name\":\"gpt-5.6-sol\"},\"session_id\":\"bats-invalid-id-control\",\"context_window\":{\"context_window_size\":200000}}"
+        "{\"model\":{\"id\":\"${oversized_id}\",\"display_name\":\"gpt-5.6-sol\"},\"session_id\":\"bats-invalid-id-oversized\",\"context_window\":{\"context_window_size\":200000}}"
+    )
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+
+    for payload in "${payloads[@]}"; do
+        rm -f "$MOCK_CURL_LOG"
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+            bash "$CONTEXT_BAR_SH" <<< "$payload"
+        assert_success
+        assert_output --partial "gpt-5.6-sol"
+        _refute_gpt_fast_segment
+        run test ! -e "$MOCK_CURL_LOG"
+        assert_success
+    done
+}
+
+@test "exact shim route plus a non-GPT model is silent and skips the health probe" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "claude-fable-5" 1000000)
+    assert_success
+    assert_output --partial "claude-fable-5"
+    _refute_gpt_fast_segment
+    run test ! -e "$MOCK_CURL_LOG"
+    assert_success
+}
+
+@test "Anthropic and OpenRouter non-GPT route fixtures remain byte-for-byte unchanged" {
+    run bash "$CONTEXT_BAR_SH" < <(_payload "claude-fable-5" 1000000)
+    assert_success
+    local anthropic_baseline="$output"
+    run env DAAF_PROVIDER_SHIM=anthropic SHIM_BACKEND_MODE=chatgpt \
+        bash "$CONTEXT_BAR_SH" < <(_payload "claude-fable-5" 1000000)
+    assert_success
+    [[ "$output" == "$anthropic_baseline" ]]
+    _refute_gpt_fast_segment
+
+    rm -f "$OR_CACHE" "$MOCK_CURL_LOG"
+    run env ANTHROPIC_BASE_URL="https://openrouter.ai/api" \
+        MOCK_OPENROUTER_CONTEXT=1048576 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "z-ai/glm-5.2")
+    assert_success
+    local openrouter_baseline="$output"
+    rm -f "$OR_CACHE" "$MOCK_CURL_LOG"
+    run env ANTHROPIC_BASE_URL="https://openrouter.ai/api" \
+        DAAF_PROVIDER_SHIM=openrouter SHIM_BACKEND_MODE=openai \
+        MOCK_OPENROUTER_CONTEXT=1048576 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "z-ai/glm-5.2")
+    assert_success
+    [[ "$output" == "$openrouter_baseline" ]]
+    _refute_gpt_fast_segment
+
+    run cat "$MOCK_CURL_LOG"
+    assert_success
+    assert_output --partial "https://openrouter.ai/api/v1/models"
+    refute_output --partial "127.0.0.1"
+}
+
+@test "each missing shim-route signal leaves the GPT Fast segment silent" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
+    run env SHIM_BACKEND_MODE=chatgpt CLAUDE_CODE_DISABLE_FAST_MODE=1 \
         bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
     assert_success
     assert_output --partial "of 1050k tokens"
+    _refute_gpt_fast_segment
 
-    run env DAAF_PROVIDER_SHIM=openai \
+    run env DAAF_PROVIDER_SHIM=openai CLAUDE_CODE_DISABLE_FAST_MODE=1 \
         bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
     assert_success
     assert_output --partial "of 1050k tokens"
+    _refute_gpt_fast_segment
 }
 
-@test "malformed and noncanonical lane values do not activate the subscription cap" {
+@test "non-shim malformed and noncanonical route values leave the GPT Fast segment silent" {
+    _write_gpt_health chatgpt ok '"chatgpt"' true true true null
     run env DAAF_PROVIDER_SHIM=OpenAI SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
         bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
     assert_success
     assert_output --partial "of 1050k tokens"
+    _refute_gpt_fast_segment
 
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=' chatgpt ' \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
         bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
     assert_success
     assert_output --partial "of 1050k tokens"
+    _refute_gpt_fast_segment
+
+    run env DAAF_PROVIDER_SHIM=openrouter SHIM_BACKEND_MODE=openai \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]" 1050000)
+    assert_success
+    assert_output --partial "of 1050k tokens"
+    _refute_gpt_fast_segment
 }
 
 @test "chatgpt lane does not perturb a non-GPT (Claude) model window" {
@@ -301,6 +1164,47 @@ _payload() {
     assert_output --partial "of 128k tokens"
 }
 
+# -------------------------------------------------------------------------
+# O1: anchored mini/chat grammar (byte-consistent with subagent-bar.sh).
+# The old inner globs (*-mini*/*-chat*) matched any id containing -mini/-chat
+# and mapped it to 400k/128k; the anchored gpt_mini_re/gpt_chat_re reject a
+# trailing suffix so suffixed near-misses fall through to the 200k default.
+# -------------------------------------------------------------------------
+@test "anchored mini/chat grammar rejects suffixed near-misses the old inner globs accepted (O1)" {
+    local model
+    for model in \
+        gpt-5.6-mini-preview \
+        gpt-5.6-sol-mini-preview \
+        'gpt-5.6-mini[1m]x' \
+        gpt-5.6-chat-preview \
+        gpt-5.6-sol-chat-beta \
+        'gpt-5.6-chat[1m]x'; do
+        run bash "$CONTEXT_BAR_SH" < <(_payload "$model")
+        assert_success
+        assert_output --partial "of 200k tokens"
+        refute_output --partial "of 400k tokens"
+        refute_output --partial "of 128k tokens"
+    done
+}
+
+@test "well-formed mini/chat slugs still map to 400k/128k under the anchored grammar (O1)" {
+    run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-mini")
+    assert_success
+    assert_output --partial "of 400k tokens"
+
+    run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol-mini[1m]")
+    assert_success
+    assert_output --partial "of 400k tokens"
+
+    run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-chat")
+    assert_success
+    assert_output --partial "of 128k tokens"
+
+    run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol-chat[1m]")
+    assert_success
+    assert_output --partial "of 128k tokens"
+}
+
 @test "malformed left boundaries and unsupported GPT version prefixes stay on the ordinary 200k default" {
     local model
     for model in \
@@ -316,6 +1220,25 @@ _payload() {
     done
 }
 
+# -------------------------------------------------------------------------
+# O3: the transcript token-sum jq must suppress stderr (idiom parity with the
+# ctx-window write at the sibling site). A corrupt transcript makes jq emit a
+# parse error; without 2>/dev/null it leaks into the statusline display stream.
+# The value path stays fail-open (// 0 + canonical-decimal guard), so the bar
+# still renders against the resolved window.
+# -------------------------------------------------------------------------
+@test "corrupt transcript does not leak jq parse errors into the display stream (O3)" {
+    local bad_transcript="${SCRATCH_DIR}/corrupt.jsonl"
+    printf '%s\n' '{"message":{"usage":{"input_tokens":123}' '<<<not json>>>' > "$bad_transcript"
+    run bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"id":"gpt-5.6-sol","display_name":"gpt-5.6-sol"},"cwd":"$TEST_DIR","transcript_path":"$bad_transcript","session_id":"$FAKE_SESSION","context_window":{"context_window_size":1050000}}
+JSON
+    assert_success
+    refute_output --partial "parse error"
+    refute_output --partial "jq:"
+    assert_output --partial "of 1050k tokens"
+}
+
 @test "chatgpt final-cap predicate accepts anchored provider slugs and rejects adversarial near misses" {
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_BAR_SH" < <(_payload "openrouter/openai/gpt-5.6-terra[1m]" 1050000)
@@ -331,3 +1254,421 @@ _payload() {
         refute_output --partial "of 370k tokens"
     done
 }
+
+# =========================================================================
+# Codex (ChatGPT-subscription) Plan-usage segment (v1.3.1)
+# -------------------------------------------------------------------------
+# On shim-lane sessions (DAAF_PROVIDER_SHIM=openai AND SHIM_BACKEND_MODE=chatgpt)
+# with no native rate limits in the payload, context-bar.sh reads the shim's
+# quota_state.json (DAAF_QUOTA_STATE_FILE test seam) and renders "Plan usage:".
+# The reader computes the absolute reset instant as captured_at + primary_reset_s.
+# =========================================================================
+
+@test "codex Plan-usage renders 7d label pct and countdown from a fresh state file" {
+    local now
+    now="$(date +%s)"
+    # primary_reset_s ~4.65 days -> a future reset -> a "(4d..h)" countdown.
+    _write_quota_state "$now" 73 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "Plan usage:"
+    assert_output --partial "7d:73%"
+    assert_output --partial "(4d"
+}
+
+@test "codex Plan-usage omits an all-zero secondary window" {
+    local now
+    now="$(date +%s)"
+    _write_quota_state "$now" 73 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "7d:73%"
+    refute_output --partial "5h:"
+}
+
+@test "codex Plan-usage renders a positive secondary window when present" {
+    local now
+    now="$(date +%s)"
+    # secondary: 300 min -> "5h", 5%, reset 600s in the future.
+    _write_quota_state "$now" 73 10080 402168 5 300 600
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "7d:73%"
+    assert_output --partial "5h:5%"
+}
+
+@test "codex Plan-usage drops the whole segment when the primary window is stale" {
+    local past
+    past="$(( $(date +%s) - 100000 ))"
+    # captured_at + 50s is well in the past -> stale -> segment dropped entirely.
+    _write_quota_state "$past" 73 10080 50 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    # Rest of the bar is intact (chatgpt lane caps gpt-5.6-sol at 370k).
+    assert_output --partial "of 370k tokens"
+}
+
+@test "codex Plan-usage is absent on malformed state JSON and the bar stays intact" {
+    printf '{"captured_at":' > "$QUOTA_STATE_FILE"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    assert_output --partial "of 370k tokens"
+}
+
+@test "codex Plan-usage is gated off on a native session even with a state file present" {
+    local now
+    now="$(date +%s)"
+    _write_quota_state "$now" 73 10080 402168 0 0 0
+    # No shim lane env (setup unsets DAAF_PROVIDER_SHIM/SHIM_BACKEND_MODE).
+    run env DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    assert_output --partial "of 1050k tokens"
+}
+
+@test "codex Plan-usage renders a zero primary percent" {
+    local now
+    now="$(date +%s)"
+    _write_quota_state "$now" 0 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "7d:0%"
+}
+
+@test "codex Plan-usage segment is dropped when primary_used_pct carries a hostile control-char escape" {
+    local now
+    now="$(date +%s)"
+    # Valid JSON (a properly-escaped unicode sequence, not a raw control byte)
+    # whose parsed value embeds an ESC/ANSI sequence in primary_used_pct.
+    # Bypasses _write_quota_state (which only accepts plain values) to write
+    # the JSON literal directly; the double backslash below makes printf emit
+    # a literal backslash-u-0-0-1-b sequence in the file, mirroring how the
+    # earlier newline/NUL bats fixtures embed JSON unicode escapes rather
+    # than raw bytes.
+    printf '{"captured_at":%s,"plan_type":"pro","active_limit":"premium","primary_used_pct":"73\\u001b[31m","primary_window_min":"10080","primary_reset_s":"402168","secondary_used_pct":"0","secondary_window_min":"0","secondary_reset_s":"0","credits_has":"False","credits_balance":"0","credits_unlimited":"False"}' \
+        "$now" > "$QUOTA_STATE_FILE"
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    # Rest of the bar is intact (chatgpt lane caps gpt-5.6-sol at 370k).
+    assert_output --partial "of 370k tokens"
+}
+
+# =========================================================================
+# Hardening: terminal-escape-safe rendering (Finding 1 / Convention 1)
+# -------------------------------------------------------------------------
+# Colors are ANSI-C ($'...') constants and the final render is printf '%s'.
+# A printable backslash-escape payload arriving in an untrusted field must stay
+# an inert literal (never re-materialized into a real ESC/OSC), while real
+# control bytes in a field are still stripped by the jq [[:cntrl:]] stage.
+# =========================================================================
+
+@test "printable escape payload in the display name stays a literal and is not re-materialized" {
+    local payload
+    # JSON \\033 -> literal backslash-0-3-3 after jq parse (printable, no control
+    # byte). Under the old printf '%b' render this would have become a real ESC and
+    # emitted a live OSC 52 clipboard-write sequence; under '%s' it stays literal.
+    payload='{"model":{"id":"claude-fable-5","display_name":"PRE\\033]52;c;OSCPAYLOAD"},"cwd":"'"$TEST_DIR"'","transcript_path":"","session_id":"'"$FAKE_SESSION"'","context_window":{"context_window_size":200000}}'
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial '\033]52;c;OSCPAYLOAD'
+    assert_output --partial "of 200k tokens"
+}
+
+@test "a real ESC byte in the display name is still stripped by the jq control filter" {
+    local payload
+    # JSON  -> a REAL ESC byte after parse; the display filter removes it so
+    # the surrounding text joins cleanly and no raw ESC reaches the display stream.
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"AAA\\u%04xBBB"},"cwd":"%s","transcript_path":"","session_id":"%s","context_window":{"context_window_size":200000}}' 27 "$TEST_DIR" "$FAKE_SESSION"
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "AAABBB"
+}
+
+# =========================================================================
+# Hardening: closed-set flagship grammar rejects malformed suffixes (Finding 4)
+# -------------------------------------------------------------------------
+# The anchored ERE ^gpt-5\.(4|5|6)(-(sol|terra|luna))?(\[1m\])?$ tightens the
+# old case-globs (gpt-5.6[-\[]*) that accepted arbitrary trailing junk. These
+# five slugs used to map to the 1,050,000 flagship window; they now fall through.
+# =========================================================================
+
+@test "anchored flagship grammar rejects malformed suffixes the old globs accepted" {
+    local model
+    for model in \
+        'gpt-5.4-' \
+        'gpt-5.4x' \
+        'gpt-5.6-experimental' \
+        'gpt-5.5[1m' \
+        'gpt-5.6-sol[1m]x'; do
+        run bash "$CONTEXT_BAR_SH" < <(_payload "$model")
+        assert_success
+        assert_output --partial "of 200k tokens"
+        refute_output --partial "of 1050k tokens"
+    done
+}
+
+@test "chatgpt lane final cap ignores malformed flagship-suffix near-misses" {
+    local model
+    for model in 'gpt-5.4-' 'gpt-5.6-experimental' 'gpt-5.5[1m' 'gpt-5.6-sol[1m]x'; do
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            bash "$CONTEXT_BAR_SH" < <(_payload "$model" 1050000)
+        assert_success
+        assert_output --partial "of 1050k tokens"
+        refute_output --partial "of 370k tokens"
+    done
+}
+
+# =========================================================================
+# Hardening: bounded numerator before x100 (Finding 10 / Convention 5)
+# -------------------------------------------------------------------------
+# context_length is guarded (is_canonical_positive_decimal AND <= INT64_MAX/100 =
+# 92233720368547758) before `context_length * 100`, so a huge token count cannot
+# overflow signed-64 and wrap pct negative. NOTE: jq (IEEE-754 doubles) rounds
+# both 92233720368547758 and ...759 to 92233720368547760 before the guard sees
+# them, so the exact +/-1 boundary is not separately observable through the
+# transcript->jq path; these tests exercise the guard's observable contract (a
+# safe value renders a real clamped pct; an overflow-inducing value falls to the
+# baseline with a non-negative reading and no arithmetic diagnostic).
+# =========================================================================
+
+@test "a large but safe transcript token count renders a real clamped percentage" {
+    local tf payload
+    tf="${SCRATCH_DIR}/transcript_safe.jsonl"
+    # 9e11 tokens: jq-exact (< 2^53) and 9e11*100 stays well within int64.
+    printf '%s\n' '{"message":{"usage":{"input_tokens":900000000000}}}' > "$tf"
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"cwd":"%s","transcript_path":"%s","session_id":"%s","context_window":{"context_window_size":200000}}' "$TEST_DIR" "$tf" "$FAKE_SESSION"
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "100% of 200k tokens"
+    refute_output --partial "~100%"
+}
+
+@test "an overflow-inducing transcript token count falls to baseline with no negative percent" {
+    local tf payload
+    tf="${SCRATCH_DIR}/transcript_huge.jsonl"
+    # jq rounds this to 92233720368547760 (> INT64_MAX/100); *100 would overflow
+    # signed-64 and wrap pct negative if unguarded. The guard rejects it -> baseline.
+    printf '%s\n' '{"message":{"usage":{"input_tokens":92233720368547758}}}' > "$tf"
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"cwd":"%s","transcript_path":"%s","session_id":"%s","context_window":{"context_window_size":200000}}' "$TEST_DIR" "$tf" "$FAKE_SESSION"
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    assert_output --partial "~10% of 200k tokens"
+    refute_output --partial "value too great"
+    refute_output --partial "syntax error"
+}
+
+# =========================================================================
+# Hardening: redirection-open diagnostics are suppressed (Finding 11 / Conv. 6)
+# -------------------------------------------------------------------------
+# Cache writes are brace-wrapped so 2>/dev/null covers an open() failure on '>'.
+# An unusable cache dir (a regular file -> ENOTDIR, or a child of a nonexistent
+# dir -> ENOENT) must not leak a diagnostic onto the display stream; the
+# statusline still renders and exits 0.
+# =========================================================================
+
+@test "cache dir that is a regular file (ENOTDIR) does not leak an open diagnostic" {
+    local regfile="${SCRATCH_DIR}/reg-not-dir"
+    printf 'x' > "$regfile"
+    run env DAAF_CONTEXT_BAR_CACHE_DIR="$regfile" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "of 1050k tokens"
+    refute_output --partial "Not a directory"
+    refute_output --partial "No such file"
+}
+
+@test "cache dir under a nonexistent parent (ENOENT) does not leak an open diagnostic" {
+    run env DAAF_CONTEXT_BAR_CACHE_DIR="${SCRATCH_DIR}/does-not-exist/sub" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "of 1050k tokens"
+    refute_output --partial "No such file"
+    refute_output --partial "Not a directory"
+}
+
+# =========================================================================
+# Hardening: atomic ctx-window publish (Finding 5 / Convention 7)
+# -------------------------------------------------------------------------
+# The claude-ctx-window-* cache is written to a writer-private temp then renamed,
+# so a concurrent reader never sees a momentarily-empty file. Observable here:
+# the final value is present and no .tmp.* artifact is left behind.
+# =========================================================================
+
+@test "context window cache is published atomically with no leftover temp file" {
+    run bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol[1m]")
+    assert_success
+    run cat "$CTX_CACHE"
+    assert_success
+    assert_output "1050000"
+    run find "$DAAF_CONTEXT_BAR_CACHE_DIR" -maxdepth 1 -name 'claude-ctx-window-*.tmp.*' -print
+    assert_success
+    assert_output ""
+}
+
+# =========================================================================
+# Hardening: OpenRouter catalog private temp + JSON validation (Finding 6 / Conv 8)
+# -------------------------------------------------------------------------
+# A 200-response body that is not a JSON object with a .data array must NOT be
+# promoted to the session cache; resolution falls back to the static map.
+# =========================================================================
+
+@test "corrupt OpenRouter catalog body is not promoted and falls back to the static map" {
+    local badbin="${SCRATCH_DIR}/badcurl-bin"
+    mkdir -p "$badbin"
+    cat > "${badbin}/curl" <<'MOCK_BAD_CURL'
+#!/usr/bin/env bash
+printf '%s' "${MOCK_OPENROUTER_BODY?MOCK_OPENROUTER_BODY must be set}"
+MOCK_BAD_CURL
+    chmod +x "${badbin}/curl"
+
+    local body
+    for body in \
+        '{"data":"not-an-array"}' \
+        '{"data":' \
+        '{"error":"rate limited"}' \
+        'null'; do
+        rm -f "$OR_CACHE"
+        run env ANTHROPIC_BASE_URL="https://openrouter.ai/api" \
+            PATH="${badbin}:${PATH}" \
+            MOCK_OPENROUTER_BODY="$body" \
+            bash "$CONTEXT_BAR_SH" < <(_payload "z-ai/glm-5.2")
+        assert_success
+        assert_output --partial "of 1048k tokens"
+        run test -e "$OR_CACHE"
+        assert_failure
+    done
+}
+
+# =========================================================================
+# Hardening: codex plan-usage percentage bounds (Finding 9 / Convention 9)
+# -------------------------------------------------------------------------
+# The codex path now floors a fractional percent (69.9 -> 69) and clamps to <=100,
+# mirroring the native rate-limit path. Non-numeric/negative stays a fail-closed
+# drop of the whole segment. v1.3.2 (deferred obs. O2): the fractional-floor strip is
+# gated on ^[0-9]+\.[0-9]+$, so an exponent-notation value carrying a dot ("1.0e999")
+# is NOT stripped to "1" — it stays intact, fails the validator, and drops.
+# =========================================================================
+
+@test "codex Plan-usage clamps a primary percent above 100 to 100" {
+    local now
+    now="$(date +%s)"
+    _write_quota_state "$now" 101 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "7d:100%"
+    refute_output --partial "7d:101%"
+}
+
+@test "codex Plan-usage floors a fractional primary percent and keeps the segment" {
+    local now
+    now="$(date +%s)"
+    # 69.9 used to be dropped by the integer-only validator; it is now floored to 69.
+    _write_quota_state "$now" 69.9 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "Plan usage:"
+    assert_output --partial "7d:69%"
+}
+
+@test "codex Plan-usage drops the segment when primary percent is exponent notation" {
+    local now
+    now="$(date +%s)"
+    # O2: "1.0e999" carries a dot but is NOT a plain fractional. The gated strip leaves
+    # it intact, is_canonical_nonneg_decimal rejects it, and the whole segment drops —
+    # it must never be floored to "1" and render "7d:1%".
+    _write_quota_state "$now" 1.0e999 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    refute_output --partial "7d:1%"
+    assert_output --partial "of 370k tokens"
+}
+
+@test "codex Plan-usage drops only the secondary when its percent is exponent notation" {
+    local now
+    now="$(date +%s)"
+    # Primary is a clean integer and renders; the secondary percent "2.0e9" is left
+    # intact by the gated strip, fails the validator, and the secondary is omitted
+    # (never floored to "2").
+    _write_quota_state "$now" 73 10080 402168 2.0e9 300 600
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "7d:73%"
+    refute_output --partial "5h:"
+}
+
+@test "codex Plan-usage drops the segment for a negative primary percent" {
+    local now
+    now="$(date +%s)"
+    _write_quota_state "$now" -1 10080 402168 0 0 0
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    refute_output --partial "Plan usage:"
+    assert_output --partial "of 370k tokens"
+}
+
+@test "codex Plan-usage clamps a secondary percent above 100 to 100" {
+    local now
+    now="$(date +%s)"
+    # secondary: 300 min -> "5h", percent 150 -> clamped to 100, reset 600s ahead.
+    _write_quota_state "$now" 50 10080 402168 150 300 600
+    run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+        DAAF_QUOTA_STATE_FILE="$QUOTA_STATE_FILE" \
+        bash "$CONTEXT_BAR_SH" < <(_payload "gpt-5.6-sol")
+    assert_success
+    assert_output --partial "5h:100%"
+    refute_output --partial "5h:150%"
+}
+
+# =========================================================================
+# Hardening follow-up: C1 controls in the git branch name (Convention 1)
+# -------------------------------------------------------------------------
+# git refnames only forbid bytes < 0x20 and DEL, so a hostile repo can name a
+# branch with a UTF-8-encoded C1 control (U+009B = 8-bit CSI on xterm-class
+# terminals). Byte-wise tr [:cntrl:] passed it through to the display stream;
+# the Unicode-aware jq strip removes it while keeping the printable remainder.
+# =========================================================================
+
+@test "UTF-8-encoded C1 in a git branch name is stripped from the display stream" {
+    local repo="${SCRATCH_DIR}/c1-branch-repo"
+    mkdir -p "$repo"
+    git -C "$repo" -c init.defaultBranch=main init -q
+    git -C "$repo" -c user.email=b@b -c user.name=b commit -q --allow-empty -m x
+    git -C "$repo" checkout -q -b "$(printf 'br\302\233inj')"
+    local payload
+    printf -v payload '{"model":{"id":"claude-fable-5","display_name":"Fable 5"},"cwd":"%s","transcript_path":"","session_id":"%s","context_window":{"context_window_size":200000}}' \
+        "$repo" "$FAKE_SESSION"
+    run bash "$CONTEXT_BAR_SH" <<< "$payload"
+    assert_success
+    # C1 removed: the two halves of the branch name join; no raw c2 9b bytes.
+    assert_output --partial "🔀brinj"
+    refute_output --partial "$(printf '\302\233')"
+}
diff --git a/tests/bash/context_reporter.bats b/tests/bash/context_reporter.bats
index d5592922..7f9908c0 100755
--- a/tests/bash/context_reporter.bats
+++ b/tests/bash/context_reporter.bats
@@ -24,20 +24,22 @@ load 'test_helper'
 CONTEXT_REPORTER_SH="${CONTEXT_REPORTER_SH:-${REPO_ROOT}/.claude/hooks/context-reporter.sh}"
 CONTEXT_BAR_SH="${CONTEXT_BAR_SH:-${REPO_ROOT}/.claude/scripts/context-bar.sh}"
 
-# Fixed fake session id so tests never touch a real session's /tmp caches.
+# Fixed fake session id so tests never touch a real session's caches.
 FAKE_SESSION="bats-ctxrep-session"
 FAKE_AGENT="bats-agent-0001"
 
-# /tmp cache files this hook reads/writes for FAKE_SESSION (cleaned each test).
+# Cache files this hook reads/writes for FAKE_SESSION (cleaned each test). All
+# live under the DAAF_CONTEXT_REPORTER_CACHE_DIR test seam (project scratch),
+# never real /tmp -- mirroring context_bar.bats' DAAF_CONTEXT_BAR_CACHE_DIR.
 _ctx_caches() {
     printf '%s\n' \
-        "/tmp/claude-ctx-window-${FAKE_SESSION}" \
-        "/tmp/claude-model-${FAKE_SESSION}" \
-        "/tmp/claude-ctx-ts-${FAKE_SESSION}" \
-        "/tmp/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}" \
-        "/tmp/claude-model-${FAKE_SESSION}.transcript-signature" \
-        "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}" \
-        "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}.transcript-signature"
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-window-${FAKE_SESSION}" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}.transcript-signature" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}" \
+        "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}.transcript-signature"
 }
 
 _clean_ctx_caches() {
@@ -45,23 +47,38 @@ _clean_ctx_caches() {
     while read -r f; do
         [ -n "$f" ] && rm -f "$f"
     done < <(_ctx_caches)
-    rm -f /tmp/claude-model-"${FAKE_SESSION}".tmp.*
-    rm -f /tmp/claude-model-"${FAKE_SESSION}".transcript-signature.tmp.*
-    rm -f /tmp/claude-subagent-model-"${FAKE_SESSION}"-*.tmp.*
-    rm -f /tmp/claude-subagent-model-"${FAKE_SESSION}"-*.transcript-signature.tmp.*
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}"/claude-model-"${FAKE_SESSION}".tmp.*
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}"/claude-model-"${FAKE_SESSION}".transcript-signature.tmp.*
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}"/claude-subagent-model-"${FAKE_SESSION}"-*.tmp.*
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}"/claude-subagent-model-"${FAKE_SESSION}"-*.transcript-signature.tmp.*
 }
 
 setup() {
     common_setup
+    # Deterministic-test seam: point the reporter's cache dir at per-test project
+    # scratch so its gate/model/window caches never collide with the live
+    # container session's real /tmp/claude-* caches (the source of the prior
+    # flakiness). Mirrors context_bar.bats exactly. DAAF_CONTEXT_BAR_CACHE_DIR is
+    # aimed at the SAME dir so the statusline writer-to-reporter test rendezvouses
+    # in scratch: context-bar writes the ctx-window cache the reporter then reads.
+    SCRATCH_DIR="${REPO_ROOT}/scripts/scratch/context-reporter-bats-${BATS_TEST_NUMBER}-$$"
+    DAAF_CONTEXT_REPORTER_CACHE_DIR="${SCRATCH_DIR}/cache"
+    DAAF_CONTEXT_BAR_CACHE_DIR="${DAAF_CONTEXT_REPORTER_CACHE_DIR}"
+    mkdir -p "$DAAF_CONTEXT_REPORTER_CACHE_DIR"
     _clean_ctx_caches
     unset CLAUDE_CODE_MAX_CONTEXT_TOKENS
     unset DAAF_PROVIDER_SHIM
     unset SHIM_BACKEND_MODE
     export FAKE_SESSION FAKE_AGENT CONTEXT_REPORTER_SH CONTEXT_BAR_SH
+    export SCRATCH_DIR DAAF_CONTEXT_REPORTER_CACHE_DIR DAAF_CONTEXT_BAR_CACHE_DIR
 }
 
 teardown() {
-    _clean_ctx_caches
+    # rm -rf the whole per-test scratch dir removes every cache file AND the
+    # (empty) directory the Convention 6 EISDIR test plants at a gate path, so no
+    # cross-test residue survives and nothing is left under the repo for the
+    # workspace-invariants check.
+    rm -rf "$SCRATCH_DIR"
     common_teardown
 }
 
@@ -127,7 +144,7 @@ _payload_statusline() {
         "$1" "$1" "$TEST_DIR" "$2" "$FAKE_SESSION" "$3"
 }
 
-_seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
+_seed_window() { printf '%s' "$1" > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-window-${FAKE_SESSION}"; }
 
 # =========================================================================
 # Syntax
@@ -245,7 +262,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
         "277499 HIGH 74" \
         "277500 CRITICAL 75"; do
         read -r tokens expected_severity expected_pct <<< "$boundary"
-        rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+        rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
         _write_main_transcript "${TEST_DIR}/t.jsonl" "gpt-5.6-sol" "$tokens"
         run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
             bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
@@ -266,7 +283,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
         "499999 HIGH 47" \
         "500000 CRITICAL 47"; do
         read -r tokens expected_severity expected_pct <<< "$boundary"
-        rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+        rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
         _write_main_transcript "${TEST_DIR}/t.jsonl" \
             "openrouter/openai/gpt-5.6-sol[1m]" "$tokens"
         run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
@@ -302,8 +319,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed: GPT 5.6 Sol subagent under sonnet session gets 1050k and retained absolute gates" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -417,8 +434,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 @test "mixed: sonnet subagent under a fable session is measured conservatively" {
     # Session model is fable; subagent model is sonnet. The subagent is measured
     # against a 200k window (its own model) with the conservative family.
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'claude-sonnet-4-6' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000  # session window is 1M; subagent correction overrides to 200k
 
     # Parent transcript path -> subagent transcript derived alongside it.
@@ -437,8 +454,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed inverse: fable subagent under a sonnet session uses permissive family" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'claude-fable-5' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000  # session window; subagent correction overrides to 1M
 
     parent="${TEST_DIR}/main.jsonl"
@@ -460,8 +477,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 # =========================================================================
 
 @test "mixed: exact GLM-5.2 subagent maps to 1048k and is ELEVATED at 150k" {
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'z-ai/glm-5.2' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'z-ai/glm-5.2' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -475,8 +492,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed: date-suffixed GLM-5.2 subagent maps to 1048k and is HIGH at 200k" {
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'z-ai/glm-5.2-20260715' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'z-ai/glm-5.2-20260715' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -490,8 +507,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed: GLM-5.2 Air subagent stays on the generic 200k window" {
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'z-ai/glm-5.2-air' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'z-ai/glm-5.2-air' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -505,8 +522,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed: explicit override wins for an exact GLM-5.2 subagent" {
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'z-ai/glm-5.2' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'z-ai/glm-5.2' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -520,8 +537,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "mixed: exact GLM-5.2 subagent maps to 1048k and is CRITICAL at 250k" {
-    printf 'claude-fable-5' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'z-ai/glm-5.2' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'z-ai/glm-5.2' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1000000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -574,12 +591,12 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
         CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000 \
         bash "$CONTEXT_BAR_SH" < <(_payload_statusline "gpt-5.6-sol[1m]" "${TEST_DIR}/t.jsonl" 1050000)
     assert_success
-    run cat "/tmp/claude-ctx-window-${FAKE_SESSION}"
+    run cat "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-window-${FAKE_SESSION}"
     assert_success
     assert_output "370000"
 
     # Ensure no warm rate gate can suppress the reporter half of this path.
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000 \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
@@ -589,8 +606,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "chatgpt lane: different-model gpt-5.6-sol subagent maps to 370k (81%)" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -605,8 +622,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "chatgpt lane: same-model exact Sol subagent caps a stale 1.05M session cache" {
-    printf 'gpt-5.6-sol[1m]' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'gpt-5.6-sol[1m]' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'gpt-5.6-sol[1m]' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'gpt-5.6-sol[1m]' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 1050000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -621,8 +638,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "chatgpt lane: explicit 1.05M cannot raise a different-model Sol subagent above 370k" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -637,8 +654,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "lane vars unset: gpt-5.6-sol subagent keeps the 1.05M API-lane window (28%)" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -652,8 +669,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 }
 
 @test "SHIM_BACKEND_MODE=chatgpt alone (no DAAF_PROVIDER_SHIM) keeps 1.05M (28%)" {
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -679,8 +696,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 
 @test "chatgpt lane preserves a lower positive explicit context window" {
     # A 250k override remains below the 370k final ceiling: 200k -> 80%.
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'openai/gpt-5.6-sol' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'openai/gpt-5.6-sol' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -698,8 +715,8 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 @test "chatgpt lane does not perturb a non-GPT (Claude) subagent window (fable 1M, 25%)" {
     # The lane gate only rewrites the gpt-5.4/5.5/5.6 arm. A fable subagent still
     # maps to its 1M window regardless of the lane env: 250k -> 25% -> NOMINAL.
-    printf 'claude-sonnet-4-6' > "/tmp/claude-model-${FAKE_SESSION}"
-    printf 'claude-fable-5' > "/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     _seed_window 200000
     parent="${TEST_DIR}/main.jsonl"
     printf '{"type":"user","isSidechain":false,"message":{"content":"x"}}\n' > "$parent"
@@ -718,7 +735,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 
 @test "main cache refreshes Claude -> Sol -> Terra -> Claude before cap and tier selection" {
     local transcript="${TEST_DIR}/main-switch.jsonl"
-    local model_cache="/tmp/claude-model-${FAKE_SESSION}"
+    local model_cache="${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
     local signature_cache="${model_cache}.transcript-signature"
     _seed_window 1000000
     _write_main_transcript "$transcript" "claude-fable-5" 100000
@@ -731,7 +748,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run test -s "$signature_cache"
     assert_success
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     _append_model_usage "$transcript" "gpt-5.6-sol" 111000 false
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "$transcript")
@@ -742,7 +759,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "gpt-5.6-sol"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     _append_model_usage "$transcript" "gpt-5.6-terra" 111000 false
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "$transcript")
@@ -752,7 +769,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "gpt-5.6-terra"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     _append_model_usage "$transcript" "claude-sonnet-4-6" 90000 false
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "$transcript")
@@ -767,7 +784,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 @test "subagent cache ignores synthetic entries, refreshes on later real models, and changes physical/tier decisions" {
     local parent="${TEST_DIR}/main.jsonl"
     local transcript="${TEST_DIR}/${FAKE_SESSION}/subagents/agent-${FAKE_AGENT}.jsonl"
-    local model_cache="/tmp/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
+    local model_cache="${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-subagent-model-${FAKE_SESSION}-${FAKE_AGENT}"
     printf '{"type":"assistant","isSidechain":false,"message":{"model":"claude-sonnet-4-6"}}\n' > "$parent"
     _seed_window 200000
     _write_subagent_transcript "$transcript" "claude-sonnet-4-6" 90000
@@ -778,7 +795,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "claude-sonnet-4-6"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
     _append_model_usage "$transcript" "<synthetic>" 100000 true
     run bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
     assert_success
@@ -786,7 +803,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "claude-sonnet-4-6"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
     _append_model_usage "$transcript" "gpt-5.6-sol" 111000 true
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
@@ -796,7 +813,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "gpt-5.6-sol"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
     _append_model_usage "$transcript" "gpt-5.6-terra" 111000 true
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
@@ -806,7 +823,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     run cat "$model_cache"
     assert_output "gpt-5.6-terra"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}-${FAKE_AGENT}"
     _append_model_usage "$transcript" "claude-fable-5" 100000 true
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
@@ -819,7 +836,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
 
 @test "unchanged transcript signature reuses a nonempty compatible bare cache" {
     local transcript="${TEST_DIR}/unchanged.jsonl"
-    local model_cache="/tmp/claude-model-${FAKE_SESSION}"
+    local model_cache="${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
     _seed_window 1050000
     _write_main_transcript "$transcript" "claude-sonnet-4-6" 90000
 
@@ -836,7 +853,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     [[ "$cached_signature" == "$current_signature" ]]
     cached_model=$(cat "$model_cache")
     [[ "$cached_model" == "gpt-5.6-sol" ]]
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
 
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "$transcript")
@@ -860,7 +877,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     assert_success
     assert_output --partial "111k / 370k"
 
-    rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
         CLAUDE_CODE_MAX_CONTEXT_TOKENS=250000 \
         bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
@@ -881,7 +898,7 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
         '370000 ' \
         9223372036854775808 \
         99999999999999999999999999999999999999; do
-        rm -f "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+        rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
         run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
             CLAUDE_CODE_MAX_CONTEXT_TOKENS="$value" \
             bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
@@ -1002,8 +1019,342 @@ _seed_window() { printf '%s' "$1" > "/tmp/claude-ctx-window-${FAKE_SESSION}"; }
     _seed_window 1000000
     _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 500000
     # Seed the gate with 'now' so the 60s interval has not elapsed.
-    date +%s > "/tmp/claude-ctx-ts-${FAKE_SESSION}"
+    date +%s > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    refute_output --partial "Context utilization"
+}
+
+# ############################################################################
+# HARDENING CASES (2026-07-20 StatuslineHardening)
+# ----------------------------------------------------------------------------
+# The cases below exercise the CORRECTED logic in context-reporter.proposed.sh
+# (findings 2,3,4,7,8,10,11). They are parameterized on CONTEXT_REPORTER_SH:
+# run them against the proposed copy pre-apply, e.g.
+#   CONTEXT_REPORTER_SH=/daaf/research/2026-07-20_FrameworkDev_StatuslineHardening/context-reporter.proposed.sh \
+#     bats /daaf/tests/bash/context_reporter.bats
+# Once the user copies the proposed file over the installed hook from the host,
+# they pass with the default (installed) path too.
+# ############################################################################
+
+# --- Additional fixture helpers for the hardening cases ---
+
+# Emit a main-session payload with an ARBITRARY (possibly adversarial)
+# session_id, passed through %s verbatim so traversal/control bytes survive to
+# the hook exactly as an attacker would supply them.
+_payload_main_sid() {
+    # $1 = raw session_id, $2 = transcript path
+    printf '{"hook_event_name":"PreToolUse","session_id":"%s","transcript_path":"%s"}' \
+        "$1" "$2"
+}
+
+# Emit a subagent payload with a valid session_id but an ARBITRARY agent_id.
+_payload_subagent_aid() {
+    # $1 = raw agent_id, $2 = transcript path (the parent's)
+    printf '{"hook_event_name":"PreToolUse","session_id":"%s","transcript_path":"%s","agent_id":"%s"}' \
+        "$FAKE_SESSION" "$2" "$1"
+}
+
+# Emit a DIRECT-subagent payload: transcript_path IS the subagent's own
+# transcript (basename agent-<agent>.jsonl), the future-Claude-Code shape that
+# Convention 10 guards. No parent transcript is available to scan.
+_payload_direct_subagent() {
+    # $1 = path to the subagent's own transcript (basename = agent-<agent>.jsonl)
+    printf '{"hook_event_name":"PreToolUse","session_id":"%s","transcript_path":"%s","agent_id":"%s"}' \
+        "$FAKE_SESSION" "$1" "$FAKE_AGENT"
+}
+
+# Append N all-zero-token usage entries (streaming/shim placeholders).
+_append_zero_usage() {
+    # $1 path, $2 model, $3 count, $4 isSidechain JSON boolean
+    local path="$1" model="$2" n="$3" side="$4" i
+    for ((i=0; i<n; i++)); do
+        printf '{"type":"assistant","isSidechain":%s,"message":{"role":"assistant","model":"%s","usage":{"input_tokens":0,"cache_read_input_tokens":0,"cache_creation_input_tokens":0,"output_tokens":0}}}\n' \
+            "$side" "$model" >> "$path"
+    done
+}
+
+# Write a main transcript whose single usage entry carries an explicit
+# input_tokens value (used to drive the numerator-bound boundary).
+_write_main_transcript_raw_tokens() {
+    # $1 dest, $2 model, $3 input_tokens (raw integer literal)
+    local path="$1" model="$2" raw="$3"
+    {
+        printf '{"type":"user","isSidechain":false,"message":{"role":"user","content":"hi"}}\n'
+        printf '{"type":"assistant","isSidechain":false,"message":{"role":"assistant","model":"%s","usage":{"input_tokens":%s,"cache_read_input_tokens":0,"cache_creation_input_tokens":0,"output_tokens":10}}}\n' \
+            "$model" "$raw"
+    } > "$path"
+}
+
+# =========================================================================
+# Convention 2 — identifier allowlist before path construction (finding 2)
+# =========================================================================
+
+@test "adversarial session_id is rejected before any path build (exit 0, no injection)" {
+    local sid
+    # A valid fable transcript that WOULD inject (CRITICAL at 500k/1M) if the id
+    # were accepted; empty output therefore proves the id gate suppressed it.
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 500000
+    _seed_window 1000000
+    # Sentinel path lives under the test seam, never real /tmp. The \$ keeps the
+    # command substitution LITERAL in the session_id (the point of the test is
+    # that the hook must NOT eval it); if that guarantee ever regressed the touch
+    # would land in scratch, not pollute /tmp.
+    local pwned="${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctxrep-pwned"
+    for sid in \
+        '../x' \
+        'a/b' \
+        'a\nb' \
+        '-lead' \
+        '..' \
+        "\$(touch ${pwned})" \
+        'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'; do
+        run bash "$CONTEXT_REPORTER_SH" < <(_payload_main_sid "$sid" "${TEST_DIR}/t.jsonl")
+        assert_success
+        refute_output --partial "Context utilization"
+    done
+    # No command-substitution id could have run, and no traversal path was built.
+    run test -e "$pwned"
+    assert_failure
+}
+
+@test "adversarial agent_id is rejected before the subagent transcript path is built" {
+    local aid
+    parent="${TEST_DIR}/main.jsonl"
+    # A 'busy' parent that must NEVER be injected on the subagent branch.
+    _write_main_transcript "$parent" "claude-fable-5" 500000
+    _seed_window 1000000
+    for aid in \
+        '../../etc/x' \
+        'a/b' \
+        'a\nb' \
+        '-lead' \
+        'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'; do
+        run bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent_aid "$aid" "$parent")
+        assert_success
+        refute_output --partial "Context utilization"
+    done
+}
+
+@test "the default session_id and the bats fixture ids still pass the allowlist" {
+    # is_safe_id must not regress the legitimate default: no session_id key ->
+    # jq default 'default' -> must inject normally.
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 300000
+    printf '%s' 1000000 > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-window-default"
+    run bash "$CONTEXT_REPORTER_SH" < <(printf '{"hook_event_name":"PreToolUse","transcript_path":"%s"}' "${TEST_DIR}/t.jsonl")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-window-default" "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-default" \
+          "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-default" "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-default.transcript-signature"
+}
+
+# =========================================================================
+# Convention 4 — full-transcript usage recovery (finding 3)
+# =========================================================================
+
+@test "full-scan recovery: >50 trailing zero-token placeholders do not hide real usage" {
+    local transcript="${TEST_DIR}/trailing-zeros.jsonl"
+    _seed_window 1000000
+    _write_main_transcript "$transcript" "claude-fable-5" 300000
+    # 60 trailing zero-token placeholders push the positive record out of the
+    # old tail-50 window; a full scan must still recover 300k.
+    _append_zero_usage "$transcript" "claude-fable-5" 60 false
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "$transcript")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "300k / 1000k"
+}
+
+@test "full-scan recovery works on the subagent branch too" {
+    local parent="${TEST_DIR}/main.jsonl"
+    local transcript="${TEST_DIR}/${FAKE_SESSION}/subagents/agent-${FAKE_AGENT}.jsonl"
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    _seed_window 1000000
+    _write_subagent_transcript "$transcript" "claude-fable-5" 300000
+    _append_zero_usage "$transcript" "claude-fable-5" 60 true
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
+    assert_success
+    assert_output --partial "300k / 1000k"
+}
+
+# =========================================================================
+# Convention 3 — closed-set flagship classifier grammar (finding 4)
+# =========================================================================
+# The physical-window classifier must grant the 1,050,000 flagship window ONLY
+# to exact closed-set matches. Malformed codenames that the OLD broad glob
+# accepted must now fall through to the conservative 200k default (they are
+# neither mini/chat nor an exact flagship), and must not trip the 370k cap.
+
+@test "malformed flagship-ish ids map conservatively, not to the 1.05M flagship window" {
+    local model
+    parent="${TEST_DIR}/main.jsonl"
+    transcript="${TEST_DIR}/${FAKE_SESSION}/subagents/agent-${FAKE_AGENT}.jsonl"
+    printf 'claude-sonnet-4-6' > "$parent"  # parent-model source (any non-gpt is fine)
+    for model in \
+        'gpt-5.4-' \
+        'gpt-5.6-experimental' \
+        'gpt-5.6-sol[1m]x' \
+        'gpt-5.5[1m'; do
+        _clean_ctx_caches
+        printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+        _seed_window 200000
+        _write_subagent_transcript "$transcript" "$model" 90000
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
+        assert_success
+        assert_output --partial "90k / 200k"
+        refute_output --partial "/ 1050k"
+        refute_output --partial "/ 370k"
+    done
+}
+
+@test "exact closed-set flagships still receive the flagship window / 370k lane cap" {
+    local model
+    parent="${TEST_DIR}/main.jsonl"
+    transcript="${TEST_DIR}/${FAKE_SESSION}/subagents/agent-${FAKE_AGENT}.jsonl"
+    printf 'claude-sonnet-4-6' > "$parent"
+    for model in gpt-5.4 gpt-5.5 gpt-5.6 gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna \
+                 'gpt-5.6-sol[1m]' 'gpt-5.6-luna[1m]' openrouter/openai/gpt-5.6-terra; do
+        _clean_ctx_caches
+        printf 'claude-sonnet-4-6' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+        _seed_window 200000
+        _write_subagent_transcript "$transcript" "$model" 111000
+        run env DAAF_PROVIDER_SHIM=openai SHIM_BACKEND_MODE=chatgpt \
+            bash "$CONTEXT_REPORTER_SH" < <(_payload_subagent "$parent")
+        assert_success
+        assert_output --partial "111k / 370k"
+    done
+}
+
+# =========================================================================
+# Convention 5 — bounded numerator before x100 (finding 10)
+# =========================================================================
+# The exact boundary floor(INT64_MAX/100) = 92233720368547758. jq coerces usage
+# sums through IEEE-754 doubles, so the input_tokens literals below are chosen as
+# multiples of 16 (double-exact near 9.2e16) that jq emits in CANONICAL fixed
+# notation bracketing the bound -- exercising the numerator guard itself, not the
+# upstream is_canonical/sci-notation reject:
+#   input 92233720368547744 -> jq emits 92233720368547740 (<= bound): injects,
+#       and 92233720368547740*100 = 9223372036854774000 < INT64_MAX (no overflow),
+#       so pct clamps to 100 -- never negative.
+#   input 92233720368547760 -> jq emits 92233720368547760 (>  bound): fails open.
+#       Pre-guard, 92233720368547760*100 = 9223372036854776000 > INT64_MAX wraps
+#       signed-64 negative, which the bound check prevents.
+
+@test "numerator bound: a canonical value <= floor(INT64_MAX/100) injects with a clamped, non-negative pct" {
+    _seed_window 1000000
+    _write_main_transcript_raw_tokens "${TEST_DIR}/t.jsonl" "claude-fable-5" 92233720368547744
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    assert_output --partial "[CRITICAL]"
+    assert_output --partial "(100%)"
+    refute_output --partial "(-"
+}
+
+@test "numerator bound: a canonical value above floor(INT64_MAX/100) fails open (no injection, no negative pct)" {
+    _seed_window 1000000
+    _write_main_transcript_raw_tokens "${TEST_DIR}/t.jsonl" "claude-fable-5" 92233720368547760
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    refute_output --partial "Context utilization"
+    refute_output --partial "(-"
+}
+
+# =========================================================================
+# Convention 10 — parent-model isolation on a direct subagent transcript
+# (finding 7)
+# =========================================================================
+
+@test "direct subagent transcript: session model comes from the parent cache, subagent mapped by its OWN window" {
+    # Target scenario from Convention 10: parent ctx cache 1,000,000; legacy
+    # parent model Fable; a DIRECT Sonnet subagent transcript; usage 100,000; no
+    # subagent-model cache. Must report 100k / 200k (50%) ELEVATED (Sonnet's own
+    # conservative window) -- NOT 100k / 1000k (10%), which is the pre-fix bug
+    # where SESSION_MODEL was re-parsed from the subagent transcript, made equal
+    # to AGENT_MODEL, and skipped the different-model window correction.
+    printf 'claude-fable-5' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    _seed_window 1000000
+    local transcript="${TEST_DIR}/agent-${FAKE_AGENT}.jsonl"
+    _write_subagent_transcript "$transcript" "claude-sonnet-4-6" 100000
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_direct_subagent "$transcript")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "100k / 200k"
+    assert_output --partial "(50%)"
+    refute_output --partial "100k / 1000k"
+}
+
+@test "direct subagent transcript with NO parent model cache still maps by the subagent's own window" {
+    # No claude-model-<session> cache at all -> SESSION_MODEL empty. The
+    # correction must still run (empty != sonnet) and map by the subagent's own
+    # model, never assuming same-model as the (unknown) session.
+    _seed_window 1000000
+    local transcript="${TEST_DIR}/agent-${FAKE_AGENT}.jsonl"
+    _write_subagent_transcript "$transcript" "claude-sonnet-4-6" 100000
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_direct_subagent "$transcript")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "100k / 200k"
+    assert_output --partial "(50%)"
+    refute_output --partial "100k / 1000k"
+}
+
+# =========================================================================
+# Convention 11 — future/corrupt gate timestamp (finding 8)
+# =========================================================================
+
+@test "future gate timestamp is treated as corrupt (reset to 0) and does not suppress the report" {
+    _seed_window 1000000
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 300000
+    # A far-future gate value would make (NOW - LAST_INJECT) negative -> always
+    # under the 60s interval -> reports suppressed indefinitely, pre-fix.
+    printf '%s' "$(( $(date +%s) + 100000 ))" > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "300k / 1000k"
+}
+
+@test "corrupt (non-numeric) gate timestamp is treated as 0 and does not suppress the report" {
+    _seed_window 1000000
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 300000
+    printf '%s' 'not-a-timestamp' > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "300k / 1000k"
+}
+
+@test "a legitimate recent-past gate timestamp still suppresses within the interval" {
+    # Regression guard: the Convention 11 reset must not defeat normal rate
+    # limiting. A valid value a few seconds in the past stays under 60s.
+    _seed_window 1000000
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 300000
+    printf '%s' "$(( $(date +%s) - 5 ))" > "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
     run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
     assert_success
     refute_output --partial "Context utilization"
 }
+
+# =========================================================================
+# Convention 6 — suppress redirection-open diagnostics (finding 11)
+# =========================================================================
+
+@test "gate write open() failure (gate path is a directory) leaks no diagnostic and still injects" {
+    # Force an open() failure by making the gate path (under the test cache seam)
+    # an (empty) DIRECTORY: EISDIR on the '>' redirect. Convention 6 wraps the
+    # write so the "Is a directory" diagnostic cannot reach the display stream;
+    # the injection still emits and the hook exits 0. teardown's rm -rf of the
+    # scratch dir removes the planted directory.
+    _seed_window 1000000
+    _write_main_transcript "${TEST_DIR}/t.jsonl" "claude-fable-5" 300000
+    rm -f "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
+    mkdir -p "${DAAF_CONTEXT_REPORTER_CACHE_DIR}/claude-ctx-ts-${FAKE_SESSION}"
+    run bash "$CONTEXT_REPORTER_SH" < <(_payload_main "${TEST_DIR}/t.jsonl")
+    assert_success
+    assert_output --partial "[ELEVATED]"
+    assert_output --partial "300k / 1000k"
+    refute_output --partial "Is a directory"
+    refute_output --partial "No such file"
+    refute_output --partial "Permission denied"
+}
diff --git a/tests/bash/daaf_lib.bats b/tests/bash/daaf_lib.bats
index f2acb656..9cc6fd05 100755
--- a/tests/bash/daaf_lib.bats
+++ b/tests/bash/daaf_lib.bats
@@ -471,6 +471,80 @@ teardown() {
     [ ! -f /tmp/daaf_should_not_exist ]
 }
 
+@test "load_daaf_settings rejects a whitespace-padded key (column-0 strict, parity with PS)" {
+    # A leading-space "  DAAF_PROJECT_NAME=..." line is not flush at column 0, so the
+    # column-0 `case` glob rejects it. This is the conformance anchor the PowerShell
+    # loaders were fixed to match (PS now extracts the key WITHOUT .Trim()), so a padded
+    # key resolves to nothing on BOTH platforms rather than silently working on one.
+    printf '  DAAF_PROJECT_NAME=padded\n' > "${TEST_DIR}/environment_settings.txt"
+    run bash -c '
+        unset _DAAF_LIB_LOADED
+        source "'"${REPO_ROOT}"'/scripts/host/daaf_lib.sh"
+        unset DAAF_PROJECT_NAME
+        load_daaf_settings "./environment_settings.txt"
+        echo "NAME=${DAAF_PROJECT_NAME:-UNSET}"
+    '
+    assert_success
+    assert_output --partial "NAME=UNSET"
+}
+
+# =========================================================================
+# Data-volume name resolver (resolve_data_volume_name)
+# =========================================================================
+# Precedence: DAAF_DATA_VOLUME_NAME (verbatim) > "<project>_daaf-data" default.
+# An unset override reproduces the historical hardcoded derivation byte-for-byte.
+
+@test "resolve_data_volume_name derives the default when no override and no project name" {
+    run bash -c '
+        unset _DAAF_LIB_LOADED
+        source "'"${REPO_ROOT}"'/scripts/host/daaf_lib.sh"
+        unset DAAF_DATA_VOLUME_NAME DAAF_PROJECT_NAME
+        resolve_data_volume_name
+    '
+    assert_success
+    # Unset override + unset project name => the legacy hardcoded name, unchanged.
+    assert_output "daaf_daaf-data"
+}
+
+@test "resolve_data_volume_name applies the project prefix when only DAAF_PROJECT_NAME is set" {
+    run bash -c '
+        unset _DAAF_LIB_LOADED
+        source "'"${REPO_ROOT}"'/scripts/host/daaf_lib.sh"
+        unset DAAF_DATA_VOLUME_NAME
+        export DAAF_PROJECT_NAME=daaf2
+        resolve_data_volume_name
+    '
+    assert_success
+    # A second instance owns "<project>_daaf-data" without touching the override.
+    assert_output "daaf2_daaf-data"
+}
+
+@test "resolve_data_volume_name uses DAAF_DATA_VOLUME_NAME verbatim when set (ignores project prefix)" {
+    run bash -c '
+        unset _DAAF_LIB_LOADED
+        source "'"${REPO_ROOT}"'/scripts/host/daaf_lib.sh"
+        export DAAF_DATA_VOLUME_NAME=shared_workspace_vol
+        export DAAF_PROJECT_NAME=daaf2
+        resolve_data_volume_name
+    '
+    assert_success
+    # Set override wins verbatim -- no project prefix is added (shared-workspace hatch).
+    assert_output "shared_workspace_vol"
+}
+
+@test "resolve_data_volume_name treats a set-but-empty override as unset (derived default)" {
+    run bash -c '
+        unset _DAAF_LIB_LOADED
+        source "'"${REPO_ROOT}"'/scripts/host/daaf_lib.sh"
+        export DAAF_DATA_VOLUME_NAME=
+        unset DAAF_PROJECT_NAME
+        resolve_data_volume_name
+    '
+    assert_success
+    # The `:-` default treats empty and unset alike, so it falls through to derived.
+    assert_output "daaf_daaf-data"
+}
+
 # =========================================================================
 # docker-compose.yml multi-instance interpolation defaults
 # =========================================================================
diff --git a/tests/bash/deploy_smoke.bats b/tests/bash/deploy_smoke.bats
index 85bf2108..18b541c9 100755
--- a/tests/bash/deploy_smoke.bats
+++ b/tests/bash/deploy_smoke.bats
@@ -43,28 +43,32 @@ print("wide-context classifier: 9/9 cases passed")
     assert_output "wide-context classifier: 9/9 cases passed"
 }
 
-@test "route detection uses exact raw ChatGPT lane controls and explains near misses" {
+@test "route detection enforces exact shim lane controls and explains near misses" {
     run env PYTHONDONTWRITEBYTECODE=1 PYTHONPATH="${SMOKE_PROBES_DIR}:${REPO_ROOT}" python3 -c '
 from route_detection import (
     ROUTE_ANTHROPIC,
     ROUTE_CHATGPT,
     ROUTE_OPENAI_API,
+    ROUTE_OPENROUTER,
     Verdict,
     build_route_info,
     probe_route_detection,
 )
 
 cases = [
-    ("exact conjunction", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_CHATGPT, Verdict.PASS),
+    ("clean native controls", {}, ROUTE_ANTHROPIC, Verdict.PASS),
+    ("clean OpenRouter controls", {"ANTHROPIC_BASE_URL": "https://openrouter.ai/api"}, ROUTE_OPENROUTER, Verdict.PASS),
+    ("exact ChatGPT conjunction", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_CHATGPT, Verdict.PASS),
+    ("exact OpenAI conjunction", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "openai"}, ROUTE_OPENAI_API, Verdict.PASS),
     ("uppercase shim", {"DAAF_PROVIDER_SHIM": "OPENAI", "SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_ANTHROPIC, Verdict.FAIL),
     ("leading-space shim", {"DAAF_PROVIDER_SHIM": " openai", "SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_ANTHROPIC, Verdict.FAIL),
     ("trailing-space shim", {"DAAF_PROVIDER_SHIM": "openai ", "SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_ANTHROPIC, Verdict.FAIL),
-    ("uppercase backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "CHATGPT"}, ROUTE_OPENAI_API, Verdict.FAIL),
-    ("leading-space backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": " chatgpt"}, ROUTE_OPENAI_API, Verdict.FAIL),
-    ("trailing-space backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chatgpt "}, ROUTE_OPENAI_API, Verdict.FAIL),
+    ("uppercase backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "CHATGPT"}, ROUTE_ANTHROPIC, Verdict.FAIL),
+    ("leading-space backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": " chatgpt"}, ROUTE_ANTHROPIC, Verdict.FAIL),
+    ("trailing-space backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chatgpt "}, ROUTE_ANTHROPIC, Verdict.FAIL),
     ("partial shim", {"DAAF_PROVIDER_SHIM": "open"}, ROUTE_ANTHROPIC, Verdict.FAIL),
-    ("partial backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chat"}, ROUTE_OPENAI_API, Verdict.FAIL),
-    ("only shim signal", {"DAAF_PROVIDER_SHIM": "openai"}, ROUTE_OPENAI_API, Verdict.PASS),
+    ("partial backend", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chat"}, ROUTE_ANTHROPIC, Verdict.FAIL),
+    ("only shim signal", {"DAAF_PROVIDER_SHIM": "openai"}, ROUTE_ANTHROPIC, Verdict.FAIL),
     ("only backend signal", {"SHIM_BACKEND_MODE": "chatgpt"}, ROUTE_ANTHROPIC, Verdict.FAIL),
 ]
 for label, env, route, verdict in cases:
@@ -74,10 +78,10 @@ for label, env, route, verdict in cases:
     assert got.verdict == verdict, (label, got.verdict, verdict, got.detail)
     if verdict == Verdict.FAIL:
         assert "exact" in got.detail.lower(), (label, got.detail)
-print("exact lane controls: 11/11 cases passed")
+print("exact lane controls: 14/14 cases passed")
 '
     assert_success
-    assert_output "exact lane controls: 11/11 cases passed"
+    assert_output "exact lane controls: 14/14 cases passed"
 }
 
 @test "GPT physical-family classifier mirrors runtime boundaries and mappings" {
@@ -186,9 +190,9 @@ cases = [
     ("chat excluded from flagship cap", {**base_chatgpt, "ANTHROPIC_MODEL": "gpt-5.6-sol-chat", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "128000"}, Verdict.PASS),
     ("non-GPT control", {**base_chatgpt, "ANTHROPIC_MODEL": "claude-opus-4-8[1m]"}, Verdict.PASS),
     ("malformed left-boundary GPT is not capped", {**base_chatgpt, "ANTHROPIC_MODEL": "vendor/notgpt-5.6-sol", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "1050000"}, Verdict.PASS),
-    ("direct API [1m] hint is supported", {"DAAF_PROVIDER_SHIM": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol[1m]"}, Verdict.PASS),
-    ("direct API bare GPT needs explicit declaration", {"DAAF_PROVIDER_SHIM": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol"}, Verdict.FAIL),
-    ("API route keeps canonical 1.05M", {"DAAF_PROVIDER_SHIM": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol[1m]", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "1050000"}, Verdict.PASS),
+    ("direct API [1m] hint is supported", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol[1m]"}, Verdict.PASS),
+    ("direct API bare GPT needs explicit declaration", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol"}, Verdict.FAIL),
+    ("API route keeps canonical 1.05M", {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "openai", "ANTHROPIC_MODEL": "gpt-5.6-sol[1m]", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "1050000"}, Verdict.PASS),
     ("OpenRouter keeps canonical 1.05M", {"ANTHROPIC_BASE_URL": "https://openrouter.ai/api", "ANTHROPIC_MODEL": "openai/gpt-5.6-sol", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "1050000"}, Verdict.PASS),
     ("OpenRouter does not generalize [1m]", {"ANTHROPIC_BASE_URL": "https://openrouter.ai/api", "ANTHROPIC_MODEL": "openai/gpt-5.6-sol[1m]"}, Verdict.FAIL),
     ("native route rejects an explicit overflow declaration", {"ANTHROPIC_MODEL": "claude-opus-4-8[1m]", "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "9223372036854775808"}, Verdict.FAIL),
diff --git a/tests/bash/environment_settings_example.bats b/tests/bash/environment_settings_example.bats
index 14559299..0fabf89e 100755
--- a/tests/bash/environment_settings_example.bats
+++ b/tests/bash/environment_settings_example.bats
@@ -28,7 +28,7 @@
 #       (hash-SPACE-key) that would activate to a valid assignment
 #   (e) CONTENTS entries correspond 1:1 (number + title, in order) with the
 #       "# ====" numbered section banners
-#   (f) the 6 host-bridged keys each appear at least once as an example key line
+#   (f) the 7 host-bridged keys each appear at least once as an example key line
 #
 # This test reads the real file (read-only); it never writes to it.
 # ============================================================================
@@ -174,12 +174,12 @@ teardown() {
 }
 
 # =========================================================================
-# (f) The six host-bridged keys each appear as an example key line
+# (f) The seven host-bridged keys each appear as an example key line
 # =========================================================================
 
 @test "(f) each host-bridged key appears as a #KEY= example line" {
     for key in DAAF_PROJECT_NAME DAAF_PORT_MARIMO DAAF_PORT_LOGVIEWER \
-               DAAF_PORT_VSCODE DAAF_DEV DAAF_BRANCH; do
+               DAAF_PORT_VSCODE DAAF_DEV DAAF_BRANCH DAAF_DATA_VOLUME_NAME; do
         run grep -qE "^#${key}=" "${EXAMPLE_FILE}"
         if [ "${status}" -ne 0 ]; then
             echo "missing host-bridged example key: #${key}="
diff --git a/tests/bash/gpt_fast.bats b/tests/bash/gpt_fast.bats
new file mode 100755
index 00000000..40cc904f
--- /dev/null
+++ b/tests/bash/gpt_fast.bats
@@ -0,0 +1,132 @@
+#!/usr/bin/env bats
+
+setup() {
+    # Derive paths from the test's own location so the suite runs identically
+    # inside the DAAF container (repo root /daaf) and on CI runners (checkout
+    # under /home/runner/work/...). Hardcoding /daaf breaks CI with EPERM.
+    REPO_ROOT="$(cd "${BATS_TEST_DIRNAME}/../.." && pwd)"
+    export GPT_FAST_SH="${REPO_ROOT}/scripts/provider_shim/gpt_fast.sh"
+    export TEST_ROOT="${REPO_ROOT}/scripts/scratch/gpt-fast-bats-${BATS_TEST_NUMBER}-$$"
+    mkdir -p "$TEST_ROOT"
+    chmod 700 "$TEST_ROOT"
+}
+
+teardown() {
+    if [ -e "$TEST_ROOT" ]; then
+        find "$TEST_ROOT" -depth -delete
+    fi
+}
+
+@test "wrapper rejects missing arguments" {
+    run bash "$GPT_FAST_SH"
+    [ "$status" -eq 20 ]
+    [[ "$output" == *"Usage:"* ]]
+}
+
+@test "wrapper resolves its checked-in controller through a symlink" {
+    ln -s "$GPT_FAST_SH" "$TEST_ROOT/gpt-fast-link.sh"
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=chatgpt \
+        SHIM_PORT=1 \
+        bash "$TEST_ROOT/gpt-fast-link.sh" status
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Route: ChatGPT subscription"* ]]
+}
+
+@test "wrapper rejects unknown and extra arguments" {
+    run bash "$GPT_FAST_SH" enable
+    [ "$status" -eq 20 ]
+    [[ "$output" == *"use exactly one of"* ]]
+
+    run bash "$GPT_FAST_SH" on extra
+    [ "$status" -eq 20 ]
+    [[ "$output" == *"Usage:"* ]]
+}
+
+@test "on requires exact native Fast disable and leaves explicit OFF unchanged" {
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=chatgpt \
+        bash "$GPT_FAST_SH" off
+    [ "$status" -eq 0 ]
+    before="$(sha256sum "$TEST_ROOT/.claude/provider_shim/gpt_fast_policy.json")"
+
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=true \
+        bash "$GPT_FAST_SH" on
+    [ "$status" -eq 20 ]
+    [[ "$output" == *"CLAUDE_CODE_DISABLE_FAST_MODE=1"* ]]
+    after="$(sha256sum "$TEST_ROOT/.claude/provider_shim/gpt_fast_policy.json")"
+    [ "$after" = "$before" ]
+}
+
+@test "ChatGPT on and off persist exact route-bound booleans" {
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=chatgpt \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$GPT_FAST_SH" on
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Requested Fast service is ON"* ]]
+    [[ "$output" == *"service_tier='priority'"* ]]
+    [[ "$output" != *"Priority Processing can change API cost"* ]]
+    run grep -Fx '{"version":1,"backend_mode":"chatgpt","enabled":true}' \
+        "$TEST_ROOT/.claude/provider_shim/gpt_fast_policy.json"
+    [ "$status" -eq 0 ]
+
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=chatgpt \
+        bash "$GPT_FAST_SH" off
+    [ "$status" -eq 0 ]
+    run grep -Fx '{"version":1,"backend_mode":"chatgpt","enabled":false}' \
+        "$TEST_ROOT/.claude/provider_shim/gpt_fast_policy.json"
+    [ "$status" -eq 0 ]
+}
+
+@test "OpenAI API on prints non-interactive Priority cost warning" {
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=openai \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$GPT_FAST_SH" on
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Priority Processing can change API cost"* ]]
+    [[ "$output" == *"Requested Priority service is ON"* ]]
+    [[ "$output" == *"service_tier='priority'"* ]]
+}
+
+@test "status remains available and never claims requested means served" {
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=openai \
+        SHIM_PORT=1 \
+        bash "$GPT_FAST_SH" status
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Persisted requested policy:"* ]]
+    [[ "$output" == *"Shim: unavailable"* ]]
+    [[ "$output" == *"Latest terminal: unknown"* ]]
+    [[ "$output" == *"requested Priority service is not proof"* ]]
+}
+
+@test "malformed route variables reject mutation" {
+    run env \
+        HOME="$TEST_ROOT" \
+        DAAF_PROVIDER_SHIM=openai \
+        SHIM_BACKEND_MODE=OPENAI \
+        CLAUDE_CODE_DISABLE_FAST_MODE=1 \
+        bash "$GPT_FAST_SH" on
+    [ "$status" -eq 20 ]
+    [[ "$output" == *"SHIM_BACKEND_MODE must be exactly"* ]]
+    [ ! -e "$TEST_ROOT/.claude/provider_shim/gpt_fast_policy.json" ]
+}
diff --git a/tests/bash/install.bats b/tests/bash/install.bats
index 0d6755f1..d20c81ef 100755
--- a/tests/bash/install.bats
+++ b/tests/bash/install.bats
@@ -686,6 +686,22 @@ teardown() {
     assert_output --partial "DAAF_PORT_MARIMO=9990"
 }
 
+@test "install.sh: seeds DAAF_DATA_VOLUME_NAME from the process environment when set" {
+    # The data-volume override rides the same seeding array as the multi-instance
+    # keys, so a value exported for the install persists into the settings file.
+    export DAAF_NESTED=1
+    export DAAF_PROJECT_NAME="myproj"
+    export DAAF_DATA_VOLUME_NAME="shared_workspace_vol"
+    MOCK_DOCKER_EXEC_EXIT=0
+    cd "${TEST_DIR}"
+    run bash "${REPO_ROOT}/scripts/host/install.sh"
+    assert_success
+    assert_output --partial "seeded these values"
+    [ -f "${TEST_DIR}/daaf-docker/environment_settings.txt" ]
+    run cat "${TEST_DIR}/daaf-docker/environment_settings.txt"
+    assert_output --partial "DAAF_DATA_VOLUME_NAME=shared_workspace_vol"
+}
+
 @test "install.sh: preserves an existing environment_settings.txt (never overwrites)" {
     export DAAF_NESTED=1
     export DAAF_PROJECT_NAME="ignored"
diff --git a/tests/bash/migrate_daaf.bats b/tests/bash/migrate_daaf.bats
index 08d03470..1e177bab 100755
--- a/tests/bash/migrate_daaf.bats
+++ b/tests/bash/migrate_daaf.bats
@@ -735,6 +735,117 @@ SH
     assert_output --partial "Migration complete"
 }
 
+# --- Pre-migration backup gate (section 3) ---
+# migrate's backup is MANDATORY (not prompted): section 3 captures the exit with
+# `BACKUP_EXIT=0; DAAF_NESTED=1 bash backup_daaf.sh || BACKUP_EXIT=$?` and aborts
+# on any nonzero code with a clear message. These are real-run-path tests (the
+# dry-run path skips the nested backup call entirely, keeping BACKUP_COMPLETED=true).
+# The full-run harness's curl mock writes every downloaded host script, INCLUDING
+# backup_daaf.sh, so the exit code is controlled by special-casing that file in the
+# curl mock rather than by a pre-seeded stub (which the download would clobber).
+
+@test "migrate: backup failure aborts the migration with a clear message" {
+    setup_migrate_integrated
+    run bash -c '
+        cd "'"${TEST_DIR}"'"
+        curl() {
+            local outfile=""
+            local args=("$@")
+            for ((i=0; i<${#args[@]}; i++)); do
+                if [ "${args[$i]}" = "-o" ]; then
+                    outfile="${args[$((i+1))]}"
+                    break
+                fi
+            done
+            if [ -n "${outfile}" ]; then
+                mkdir -p "$(dirname "${outfile}")"
+                echo "#!/usr/bin/env bash" > "${outfile}"
+                if [ "$(basename "${outfile}")" = "backup_daaf.sh" ]; then
+                    # The mandatory backup fails: emit a marker, then exit nonzero.
+                    echo "echo \"STUB BACKUP RAN\"" >> "${outfile}"
+                    echo "exit 1" >> "${outfile}"
+                else
+                    echo "exit 0" >> "${outfile}"
+                fi
+            fi
+            return 0
+        }
+        export -f curl
+        docker() {
+            local all_args="$*"
+            case "$all_args" in
+                "info") return 0 ;;
+                *"volume inspect"*) return 0 ;;
+                *"ps -a"*"--filter"*"volume="*"--format"*) echo "daaf-test-1" ;;
+                *"inspect --format"*"State.Status"*) echo "running" ;;
+                *) return 0 ;;
+            esac
+        }
+        export -f docker
+        bash "'"${REPO_ROOT}"'/scripts/host/migrate_daaf.sh"
+    '
+    assert_failure
+    assert_output --partial "STUB BACKUP RAN"
+    assert_output --partial "ERROR: Backup failed (exit code 1)"
+    assert_output --partial "The migration will not proceed without a successful backup."
+    # The abort happens in section 3, so no section-4 post-backup step is reached.
+    refute_output --partial "Starting container"
+    refute_output --partial "Migration complete"
+}
+
+@test "migrate: backup success lets the migration proceed past the backup step" {
+    setup_migrate_integrated
+    run bash -c '
+        cd "'"${TEST_DIR}"'"
+        curl() {
+            local outfile=""
+            local args=("$@")
+            for ((i=0; i<${#args[@]}; i++)); do
+                if [ "${args[$i]}" = "-o" ]; then
+                    outfile="${args[$((i+1))]}"
+                    break
+                fi
+            done
+            if [ -n "${outfile}" ]; then
+                mkdir -p "$(dirname "${outfile}")"
+                echo "#!/usr/bin/env bash" > "${outfile}"
+                if [ "$(basename "${outfile}")" = "backup_daaf.sh" ]; then
+                    # The mandatory backup succeeds: emit a marker, then exit 0.
+                    echo "echo \"STUB BACKUP RAN\"" >> "${outfile}"
+                    echo "exit 0" >> "${outfile}"
+                else
+                    echo "exit 0" >> "${outfile}"
+                fi
+            fi
+            return 0
+        }
+        export -f curl
+        docker() {
+            local all_args="$*"
+            case "$all_args" in
+                "info") return 0 ;;
+                *"volume inspect"*) return 0 ;;
+                *"ps -a"*"--filter"*"volume="*"--format"*) echo "daaf-test-1" ;;
+                *"inspect --format"*"State.Status"*) echo "running" ;;
+                *"exec"*"true"*) return 0 ;;
+                *"exec"*"test -f"*"CLAUDE.md"*) return 0 ;;
+                *"exec"*"remote get-url"*"origin"*) echo "https://github.com/DAAF-Contribution-Community/daaf.git" ;;
+                *"exec"*"fetch"*) return 0 ;;
+                *"exec"*"branch --set-upstream"*) return 0 ;;
+                *"exec"*"remote get-url"*"upstream"*) echo "" ; return 1 ;;
+                *) return 0 ;;
+            esac
+        }
+        export -f docker
+        bash "'"${REPO_ROOT}"'/scripts/host/migrate_daaf.sh"
+    '
+    assert_success
+    assert_output --partial "STUB BACKUP RAN"
+    # The gate must NOT false-fire, and the flow must reach the post-backup step.
+    refute_output --partial "The migration will not proceed without a successful backup."
+    assert_output --partial "Starting container"
+}
+
 @test "migrate: already migrated (idempotency) skips graft via replace-ref leg" {
     # Idempotency via LEG 1 (replace-ref): a non-empty `git replace -l` marks the
     # graft as already done. cat-file returns NO parent here, so the ONLY thing
diff --git a/tests/bash/remind_orchestrator.bats b/tests/bash/remind_orchestrator.bats
new file mode 100755
index 00000000..4c24704c
--- /dev/null
+++ b/tests/bash/remind_orchestrator.bats
@@ -0,0 +1,342 @@
+#!/usr/bin/env bats
+# ============================================================================
+# Tests for remind-orchestrator.sh -- first-prompt orchestrator reminder
+# ============================================================================
+# The protected deployed hook is not edited by automation. SCRIPT UNDER TEST is
+# parameterized so this suite can validate the workspace draft before a user
+# copies it into .claude/hooks/:
+#   REMIND_ORCHESTRATOR_SH=/path/to/draft/remind-orchestrator.sh \
+#     bats tests/bash/remind_orchestrator.bats
+# ============================================================================
+
+load 'test_helper'
+
+REMIND_ORCHESTRATOR_SH="${REMIND_ORCHESTRATOR_SH:-${REPO_ROOT}/.claude/hooks/remind-orchestrator.sh}"
+CONTEXT_BAR_SH="${CONTEXT_BAR_SH:-${REPO_ROOT}/.claude/scripts/context-bar.sh}"
+FAKE_SESSION="bats-remind-orchestrator-session"
+ORDINARY_REMINDER='You are interacting with a human user. You MUST IMMEDIATELY invoke the daaf-orchestrator skill'
+GUIDANCE_MARKER='For this GPT session, treat the user as an equal stakeholder and thoughtful collaborator'
+GUIDANCE_CONCISE='Default to concise, user-relevant responses in plain language'
+GUIDANCE_DEPTH='at their demonstrated technical depth'
+GUIDANCE_ANSWER='Lead with the answer or decision'
+GUIDANCE_ACTION='put an immediate action first only when action is what they need'
+GUIDANCE_OPTIONS='Make required actions, options, recommendations, and consequences easy to spot'
+GUIDANCE_DECISIONS='When several independent decisions are genuinely needed, present them separately'
+GUIDANCE_DETAIL='Put secondary technical and implementation detail in clearly marked optional sections or artifacts'
+GUIDANCE_RIGOR='Keep full evidence and reproducibility detail available'
+GUIDANCE_UNCERTAINTY='surfacing the uncertainty, caveats, citations, safety warnings, and consent checkpoints that affect the current decision'
+
+setup() {
+    common_setup
+    TEST_HOME="${TEST_DIR}/home"
+    PROJECT_DIR="${TEST_DIR}/project"
+    MODEL_CACHE_DIR="${TEST_DIR}/model-cache"
+    STATE_DIR="${TEST_HOME}/.claude/daaf-state"
+    ACTIVITY_LOG="${PROJECT_DIR}/.claude/logs/activity.log"
+    TRANSPARENCY_FILE="${REPO_ROOT}/.claude/hooks/first-run-transparency.txt"
+    mkdir -p "$STATE_DIR" "$(dirname "$ACTIVITY_LOG")" "$MODEL_CACHE_DIR"
+    printf 'session-one\nsession-two\n' > "$ACTIVITY_LOG"
+    export REMIND_ORCHESTRATOR_SH CONTEXT_BAR_SH FAKE_SESSION TEST_HOME PROJECT_DIR
+    export MODEL_CACHE_DIR STATE_DIR ACTIVITY_LOG TRANSPARENCY_FILE
+    export ORDINARY_REMINDER GUIDANCE_MARKER GUIDANCE_CONCISE GUIDANCE_DEPTH
+    export GUIDANCE_ANSWER GUIDANCE_ACTION GUIDANCE_OPTIONS GUIDANCE_DECISIONS
+    export GUIDANCE_DETAIL GUIDANCE_RIGOR GUIDANCE_UNCERTAINTY
+}
+
+teardown() {
+    common_teardown
+}
+
+_payload_main() {
+    printf '{"hook_event_name":"UserPromptSubmit","session_id":"%s"}' "$FAKE_SESSION"
+}
+
+_payload_agent_id() {
+    printf '{"hook_event_name":"UserPromptSubmit","session_id":"%s","agent_id":"agent-123","agent_type":"general-purpose"}' "$FAKE_SESSION"
+}
+
+_payload_agent_type() {
+    printf '{"hook_event_name":"UserPromptSubmit","session_id":"%s","agent_type":"%s"}' "$FAKE_SESSION" "$1"
+}
+
+_seed_model() {
+    printf '%s' "$1" > "${MODEL_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+}
+
+_run_hook() {
+    run env \
+        HOME="$TEST_HOME" \
+        CLAUDE_PROJECT_DIR="$PROJECT_DIR" \
+        DAAF_REMIND_MODEL_CACHE_DIR="$MODEL_CACHE_DIR" \
+        DAAF_REMIND_TRANSPARENCY_FILE="$TRANSPARENCY_FILE" \
+        bash "$REMIND_ORCHESTRATOR_SH"
+}
+
+@test "remind-orchestrator.sh draft parses without errors" {
+    run bash -n "$REMIND_ORCHESTRATOR_SH"
+    assert_success
+}
+
+@test "bare GPT Sol receives the stable collaborator policy clauses without a one-question constraint" {
+    _seed_model 'gpt-5.6-sol'
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    assert_output --partial "$GUIDANCE_MARKER"
+    assert_output --partial "$GUIDANCE_CONCISE"
+    assert_output --partial "$GUIDANCE_DEPTH"
+    assert_output --partial "$GUIDANCE_ANSWER"
+    assert_output --partial "$GUIDANCE_ACTION"
+    assert_output --partial "$GUIDANCE_OPTIONS"
+    assert_output --partial "$GUIDANCE_DECISIONS"
+    assert_output --partial "$GUIDANCE_DETAIL"
+    assert_output --partial "$GUIDANCE_RIGOR"
+    assert_output --partial "$GUIDANCE_UNCERTAINTY"
+    assert_output --partial 'Be warm, direct, and easy to scan, never patronizing.'
+    refute_output --partial 'ask one'
+    refute_output --partial 'single question'
+    refute_output --partial 'one clear question'
+    refute_output --partial 'at most one'
+    refute_output --partial 'only one question'
+    refute_output --partial 'one question at a time'
+}
+
+@test "statusline model-cache writer feeds the first-prompt guidance path end to end" {
+    run env DAAF_CONTEXT_BAR_CACHE_DIR="$MODEL_CACHE_DIR" \
+        bash "$CONTEXT_BAR_SH" <<JSON
+{"model":{"id":"openrouter/openai/gpt-5.6-terra[1m]","display_name":"gpt-5.6-terra[1m]"},"cwd":"$PROJECT_DIR","transcript_path":"","session_id":"$FAKE_SESSION","context_window":{"context_window_size":1050000}}
+JSON
+    assert_success
+
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    assert_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "GPT Terra and other terminal GPT variants receive guidance" {
+    local model
+    for model in gpt-5.6-terra gpt-5.5 gpt-4.1 gpt-future-collaborator; do
+        _seed_model "$model"
+        _run_hook < <(_payload_main)
+        assert_success
+        assert_output --partial "$ORDINARY_REMINDER"
+        assert_output --partial "$GUIDANCE_MARKER"
+    done
+}
+
+@test "bracketed context modifier receives guidance" {
+    _seed_model 'gpt-5.6-sol[1m]'
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "one and multiple provider prefixes preserve terminal GPT matching" {
+    local model
+    for model in openai/gpt-5.6-sol openrouter/openai/gpt-5.6-terra[1m]; do
+        _seed_model "$model"
+        _run_hook < <(_payload_main)
+        assert_success
+        assert_output --partial "$GUIDANCE_MARKER"
+    done
+}
+
+@test "malformed left-boundary lookalikes keep ordinary reminder but receive no guidance" {
+    local model
+    for model in xgpt-5.6-sol notgpt-5.6-sol foo-gpt-5.6-sol vendor/notgpt-5.6-sol vendor/foo-gpt-5.6-sol; do
+        _seed_model "$model"
+        _run_hook < <(_payload_main)
+        assert_success
+        assert_output --partial "$ORDINARY_REMINDER"
+        refute_output --partial "$GUIDANCE_MARKER"
+    done
+}
+
+@test "Claude Fable keeps ordinary reminder but receives no GPT guidance" {
+    _seed_model 'claude-fable-5[1m]'
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "missing model cache preserves ordinary reminder with no GPT guidance" {
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "empty model cache preserves ordinary reminder with no GPT guidance" {
+    : > "${MODEL_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "malformed cache content does not enable GPT-specific guidance" {
+    printf 'gpt-5.6-sol\ntrailing-data' > "${MODEL_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "trailing newline in the model cache makes identity ineligible" {
+    printf 'gpt-5.6-sol\n' > "${MODEL_CACHE_DIR}/claude-model-${FAKE_SESSION}"
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "malformed input cannot read a seeded shared default model cache" {
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-default"
+    _run_hook <<< 'not-json {{{'
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "missing null and empty session ids cannot read a seeded shared default model cache" {
+    local payload
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-default"
+    for payload in \
+        '{"hook_event_name":"UserPromptSubmit"}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":null}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":""}'; do
+        _run_hook <<< "$payload"
+        assert_success
+        assert_output --partial "$ORDINARY_REMINDER"
+        refute_output --partial "$GUIDANCE_MARKER"
+    done
+}
+
+@test "newline NUL and unit-separator session identities cannot read seeded alias caches" {
+    local payload
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-safe"
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-victim"
+    touch "${STATE_DIR}/orchestrator-loaded-safe" "${STATE_DIR}/orchestrator-loaded-victim"
+
+    for payload in \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"safe\nid"}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"safe\n"}'; do
+        _run_hook <<< "$payload"
+        assert_success
+        assert_output --partial "$ORDINARY_REMINDER"
+        refute_output --partial "$GUIDANCE_MARKER"
+    done
+
+    printf -v payload '{"hook_event_name":"UserPromptSubmit","session_id":"victim\\u%04x"}' 0
+    _run_hook <<< "$payload"
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+
+    printf -v payload '{"hook_event_name":"UserPromptSubmit","session_id":"victim\\u%04xgpt-5.6-sol"}' 31
+    _run_hook <<< "$payload"
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "malformed nonempty caller identity is silent and cannot enable GPT guidance" {
+    local payload
+    _seed_model 'gpt-5.6-sol'
+
+    for payload in \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"bats-remind-orchestrator-session","agent_id":"agent\nnormalized"}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"bats-remind-orchestrator-session","agent_id":{"id":"agent-123"}}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"bats-remind-orchestrator-session","agent_type":"orchestrator\nsubagent"}' \
+        '{"hook_event_name":"UserPromptSubmit","session_id":"bats-remind-orchestrator-session","agent_type":42}'; do
+        _run_hook <<< "$payload"
+        assert_success
+        assert_output ""
+    done
+}
+
+@test "explicit empty caller identity remains eligible for GPT guidance" {
+    _seed_model 'gpt-5.6-sol'
+    _run_hook <<JSON
+{"hook_event_name":"UserPromptSubmit","session_id":"$FAKE_SESSION","agent_id":"","agent_type":""}
+JSON
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    assert_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "payload with agent_id is explicitly ignored" {
+    _seed_model 'gpt-5.6-sol'
+    _run_hook < <(_payload_agent_id)
+    assert_success
+    assert_output ""
+}
+
+@test "explicit non-orchestrator agent_type is ignored even without agent_id" {
+    _seed_model 'gpt-5.6-sol'
+    _run_hook < <(_payload_agent_type 'research-executor')
+    assert_success
+    assert_output ""
+}
+
+@test "positive orchestrator agent_type remains eligible for GPT guidance" {
+    _seed_model 'openai/gpt-5.6-terra'
+    _run_hook < <(_payload_agent_type 'orchestrator')
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    assert_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "existing persistent loaded flag suppresses every reminder" {
+    _seed_model 'gpt-5.6-sol'
+    touch "${STATE_DIR}/orchestrator-loaded-${FAKE_SESSION}"
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output ""
+}
+
+@test "first-run transparency still appears alongside ordinary and GPT reminders" {
+    printf 'first-session\n' > "$ACTIVITY_LOG"
+    _seed_model 'gpt-5.6-sol'
+    _run_hook < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    assert_output --partial "$GUIDANCE_MARKER"
+    assert_output --partial 'FIRST-TIME USER DETECTED: ONBOARDING PROCESS TRIGGERED.'
+    assert_output --partial 'KEY POINTS TO COVER:'
+}
+
+@test "missing jq cannot read a seeded shared default cache and remains fail-open" {
+    local bindir="${TEST_DIR}/nojq-bin"
+    mkdir -p "$bindir"
+    ln -s "$(command -v bash)" "${bindir}/bash"
+    ln -s "$(command -v cat)" "${bindir}/cat"
+    ln -s "$(command -v wc)" "${bindir}/wc"
+    ln -s "$(command -v tr)" "${bindir}/tr"
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-default"
+
+    run env -i \
+        PATH="$bindir" \
+        HOME="$TEST_HOME" \
+        CLAUDE_PROJECT_DIR="$PROJECT_DIR" \
+        DAAF_REMIND_MODEL_CACHE_DIR="$MODEL_CACHE_DIR" \
+        bash "$REMIND_ORCHESTRATOR_SH" < <(_payload_main)
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
+
+@test "unsafe session id cannot select a model cache but ordinary reminder survives" {
+    printf '%s' 'gpt-5.6-sol' > "${MODEL_CACHE_DIR}/claude-model-default"
+    run env \
+        HOME="$TEST_HOME" \
+        CLAUDE_PROJECT_DIR="$PROJECT_DIR" \
+        DAAF_REMIND_MODEL_CACHE_DIR="$MODEL_CACHE_DIR" \
+        bash "$REMIND_ORCHESTRATOR_SH" \
+        <<<'{"hook_event_name":"UserPromptSubmit","session_id":"../unsafe"}'
+    assert_success
+    assert_output --partial "$ORDINARY_REMINDER"
+    refute_output --partial "$GUIDANCE_MARKER"
+}
diff --git a/tests/bash/restore_from_backup.bats b/tests/bash/restore_from_backup.bats
index 49e89236..f36ed2d3 100755
--- a/tests/bash/restore_from_backup.bats
+++ b/tests/bash/restore_from_backup.bats
@@ -836,3 +836,103 @@ teardown() {
     assert_output --partial "may predate"
     assert_output --partial "permission preservation"
 }
+
+# =========================================================================
+# --- Helper-container reap on `docker create` launch failure ---
+# =========================================================================
+# `docker create` echoes a CID to stdout; if the command then exits nonzero the
+# command substitution has ALREADY captured that CID. The two launch guards must
+# reap it (docker rm -f <cid>) so a launch failure does not leak a helper container.
+# `docker create` is single-phase, so a fail-with-CID is near-theoretical here --
+# these tests pin insurance parity with backup_daaf.sh's fixed launch guards and
+# with the .ps1 twin's finally-reap. The mocks log every docker call to a file so
+# the reap can be asserted after `run` (a bats array does not survive the `run`
+# subshell). Each test FAILS against the pre-fix restore code (main branch: no reap
+# before exit 1; Claude branch: `|| CLAUDE_CID=""` blanked the CID before the
+# end-of-block reap).
+
+@test "restore: main create launch failure reaps the captured helper container" {
+    mkdir -p "${TEST_DIR}/2026-01-01_daaf_backup"
+    touch "${TEST_DIR}/2026-01-01_daaf_backup/f1"
+
+    export DAAF_NESTED=1
+
+    # Step 1 volume-clear (`docker run --rm ... rm -rf`) succeeds; the Site A
+    # `docker create` for the data volume prints a CID but exits nonzero. The error
+    # branch must run `docker rm -f mockcid0000` before `exit 1`.
+    docker() {
+        printf '%s\n' "$*" >> "${TEST_DIR}/docker_calls.log"
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            ps)     return 0 ;;
+            create) echo "mockcid0000"; return 1 ;;
+            cp)     return 0 ;;
+            rm)     return 0 ;;
+            run)    return 0 ;;
+            *)      return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash -c 'printf "1\nRESTORE\n" | bash "'"${REPO_ROOT}"'/scripts/host/restore_from_backup.sh"'
+    assert_failure
+    assert_output --partial "Could not create the helper container"
+    # The captured CID must have been reaped in the error branch (fix-specific).
+    run grep -F 'rm -f mockcid0000' "${TEST_DIR}/docker_calls.log"
+    assert_success
+}
+
+@test "restore: Claude create launch failure preserves and reaps the captured CID (WARNING, not fatal)" {
+    mkdir -p "${TEST_DIR}/2026-01-01_daaf_backup"
+    touch "${TEST_DIR}/2026-01-01_daaf_backup/f1"
+    # A non-empty Claude subfolder => HAS_CLAUDE_BACKUP=1, so the Claude restore path
+    # runs after the data-volume restore succeeds.
+    mkdir -p "${TEST_DIR}/2026-01-01_daaf_backup/.daaf-claude-config"
+    touch "${TEST_DIR}/2026-01-01_daaf_backup/.daaf-claude-config/creds"
+
+    export DAAF_NESTED=1
+
+    # Data-volume restore succeeds (its `docker create` -> CID, exit 0). The
+    # Claude-volume `docker create` prints a CID but exits nonzero; the fix keeps that
+    # CID (no `|| CLAUDE_CID=""`) so the end-of-block `docker rm -f claudecid1111`
+    # reaps it. The two creates are distinguished by the "claude-config" volume
+    # substring. Both manifests probe ABSENT (test -f -> 1); verification returns a
+    # positive count so the data restore succeeds. Claude failure stays a WARNING and
+    # the script still completes (overall success).
+    docker() {
+        printf '%s\n' "$*" >> "${TEST_DIR}/docker_calls.log"
+        case "$1" in
+            info)   return 0 ;;
+            volume) return 0 ;;
+            ps)     return 0 ;;
+            create)
+                if printf '%s' "$*" | grep -q 'claude-config'; then
+                    echo "claudecid1111"; return 1
+                fi
+                echo "datacid0000"; return 0
+                ;;
+            cp)     return 0 ;;
+            rm)     return 0 ;;
+            run)
+                shift
+                local args_str="$*"
+                if [[ "${args_str}" == *"test -f"* ]]; then
+                    return 1
+                elif [[ "${args_str}" == *"find /dest"* ]] && [[ "${args_str}" == *"wc -l"* ]]; then
+                    echo "1"; return 0
+                fi
+                return 0
+                ;;
+            *)      return 0 ;;
+        esac
+    }
+    export -f docker
+
+    run bash -c 'printf "1\nRESTORE\n" | bash "'"${REPO_ROOT}"'/scripts/host/restore_from_backup.sh"'
+    assert_success
+    assert_output --partial "Failed to restore the Claude Code state volume"
+    # The captured Claude CID must be reaped -- proving it was NOT blanked before cleanup.
+    run grep -F 'rm -f claudecid1111' "${TEST_DIR}/docker_calls.log"
+    assert_success
+}
diff --git a/tests/bash/settings_permissions.bats b/tests/bash/settings_permissions.bats
new file mode 100644
index 00000000..44e7088b
--- /dev/null
+++ b/tests/bash/settings_permissions.bats
@@ -0,0 +1,134 @@
+#!/usr/bin/env bats
+# ============================================================================
+# Static contract tests for checked-in Claude Code permission rules.
+#
+# This suite validates the checked-in configuration contract in
+# .claude/settings.json. It does NOT dynamically prove Claude Code permission-
+# matcher semantics; runtime matcher behavior remains the responsibility of the
+# installed Claude Code version and its authoritative documentation.
+# ============================================================================
+
+load 'test_helper'
+
+setup() { common_setup; }
+teardown() { common_teardown; }
+
+SETTINGS_FILE="${REPO_ROOT}/.claude/settings.json"
+EXPECTED_RULES_JSON='[
+  "Edit(/.claude/logs/**)",
+  "Write(/.claude/logs/**)",
+  "Edit(//home/appuser/.claude/**/*.jsonl)",
+  "Write(//home/appuser/.claude/**/*.jsonl)",
+  "Edit(/research/*/logs/**)",
+  "Write(/research/*/logs/**)"
+]'
+EXPECTED_PATHS=(
+    '/.claude/logs/**'
+    '//home/appuser/.claude/**/*.jsonl'
+    '/research/*/logs/**'
+)
+NEAR_RULES_JSON='[
+  "Read(/.claude/logs/**)",
+  "Read(//home/appuser/.claude/**/*.jsonl)",
+  "Edit(.claude/logs/**)",
+  "Write(research/*/logs/**)",
+  "Edit(/.claude/./logs/**)",
+  "Write(//home/appuser//.claude/**/*.jsonl)",
+  "Edit(/research/*/./logs/**)",
+  "Read(/.claude/././logs/**)",
+  "Write(//home/appuser/././.claude/**/*.jsonl)",
+  "Edit(/research/*/././logs/**)"
+]'
+NON_MEMBER_RULES_JSON='[
+  "Read(/archive/.claude/logs/**)",
+  "Read(/archive/home/appuser/.claude/**/*.jsonl)",
+  "Read(/archive/research/project/logs/**)",
+  "Read(//home/appuser/.claude/cache/example.jsonl.bak)",
+  "Read(/ordinary/path/**)"
+]'
+
+# Select any permission rule targeting one of the three protected path families.
+# Structural segment normalization removes every repeated slash and /./ segment
+# while preserving whether the original path had zero, one, or two leading
+# slashes. Direct anchors exclude unrelated archive/lookalike paths; exact set
+# equality below then rejects every selected variant except the six approved
+# strings.
+PROTECTED_FAMILY_FILTER='def normalized_path:
+    (if startswith("//") then "//" elif startswith("/") then "/" else "" end) as $anchor
+    | (if startswith("//") then .[2:] elif startswith("/") then .[1:] else . end) as $rest
+    | ($rest | split("/") | map(select(. != "" and . != ".")) | join("/")) as $body
+    | $anchor + $body;
+  [.permissions.deny[]
+   | (capture("^(?<tool>[^()]+)\\((?<path>.*)\\)$")?) as $rule
+   | select($rule != null)
+   | ($rule.path | normalized_path) as $path
+   | select(
+       ($path | test("^(//|/)?\\.claude/logs(/|$)"))
+       or (($path | test("^(//|/)?home/appuser/\\.claude(/|$)")) and ($path | test("\\.jsonl$")))
+       or ($path | test("^(//|/)?research/[^/]+/logs(/|$)"))
+     )
+   | .] | sort'
+
+@test "settings permissions: checked-in settings JSON parses" {
+    run jq empty "${SETTINGS_FILE}"
+    assert_success
+}
+
+@test "settings permissions: all six approved deny rules are present" {
+    run jq -e --argjson expected "${EXPECTED_RULES_JSON}" '
+        . as $settings
+        | all($expected[]; . as $rule | $settings.permissions.deny | index($rule) != null)
+    ' "${SETTINGS_FILE}"
+    assert_success
+}
+
+@test "settings permissions: obsolete non-recursive log rules are absent" {
+    run jq -e '
+        [.permissions.deny[]
+         | select(. == "Edit(.claude/logs/*)" or . == "Write(.claude/logs/*)")]
+        | length == 0
+    ' "${SETTINGS_FILE}"
+    assert_success
+}
+
+@test "settings permissions: protected log and transcript subset is exactly six rules" {
+    run jq -e \
+        --argjson expected "${EXPECTED_RULES_JSON}" \
+        "${PROTECTED_FAMILY_FILTER} == (\$expected | sort)" \
+        "${SETTINGS_FILE}"
+    assert_success
+}
+
+@test "settings permissions: classifier includes near-rules and excludes lookalikes" {
+    run jq -n -e \
+        --argjson expected "${EXPECTED_RULES_JSON}" \
+        --argjson extras "${NEAR_RULES_JSON}" \
+        --argjson nonmembers "${NON_MEMBER_RULES_JSON}" \
+        "{permissions: {deny: (\$expected + \$extras + \$nonmembers)}}
+         | ${PROTECTED_FAMILY_FILTER} as \$observed
+         | (all(\$extras[]; . as \$rule | \$observed | index(\$rule) != null))
+           and (all(\$nonmembers[]; . as \$rule | \$observed | index(\$rule) == null))
+           and (\$observed != (\$expected | sort))"
+    assert_success
+}
+
+@test "settings permissions: every approved path has exact Edit and Write variants" {
+    local path
+    for path in "${EXPECTED_PATHS[@]}"; do
+        run jq -e --arg path "${path}" '
+            ["Edit(" + $path + ")", "Write(" + $path + ")"] as $expected
+            | [.permissions.deny[] | select(. == $expected[0] or . == $expected[1])] | sort
+            == ($expected | sort)
+        ' "${SETTINGS_FILE}"
+        assert_success
+    done
+}
+
+@test "settings permissions: existing tmp Edit and Write deny rules remain present" {
+    run jq -e '
+        . as $settings
+        | ["Edit(//tmp/**)", "Write(//tmp/**)"]
+        | all(. as $rule | $settings.permissions.deny | index($rule) != null)
+    ' "${SETTINGS_FILE}"
+    assert_success
+}
diff --git a/tests/bash/settings_whitelist_parity.bats b/tests/bash/settings_whitelist_parity.bats
index 21983dbd..c7ac49e5 100755
--- a/tests/bash/settings_whitelist_parity.bats
+++ b/tests/bash/settings_whitelist_parity.bats
@@ -11,8 +11,8 @@
 # + 2 optional dev-workspace pairs, enumerated below). Every copy hardcodes the
 # SAME whitelist of DAAF_* keys:
 #
-#     DAAF_BRANCH DAAF_DEV DAAF_PORT_LOGVIEWER DAAF_PORT_MARIMO
-#     DAAF_PORT_VSCODE DAAF_PROJECT_NAME
+#     DAAF_BRANCH DAAF_DATA_VOLUME_NAME DAAF_DEV DAAF_PORT_LOGVIEWER
+#     DAAF_PORT_MARIMO DAAF_PORT_VSCODE DAAF_PROJECT_NAME
 #
 # If one copy drifts (a key added to the library but not propagated to a
 # launcher, or vice versa), a second install's project name / published ports /
@@ -76,6 +76,7 @@ OPTIONAL_COPIES=(
 canonical_expected() {
     LC_ALL=C sort -u <<'KEYS'
 DAAF_BRANCH
+DAAF_DATA_VOLUME_NAME
 DAAF_DEV
 DAAF_PORT_LOGVIEWER
 DAAF_PORT_MARIMO
@@ -122,29 +123,29 @@ INSTALL_SH="${REPO_ROOT}/scripts/host/install.sh"
 INSTALL_PS1="${REPO_ROOT}/scripts/host/install.ps1"
 
 # ===========================================================================
-# (d) Canonical sets are EXACTLY the pinned literal 6 keys (both languages).
+# (d) Canonical sets are EXACTLY the pinned literal 7 keys (both languages).
 # Placed first: if the extraction returns empty or wrong, every set-equality
 # test below would pass vacuously, so this pin is the anti-vacuity anchor.
 # ===========================================================================
 
-@test "parity: daaf_lib.sh canonical whitelist is exactly the pinned 6 keys" {
+@test "parity: daaf_lib.sh canonical whitelist is exactly the pinned 7 keys" {
     local got want
     got="$(extract_sh_whitelist "${DAAF_LIB_SH}")"
     want="$(canonical_expected)"
     [ "${got}" = "${want}" ] || {
-        echo "CANONICAL DRIFT: daaf_lib.sh whitelist != pinned 6 keys"
+        echo "CANONICAL DRIFT: daaf_lib.sh whitelist != pinned 7 keys"
         echo "-- extracted:"; echo "${got}"
         echo "-- pinned:";    echo "${want}"
         return 1
     }
 }
 
-@test "parity: daaf_lib.ps1 canonical whitelist is exactly the pinned 6 keys" {
+@test "parity: daaf_lib.ps1 canonical whitelist is exactly the pinned 7 keys" {
     local got want
     got="$(extract_ps1_whitelist "${DAAF_LIB_PS1}")"
     want="$(canonical_expected)"
     [ "${got}" = "${want}" ] || {
-        echo "CANONICAL DRIFT: daaf_lib.ps1 \$known != pinned 6 keys"
+        echo "CANONICAL DRIFT: daaf_lib.ps1 \$known != pinned 7 keys"
         echo "-- extracted:"; echo "${got}"
         echo "-- pinned:";    echo "${want}"
         return 1
@@ -240,7 +241,7 @@ INSTALL_PS1="${REPO_ROOT}/scripts/host/install.ps1"
 # parsing arms are therefore bespoke, NOT the shared pattern. This test pins that
 # deviation to exactly {DAAF_DEV, DAAF_PROJECT_NAME} so that a well-meaning
 # "let's make install consistent too" edit that silently converts them to the
-# full 6-key whitelist TRIPS here and forces a deliberate decision + a matching
+# full 7-key whitelist TRIPS here and forces a deliberate decision + a matching
 # update to this allowlist.
 
 @test "deviation: install.sh parses exactly {DAAF_DEV, DAAF_PROJECT_NAME}" {
@@ -278,8 +279,8 @@ INSTALL_PS1="${REPO_ROOT}/scripts/host/install.ps1"
 
 @test "parity SELF-TEST: perturbing a .sh copy's whitelist trips the comparison" {
     cp "${REPO_ROOT}/scripts/host/backup_daaf.sh" "${TEST_DIR}/perturbed.sh"
-    # Drop DAAF_BRANCH from the case-arm (a one-key regression).
-    sed -i 's/|DAAF_DEV=\*|DAAF_BRANCH=\*)/|DAAF_DEV=*)/' "${TEST_DIR}/perturbed.sh"
+    # Drop the terminal DAAF_DATA_VOLUME_NAME from the case-arm (a one-key regression).
+    sed -i 's/|DAAF_BRANCH=\*|DAAF_DATA_VOLUME_NAME=\*)/|DAAF_BRANCH=*)/' "${TEST_DIR}/perturbed.sh"
 
     local canon perturbed
     canon="$(extract_sh_whitelist "${DAAF_LIB_SH}")"
@@ -291,17 +292,17 @@ INSTALL_PS1="${REPO_ROOT}/scripts/host/install.ps1"
         echo "${perturbed}"
         return 1
     }
-    # And specifically DAAF_BRANCH must be the key that disappeared.
-    if echo "${perturbed}" | grep -qx 'DAAF_BRANCH'; then
-        echo "SELF-TEST: perturbation failed to remove DAAF_BRANCH (sed anchor stale?)"
+    # And specifically DAAF_DATA_VOLUME_NAME must be the key that disappeared.
+    if echo "${perturbed}" | grep -qx 'DAAF_DATA_VOLUME_NAME'; then
+        echo "SELF-TEST: perturbation failed to remove DAAF_DATA_VOLUME_NAME (sed anchor stale?)"
         return 1
     fi
 }
 
 @test "parity SELF-TEST: perturbing a .ps1 copy's whitelist trips the comparison" {
     cp "${REPO_ROOT}/scripts/host/backup_daaf.ps1" "${TEST_DIR}/perturbed.ps1"
-    # Drop DAAF_BRANCH from the $known array.
-    sed -i "s/, 'DAAF_DEV', 'DAAF_BRANCH')/, 'DAAF_DEV')/" "${TEST_DIR}/perturbed.ps1"
+    # Drop the terminal DAAF_DATA_VOLUME_NAME from the $known array.
+    sed -i "s/, 'DAAF_BRANCH', 'DAAF_DATA_VOLUME_NAME')/, 'DAAF_BRANCH')/" "${TEST_DIR}/perturbed.ps1"
 
     local canon perturbed
     canon="$(extract_ps1_whitelist "${DAAF_LIB_PS1}")"
@@ -312,8 +313,8 @@ INSTALL_PS1="${REPO_ROOT}/scripts/host/install.ps1"
         echo "${perturbed}"
         return 1
     }
-    if echo "${perturbed}" | grep -qx 'DAAF_BRANCH'; then
-        echo "SELF-TEST: perturbation failed to remove DAAF_BRANCH (sed anchor stale?)"
+    if echo "${perturbed}" | grep -qx 'DAAF_DATA_VOLUME_NAME'; then
+        echo "SELF-TEST: perturbation failed to remove DAAF_DATA_VOLUME_NAME (sed anchor stale?)"
         return 1
     fi
 }
diff --git a/tests/bash/start_shim.bats b/tests/bash/start_shim.bats
new file mode 100644
index 00000000..a4745124
--- /dev/null
+++ b/tests/bash/start_shim.bats
@@ -0,0 +1,958 @@
+#!/usr/bin/env bats
+# =============================================================================
+# Deterministic lifecycle tests for scripts/provider_shim/start_shim.sh.
+#
+# Every test stages the manager and a fabricated loopback-only shim under
+# BATS_TEST_TMPDIR. The production process, source, state files, and shim.log are
+# never touched. teardown stops only the staged manager's identity-verified pids,
+# removes any symlink fixture, and deletes the isolated directory.
+# =============================================================================
+
+load 'test_helper'
+
+START_SHIM_SH="${START_SHIM_SH:-${REPO_ROOT}/scripts/provider_shim/start_shim.sh}"
+
+setup() {
+    SHIM_TEST_ROOT="${BATS_TEST_TMPDIR}/provider_shim"
+    mkdir -p "$SHIM_TEST_ROOT"
+    cp "$START_SHIM_SH" "${SHIM_TEST_ROOT}/start_shim.sh"
+    chmod 0755 "${SHIM_TEST_ROOT}/start_shim.sh"
+    MANAGER="${SHIM_TEST_ROOT}/start_shim.sh"
+    LOG_DIR="${SHIM_TEST_ROOT}/logs"
+    LOG_FILE="${LOG_DIR}/shim.log"
+
+    cat > "${SHIM_TEST_ROOT}/anthropic_openai_shim.py" <<'PY'
+#!/usr/bin/env python3
+SHIM_VERSION = "1.2.12"
+
+import json
+import os
+import signal
+import time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+behavior = os.environ.get("FAKE_SHIM_BEHAVIOR", "serve")
+if behavior == "crash":
+    raise SystemExit(int(os.environ.get("FAKE_SHIM_CRASH_CODE", "42")))
+time.sleep(float(os.environ.get("FAKE_SHIM_START_DELAY", "0")))
+
+stopping = False
+
+
+def stop_server(_signum, _frame):
+    global stopping
+    stopping = True
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path != "/health":
+            self.send_response(404)
+            self.end_headers()
+            return
+        raw = os.environ.get("FAKE_HEALTH_RAW")
+        if raw is None:
+            mode = os.environ.get("FAKE_HEALTH_BACKEND_MODE", os.environ.get("SHIM_BACKEND_MODE", "openai"))
+            payload = {
+                "service": os.environ.get("FAKE_HEALTH_SERVICE", "daaf-anthropic-openai-shim"),
+                "status": os.environ.get("FAKE_HEALTH_STATUS", "ok"),
+                "version": os.environ.get("FAKE_HEALTH_VERSION", SHIM_VERSION),
+                "backend_mode": mode,
+                "backend": "https://example.invalid/v1",
+                "codex_home_present": True,
+                "sanitize_tools": True,
+                "reasoning_effort": None,
+                "text_verbosity": "high",
+            }
+            # v1.3.0 (A1-R4): optional auth block, driven by FAKE_HEALTH_AUTH_STATE.
+            auth_state = os.environ.get("FAKE_HEALTH_AUTH_STATE")
+            if auth_state:
+                auth = {"state": auth_state}
+                days = os.environ.get("FAKE_HEALTH_AUTH_DAYS")
+                if days:
+                    auth["days_left"] = json.loads(days)
+                if auth_state not in ("valid", "n/a"):
+                    auth["recovery"] = "codex login --device-auth"
+                payload["auth"] = auth
+            raw = json.dumps(payload)
+        body = raw.encode("utf-8")
+        self.send_response(int(os.environ.get("FAKE_HEALTH_HTTP_STATUS", "200")))
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, _format, *_args):
+        return
+
+
+signal.signal(signal.SIGTERM, stop_server)
+signal.signal(signal.SIGINT, stop_server)
+server = HTTPServer(("127.0.0.1", int(os.environ.get("SHIM_PORT", "4141"))), Handler)
+server.timeout = 0.05
+while not stopping:
+    server.handle_request()
+server.server_close()
+PY
+    chmod 0755 "${SHIM_TEST_ROOT}/anthropic_openai_shim.py"
+
+    SHIM_PORT="$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()')"
+    export SHIM_PORT
+    export DAAF_SHIM_TEST_MODE=1
+    export DAAF_SHIM_TEST_READINESS_WAIT=5
+    export DAAF_SHIM_TEST_RESTART_DELAY=0.2
+    export DAAF_SHIM_TEST_STORM_LIMIT=4
+    export DAAF_SHIM_TEST_STORM_WINDOW=60
+    export START_SHIM_SH MANAGER LOG_DIR LOG_FILE
+    unset FAKE_SHIM_BEHAVIOR FAKE_SHIM_CRASH_CODE FAKE_SHIM_START_DELAY FAKE_HEALTH_RAW
+    unset FAKE_HEALTH_SERVICE FAKE_HEALTH_STATUS FAKE_HEALTH_VERSION
+    unset FAKE_HEALTH_BACKEND_MODE FAKE_HEALTH_HTTP_STATUS DAAF_SHIM_TEST_NO_SETSID
+    unset FAKE_HEALTH_AUTH_STATE FAKE_HEALTH_AUTH_DAYS
+    unset DAAF_SHIM_TEST_STOP_FAILURE DAAF_SHIM_TEST_RESULT_APPEND_FAILURE
+    unset DAAF_SHIM_TEST_SIGNAL_RESULT_IN_PROGRESS SHIM_BACKEND_MODE
+}
+
+teardown() {
+    unset DAAF_SHIM_TEST_STOP_FAILURE DAAF_SHIM_TEST_RESULT_APPEND_FAILURE
+    unset DAAF_SHIM_TEST_SIGNAL_RESULT_IN_PROGRESS
+    if [ -x "${MANAGER:-}" ]; then
+        "$MANAGER" --stop >/dev/null 2>&1 || true
+    fi
+    if [ -n "${EXTERNAL_SERVER_PID:-}" ]; then
+        kill "$EXTERNAL_SERVER_PID" 2>/dev/null || true
+        wait "$EXTERNAL_SERVER_PID" 2>/dev/null || true
+    fi
+    if [ -n "${VICTIM_PID:-}" ]; then
+        kill "$VICTIM_PID" 2>/dev/null || true
+        wait "$VICTIM_PID" 2>/dev/null || true
+    fi
+    if [ -n "${DIRECT_SUPERVISOR_PID:-}" ]; then
+        kill "$DIRECT_SUPERVISOR_PID" 2>/dev/null || true
+        wait "$DIRECT_SUPERVISOR_PID" 2>/dev/null || true
+    fi
+    find "${SHIM_TEST_ROOT:-${BATS_TEST_TMPDIR}}" -type l -delete 2>/dev/null || true
+    rm -rf "${SHIM_TEST_ROOT:-${BATS_TEST_TMPDIR}/provider_shim}"
+}
+
+wait_for_file() {
+    local path="$1" attempts=0
+    while [ "$attempts" -lt 100 ]; do
+        [ -s "$path" ] && return 0
+        sleep 0.05
+        attempts=$((attempts + 1))
+    done
+    return 1
+}
+
+wait_for_log_text() {
+    local text="$1" attempts=0
+    while [ "$attempts" -lt 100 ]; do
+        if [ -f "$LOG_FILE" ] && grep -F "$text" "$LOG_FILE" >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.05
+        attempts=$((attempts + 1))
+    done
+    return 1
+}
+
+wait_for_dead() {
+    local pid="$1" attempts=0
+    while [ "$attempts" -lt 100 ]; do
+        kill -0 "$pid" 2>/dev/null || return 0
+        sleep 0.05
+        attempts=$((attempts + 1))
+    done
+    return 1
+}
+
+wait_for_ready() {
+    local attempts=0
+    while [ "$attempts" -lt 100 ]; do
+        if curl -fsS --max-time 1 "http://127.0.0.1:${SHIM_PORT}/health" 2>/dev/null | \
+            jq -e '.service == "daaf-anthropic-openai-shim" and .status == "ok"' \
+                >/dev/null 2>&1; then
+            return 0
+        fi
+        sleep 0.05
+        attempts=$((attempts + 1))
+    done
+    return 1
+}
+
+count_exact_arg_processes() {
+    local expected="$1" path arg found count=0
+    for path in /proc/[0-9]*/cmdline; do
+        [ -r "$path" ] || continue
+        found=0
+        while IFS= read -r -d '' arg; do
+            if [ "$arg" = "$expected" ]; then
+                found=1
+                break
+            fi
+        done < "$path"
+        [ "$found" -eq 0 ] || count=$((count + 1))
+    done
+    printf '%s\n' "$count"
+}
+
+assert_manager_success() {
+    if [ "$status" -ne 0 ] && [ -f "$LOG_FILE" ]; then
+        printf '%s\n' '--- isolated lifecycle log ---' >&3
+        while IFS= read -r line; do
+            printf '%s\n' "$line" >&3
+        done < "$LOG_FILE"
+    fi
+    assert_success
+}
+
+start_external_fixture() {
+    python3 "${SHIM_TEST_ROOT}/anthropic_openai_shim.py" >/dev/null 2>&1 &
+    EXTERNAL_SERVER_PID=$!
+    export EXTERNAL_SERVER_PID
+    local attempts=0 http_status
+    while [ "$attempts" -lt 100 ]; do
+        http_status="$(curl -sS --max-time 1 --output /dev/null --write-out '%{http_code}' \
+            "http://127.0.0.1:${SHIM_PORT}/health" 2>/dev/null)" || http_status="000"
+        case "$http_status" in
+            [0-9][0-9][0-9]) [ "$http_status" = "000" ] || return 0 ;;
+        esac
+        sleep 0.05
+        attempts=$((attempts + 1))
+    done
+    return 1
+}
+
+# --- Syntax and deterministic rotation --------------------------------------
+
+@test "start_shim.sh parses without errors" {
+    run bash -n "$MANAGER"
+    assert_success
+}
+
+@test "usage and help recognize restart as a public action" {
+    run "$MANAGER" --help
+    assert_success
+    assert_output --partial "--restart"
+    run "$MANAGER" --unknown
+    assert_failure
+    assert_output --partial "--restart"
+}
+
+@test "missing log is created private without rotation" {
+    run "$MANAGER" __rotate_logs
+    assert_success
+    [ -f "$LOG_FILE" ]
+    [ "$(stat -c '%a' "$LOG_FILE")" = "600" ]
+    [ ! -e "${LOG_FILE}.1" ]
+}
+
+@test "existing log at exact 25 MiB boundary does not rotate" {
+    mkdir -p "$LOG_DIR"
+    truncate -s 26214400 "$LOG_FILE"
+    run "$MANAGER" __rotate_logs
+    assert_success
+    [ "$(wc -c < "$LOG_FILE")" -eq 26214400 ]
+    [ ! -e "${LOG_FILE}.1" ]
+    [ "$(stat -c '%a' "$LOG_FILE")" = "600" ]
+}
+
+@test "log one byte over boundary rotates before creating private replacement" {
+    mkdir -p "$LOG_DIR"
+    truncate -s 26214401 "$LOG_FILE"
+    chmod 0644 "$LOG_FILE"
+    run "$MANAGER" __rotate_logs
+    assert_success
+    [ "$(wc -c < "$LOG_FILE")" -eq 0 ]
+    [ "$(wc -c < "${LOG_FILE}.1")" -eq 26214401 ]
+    [ "$(stat -c '%a' "$LOG_FILE")" = "600" ]
+    [ "$(stat -c '%a' "${LOG_FILE}.1")" = "600" ]
+}
+
+@test "over-boundary start rotates before preserving the supervisor first record" {
+    mkdir -p "$LOG_DIR"
+    truncate -s 26214401 "$LOG_FILE"
+    run "$MANAGER" --start
+    assert_manager_success
+    grep -F "SUPERVISOR starting shim" "$LOG_FILE"
+    [ "$(wc -c < "${LOG_FILE}.1")" -eq 26214401 ]
+    run "$MANAGER" --stop
+    assert_success
+}
+
+@test "rotation retains exactly five descending generations" {
+    mkdir -p "$LOG_DIR"
+    truncate -s 26214401 "$LOG_FILE"
+    printf 'old-1\n' > "${LOG_FILE}.1"
+    printf 'old-2\n' > "${LOG_FILE}.2"
+    printf 'old-3\n' > "${LOG_FILE}.3"
+    printf 'old-4\n' > "${LOG_FILE}.4"
+    printf 'old-5-discard\n' > "${LOG_FILE}.5"
+    run "$MANAGER" __rotate_logs
+    assert_success
+    grep -Fx 'old-1' "${LOG_FILE}.2"
+    grep -Fx 'old-2' "${LOG_FILE}.3"
+    grep -Fx 'old-3' "${LOG_FILE}.4"
+    grep -Fx 'old-4' "${LOG_FILE}.5"
+    ! grep -R -F 'old-5-discard' "$LOG_DIR" >/dev/null 2>&1
+    [ ! -e "${LOG_FILE}.6" ]
+}
+
+@test "unsafe symlink log target is rejected without touching its referent" {
+    mkdir -p "$LOG_DIR"
+    local referent="${SHIM_TEST_ROOT}/outside.log"
+    printf 'referent-unchanged\n' > "$referent"
+    ln -s "$referent" "$LOG_FILE"
+    run "$MANAGER" __rotate_logs
+    assert_failure
+    assert_output --partial "refusing unsafe shim state target"
+    grep -Fx 'referent-unchanged' "$referent"
+    [ -L "$LOG_FILE" ]
+}
+
+@test "unsafe symlink generation is rejected before current log mutation" {
+    mkdir -p "$LOG_DIR"
+    truncate -s 26214401 "$LOG_FILE"
+    local referent="${SHIM_TEST_ROOT}/generation-referent.log"
+    printf 'generation-referent\n' > "$referent"
+    ln -s "$referent" "${LOG_FILE}.3"
+    run "$MANAGER" __rotate_logs
+    assert_failure
+    [ "$(wc -c < "$LOG_FILE")" -eq 26214401 ]
+    grep -Fx 'generation-referent' "$referent"
+}
+
+# --- Strict readiness -------------------------------------------------------
+
+@test "cleanly stopped status exits zero without launching a process" {
+    run "$MANAGER" --status
+    assert_success
+    assert_output "STATUS: stopped"
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ "$(count_exact_arg_processes "$MANAGER")" -eq 0 ]
+    [ ! -e "${LOG_DIR}/supervisor.pid" ]
+    [ ! -e "${LOG_DIR}/shim.pid" ]
+}
+
+@test "strict readiness accepts exact identity version normalized mode and status" {
+    export SHIM_BACKEND_MODE=' ChatGPT '
+    export FAKE_HEALTH_BACKEND_MODE=chatgpt
+    run "$MANAGER" --start
+    assert_manager_success
+    assert_output --partial "strictly ready"
+    run "$MANAGER" --status
+    assert_success
+    assert_output --partial '"service": "daaf-anthropic-openai-shim"'
+    assert_output --partial '"version": "1.2.12"'
+    assert_output --partial '"backend_mode": "chatgpt"'
+}
+
+@test "readiness renders an expiring auth warning naming the recovery command" {
+    export SHIM_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_AUTH_STATE=expiring
+    export FAKE_HEALTH_AUTH_DAYS=1.5
+    run "$MANAGER" --start
+    assert_manager_success
+    assert_output --partial "strictly ready"
+    assert_output --partial "ChatGPT subscription auth expires in 1.5 days"
+    assert_output --partial "codex login --device-auth"
+    # The same line is surfaced by --status.
+    run "$MANAGER" --status
+    assert_success
+    assert_output --partial "expires in 1.5 days"
+    assert_output --partial "codex login --device-auth"
+}
+
+@test "readiness renders a dead auth warning for expired absent and unreadable" {
+    export SHIM_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_AUTH_STATE=expired
+    run "$MANAGER" --start
+    assert_manager_success
+    assert_output --partial "ChatGPT subscription auth is dead (expired)"
+    assert_output --partial "codex login --device-auth"
+}
+
+@test "a valid auth state prints an informational line without a warning" {
+    export SHIM_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_BACKEND_MODE=chatgpt
+    export FAKE_HEALTH_AUTH_STATE=valid
+    export FAKE_HEALTH_AUTH_DAYS=280
+    run "$MANAGER" --start
+    assert_manager_success
+    run "$MANAGER" --status
+    assert_success
+    assert_output --partial "ChatGPT subscription auth is valid (expires in 280 days)"
+    refute_output --partial "codex login --device-auth"
+    refute_output --partial "is dead"
+}
+
+@test "the openai lane emits no auth line" {
+    export SHIM_BACKEND_MODE=openai
+    export FAKE_HEALTH_AUTH_STATE=n/a
+    run "$MANAGER" --start
+    assert_manager_success
+    run "$MANAGER" --status
+    assert_success
+    refute_output --partial "ChatGPT subscription auth"
+    refute_output --partial "codex login --device-auth"
+}
+
+@test "auth line sanitizes an injecting days value into a bounded token" {
+    export SHIM_BACKEND_MODE=chatgpt
+    # A /health body whose auth.days_left carries an embedded newline + shell
+    # metacharacters (a forged-line / injection attempt). print_auth_line strips it
+    # to the bounded [0-9.-] token before output (the D4 injection convention), so no
+    # forged line and no metacharacters reach the terminal. The `\n` is a JSON string
+    # escape that jq -r decodes to a real newline in the shell value.
+    export FAKE_HEALTH_RAW='{"service":"daaf-anthropic-openai-shim","status":"ok","version":"1.2.12","backend_mode":"chatgpt","backend":"x","codex_home_present":true,"sanitize_tools":true,"reasoning_effort":null,"text_verbosity":"high","auth":{"state":"expiring","days_left":"2\nFORGED: fake auth line rm -rf slash"}}'
+    # Drive the readiness path (not --status, which additionally dumps the raw HEALTH
+    # JSON): the only auth output here is print_auth_line's own sanitized line.
+    run "$MANAGER" --start
+    assert_manager_success
+    assert_output --partial "expires in 2"
+    refute_output --partial "FORGED"
+    refute_output --partial "rm -rf"
+}
+
+@test "non-200 health response is reachable unexpected and blocks manager launch" {
+    export FAKE_HEALTH_HTTP_STATUS=404
+    start_external_fixture
+
+    run "$MANAGER" --start
+
+    assert_failure
+    assert_output --partial "port ${SHIM_PORT} answered /health"
+    assert_output --partial "reason=http_status_404"
+    refute_output --partial "reason=unreachable"
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 1 ]
+    [ "$(count_exact_arg_processes "$MANAGER")" -eq 0 ]
+    [ ! -e "${LOG_DIR}/supervisor.pid" ]
+    [ ! -e "${LOG_DIR}/shim.pid" ]
+}
+
+@test "malformed JSON wrong identity wrong version and wrong mode are rejected" {
+    local name
+    for name in malformed identity version mode; do
+        unset FAKE_HEALTH_RAW FAKE_HEALTH_SERVICE FAKE_HEALTH_VERSION FAKE_HEALTH_BACKEND_MODE
+        case "$name" in
+            malformed) export FAKE_HEALTH_RAW='{not-json' ;;
+            identity) export FAKE_HEALTH_SERVICE='unrelated-service' ;;
+            version) export FAKE_HEALTH_VERSION='1.2.11' ;;
+            mode) export FAKE_HEALTH_BACKEND_MODE='chatgpt' ;;
+        esac
+        start_external_fixture
+        run "$MANAGER" --start
+        assert_failure
+        assert_output --partial "SHIM_READINESS_FAILURE status=failed"
+        case "$name" in
+            malformed) assert_output --partial "reason=malformed_json" ;;
+            identity) assert_output --partial "reason=wrong_identity_or_status" ;;
+            version) assert_output --partial "reason=version_mismatch" ;;
+            mode) assert_output --partial "reason=backend_mode_mismatch" ;;
+        esac
+        kill "$EXTERNAL_SERVER_PID" 2>/dev/null || true
+        wait "$EXTERNAL_SERVER_PID" 2>/dev/null || true
+        EXTERNAL_SERVER_PID=""
+    done
+}
+
+@test "auto remains boot-nonfatal but emits machine-readable readiness failure" {
+    export DAAF_PROVIDER_SHIM=openai
+    export FAKE_HEALTH_SERVICE=unrelated-service
+    start_external_fixture
+    run "$MANAGER" --auto
+    assert_success
+    assert_output --partial "SHIM_READINESS_FAILURE status=failed"
+    assert_output --partial "SHIM_AUTO_FAILURE status=failed"
+    [ "$(grep -c 'MANAGER SHIM_AUTO_FAILURE status=failed' "$LOG_FILE")" -eq 1 ]
+}
+
+@test "auto remains nonblocking while a restart owns the lifecycle lock" {
+    run "$MANAGER" --start
+    assert_manager_success
+    export DAAF_PROVIDER_SHIM=openai
+    export FAKE_SHIM_START_DELAY=5
+    export DAAF_SHIM_TEST_READINESS_WAIT=10
+    local restart_pid before after
+
+    "$MANAGER" --restart > "${SHIM_TEST_ROOT}/restart-for-auto.out" 2>&1 &
+    restart_pid=$!
+    wait_for_log_text "MANAGER SHIM_RESTART_BEGIN status=begin"
+    before="$(date +%s)"
+    run "$MANAGER" --auto
+    after="$(date +%s)"
+
+    assert_success
+    assert_output --partial "SHIM_AUTO_FAILURE status=failed"
+    [ $((after - before)) -lt 3 ]
+    wait "$restart_pid"
+    wait_for_ready
+}
+
+# --- Process identity, idempotency, restart, and stop -----------------------
+
+@test "restart replaces a running-ready generation and passes strict readiness" {
+    run "$MANAGER" --start
+    assert_manager_success
+    local old_sp old_pp new_sp new_pp
+    old_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    old_pp="$(< "${LOG_DIR}/shim.pid")"
+
+    run "$MANAGER" --restart
+    assert_manager_success
+    assert_output --partial "SHIM_RESTART_BEGIN status=begin prior=running_ready"
+    assert_output --partial "SHIM_RESTART_RESULT status=ready stage=readiness reason=ready exit_code=0"
+    assert_output --partial "Shim restarted and strictly ready"
+    new_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    new_pp="$(< "${LOG_DIR}/shim.pid")"
+    [ "$old_sp" != "$new_sp" ]
+    [ "$old_pp" != "$new_pp" ]
+    wait_for_dead "$old_sp"
+    wait_for_dead "$old_pp"
+    wait_for_ready
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 1 ]
+}
+
+@test "restart starts a stopped daemon and passes strict readiness" {
+    run "$MANAGER" --restart
+    assert_manager_success
+    assert_output --partial "SHIM_RESTART_BEGIN status=begin prior=stopped"
+    assert_output --partial "SHIM_RESTART_RESULT status=ready"
+    wait_for_ready
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 1 ]
+}
+
+@test "restart recovers stale state without signaling an unrelated process" {
+    mkdir -p "$LOG_DIR"
+    sleep 30 &
+    VICTIM_PID=$!
+    export VICTIM_PID
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/shim.pid"
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/supervisor.pid"
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/pgid"
+
+    run "$MANAGER" --restart
+    assert_manager_success
+    kill -0 "$VICTIM_PID"
+    wait_for_ready
+    [ "$(< "${LOG_DIR}/supervisor.pid")" != "$VICTIM_PID" ]
+    [ "$(< "${LOG_DIR}/shim.pid")" != "$VICTIM_PID" ]
+}
+
+@test "restart stop failure is explicit and never emits false readiness" {
+    run "$MANAGER" --start
+    assert_manager_success
+    local old_sp old_pp
+    old_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    old_pp="$(< "${LOG_DIR}/shim.pid")"
+    export DAAF_SHIM_TEST_STOP_FAILURE=1
+
+    run "$MANAGER" --restart
+    [ "$status" -eq 40 ]
+    assert_output --partial "SHIM_RESTART_RESULT status=failed stage=stop reason=termination_failed exit_code=40"
+    refute_output --partial "SHIM_RESTART_RESULT status=ready"
+    kill -0 "$old_sp"
+    kill -0 "$old_pp"
+    [ "$(grep -c 'MANAGER SHIM_RESTART_BEGIN status=begin' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT status=failed stage=stop' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT status=ready' "$LOG_FILE" || true)" -eq 0 ]
+}
+
+@test "restart launch failure after stop is explicit and leaves no orphan" {
+    run "$MANAGER" --start
+    assert_manager_success
+    local old_sp old_pp
+    old_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    old_pp="$(< "${LOG_DIR}/shim.pid")"
+    export FAKE_SHIM_BEHAVIOR=crash
+    export DAAF_SHIM_TEST_STORM_LIMIT=2
+    export DAAF_SHIM_TEST_RESTART_DELAY=0.05
+    export DAAF_SHIM_TEST_READINESS_WAIT=3
+
+    run "$MANAGER" --restart
+    [ "$status" -eq 41 ]
+    assert_output --partial "SHIM_RESTART_RESULT status=failed stage=launch reason=launch_failed exit_code=41"
+    refute_output --partial "SHIM_RESTART_RESULT status=ready"
+    wait_for_dead "$old_sp"
+    wait_for_dead "$old_pp"
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ "$(count_exact_arg_processes "$MANAGER")" -eq 0 ]
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+    [ ! -s "${LOG_DIR}/shim.pid" ]
+}
+
+@test "restart readiness failure after stop is explicit and leaves no orphan" {
+    run "$MANAGER" --start
+    assert_manager_success
+    export FAKE_HEALTH_STATUS=starting
+    export DAAF_SHIM_TEST_READINESS_WAIT=3
+
+    run "$MANAGER" --restart
+    [ "$status" -eq 42 ]
+    assert_output --partial "SHIM_RESTART_RESULT status=failed stage=readiness reason=strict_readiness_failed exit_code=42"
+    refute_output --partial "SHIM_RESTART_RESULT status=ready"
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ "$(count_exact_arg_processes "$MANAGER")" -eq 0 ]
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+    [ ! -s "${LOG_DIR}/shim.pid" ]
+}
+
+@test "restart result append failure exits 43 without a false persisted record" {
+    export DAAF_SHIM_TEST_RESULT_APPEND_FAILURE=1
+
+    run "$MANAGER" --restart
+
+    [ "$status" -eq 43 ]
+    assert_output --partial "SHIM_RESTART_RESULT status=failed stage=record reason=manager_log_write exit_code=43"
+    assert_output --partial "record_persisted=no"
+    refute_output --partial "record_persisted=unknown"
+    [ "$(grep -c 'MANAGER SHIM_RESTART_BEGIN status=begin' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT' "$LOG_FILE" || true)" -eq 0 ]
+}
+
+@test "signal during restart result persistence exits 130 without deadlock or orphan" {
+    export DAAF_SHIM_TEST_SIGNAL_RESULT_IN_PROGRESS=1
+
+    run timeout 15 "$MANAGER" --restart
+
+    [ "$status" -eq 130 ]
+    assert_output --partial "SHIM_RESTART_RESULT status=failed stage=record reason=write_interrupted exit_code=130"
+    assert_output --partial "record_persisted=unknown"
+    refute_output --partial "record_persisted=no"
+    [ "$(grep -c 'MANAGER SHIM_RESTART_BEGIN status=begin' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT' "$LOG_FILE" || true)" -eq 0 ]
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ "$(count_exact_arg_processes "$MANAGER")" -eq 0 ]
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+    [ ! -s "${LOG_DIR}/shim.pid" ]
+}
+
+@test "interrupted restart never emits success and leaves a truthful stopped state" {
+    run "$MANAGER" --start
+    assert_manager_success
+    local old_sp old_pp restart_pid restart_rc=0
+    old_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    old_pp="$(< "${LOG_DIR}/shim.pid")"
+    export FAKE_SHIM_START_DELAY=10
+    export DAAF_SHIM_TEST_READINESS_WAIT=20
+
+    "$MANAGER" --restart > "${SHIM_TEST_ROOT}/restart-interrupt.out" 2>&1 &
+    restart_pid=$!
+    wait_for_log_text "MANAGER SHIM_RESTART_BEGIN status=begin"
+    wait_for_dead "$old_sp"
+    wait_for_dead "$old_pp"
+    kill -TERM "$restart_pid"
+    wait "$restart_pid" || restart_rc=$?
+
+    [ "$restart_rc" -eq 130 ]
+    grep -F "SHIM_RESTART_RESULT status=failed stage=interrupt reason=signal_TERM exit_code=130" \
+        "${SHIM_TEST_ROOT}/restart-interrupt.out"
+    ! grep -F "SHIM_RESTART_RESULT status=ready" "${SHIM_TEST_ROOT}/restart-interrupt.out"
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+    [ ! -s "${LOG_DIR}/shim.pid" ]
+}
+
+@test "restart records are exactly once and supervisor records are not duplicated" {
+    run "$MANAGER" --start
+    assert_manager_success
+    run "$MANAGER" --restart
+    assert_manager_success
+    [ "$(grep -c 'MANAGER SHIM_RESTART_BEGIN status=begin' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT status=ready' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'SUPERVISOR starting shim' "$LOG_FILE")" -eq 2 ]
+    [ "$(grep -c 'SUPERVISOR supervisor exiting' "$LOG_FILE")" -eq 1 ]
+}
+
+@test "concurrent restart and start serialize without duplicate daemons" {
+    run "$MANAGER" --start
+    assert_manager_success
+    export FAKE_SHIM_START_DELAY=0.5
+    local restart_pid start_pid
+
+    "$MANAGER" --restart > "${SHIM_TEST_ROOT}/restart.out" 2>&1 &
+    restart_pid=$!
+    wait_for_log_text "MANAGER SHIM_RESTART_BEGIN status=begin"
+    "$MANAGER" --start > "${SHIM_TEST_ROOT}/start.out" 2>&1 &
+    start_pid=$!
+    wait "$restart_pid"
+    wait "$start_pid"
+
+    wait_for_ready
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT status=ready' "$LOG_FILE")" -eq 1 ]
+    grep -F "Shim already running and strictly ready" "${SHIM_TEST_ROOT}/start.out"
+}
+
+@test "concurrent restarts serialize without duplicate daemons" {
+    run "$MANAGER" --start
+    assert_manager_success
+    export FAKE_SHIM_START_DELAY=0.5
+    local first_pid second_pid
+
+    "$MANAGER" --restart > "${SHIM_TEST_ROOT}/restart-first.out" 2>&1 &
+    first_pid=$!
+    wait_for_log_text "MANAGER SHIM_RESTART_BEGIN status=begin"
+    "$MANAGER" --restart > "${SHIM_TEST_ROOT}/restart-second.out" 2>&1 &
+    second_pid=$!
+    wait "$first_pid"
+    wait "$second_pid"
+
+    wait_for_ready
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 1 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_BEGIN status=begin' "$LOG_FILE")" -eq 2 ]
+    [ "$(grep -c 'MANAGER SHIM_RESTART_RESULT status=ready' "$LOG_FILE")" -eq 2 ]
+    [ "$(grep -c 'SUPERVISOR starting shim' "$LOG_FILE")" -eq 3 ]
+}
+
+@test "stale PID and PGID files never signal an unrelated live process" {
+    mkdir -p "$LOG_DIR"
+    sleep 30 &
+    VICTIM_PID=$!
+    export VICTIM_PID
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/shim.pid"
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/supervisor.pid"
+    printf '%s\n' "$VICTIM_PID" > "${LOG_DIR}/pgid"
+    run "$MANAGER" --stop
+    assert_success
+    assert_output --partial "was not running"
+    kill -0 "$VICTIM_PID"
+    [ ! -e "${LOG_DIR}/shim.pid" ]
+    [ ! -e "${LOG_DIR}/supervisor.pid" ]
+    [ ! -e "${LOG_DIR}/pgid" ]
+}
+
+@test "duplicate starts preserve one supervisor and one start record" {
+    run "$MANAGER" --start
+    assert_success
+    wait_for_file "${LOG_DIR}/supervisor.pid"
+    local first second
+    first="$(< "${LOG_DIR}/supervisor.pid")"
+    run "$MANAGER" --start
+    assert_success
+    second="$(< "${LOG_DIR}/supervisor.pid")"
+    [ "$first" = "$second" ]
+    [ "$(grep -c 'SUPERVISOR starting shim' "$LOG_FILE")" -eq 1 ]
+}
+
+@test "supervisor records are single-write rather than tee-duplicated" {
+    run "$MANAGER" --start
+    assert_success
+    run "$MANAGER" --stop
+    assert_success
+    [ "$(grep -c 'SUPERVISOR starting shim' "$LOG_FILE")" -eq 1 ]
+    [ "$(grep -c 'SUPERVISOR supervisor exiting' "$LOG_FILE")" -eq 1 ]
+}
+
+@test "crash storm stops after deterministic limit and leaves no live supervisor" {
+    export FAKE_SHIM_BEHAVIOR=crash
+    export FAKE_SHIM_CRASH_CODE=42
+    export DAAF_SHIM_TEST_STORM_LIMIT=3
+    export DAAF_SHIM_TEST_RESTART_DELAY=0.05
+    export DAAF_SHIM_TEST_READINESS_WAIT=3
+    run "$MANAGER" --start
+    assert_failure
+    wait_for_log_text "RESTART_STORM"
+    [ "$(grep -c 'shim exited rc=42' "$LOG_FILE")" -eq 3 ]
+    grep -F 'RESTART_STORM crashes=3' "$LOG_FILE"
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+}
+
+@test "stop interrupts supervisor restart sleep promptly" {
+    export FAKE_SHIM_BEHAVIOR=crash
+    export DAAF_SHIM_TEST_RESTART_DELAY=20
+    mkdir -p "$LOG_DIR"
+    setsid "$MANAGER" __supervise >> "$LOG_FILE" 2>&1 &
+    DIRECT_SUPERVISOR_PID=$!
+    export DIRECT_SUPERVISOR_PID
+    wait_for_log_text "shim exited rc=42"
+    local before after
+    before="$(date +%s)"
+    run "$MANAGER" --stop
+    assert_success
+    after="$(date +%s)"
+    [ $((after - before)) -lt 5 ]
+    wait_for_dead "$DIRECT_SUPERVISOR_PID"
+    DIRECT_SUPERVISOR_PID=""
+}
+
+@test "stop leaves no supervisor or shim child orphan" {
+    run "$MANAGER" --start
+    assert_success
+    wait_for_file "${LOG_DIR}/supervisor.pid"
+    wait_for_file "${LOG_DIR}/shim.pid"
+    local sp pp
+    sp="$(< "${LOG_DIR}/supervisor.pid")"
+    pp="$(< "${LOG_DIR}/shim.pid")"
+    run "$MANAGER" --stop
+    assert_success
+    wait_for_dead "$sp"
+    wait_for_dead "$pp"
+    [ ! -e "${LOG_DIR}/supervisor.pid" ]
+    [ ! -e "${LOG_DIR}/shim.pid" ]
+    [ ! -e "${LOG_DIR}/pgid" ]
+}
+
+@test "no-setsid fallback restarts safely without a broad PGID" {
+    export DAAF_SHIM_TEST_NO_SETSID=1
+    run "$MANAGER" --start
+    assert_success
+    wait_for_file "${LOG_DIR}/supervisor.pid"
+    wait_for_file "${LOG_DIR}/shim.pid"
+    local old_sp old_pp new_sp new_pp
+    old_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    old_pp="$(< "${LOG_DIR}/shim.pid")"
+    [ ! -e "${LOG_DIR}/pgid" ]
+
+    run "$MANAGER" --restart
+    assert_manager_success
+    new_sp="$(< "${LOG_DIR}/supervisor.pid")"
+    new_pp="$(< "${LOG_DIR}/shim.pid")"
+    [ "$old_sp" != "$new_sp" ]
+    [ "$old_pp" != "$new_pp" ]
+    [ ! -e "${LOG_DIR}/pgid" ]
+    wait_for_dead "$old_sp"
+    wait_for_dead "$old_pp"
+
+    run "$MANAGER" --stop
+    assert_success
+    wait_for_dead "$new_sp"
+    wait_for_dead "$new_pp"
+    [ "$(grep -c 'process-group isolation unavailable' "$LOG_FILE")" -eq 2 ]
+}
+
+# --- D3: lifecycle status honesty (supervisor.state) ------------------------
+
+@test "status reports a restart-storm give-up distinctly from a clean stop" {
+    # Drive the supervisor directly (as at boot via --auto), so no foreground
+    # manager is watching to run its post-failure cleanup. This is the scenario
+    # the give-up marker exists for: a detached supervisor that exhausts its
+    # storm budget long after launch, with nobody to observe the failure live.
+    export FAKE_SHIM_BEHAVIOR=crash
+    export FAKE_SHIM_CRASH_CODE=42
+    export DAAF_SHIM_TEST_STORM_LIMIT=3
+    export DAAF_SHIM_TEST_RESTART_DELAY=0.05
+    mkdir -p "$LOG_DIR"
+    setsid "$MANAGER" __supervise >> "$LOG_FILE" 2>&1 &
+    DIRECT_SUPERVISOR_PID=$!
+    export DIRECT_SUPERVISOR_PID
+    wait_for_log_text "RESTART_STORM"
+    wait_for_log_text "supervisor exiting"
+    wait_for_dead "$DIRECT_SUPERVISOR_PID"
+    DIRECT_SUPERVISOR_PID=""
+
+    # The give-up record persists after the supervisor exits and removes its pids.
+    run cat "${LOG_DIR}/supervisor.state"
+    assert_output --partial "gave_up_storm"
+    [ ! -s "${LOG_DIR}/supervisor.pid" ]
+
+    run "$MANAGER" --status
+    assert_success
+    assert_output --partial "STATUS: stopped (supervisor gave up after restart storm at "
+}
+
+@test "supervisor.state records running across start and restart and is cleaned on stop" {
+    run "$MANAGER" --start
+    assert_manager_success
+    wait_for_file "${LOG_DIR}/supervisor.state"
+    run cat "${LOG_DIR}/supervisor.state"
+    assert_output --partial "running"
+    [ "$(stat -c '%a' "${LOG_DIR}/supervisor.state")" = "600" ]
+
+    run "$MANAGER" --restart
+    assert_manager_success
+    wait_for_ready
+    [ -f "${LOG_DIR}/supervisor.state" ]
+    run cat "${LOG_DIR}/supervisor.state"
+    assert_output --partial "running"
+
+    run "$MANAGER" --stop
+    assert_success
+    [ ! -e "${LOG_DIR}/supervisor.state" ]
+
+    # A clean stop is indistinguishable from never-started: plain "stopped".
+    run "$MANAGER" --status
+    assert_success
+    assert_output "STATUS: stopped"
+}
+
+@test "unsafe symlink supervisor.state target is rejected by lifecycle preflight" {
+    mkdir -p "$LOG_DIR"
+    local referent="${SHIM_TEST_ROOT}/state-referent"
+    printf 'state-referent-unchanged\n' > "$referent"
+    ln -s "$referent" "${LOG_DIR}/supervisor.state"
+    run "$MANAGER" __rotate_logs
+    assert_failure
+    assert_output --partial "refusing unsafe shim state target"
+    grep -Fx 'state-referent-unchanged' "$referent"
+    [ -L "${LOG_DIR}/supervisor.state" ]
+}
+
+@test "unsafe symlink quota_state.json target is rejected by lifecycle preflight" {
+    # v1.3.3 (A2-R7): quota_state.json — a shim-written install-shared state file —
+    # is now in state_targets_are_safe()'s hijack checklist. A symlink must be
+    # refused without touching its referent.
+    mkdir -p "$LOG_DIR"
+    local referent="${SHIM_TEST_ROOT}/quota-referent"
+    printf 'quota-referent-unchanged\n' > "$referent"
+    ln -s "$referent" "${LOG_DIR}/quota_state.json"
+    run "$MANAGER" __rotate_logs
+    assert_failure
+    assert_output --partial "refusing unsafe shim state target"
+    grep -Fx 'quota-referent-unchanged' "$referent"
+    [ -L "${LOG_DIR}/quota_state.json" ]
+}
+
+@test "non-regular quota_state.json target is rejected by lifecycle preflight" {
+    # The named-target check refuses any existing non-regular file, not just
+    # symlinks; a directory planted at the quota_state.json path is rejected.
+    mkdir -p "$LOG_DIR"
+    mkdir "${LOG_DIR}/quota_state.json"
+    run "$MANAGER" __rotate_logs
+    assert_failure
+    assert_output --partial "refusing unsafe shim state target"
+    [ -d "${LOG_DIR}/quota_state.json" ]
+}
+
+# --- D4: --auto config footgun ----------------------------------------------
+
+@test "auto warns and stays boot-safe on an unrecognized DAAF_PROVIDER_SHIM value" {
+    export DAAF_PROVIDER_SHIM=chatgpt
+    run "$MANAGER" --auto
+    assert_success
+    assert_output --partial "WARNING: DAAF_PROVIDER_SHIM=chatgpt is not a recognized"
+    assert_output --partial 'accepted value is "openai"'
+    assert_output --partial "SHIM_AUTO_SKIPPED status=skipped reason=unrecognized_provider_shim observed=chatgpt accepted=openai"
+    [ "$(grep -c 'MANAGER SHIM_AUTO_SKIPPED status=skipped' "$LOG_FILE")" -eq 1 ]
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+    [ ! -e "${LOG_DIR}/supervisor.pid" ]
+}
+
+@test "auto sanitizes an injecting DAAF_PROVIDER_SHIM value into a single log token" {
+    export DAAF_PROVIDER_SHIM='chatgpt bogus'
+    run "$MANAGER" --auto
+    assert_success
+    # The space is neutralized so the value cannot forge a second log field.
+    assert_output --partial "observed=chatgpt_bogus accepted=openai"
+    [ "$(grep -c 'MANAGER SHIM_AUTO_SKIPPED status=skipped' "$LOG_FILE")" -eq 1 ]
+}
+
+@test "auto is a silent no-op when DAAF_PROVIDER_SHIM is unset" {
+    unset DAAF_PROVIDER_SHIM
+    run "$MANAGER" --auto
+    assert_success
+    assert_output ""
+    [ ! -e "$LOG_FILE" ]
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+}
+
+@test "auto is a silent no-op when DAAF_PROVIDER_SHIM is empty" {
+    export DAAF_PROVIDER_SHIM=""
+    run "$MANAGER" --auto
+    assert_success
+    assert_output ""
+    [ ! -e "$LOG_FILE" ]
+    [ "$(count_exact_arg_processes "${SHIM_TEST_ROOT}/anthropic_openai_shim.py")" -eq 0 ]
+}
diff --git a/tests/bash/subagent_bar.bats b/tests/bash/subagent_bar.bats
index c142cfb9..8407e6a2 100755
--- a/tests/bash/subagent_bar.bats
+++ b/tests/bash/subagent_bar.bats
@@ -35,6 +35,11 @@ COLOR_ELEVATED="38;5;179m"
 COLOR_HIGH="1;38;5;173m"
 COLOR_CRITICAL="38;5;167m"
 
+# jq -Rsc encodes a real ESC byte as the 6-char text ESC. Trusted colors emit
+# ESC[ (CSI); an injected OSC would emit ESC] . Build the encoded OSC
+# introducer at runtime (avoids embedding a raw ESC or a \u escape in the source).
+OSC_ENC=$(printf '\033]' | jq -Rsc . | tr -d '"')
+
 # /tmp caches this script reads for FAKE_SESSION (cleaned each test). The
 # per-subagent model cache uses a task-id suffix; tests that seed it build the
 # exact path from their task id.
@@ -755,3 +760,214 @@ _append_subbar_model() {
     assert_success
     assert_output --partial '"id":"t1"'
 }
+
+# =========================================================================
+# HARDENING — Convention 1: terminal-escape-safe rendering (Finding 1)
+# -------------------------------------------------------------------------
+# Colors are now $'…' (real ESC in trusted constants) and the final render is
+# printf '%s' (not '%b'). Untrusted fields are control-stripped: the main-payload
+# clean() (all C0+DEL), the agentType sidecar read, and the resolved task_model.
+# jq -Rsc encodes trusted color ESC as ESC[…; an INJECTED ESC/OSC would appear
+# as ESC] (OSC) or as a raw ESC byte — both must be absent from output.
+# =========================================================================
+
+# Single-task payload with a jq-injected description expression.
+# $1 = task id, $2 = jq expression producing the description string.
+_payload_desc() {
+    jq -nc --arg sid "$FAKE_SESSION" --arg tp "${TEST_DIR}/main.jsonl" \
+        "{session_id:\$sid,transcript_path:\$tp,tasks:[{id:\"$1\",type:\"local_agent\",status:\"running\",description:($2),tokenCount:80000}]}"
+}
+
+@test "C1: injected ESC/BEL in a display field are stripped; printable backslash stays literal; trusted color survives" {
+    _seed_window 200000
+    _seed_session_model "claude-sonnet-4-6"
+    _seed_task_model "t1" "claude-sonnet-4-6"
+    local esc bel
+    esc=$(printf '\033')
+    bel=$(printf '\007')
+    # description parses to: A <ESC> ]0;pwn <BEL> B\033C  ("\\033" is a printable
+    # backslash sequence, NOT a control byte).
+    run bash "$SUBAGENT_BAR_SH" < <(_payload_desc "t1" '"A"+([27]|implode)+"]0;pwn"+([7]|implode)+"B\\033C"')
+    assert_success
+    # trusted color CSI (ELEVATED amber, 40%) survives, encoded as ESC[38;5;179m
+    assert_output --partial "$COLOR_ELEVATED"
+    # injected ESC/BEL removed: no encoded OSC introducer, no raw control bytes
+    refute_output --partial "$OSC_ENC"
+    refute_output --partial "$esc"
+    refute_output --partial "$bel"
+    # JSON-encoding ALONE would not neutralize a materialized escape; the %b->%s
+    # fix keeps the printable backslash literal (encoded as \\033), never an ESC.
+    assert_output --partial '\\033'
+}
+
+@test "C1: raw control bytes from a hostile model cache are stripped before display" {
+    # The bare model cache is read with cat (bypasses jq), so it is the one path
+    # that can carry raw C0/DEL bytes into task_model. The bash strip removes them.
+    _seed_window 200000
+    _seed_session_model "claude-sonnet-4-6"
+    jq -rn '"g"+([27]|implode)+"]0;X"+([7]|implode)+"-5.6-sol"' \
+        > "/tmp/claude-subagent-model-${FAKE_SESSION}-c1"
+    local esc bel
+    esc=$(printf '\033')
+    bel=$(printf '\007')
+    run bash "$SUBAGENT_BAR_SH" < <(_payload_one_task "c1" 50000)
+    assert_success
+    refute_output --partial "$esc"
+    refute_output --partial "$bel"
+    refute_output --partial "$OSC_ENC"
+    # harmless text remainder survives, sans the control bytes
+    assert_output --partial 'g]0;X-5.6-sol'
+}
+
+# =========================================================================
+# HARDENING — Convention 2: identifier allowlist before path construction (Finding 2)
+# =========================================================================
+
+@test "C2: path-unsafe and mistyped ids are omitted (no row emitted)" {
+    _seed_window 200000
+    local idexpr
+    # traversal, slash, leading dash, embedded newline, JSON number, JSON object
+    for idexpr in '"../evil"' '"a/b"' '"-lead"' '("a"+([10]|implode)+"b")' '123' '{"k":1}'; do
+        run bash "$SUBAGENT_BAR_SH" < <(jq -nc --arg sid "$FAKE_SESSION" \
+            "{session_id:\$sid,transcript_path:\"x\",tasks:[{id:($idexpr),type:\"local_agent\",status:\"running\",tokenCount:50000}]}")
+        assert_success
+        refute_output --partial '"content"'
+    done
+}
+
+@test "C2: id length boundary — 128 chars renders, 129 chars omitted" {
+    _seed_window 200000
+    local id128 id129
+    id128=$(printf 'a%.0s' {1..128})
+    id129=$(printf 'a%.0s' {1..129})
+    run bash "$SUBAGENT_BAR_SH" < <(jq -nc --arg sid "$FAKE_SESSION" --arg id "$id128" \
+        '{session_id:$sid,transcript_path:"x",tasks:[{id:$id,type:"local_agent",status:"running",tokenCount:50000}]}')
+    assert_success
+    assert_output --partial '"content"'
+    run bash "$SUBAGENT_BAR_SH" < <(jq -nc --arg sid "$FAKE_SESSION" --arg id "$id129" \
+        '{session_id:$sid,transcript_path:"x",tasks:[{id:$id,type:"local_agent",status:"running",tokenCount:50000}]}')
+    assert_success
+    refute_output --partial '"content"'
+}
+
+@test "C2: unsafe session_id is blanked but rows still render (fail-open, no session path built)" {
+    _seed_window 200000
+    run bash "$SUBAGENT_BAR_SH" < <(jq -nc \
+        '{session_id:"a/b/../etc",transcript_path:"x",tasks:[{id:"t1",type:"local_agent",status:"running",tokenCount:50000}]}')
+    assert_success
+    assert_output --partial '"id":"t1"'
+}
+
+# =========================================================================
+# HARDENING — Convention 3: closed-set flagship classifier grammar (Finding 4)
+# -------------------------------------------------------------------------
+# Existing tests 39-41 cover the accept side + left-boundary/gpt-5.60 rejects.
+# This adds the RIGHT-boundary malformed rejects that the old open-ended globs
+# (gpt-5.6[-\[]*) wrongly mapped into the 1.05M physical window.
+# =========================================================================
+
+@test "C3: malformed flagship-looking slugs do NOT get the 1.05M window" {
+    local model
+    for model in gpt-5.6-experimental 'gpt-5.6-sol[1m]x' gpt-5.4- gpt-5.4x 'gpt-5.5[1m' gpt-5.60; do
+        _clean_subbar_caches
+        _seed_window 1000000
+        _seed_session_model "claude-fable-5"
+        _seed_task_model "t1" "$model"
+        run bash "$SUBAGENT_BAR_SH" < <(_payload_one_task "t1" 90000)
+        assert_success
+        # The Finding-4 invariant: NONE may map to the 1,050,000 flagship window
+        # (90k/1.05M = 8%). They land on a conservative window instead — 200k -> 45%,
+        # or the pre-existing generic [1m] arm -> 1M -> 9% for gpt-5.6-sol[1m]x — but
+        # never the flagship 8%.
+        assert_output --partial '"id":"t1"'
+        refute_output --partial "8%"
+    done
+}
+
+# =========================================================================
+# HARDENING — Convention 4: full-transcript usage recovery (Finding 3)
+# =========================================================================
+
+@test "C4: usage recovery scans the full transcript — 60 trailing zero placeholders do not hide a positive record" {
+    _seed_window 200000
+    mkdir -p "${TEST_DIR}/${FAKE_SESSION}/subagents"
+    jq -cn '[{isSidechain:true,message:{usage:{input_tokens:123000,cache_read_input_tokens:0,cache_creation_input_tokens:0}}}] + [range(60)|{isSidechain:true,message:{usage:{input_tokens:0,cache_read_input_tokens:0,cache_creation_input_tokens:0}}}] | .[]' \
+        > "${TEST_DIR}/${FAKE_SESSION}/subagents/agent-recov.jsonl"
+    run bash "$SUBAGENT_BAR_SH" < <(jq -nc --arg sid "$FAKE_SESSION" --arg tp "${TEST_DIR}/main.jsonl" \
+        '{session_id:$sid,transcript_path:$tp,tasks:[{id:"recov",type:"local_agent",status:"running",tokenCount:0}]}')
+    assert_success
+    # full scan recovers 123k -> 61%; tail -n 50 would have seen only zeros -> 0%
+    assert_output --partial "61%"
+    refute_output --partial " 0%"
+}
+
+# =========================================================================
+# HARDENING — Convention 5: bounded numerator before x100 (Finding 10)
+# =========================================================================
+
+@test "C5: numerator bound — floor(INT64/100) accepted (100%), +1 rejected (0%), no wrap" {
+    _seed_window 200000
+    _seed_session_model "claude-fable-5"
+    _seed_task_model "t1" "claude-sonnet-4-6"
+    # 92233720368547758 = floor(INT64_MAX/100): tokens*100 stays int64-valid
+    run bash "$SUBAGENT_BAR_SH" < <(_payload_one_task "t1" 92233720368547758)
+    assert_success
+    assert_output --partial "100%"
+    assert_output --partial "$COLOR_CRITICAL"
+    # +1 would overflow tokens*100 and wrap pct negative -> guarded to 0
+    run bash "$SUBAGENT_BAR_SH" < <(_payload_one_task "t1" 92233720368547759)
+    assert_success
+    # guarded to 0 -> NOMINAL green at 0% (NOT a wrapped/overflowed 100% or negative)
+    assert_output --partial "$COLOR_NOMINAL"
+    refute_output --partial "100%"
+    refute_output --partial "syntax error"
+}
+
+# =========================================================================
+# HARDENING — Convention 6: suppress redirection-open diagnostics (Finding 11)
+# =========================================================================
+
+@test "C6: an ENOTDIR cache dir emits no stderr and still renders the row (exit 0)" {
+    # A regular file as the cache dir makes every cache path under it ENOTDIR.
+    # The grouped write must swallow the open() diagnostic (not leak it to the
+    # display stream), while the row still renders from the transcript.
+    local notadir="${TEST_DIR}/notadir"
+    local payload="${TEST_DIR}/enotdir_payload.json"
+    local errfile="${TEST_DIR}/enotdir_err.txt"
+    printf 'x' > "$notadir"
+    mkdir -p "${TEST_DIR}/${FAKE_SESSION}/subagents"
+    printf '{"type":"assistant","isSidechain":true,"message":{"model":"claude-sonnet-4-6"}}\n' \
+        > "${TEST_DIR}/${FAKE_SESSION}/subagents/agent-t1.jsonl"
+    printf '{"session_id":"%s","transcript_path":"%s/main.jsonl","tasks":[{"id":"t1","type":"local_agent","status":"running","tokenCount":0}]}' \
+        "$FAKE_SESSION" "$TEST_DIR" > "$payload"
+    run bash -c "DAAF_SUBAGENT_BAR_CACHE_DIR='$notadir' bash '$SUBAGENT_BAR_SH' < '$payload' 2>'$errfile'"
+    assert_success
+    # errfile must be empty: the ENOTDIR open() diagnostic was suppressed. A bare
+    # test command (bats-assert's generic `assert` is not loaded in this harness).
+    [ ! -s "$errfile" ]
+    assert_output --partial '"id":"t1"'
+}
+
+# =========================================================================
+# HARDENING follow-up — Convention 1: UTF-8-encoded C1 via the model cache
+# -------------------------------------------------------------------------
+# The bare model cache is read with cat, so it can carry a VALID-UTF-8 C1
+# control (U+009B = 8-bit CSI on xterm-class terminals) that the old byte-wise
+# bash range strip (C0+DEL only) passed through into the row and the emitted
+# JSON. The Unicode-aware jq [[:cntrl:]] strip (Unicode Cc) removes it.
+# =========================================================================
+
+@test "C1: UTF-8-encoded C1 from a hostile model cache is stripped before display" {
+    _seed_window 200000
+    _seed_session_model "claude-sonnet-4-6"
+    # [155]|implode -> U+009B, emitted by jq -rn as raw UTF-8 bytes c2 9b.
+    jq -rn '"evil"+([155]|implode)+"0;pwn-model"' \
+        > "/tmp/claude-subagent-model-${FAKE_SESSION}-c1u"
+    run bash "$SUBAGENT_BAR_SH" < <(_payload_one_task "c1u" 50000)
+    assert_success
+    # Neither the raw UTF-8 C1 bytes nor a JSON-escaped › may survive.
+    refute_output --partial "$(printf '\302\233')"
+    refute_output --partial 'u009b'
+    # Harmless text remainder joins, sans the control.
+    assert_output --partial 'evil0;pwn-model'
+}
diff --git a/tests/bash/update_daaf.bats b/tests/bash/update_daaf.bats
index ab4d8d14..fd74845e 100755
--- a/tests/bash/update_daaf.bats
+++ b/tests/bash/update_daaf.bats
@@ -1439,6 +1439,83 @@ setup_state_machine() {
     assert_output --partial "Failed to start"
 }
 
+# --- Pre-update backup gate ---
+# The updater's pre-update backup is prompted/optional. In the non-interactive test
+# harness prompt_choice auto-selects the FIRST valid choice ("y"), so these tests
+# exercise the opted-in path: a FAILED backup must abort the update with a clear
+# message, and a SUCCESSFUL backup must let it continue (the abort must not
+# false-fire). A declined backup (CHOICE=n) is unreachable non-interactively, so it
+# is not exercised here.
+
+@test "update: opted-in backup failure aborts the update with a clear message" {
+    setup_state_machine
+    # Stub backup script the updater will find in the CWD and run; it fails (exit 1).
+    cat > "${TEST_DIR}/backup_daaf.sh" <<'STUB'
+#!/usr/bin/env bash
+echo "STUB BACKUP RAN"
+exit 1
+STUB
+    chmod +x "${TEST_DIR}/backup_daaf.sh"
+    run bash -c '
+        docker() {
+            local all_args="$*"
+            case "$all_args" in
+                "info") return 0 ;;
+                *"compose ps"*"--format"*) echo "daaf-docker" ;;
+                *"compose exec"*"true"*) return 0 ;;
+                *"compose exec"*"test -f"*"/daaf/CLAUDE.md"*) return 0 ;;
+                *) return 0 ;;
+            esac
+        }
+        export -f docker
+        bash "'"${REPO_ROOT}"'/scripts/host/update_daaf.sh"
+    '
+    assert_failure
+    assert_output --partial "STUB BACKUP RAN"
+    assert_output --partial "Backup failed (exit code 1)"
+    assert_output --partial "The update will not proceed without a successful backup"
+}
+
+@test "update: opted-in backup success lets the update continue past the backup step" {
+    setup_state_machine
+    # Stub backup script that succeeds (exit 0); the update must NOT abort and should
+    # proceed to its normal outcome (same SHA everywhere -> "Already up to date").
+    cat > "${TEST_DIR}/backup_daaf.sh" <<'STUB'
+#!/usr/bin/env bash
+echo "STUB BACKUP RAN"
+exit 0
+STUB
+    chmod +x "${TEST_DIR}/backup_daaf.sh"
+    run bash -c '
+        docker() {
+            local all_args="$*"
+            case "$all_args" in
+                "info") return 0 ;;
+                *"compose ps"*"--format"*) echo "daaf-docker" ;;
+                *"compose exec"*"true"*) return 0 ;;
+                *"compose exec"*"test -f"*"/daaf/CLAUDE.md"*) return 0 ;;
+                *"compose exec"*"test -f"*"/daaf/.git/shallow"*) return 1 ;;
+                *"compose exec"*"remote get-url"*"origin"*) echo "https://github.com/DAAF-Contribution-Community/daaf.git" ;;
+                *"compose exec"*"fetch"*) return 0 ;;
+                *"compose exec"*"rev-parse --verify"*"backup/"*) return 1 ;;
+                *"compose exec"*"rev-parse --verify"*"origin/main"*) return 0 ;;
+                *"compose exec"*"branch --show-current"*) echo "main" ;;
+                *"compose exec"*"rev-parse"*"origin/main"*) echo "abc123same" ;;
+                *"compose exec"*"rev-parse"*"HEAD"*) echo "abc123same" ;;
+                *"compose exec"*"diff --name-only"*"HEAD"*) echo "" ;;
+                *"compose exec"*"branch"*) return 0 ;;
+                *) return 0 ;;
+            esac
+        }
+        export -f docker
+        bash "'"${REPO_ROOT}"'/scripts/host/update_daaf.sh"
+    '
+    assert_success
+    assert_output --partial "STUB BACKUP RAN"
+    assert_output --partial "Already up to date"
+    refute_output --partial "The update will not proceed without a successful backup"
+}
+
 @test "update: DAAF not installed (CLAUDE.md missing) exits with error" {
     setup_state_machine
     run bash -c '
diff --git a/tests/powershell/backup_daaf.Tests.ps1 b/tests/powershell/backup_daaf.Tests.ps1
index 40e8daeb..269ad89d 100644
--- a/tests/powershell/backup_daaf.Tests.ps1
+++ b/tests/powershell/backup_daaf.Tests.ps1
@@ -235,6 +235,50 @@ Describe "backup_daaf.ps1" {
             # No PS7-only null-coalescing operator
             $Content | Should -Not -Match '\?\?'
         }
+
+        # -----------------------------------------------------------------
+        # Regression: fail-closed staging-status parse (boolean-gated TryParse)
+        # -----------------------------------------------------------------
+        # [int]::TryParse writes 0 into the [ref] on a parse FAILURE, so the old
+        # `$null = [int]::TryParse(..., [ref]$StageStatus)` form silently overwrote the
+        # fail-closed default with 0 whenever `docker wait` emitted a non-numeric last
+        # line (a daemon error merged via 2>&1) -- flipping the fatal gate from "abort"
+        # to "proceed to copy a partial staged tree." The fix parses into a temp var and
+        # adopts it ONLY when TryParse returns $true (mirrors restore_from_backup.ps1:279).
+        Context "Regression: fail-closed staging-status parse (boolean-gated TryParse)" {
+            It "gates the data-volume staging status on TryParse's boolean via a temp var" {
+                $Content | Should -Match '\[int\]::TryParse\("\$StageStatusRaw"\.Trim\(\), \[ref\]\$StageStatusParsed\)'
+                $Content | Should -Match '\$StageStatus = \$StageStatusParsed'
+                # The fail-open idiom for the status var must be gone.
+                $Content | Should -Not -Match '\$null = \[int\]::TryParse\("\$StageStatusRaw"'
+            }
+            It "gates the Claude-volume staging status the same fail-closed way" {
+                $Content | Should -Match '\[int\]::TryParse\("\$ClaudeStageStatusRaw"\.Trim\(\), \[ref\]\$ClaudeStageStatusParsed\)'
+                $Content | Should -Match '\$ClaudeStageStatus = \$ClaudeStageStatusParsed'
+                $Content | Should -Not -Match '\$null = \[int\]::TryParse\("\$ClaudeStageStatusRaw"'
+            }
+            It "keeps the explicit fail-closed default of 1 for both staging statuses" {
+                $Content | Should -Match '\$StageStatus = 1'
+                $Content | Should -Match '\$ClaudeStageStatus = 1'
+            }
+        }
+
+        # -----------------------------------------------------------------
+        # Regression: floored 1% tolerances (no banker's rounding)
+        # -----------------------------------------------------------------
+        # `[long]($TotalFiles / 100)` round-half-to-even diverges from the bash twin's
+        # truncating integer division (350 -> 4 vs floor 3). The fix uses [math]::Floor
+        # to match bash (backup_daaf.sh:454/477) and restore_from_backup.ps1:621.
+        Context "Regression: floored 1% tolerances (no banker's rounding)" {
+            It "floors the file-count tolerance with [math]::Floor (not a bare [long] cast)" {
+                $Content | Should -Match '\[math\]::Max\(1, \[long\]\[math\]::Floor\(\$TotalFiles / 100\)\)'
+                $Content | Should -Not -Match '\[long\]\(\$TotalFiles / 100\)'
+            }
+            It "floors the size tolerance with [math]::Floor (not a bare [long] cast)" {
+                $Content | Should -Match '\[math\]::Max\(1, \[long\]\[math\]::Floor\(\$SourceSizeKB / 100\)\)'
+                $Content | Should -Not -Match '\[long\]\(\$SourceSizeKB / 100\)'
+            }
+        }
     }
 }
 
@@ -301,6 +345,17 @@ Describe "backup_daaf.ps1 Import-DaafSettingsInline" {
         $env:DAAF_PROJECT_NAME | Should -Be "safe"
         $env:ANTHROPIC_API_KEY | Should -BeNullOrEmpty
     }
+
+    It "rejects a whitespace-padded key (column-0 strict, parity with bash)" {
+        # A leading-space key like "  DAAF_PROJECT_NAME=..." is not flush at column 0.
+        # The bash loaders' `case` glob rejects it; the PS loader must too (key extracted
+        # WITHOUT .Trim()), so a padded key resolves identically -- to nothing -- on both
+        # platforms rather than silently working on Windows only. Pre-fix, the trimmed key
+        # matched the whitelist and the value was adopted.
+        Set-Content -Path $script:SettingsFile -Value "  DAAF_PROJECT_NAME=padded"
+        Import-DaafSettingsInline -SettingsFile $script:SettingsFile
+        $env:DAAF_PROJECT_NAME | Should -BeNullOrEmpty
+    }
 }
 
 # ============================================================================
@@ -398,6 +453,41 @@ Describe "backup_daaf.ps1 behavioral tests" {
             $Content | Should -Match '\$AvailableKB -lt \$RequiredKB'
         }
     }
+
+    # -----------------------------------------------------------------
+    # Executable semantics: fail-closed parse + floored tolerance
+    # -----------------------------------------------------------------
+    # These run the FIXED snippets directly so a behavioral regression (not just a
+    # text edit) is caught. Each would produce the wrong value under the pre-fix form.
+    Context "Fail-closed parse + floored tolerance (executable semantics)" {
+        It "keeps the staging status fail-closed at 1 on non-numeric docker wait output" {
+            # Reproduce the exact parse snippet and feed it a merged daemon error line.
+            # The pre-fix `$null = [int]::TryParse(...)` overwrote the default with 0.
+            $StageStatusRaw = "Error response from daemon: no such container"
+            $StageStatus = 1
+            $StageStatusParsed = 0
+            if ($null -ne $StageStatusRaw -and [int]::TryParse("$StageStatusRaw".Trim(), [ref]$StageStatusParsed)) {
+                $StageStatus = $StageStatusParsed
+            }
+            $StageStatus | Should -Be 1
+        }
+        It "adopts a genuine numeric zero status when docker wait succeeds cleanly" {
+            $StageStatusRaw = "0"
+            $StageStatus = 1
+            $StageStatusParsed = 0
+            if ($null -ne $StageStatusRaw -and [int]::TryParse("$StageStatusRaw".Trim(), [ref]$StageStatusParsed)) {
+                $StageStatus = $StageStatusParsed
+            }
+            $StageStatus | Should -Be 0
+        }
+        It "floors an odd-hundred-half tolerance to 3, not banker's-rounded 4" {
+            # 350/100: [long](...) banker's-rounds to 4; [math]::Floor gives 3, matching
+            # the bash twin's truncating integer division. The second assertion documents
+            # (with executable evidence) exactly the divergence the fix removes.
+            ([long][math]::Floor(350 / 100)) | Should -Be 3
+            ([long](350 / 100)) | Should -Be 4
+        }
+    }
 }
 
 # ============================================================================
@@ -457,6 +547,33 @@ Describe "backup_daaf.ps1 error paths" {
         }
     }
 
+    Context "Corroborated short copy is fatal" {
+        It "fails when a non-zero copy exit AND a short file count agree" {
+            # Two corroborating signals (nonzero exit + count below the scan) mean a
+            # genuinely truncated backup, so the script aborts fatally.
+            $Content | Should -Match '\$CopyExitCode -ne 0 -and \$FileCount -lt \$TotalFiles'
+            $Content | Should -Match 'only \$FileCount of \$TotalFiles expected files were copied'
+        }
+        It "tells the user to delete the partial backup folder and re-run" {
+            $Content | Should -Match 'This backup is incomplete and must not be relied on'
+            $Content | Should -Match 'partial backup folder and re-run'
+        }
+    }
+
+    Context "Warnings-aware completion banner" {
+        It "prints the plain banner when no warnings were latched" {
+            $Content | Should -Match 'Backup complete!'
+        }
+        It "prints the WITH WARNINGS banner when the latch is set" {
+            $Content | Should -Match 'Backup completed WITH WARNINGS -- verify before relying on it'
+        }
+        It "latches HadWarnings at the non-fatal WARNING sites" {
+            # Initialized false, and set true in each non-fatal WARNING path.
+            $Content | Should -Match '\$HadWarnings = \$false'
+            $Content | Should -Match '\$HadWarnings = \$true'
+        }
+    }
+
     Context "Volume scan unexpected format" {
         It "handles scan failure with error" {
             # When docker run for scan fails (LASTEXITCODE != 0), script exits with error
diff --git a/tests/powershell/daaf_lib.Tests.ps1 b/tests/powershell/daaf_lib.Tests.ps1
new file mode 100644
index 00000000..538e5bba
--- /dev/null
+++ b/tests/powershell/daaf_lib.Tests.ps1
@@ -0,0 +1,65 @@
+# ============================================================================
+# Unit tests for Resolve-DaafDataVolumeName (daaf_lib.ps1)
+# ============================================================================
+# Resolve-DaafDataVolumeName is the PowerShell twin of daaf_lib.sh
+# resolve_data_volume_name. It returns the Docker volume name that holds the DAAF
+# research workspace (/daaf), honoring the optional DAAF_DATA_VOLUME_NAME full-name
+# override. This battery mirrors the four bash cases in tests/bash/daaf_lib.bats
+# (the "Data-volume name resolver" section), asserting the same precedence:
+#   1. no override, no project name        => "daaf_daaf-data" (legacy hardcoded)
+#   2. only DAAF_PROJECT_NAME=daaf2         => "daaf2_daaf-data" (Compose prefix)
+#   3. DAAF_DATA_VOLUME_NAME set            => used verbatim (project prefix ignored)
+#   4. DAAF_DATA_VOLUME_NAME set-but-empty  => derived default (empty == unset)
+# Precedence: DAAF_DATA_VOLUME_NAME (verbatim) > "<project>_daaf-data" default.
+# An unset override reproduces the historical hardcoded derivation byte-for-byte.
+# ============================================================================
+
+Describe "daaf_lib.ps1 Resolve-DaafDataVolumeName" {
+    BeforeAll {
+        . "$PSScriptRoot/TestHelper.ps1"
+        # Dot-source the library so the function is defined in this scope.
+        . "$RepoRoot/scripts/host/daaf_lib.ps1"
+    }
+
+    BeforeEach {
+        # Snapshot the two env vars the resolver reads, then start each test from a
+        # clean slate so the ambient process env cannot skew the assertions. AfterEach
+        # restores the caller's exact prior state (clearing a var only when it was
+        # genuinely unset), so the suite leaves no environment residue.
+        $script:SavedVolName = $env:DAAF_DATA_VOLUME_NAME
+        $script:SavedProject = $env:DAAF_PROJECT_NAME
+        Remove-Item Env:DAAF_DATA_VOLUME_NAME -ErrorAction SilentlyContinue
+        Remove-Item Env:DAAF_PROJECT_NAME -ErrorAction SilentlyContinue
+    }
+
+    AfterEach {
+        if ($null -ne $script:SavedVolName) { $env:DAAF_DATA_VOLUME_NAME = $script:SavedVolName } else { Remove-Item Env:DAAF_DATA_VOLUME_NAME -ErrorAction SilentlyContinue }
+        if ($null -ne $script:SavedProject) { $env:DAAF_PROJECT_NAME = $script:SavedProject } else { Remove-Item Env:DAAF_PROJECT_NAME -ErrorAction SilentlyContinue }
+    }
+
+    It "derives the default when no override and no project name" {
+        # Unset override + unset project name => the legacy hardcoded name, unchanged.
+        Resolve-DaafDataVolumeName | Should -Be "daaf_daaf-data"
+    }
+
+    It "applies the project prefix when only DAAF_PROJECT_NAME is set" {
+        # A second instance owns "<project>_daaf-data" without touching the override.
+        $env:DAAF_PROJECT_NAME = "daaf2"
+        Resolve-DaafDataVolumeName | Should -Be "daaf2_daaf-data"
+    }
+
+    It "uses DAAF_DATA_VOLUME_NAME verbatim when set (ignores project prefix)" {
+        # Set override wins verbatim -- no project prefix is added (shared-workspace hatch).
+        $env:DAAF_DATA_VOLUME_NAME = "shared_workspace_vol"
+        $env:DAAF_PROJECT_NAME = "daaf2"
+        Resolve-DaafDataVolumeName | Should -Be "shared_workspace_vol"
+    }
+
+    It "treats a set-but-empty override as unset (derived default)" {
+        # An empty string is falsy in PowerShell, so the guard treats empty and unset
+        # alike, matching the bash `:-` semantics -- it falls through to the derived
+        # default rather than returning an empty volume name.
+        $env:DAAF_DATA_VOLUME_NAME = ""
+        Resolve-DaafDataVolumeName | Should -Be "daaf_daaf-data"
+    }
+}
diff --git a/tests/powershell/migrate_daaf.Tests.ps1 b/tests/powershell/migrate_daaf.Tests.ps1
index 3382cc33..fa7ce8fe 100644
--- a/tests/powershell/migrate_daaf.Tests.ps1
+++ b/tests/powershell/migrate_daaf.Tests.ps1
@@ -108,6 +108,19 @@ Describe "migrate_daaf.ps1" {
             $Content | Should -Match 'backup_daaf\.ps1'
         }
 
+        It "captures the backup exit code from LASTEXITCODE" {
+            $Content | Should -Match '\$backupExit\s*=\s*\$LASTEXITCODE'
+        }
+
+        It "aborts the migration on a nonzero backup exit code" {
+            $Content | Should -Match 'if \(\$backupExit -ne 0\)'
+            $Content | Should -Match 'Backup failed \(exit code \$backupExit\)'
+        }
+
+        It "explains that the migration will not proceed without a successful backup" {
+            $Content | Should -Match 'The migration will not proceed without a successful backup'
+        }
+
         It "handles fork detection" {
             $Content | Should -Match 'IsFork'
         }
diff --git a/tests/powershell/rebuild_daaf.Tests.ps1 b/tests/powershell/rebuild_daaf.Tests.ps1
index d9bf4050..a378e2e2 100644
--- a/tests/powershell/rebuild_daaf.Tests.ps1
+++ b/tests/powershell/rebuild_daaf.Tests.ps1
@@ -93,6 +93,16 @@ Describe "rebuild_daaf.ps1" {
         It "waits for container readiness after rebuild" {
             $Content | Should -Match 'Waiting for container to be ready'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across all ten PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
@@ -246,9 +256,19 @@ Describe "rebuild_daaf.ps1 error paths" {
             $Content | Should -Match 'BUILDKIT_STEP_LOG_MAX_SPEED=10485760'
         }
 
-        It "selects the builder via BUILDX_BUILDER and clears it after the build" {
+        It "selects the builder via BUILDX_BUILDER and RESTORES the prior value after the build (non-destructive)" {
+            # Regression: the pre-fix code cleared the var unconditionally with
+            # `if ($UseDiagBuilder) { $env:BUILDX_BUILDER = $null }`, which REMOVES the
+            # variable and clobbers a user's own pre-exported BUILDX_BUILDER. The fix
+            # saves the prior value first and restores it (removing only when the user had
+            # none). Assert the save + conditional restore, and that the destructive
+            # single-line unconditional clear is gone. (`$env:BUILDX_BUILDER = $null` still
+            # appears in the else-branch and in the hazard comment, so we negative-match
+            # the specific one-line `if ($UseDiagBuilder) { ... = $null }` form instead.)
             $Content | Should -Match '\$env:BUILDX_BUILDER = "daaf-diag-builder"'
-            $Content | Should -Match '\$env:BUILDX_BUILDER = \$null'
+            $Content | Should -Match '\$priorBuildxBuilder = \$env:BUILDX_BUILDER'
+            $Content | Should -Match 'if \(\$null -ne \$priorBuildxBuilder\) \{ \$env:BUILDX_BUILDER = \$priorBuildxBuilder \}'
+            $Content | Should -Not -Match 'if \(\$UseDiagBuilder\) \{ \$env:BUILDX_BUILDER = \$null \}'
         }
 
         It "falls open to the default builder when the builder cannot be created" {
diff --git a/tests/powershell/run_daaf.Tests.ps1 b/tests/powershell/run_daaf.Tests.ps1
index 1b1caabf..816081b2 100644
--- a/tests/powershell/run_daaf.Tests.ps1
+++ b/tests/powershell/run_daaf.Tests.ps1
@@ -74,6 +74,16 @@ Describe "run_daaf.ps1" {
         It "starts container if not running" {
             $Content | Should -Match 'Starting DAAF container'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
diff --git a/tests/powershell/run_vscode.Tests.ps1 b/tests/powershell/run_vscode.Tests.ps1
index 1903362e..977450b7 100644
--- a/tests/powershell/run_vscode.Tests.ps1
+++ b/tests/powershell/run_vscode.Tests.ps1
@@ -98,6 +98,16 @@ Describe "run_vscode.ps1" {
         It "reports container already running" {
             $Content | Should -Match 'DAAF container is running'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
diff --git a/tests/powershell/update_daaf.Tests.ps1 b/tests/powershell/update_daaf.Tests.ps1
index c0d41b18..bbfae3ac 100644
--- a/tests/powershell/update_daaf.Tests.ps1
+++ b/tests/powershell/update_daaf.Tests.ps1
@@ -108,6 +108,17 @@ Describe "update_daaf.ps1" {
             $Content | Should -Match 'Backup recommendation'
         }
 
+        It "captures the opt-in backup exit code" {
+            # The pre-update backup is prompted/optional; its exit must be captured
+            # so a failure can abort gracefully instead of proceeding silently.
+            $Content | Should -Match '\$backupExit = \$LASTEXITCODE'
+        }
+
+        It "aborts the update when the opted-in backup fails" {
+            $Content | Should -Match 'Backup failed \(exit code \$backupExit\)'
+            $Content | Should -Match 'The update will not proceed without a successful backup'
+        }
+
         It "creates a git backup branch" {
             $Content | Should -Match 'backup/pre-update'
         }
@@ -128,6 +139,16 @@ Describe "update_daaf.ps1" {
         It "detects ahead/behind state" {
             $Content | Should -Match 'rev-list --count'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
@@ -817,6 +838,46 @@ Describe "update_daaf.ps1 behavioral tests" {
         }
     }
 
+    # -----------------------------------------------------------------
+    # Import-DaafSettingsInline (column-0 key strictness)
+    # -----------------------------------------------------------------
+    # The settings loader must extract the key WITHOUT .Trim() so a whitespace-
+    # padded "  DAAF_PROJECT_NAME=..." line is NOT flush at column 0 and falls
+    # through as unrecognized -- matching the bash loaders' column-0 `case` glob.
+    # A flush (column-0) key is still adopted. The function is called with an
+    # explicit -SettingsFile so no CWD juggling is needed; the probed env vars are
+    # cleared before and restored after so a real container env is not clobbered.
+    Context "Import-DaafSettingsInline column-0 key strictness" {
+        BeforeEach {
+            $script:IdsDir = New-Item -ItemType Directory -Path (Join-Path ([System.IO.Path]::GetTempPath()) "daaf-ids-$(Get-Random)")
+        }
+        AfterEach {
+            Remove-Item -Recurse -Force $script:IdsDir -ErrorAction SilentlyContinue
+        }
+
+        It "rejects a whitespace-padded key and adopts a flush key (like bash column-0)" {
+            $settings = Join-Path $script:IdsDir "environment_settings.txt"
+            Set-Content -Path $settings -Value @(
+                "  DAAF_PORT_MARIMO=9999",
+                "DAAF_PROJECT_NAME=flushvalue"
+            )
+            $origName   = $env:DAAF_PROJECT_NAME
+            $origMarimo = $env:DAAF_PORT_MARIMO
+            Remove-Item Env:DAAF_PROJECT_NAME -ErrorAction SilentlyContinue
+            Remove-Item Env:DAAF_PORT_MARIMO  -ErrorAction SilentlyContinue
+            try {
+                Import-DaafSettingsInline -SettingsFile $settings
+                # Flush key adopted; padded key ("  DAAF_PORT_MARIMO") off-whitelist -> unset.
+                $env:DAAF_PROJECT_NAME | Should -Be "flushvalue"
+                $env:DAAF_PORT_MARIMO  | Should -BeNullOrEmpty
+            }
+            finally {
+                if ($null -ne $origName)   { $env:DAAF_PROJECT_NAME = $origName }   else { Remove-Item Env:DAAF_PROJECT_NAME -ErrorAction SilentlyContinue }
+                if ($null -ne $origMarimo) { $env:DAAF_PORT_MARIMO  = $origMarimo } else { Remove-Item Env:DAAF_PORT_MARIMO  -ErrorAction SilentlyContinue }
+            }
+        }
+    }
+
     # -----------------------------------------------------------------
     # Resolve-Conflict
     # -----------------------------------------------------------------
diff --git a/tests/powershell/view_logs.Tests.ps1 b/tests/powershell/view_logs.Tests.ps1
index f1ebcdc2..af425519 100644
--- a/tests/powershell/view_logs.Tests.ps1
+++ b/tests/powershell/view_logs.Tests.ps1
@@ -93,6 +93,16 @@ Describe "view_logs.ps1" {
             $Content | Should -Match 'DAAF_NESTED'
             $Content | Should -Match '\$SkipMenu'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
diff --git a/tests/powershell/view_notebooks.Tests.ps1 b/tests/powershell/view_notebooks.Tests.ps1
index f6040828..5128dd3a 100644
--- a/tests/powershell/view_notebooks.Tests.ps1
+++ b/tests/powershell/view_notebooks.Tests.ps1
@@ -98,6 +98,16 @@ Describe "view_notebooks.ps1" {
         It "reports container already running" {
             $Content | Should -Match 'DAAF container is running'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
diff --git a/tests/powershell/view_quarto.Tests.ps1 b/tests/powershell/view_quarto.Tests.ps1
index d872e9f7..f5e98476 100644
--- a/tests/powershell/view_quarto.Tests.ps1
+++ b/tests/powershell/view_quarto.Tests.ps1
@@ -107,6 +107,16 @@ Describe "view_quarto.ps1" {
         It "reports container already running" {
             $Content | Should -Match 'DAAF container is running'
         }
+
+        It "extracts the settings key column-0 strict (no .Trim(), rejects padded keys like bash)" {
+            # Import-DaafSettingsInline must extract the key WITHOUT .Trim() so a
+            # whitespace-padded "  DAAF_PROJECT_NAME=..." line falls through as
+            # unrecognized -- matching the bash loaders' column-0 `case` glob. The
+            # pre-fix `.Substring(0, $eq).Trim()` accepted padded keys, diverging from
+            # bash across the PS loader copies.
+            $Content | Should -Match '\$key = \$line\.Substring\(0, \$eq\)'
+            $Content | Should -Not -Match '\$key = \$line\.Substring\(0, \$eq\)\.Trim\(\)'
+        }
     }
 }
 
diff --git a/tests/provider_shim/_loopback_harness.py b/tests/provider_shim/_loopback_harness.py
index da05f970..dca8b1a6 100644
--- a/tests/provider_shim/_loopback_harness.py
+++ b/tests/provider_shim/_loopback_harness.py
@@ -10,6 +10,7 @@
 
 import asyncio
 import base64
+import copy
 import importlib.util
 import io
 import json
@@ -35,17 +36,93 @@
 from unittest import mock
 
 
-DAAF_ROOT = Path("/daaf")
+# Repo root resolved from this file's location (tests/provider_shim/ -> repo
+# root), not hardcoded to /daaf: in the DAAF container the two are identical,
+# but on a CI runner the checkout lands wherever the workspace is (e.g.
+# $GITHUB_WORKSPACE), and the harness must find the production shim there.
+DAAF_ROOT = Path(__file__).resolve().parents[2]
 PRODUCTION_SHIM = DAAF_ROOT / "scripts/provider_shim/anthropic_openai_shim.py"
+# v1.3.0: the fake-codex stub the shim's delegated refresh spawns instead of the
+# real codex CLI. Injected via SHIM_CODEX_BIN. Behavior is driven by FAKE_CODEX_MODE.
+FAKE_CODEX_BIN = DAAF_ROOT / "tests/provider_shim/fake_codex.py"
 SCRATCH_ROOT = DAAF_ROOT / "scripts/scratch"
+# v1.3.2 fix cycle: seam in-process loads of the production shim away from the
+# install-shared quota_state.json. Every test module imports this harness, so setting
+# the redirect env var here puts the quota-state seam on the *test-runner process* env.
+# Any in-process load of the production shim in this process — controlled_asgi_probe
+# (whose mock.patch.dict(..., clear=False) inherits this value), outer_cancel_after_
+# stream_enter_report, test_v130_auth_delegation's _load_fresh_shim, and any future
+# in-process loader — then resolves its module-level _QUOTA_STATE_PATH to scratch at
+# import instead of scripts/provider_shim/logs/quota_state.json. This complements the
+# per-instance child-env seam RealShim.__enter__ sets for *spawned* shims: spawned
+# subprocesses and in-process module loads are the two distinct contexts that can reach
+# _write_quota_state, and this default plus that child env cover both. A failed scratch
+# write is harmless either way — _write_quota_state is fail-open and swallows it — but
+# seaming keeps the write off the install-shared file. setdefault (not assignment) so a
+# value a developer exports to inspect real quota-state behavior survives untouched.
+os.environ.setdefault(
+    "DAAF_QUOTA_STATE_FILE", str(SCRATCH_ROOT / "in_process_quota_state.json")
+)
+# v1.3.3 (A2-R5): the SAME in-process seam for the reasoning-cache persistence file, so
+# an in-process load of the production shim resolves its import-time _REASONING_CACHE_PATH
+# to scratch instead of the per-container $HOME default. setdefault (not assignment) so a
+# developer's explicit export survives.
+#
+# CRITICAL HERMETICITY HAZARD (front-loaded from the v1.3.2 lesson): the reasoning cache
+# adds a failure mode quota_state does NOT have. quota_state is write-only, but the
+# reasoning cache RESTORES itself at MODULE IMPORT — so a seam file written by one
+# in-process shim load would be restored into a LATER fresh in-process load's
+# _REASONING_CACHE, and harness fixtures reuse call_ids (call_1 / call_full_fixture), so
+# the leaked entries would silently flip a later test's miss assertions. Choosing WHERE
+# the in-process default lands (this setdefault) is therefore NOT sufficient on its own;
+# the anti-leakage guarantee is enforced by _purge_in_process_reasoning_cache_seam()
+# below, which unlinks this file BEFORE each in-process fresh module load. Spawned
+# RealShim subprocesses are isolated separately via a per-instance scratch path set in
+# __enter__ (each RealShim gets its own scratch_dir, so no cross-instance leakage there).
+os.environ.setdefault(
+    "DAAF_REASONING_CACHE_FILE", str(SCRATCH_ROOT / "in_process_reasoning_cache.json")
+)
+
+
+def _purge_in_process_reasoning_cache_seam():
+    """Clear the runner-default reasoning-cache seam before an in-process fresh load.
+
+    A2-R5 hermeticity: because the production shim restores its reasoning cache at module
+    import, an in-process fresh load (controlled_asgi_probe, outer_cancel_after_stream_
+    enter_report, and any future in-process loader) would otherwise restore whatever an
+    earlier in-process load persisted to the shared runner-default seam file — leaking
+    call_ids across tests and flipping miss assertions. Unlinking the CURRENT effective
+    seam path (which honors any outer mock.patch.dict override a test set) guarantees each
+    fresh load starts cold. Idempotent and fail-quiet: an absent file is fine.
+    """
+
+    seam = os.environ.get("DAAF_REASONING_CACHE_FILE", "")
+    if seam:
+        try:
+            os.unlink(seam)
+        except OSError:
+            pass
+
+
 SCRATCH_PREFIX = "provider-shim-unittest-"
 FAKE_OPENAI_KEY = "sk-FAKE_PROVIDER_SHIM_UNITTEST_OPENAI_000000000000"
 FAKE_REFRESH_TOKEN = "FAKE_PROVIDER_SHIM_REFRESH_TOKEN_000000000000"
 FAKE_ID_TOKEN = "FAKE_PROVIDER_SHIM_ID_TOKEN_000000000000"
 FAKE_ACCOUNT_ID = "acct_provider_shim_unittest"
 USAGE = {"input_tokens": 31, "output_tokens": 17, "total_tokens": 48}
+# v1.3.6 (V6-R1 test plan item 1): sibling fixture carrying a prompt-cache detail. NOT a
+# mutation of USAGE (that would perturb existing token assertions). OpenAI's input_tokens (31)
+# INCLUDES the cached prefix (12), so the client-visible Anthropic mapping subtracts to
+# input_tokens=19 + cache_read_input_tokens=12; the terminal record keeps the OpenAI total 31.
+USAGE_WITH_CACHE = {
+    "input_tokens": 31,
+    "output_tokens": 17,
+    "total_tokens": 48,
+    "input_tokens_details": {"cached_tokens": 12},
+}
 NONSTREAM_REJECTION_BODY = {"detail": "Stream must be set to true"}
 TERMINAL_FIELD_OMITTED = object()
+_SELECTED_BACKEND_CONTROL = object()
 
 CENTRAL_SOURCE_DELTAS = [
     "**Planning ",
@@ -101,14 +178,22 @@ class Scenario:
     reject_nonstream: bool = False
     append_done: bool = True
     raw_stream_frames: Optional[list[bytes]] = None
+    preserve_raw_stream_chunks: bool = False
     abrupt_eof: bool = False
     stream_status: int = 200
     stream_headers: dict[str, str] = field(default_factory=dict)
     stream_error_body: bytes = b'{"error":{"message":"fixture backend rejection"}}'
+    # Optional per-request JSON response sequence for stateful real-process tests.
+    # The final entry repeats when the request count exceeds the sequence length.
+    nonstream_responses: Optional[list[dict[str, Any]]] = None
     attempt_statuses: Optional[list[int | str]] = None
     attempt_headers: Optional[list[dict[str, str]]] = None
     disconnect_phase: Optional[str] = None
     disconnect_delay: float = 1.8
+    # v1.2.14 (R6): when > 0, the streaming success path pauses this many seconds
+    # just before the terminal event (WITHOUT disconnecting the client) to create a
+    # silent upstream gap the downstream heartbeat must bridge with ping frames.
+    heartbeat_gap_s: float = 0.0
 
 
 @dataclass(frozen=True)
@@ -157,6 +242,9 @@ class ASGIProbeReport:
     raised: Optional[str]
     cancelled: bool
     upstream_calls: int
+    auth_calls: int
+    outbound_payloads: list[dict[str, Any]]
+    gpt_service_tier_health: dict[str, Any]
     stream_close_calls: int
     stream_close_attempts: list[int]
     close_after_cleanup: list[bool]
@@ -184,6 +272,27 @@ def add(self, event_type: str, **fields: Any) -> dict[str, Any]:
         return event
 
 
+def _start_response(builder: _EventBuilder, response_id: str) -> None:
+    """Emit the response.created + response.in_progress lifecycle preamble.
+
+    LIVE-WIRE SHAPE (notes/04:27, notes/07:26,62): both the openai and chatgpt lanes
+    send response.in_progress immediately after response.created on every turn. Both
+    events sit in the shim's _KNOWN_EVENT_TYPES ignored group (shim :1249-1250), so the
+    downstream Anthropic projection is byte-identical whether or not in_progress is
+    present. Emitting it here makes the positive fixtures faithful and exercises the
+    in_progress allowlist skip branch that no positive fixture previously hit
+    (`grep -c response\\.in_progress = 0` before this change). Applied only to the
+    positive text/reasoning happy-path builders; deliberately NOT applied to the
+    malformed/off-limits fixtures (their bare-created shape is part of the test) nor to
+    the tool-path scenarios (those belong to dispatch T2-B).
+    """
+    builder.add("response.created", response={"id": response_id, "status": "in_progress"})
+    builder.add(
+        "response.in_progress",
+        response={"id": response_id, "status": "in_progress"},
+    )
+
+
 def _reasoning_item(item_id: str, parts: Iterable[dict[str, Any]]) -> dict[str, Any]:
     summary = []
     for part in parts:
@@ -272,6 +381,24 @@ def _append_text_item(
             "content": [],
         },
     )
+    # LIVE-WIRE SHAPE (notes/04:27, notes/07:25-29): both lanes wrap the text deltas in a
+    # content_part.added/.done pair and emit output_text.done before the part closes:
+    #   output_item.added -> content_part.added -> output_text.delta* -> output_text.done
+    #   -> content_part.done -> output_item.done
+    # The pre-rebase fixture went added -> delta -> item.done, omitting the three framing
+    # events. All three (content_part.added/.done, output_text.done) sit in the shim's
+    # _KNOWN_EVENT_TYPES ignored group (shim :1252-1254), so the downstream Anthropic
+    # projection is BYTE-IDENTICAL to the old shape -- the rework's value is fidelity plus
+    # exercising allowlist skip branches that no positive fixture hit before (grep -c = 0).
+    # The single output_text.delta content is preserved byte-for-byte; the (builder,
+    # output_index, text) signature is unchanged so every caller's fixture text is intact.
+    builder.add(
+        "response.content_part.added",
+        item_id=item_id,
+        output_index=output_index,
+        content_index=0,
+        part={"type": "output_text", "text": ""},
+    )
     builder.add(
         "response.output_text.delta",
         item_id=item_id,
@@ -279,6 +406,20 @@ def _append_text_item(
         content_index=0,
         delta=text,
     )
+    builder.add(
+        "response.output_text.done",
+        item_id=item_id,
+        output_index=output_index,
+        content_index=0,
+        text=text,
+    )
+    builder.add(
+        "response.content_part.done",
+        item_id=item_id,
+        output_index=output_index,
+        content_index=0,
+        part={"type": "output_text", "text": text},
+    )
     item = {
         "type": "message",
         "id": item_id,
@@ -290,12 +431,33 @@ def _append_text_item(
     return item
 
 
+# Opaque default `obfuscation` blob stamped on every arguments.delta to mirror
+# the live Codex wire (see _append_tool_item). The exact bytes are not read by
+# the shim (it is upstream-stripped); only the field's presence and silent
+# tolerance are load-bearing, so any bounded opaque string is faithful.
+_DEFAULT_ARG_DELTA_OBFUSCATION = "b7F3kR9mP2xQ8nL5"
+
+
 def _append_tool_item(
     builder: _EventBuilder,
     output_index: int,
     call_id: str = "call_fixture_1",
     item_id: str = "fc_fixture_1",
+    *,
+    arg_delta_fields: Optional[dict[str, Any]] = None,
 ) -> dict[str, Any]:
+    # Every arguments.delta carries a default ``obfuscation`` field to mirror the
+    # live Codex wire (2026-07-16 shim.log evidence): both lanes stamp an opaque
+    # obfuscation blob on every delta. The shim tolerates it silently (no
+    # unknown_events increment, no stream failure) and strips it from the
+    # downstream Anthropic projection, so emitting it by default is live-faithful
+    # yet byte-transparent to that projection. ``arg_delta_fields`` (keyword-only)
+    # injects/overrides top-level fields on every delta; a caller-supplied
+    # ``obfuscation`` wins over the default. It backs the v1.2.14 R1
+    # obfuscation-tolerance fixture, which pins a distinct value to demonstrate
+    # the tolerance path explicitly.
+    extra = {"obfuscation": _DEFAULT_ARG_DELTA_OBFUSCATION}
+    extra.update(arg_delta_fields or {})
     arguments = '{"file_path":"/daaf/README.md"}'
     builder.add(
         "response.output_item.added",
@@ -313,12 +475,14 @@ def _append_tool_item(
         item_id=item_id,
         output_index=output_index,
         delta='{"file_path":"/daaf/',
+        **extra,
     )
     builder.add(
         "response.function_call_arguments.delta",
         item_id=item_id,
         output_index=output_index,
         delta='README.md"}',
+        **extra,
     )
     # LIVE-WIRE SHAPE (2026-07-16 shim.log evidence): the Codex backend omits
     # `name` on arguments.done — the shim resolves it from output_item.added.
@@ -346,23 +510,29 @@ def _finish_response(
     builder: _EventBuilder,
     response_id: str,
     output: list[dict[str, Any]],
+    *,
+    service_tier: Any = TERMINAL_FIELD_OMITTED,
 ) -> None:
-    builder.add(
-        "response.completed",
-        response={
-            "id": response_id,
-            "status": "completed",
-            "output": output,
-            "usage": dict(USAGE),
-        },
-    )
+    response = {
+        "id": response_id,
+        "status": "completed",
+        "output": output,
+        "usage": dict(USAGE),
+    }
+    # v1.3.7 Fast tests opt in to an exact terminal tier. Omission preserves every
+    # pre-v1.3.7 fixture byte-for-byte; no default tier is inferred from the request.
+    if service_tier is not TERMINAL_FIELD_OMITTED:
+        response["service_tier"] = service_tier
+    builder.add("response.completed", response=response)
 
 
 def _nonstream_response(
     response_id: str,
     output: list[dict[str, Any]],
+    *,
+    service_tier: Any = TERMINAL_FIELD_OMITTED,
 ) -> dict[str, Any]:
-    return {
+    response = {
         "id": response_id,
         "model": "gpt-fixture",
         "status": "completed",
@@ -371,16 +541,17 @@ def _nonstream_response(
         "incomplete_details": None,
         "error": None,
     }
+    # Opt-in only: the shared response fixture remains absent-tier by default.
+    if service_tier is not TERMINAL_FIELD_OMITTED:
+        response["service_tier"] = service_tier
+    return response
 
 
 def central_multipart_scenario(transition: Optional[str] = None) -> Scenario:
     """Capture-faithful two-item fixture with a per-item summary-index reset."""
 
     builder = _EventBuilder()
-    builder.add(
-        "response.created",
-        response={"id": "resp_multipart", "status": "in_progress"},
-    )
+    _start_response(builder, "resp_multipart")
     item_a_parts = [
         {"summary_index": 0, "deltas": ["**Planning ", "tests**"]},
         {"summary_index": 1, "deltas": ["**Validating boundaries**"]},
@@ -414,7 +585,7 @@ def identity_parts_scenario(
     """Build one or more serialized reasoning items from explicit part identities."""
 
     builder = _EventBuilder()
-    builder.add("response.created", response={"id": f"resp_{name}", "status": "in_progress"})
+    _start_response(builder, f"resp_{name}")
     output: list[dict[str, Any]] = []
     position = 0
     while position < len(parts):
@@ -534,7 +705,7 @@ def reopened_thinking_scenario() -> Scenario:
     """Synthetic reasoning -> tool -> reasoning ordering for state-reset coverage."""
 
     builder = _EventBuilder()
-    builder.add("response.created", response={"id": "resp_reopen", "status": "in_progress"})
+    _start_response(builder, "resp_reopen")
     output = [
         _append_reasoning_item(
             builder,
@@ -578,22 +749,37 @@ def full_response_scenario(*, reject_nonstream: bool = False) -> Scenario:
     """Completed Responses SSE whose terminal event carries full output and usage."""
 
     builder = _EventBuilder()
-    builder.add("response.created", response={"id": "resp_full", "status": "in_progress"})
-    output = [
-        _append_reasoning_item(
-            builder,
-            "rs_full",
-            0,
-            [{"summary_index": 0, "deltas": ["Inspecting stream semantics."]}],
-        ),
-        _append_text_item(builder, 1, text="Aggregated answer."),
-        _append_tool_item(
-            builder,
-            2,
-            call_id="call_full_fixture",
-            item_id="fc_full_fixture",
-        ),
-    ]
+    _start_response(builder, "resp_full")
+    reasoning_item = _append_reasoning_item(
+        builder,
+        "rs_full",
+        0,
+        [{"summary_index": 0, "deltas": ["Inspecting stream semantics."]}],
+    )
+    # LIVE-WIRE SHAPE: the backend interleaves benign scaffolding frames between
+    # output items -- a top-level `keepalive` (timing-driven) and a
+    # `response.metadata` lifecycle frame. NOTE: these two do NOT appear in the
+    # Tier 0 capture notes (notes/04, notes/07); both were observed live during
+    # v1.2.14 validation and absorbed into the shim's _KNOWN_EVENT_TYPES allowlist in v1.3.4
+    # (shim :1269-1270), so each is skipped silently and the downstream projection is
+    # byte-identical (unknown_events stays 0). Emitted at ONE representative mid-stream
+    # position in this commonly-exercised positive scenario -- NOT sprayed across every
+    # builder, because live keepalives are timing-driven, not structural. This is the
+    # only positive fixture that exercises these two v1.3.4 allowlist entries
+    # (`grep -c keepalive|response\\.metadata = 0` before this change).
+    builder.add("keepalive")
+    builder.add(
+        "response.metadata",
+        response={"id": "resp_full", "status": "in_progress"},
+    )
+    text_item = _append_text_item(builder, 1, text="Aggregated answer.")
+    tool_item = _append_tool_item(
+        builder,
+        2,
+        call_id="call_full_fixture",
+        item_id="fc_full_fixture",
+    )
+    output = [reasoning_item, text_item, tool_item]
     _finish_response(builder, "resp_full", output)
     return Scenario(
         name="full-response",
@@ -603,6 +789,28 @@ def full_response_scenario(*, reject_nonstream: bool = False) -> Scenario:
     )
 
 
+def heartbeat_text_scenario(name: str = "heartbeat", *, gap_s: float = 0.6) -> Scenario:
+    """A single text turn whose upstream terminal is delayed by a silent gap.
+
+    v1.2.14 (R6): the shim emits message_start and the text block promptly, then the
+    upstream falls silent for ``gap_s`` before the terminal arrives (no disconnect).
+    The downstream heartbeat must bridge that gap with Anthropic ``ping`` frames and
+    the turn must still complete as a clean success.
+    """
+
+    builder = _EventBuilder()
+    _start_response(builder, "resp_heartbeat")
+    output = [_append_text_item(builder, 0, text="Held-open answer.")]
+    _finish_response(builder, "resp_heartbeat", output)
+    scenario = Scenario(
+        name=name,
+        stream_events=builder.events,
+        nonstream_response=_nonstream_response("resp_heartbeat_nonstream", output),
+    )
+    scenario.heartbeat_gap_s = gap_s
+    return scenario
+
+
 def events_scenario(
     name: str,
     events: list[dict[str, Any]],
@@ -631,10 +839,16 @@ def terminal_contract_scenario(
     status: Any = TERMINAL_FIELD_OMITTED,
     output: Any = TERMINAL_FIELD_OMITTED,
     usage: Any = TERMINAL_FIELD_OMITTED,
+    service_tier: Any = TERMINAL_FIELD_OMITTED,
     leading_events: Optional[list[dict[str, Any]]] = None,
     trailing_events: Optional[list[dict[str, Any]]] = None,
 ) -> Scenario:
-    """Build one exact terminal event and matching JSON response for schema tests."""
+    """Build one exact terminal event and matching JSON response for schema tests.
+
+    ``service_tier`` is an opt-in exact wire value for both the streamed terminal
+    object and its matching non-stream JSON object. The omission sentinel leaves all
+    existing fixtures unchanged and deliberately does not encode production mapping.
+    """
 
     response: dict[str, Any] = {"id": f"resp_{name}"}
     if status is not TERMINAL_FIELD_OMITTED:
@@ -643,6 +857,8 @@ def terminal_contract_scenario(
         response["output"] = output
     if usage is not TERMINAL_FIELD_OMITTED:
         response["usage"] = usage
+    if service_tier is not TERMINAL_FIELD_OMITTED:
+        response["service_tier"] = service_tier
     events = list(leading_events or [])
     events.append({"type": event_type, "response": response})
     events.extend(trailing_events or [])
@@ -653,8 +869,18 @@ def terminal_contract_scenario(
     )
 
 
-def raw_sse_scenario(name: str, frames: list[bytes]) -> Scenario:
-    """Build an exact byte-framing fixture for upstream SSE parser contracts."""
+def raw_sse_scenario(
+    name: str,
+    frames: list[bytes],
+    *,
+    preserve_chunks: bool = False,
+) -> Scenario:
+    """Build an exact byte-framing fixture for upstream SSE parser contracts.
+
+    ``preserve_chunks`` emits each supplied frame as its own HTTP transfer chunk so
+    tests can deterministically vary upstream segmentation without joining another
+    full copy of a large logical event in the harness.
+    """
 
     return Scenario(
         name=name,
@@ -662,6 +888,7 @@ def raw_sse_scenario(name: str, frames: list[bytes]) -> Scenario:
         nonstream_response=_nonstream_response(f"resp_{name}_nonstream", []),
         append_done=False,
         raw_stream_frames=list(frames),
+        preserve_raw_stream_chunks=preserve_chunks,
     )
 
 
@@ -670,8 +897,15 @@ def backend_status_scenario(
     status: int,
     *,
     retry_after: Optional[str] = None,
+    error_body: Optional[bytes] = None,
 ) -> Scenario:
-    """Return the same deterministic backend status on every streamed attempt."""
+    """Return the same deterministic backend status on every streamed attempt.
+
+    v1.3.4 (V4-R8): ``error_body`` overrides the fixture error body so a test can script a
+    chosen 400 envelope (e.g. a reasoning-naming body for the stale-blob insurance tests)
+    without hand-rolling ``Scenario(...)``. It defaults to ``None``, which preserves the
+    prior fixture body BYTE-IDENTICALLY so every existing caller is unaffected.
+    """
 
     headers = {"Retry-After": retry_after} if retry_after is not None else {}
     return Scenario(
@@ -682,7 +916,9 @@ def backend_status_scenario(
         stream_status=status,
         stream_headers=headers,
         stream_error_body=(
-            b'{"error":{"type":"fixture_status","message":"fixture rejection"}}'
+            bytes(error_body)
+            if error_body is not None
+            else b'{"error":{"type":"fixture_status","message":"fixture rejection"}}'
         ),
     )
 
@@ -769,33 +1005,190 @@ def sequential_two_tools_scenario() -> Scenario:
     )
 
 
-def incomplete_response_scenario() -> Scenario:
-    """Incomplete Responses SSE whose terminal event carries output and usage."""
+def interleaved_two_tools_scenario() -> Scenario:
+    """Two function calls whose wire events INTERLEAVE (v1.2.14 R3).
+
+    The second tool is ``output_item.added`` while the first is still open, and the
+    two tools' ``function_call_arguments.delta`` events alternate. The tolerant R3
+    scheduler defers the second tool, buffers its args, and drains it after the first
+    tool closes — so the downstream Anthropic stream is two NON-OVERLAPPING
+    ``tool_use`` blocks in ADDED order, each with its own input reconstructed
+    correctly (strict emit, tolerant accept). This is the additive companion to
+    ``sequential_two_tools_scenario`` (which never interleaves on the wire).
+    """
 
     builder = _EventBuilder()
     builder.add(
         "response.created",
-        response={"id": "resp_incomplete", "status": "in_progress"},
+        response={"id": "resp_interleaved", "status": "in_progress"},
     )
-    output = [_append_text_item(builder, 0, text="Truncated fixture answer.")]
+    a_args = '{"file_path":"/daaf/A.md"}'
+    b_args = '{"file_path":"/daaf/B.md"}'
+    # Both tools are ADDED before either finishes: the second opens on the wire while
+    # the first is still open (the shape pre-R3 rejected as a protocol failure).
     builder.add(
-        "response.incomplete",
-        response={
-            "id": "resp_incomplete",
-            "status": "incomplete",
-            "output": output,
-            "usage": dict(USAGE),
-            "incomplete_details": {"reason": "max_output_tokens"},
-        },
+        "response.output_item.added",
+        output_index=0,
+        item={"type": "function_call", "id": "fc_interleaved_1",
+              "call_id": "call_interleaved_1", "name": "Read", "status": "in_progress"},
+    )
+    builder.add(
+        "response.output_item.added",
+        output_index=1,
+        item={"type": "function_call", "id": "fc_interleaved_2",
+              "call_id": "call_interleaved_2", "name": "Read", "status": "in_progress"},
+    )
+    # Interleaved argument deltas across the two open items.
+    builder.add("response.function_call_arguments.delta",
+                item_id="fc_interleaved_1", output_index=0, delta='{"file_path":"/daaf/A')
+    builder.add("response.function_call_arguments.delta",
+                item_id="fc_interleaved_2", output_index=1, delta='{"file_path":"/daaf/B')
+    builder.add("response.function_call_arguments.delta",
+                item_id="fc_interleaved_1", output_index=0, delta='.md"}')
+    builder.add("response.function_call_arguments.delta",
+                item_id="fc_interleaved_2", output_index=1, delta='.md"}')
+    # Live-wire shape: no `name` on arguments.done (resolved from output_item.added).
+    builder.add("response.function_call_arguments.done",
+                item_id="fc_interleaved_1", output_index=0, arguments=a_args)
+    builder.add("response.function_call_arguments.done",
+                item_id="fc_interleaved_2", output_index=1, arguments=b_args)
+    item_a = {"type": "function_call", "id": "fc_interleaved_1",
+              "call_id": "call_interleaved_1", "name": "Read",
+              "arguments": a_args, "status": "completed"}
+    item_b = {"type": "function_call", "id": "fc_interleaved_2",
+              "call_id": "call_interleaved_2", "name": "Read",
+              "arguments": b_args, "status": "completed"}
+    builder.add("response.output_item.done", output_index=0, item=item_a)
+    builder.add("response.output_item.done", output_index=1, item=item_b)
+    output = [item_a, item_b]
+    _finish_response(builder, "resp_interleaved", output)
+    return Scenario(
+        name="interleaved-two-tools",
+        stream_events=builder.events,
+        nonstream_response=_nonstream_response("resp_interleaved_ns", output),
+    )
+
+
+def unknown_wire_scenario(
+    name: str = "unknown-wire",
+    *,
+    unknown_event_type: Optional[str] = "response.audio.delta",
+    unknown_item_type: Optional[str] = "web_search_call",
+) -> Scenario:
+    """A clean success turn that also carries unmodeled wire shapes (v1.2.14 R1).
+
+    The turn still reduces to a well-formed Anthropic success stream (one text
+    block, message_start..message_stop) so downstream completion is unaffected;
+    the unknown SSE event type and the unmodeled ``output_item.added`` item type
+    are only counted for observability (``unknown_events``/``unknown_items`` on
+    the terminal record). Both injections are optional so a caller can isolate a
+    single dimension. ``response.audio.delta`` and ``web_search_call`` are real
+    Responses-family shapes the shim does not model, chosen so the fixture reads
+    as plausible forward-compat wire rather than a synthetic token.
+    """
+
+    builder = _EventBuilder()
+    builder.add(
+        "response.created",
+        response={"id": f"resp_{name}", "status": "in_progress"},
+    )
+    if unknown_event_type is not None:
+        # A non-load-bearing unknown event: it parses as JSON, reaches the
+        # reducer catch-all, is counted, and emits nothing downstream.
+        builder.add(
+            unknown_event_type,
+            item_id="unknown_evt_item",
+            output_index=0,
+            delta="opaque-non-text-payload",
+        )
+    output = [_append_text_item(builder, 0, text="Clean answer despite unknown wire.")]
+    if unknown_item_type is not None:
+        # An output_item.added whose item.type is outside _KNOWN_ITEM_TYPES: it
+        # carries an id (so replay bookkeeping is exercised), is counted as an
+        # unknown item, and opens no Anthropic block. No matching
+        # output_item.done is emitted — the unmodeled item is not in the terminal
+        # output[], so the success reducer uses only the known text block.
+        builder.add(
+            "response.output_item.added",
+            output_index=1,
+            item={
+                "type": unknown_item_type,
+                "id": "item_unknown_1",
+                "status": "in_progress",
+            },
+        )
+    _finish_response(builder, f"resp_{name}", output)
+    return Scenario(
+        name=name,
+        stream_events=builder.events,
+        nonstream_response=_nonstream_response(f"resp_{name}_ns", output),
+    )
+
+
+def obfuscation_tool_scenario(name: str = "obfuscation-tolerance") -> Scenario:
+    """A tool turn whose arguments.delta events carry the live ``obfuscation`` field.
+
+    ``obfuscation`` is a known-but-unmodeled field (v1.2.14 R1): the shim tolerates
+    it silently — no ``unknown_events`` increment, no stream failure — while the
+    tool call still translates to a clean Anthropic ``tool_use`` block. The value
+    string mimics the live Codex obfuscation blob (opaque, bounded).
+    """
+
+    builder = _EventBuilder()
+    builder.add(
+        "response.created",
+        response={"id": f"resp_{name}", "status": "in_progress"},
+    )
+    output = [
+        _append_tool_item(
+            builder,
+            0,
+            call_id="call_obfuscation_1",
+            item_id="fc_obfuscation_1",
+            arg_delta_fields={"obfuscation": "AB12cd34EF56gh78"},
+        ),
+    ]
+    _finish_response(builder, f"resp_{name}", output)
+    return Scenario(
+        name=name,
+        stream_events=builder.events,
+        nonstream_response=_nonstream_response(f"resp_{name}_ns", output),
+    )
+
+
+def incomplete_response_scenario(
+    *,
+    service_tier: Any = TERMINAL_FIELD_OMITTED,
+) -> Scenario:
+    """Incomplete Responses terminal with an optional exact served tier."""
+
+    builder = _EventBuilder()
+    builder.add(
+        "response.created",
+        response={"id": "resp_incomplete", "status": "in_progress"},
     )
+    output = [_append_text_item(builder, 0, text="Truncated fixture answer.")]
+    terminal = {
+        "id": "resp_incomplete",
+        "status": "incomplete",
+        "output": output,
+        "usage": dict(USAGE),
+        "incomplete_details": {"reason": "max_output_tokens"},
+    }
+    if service_tier is not TERMINAL_FIELD_OMITTED:
+        terminal["service_tier"] = service_tier
+    builder.add("response.incomplete", response=terminal)
+    nonstream = {
+        **_nonstream_response("resp_incomplete_nonstream", output),
+        "status": "incomplete",
+        "incomplete_details": {"reason": "max_output_tokens"},
+    }
+    if service_tier is not TERMINAL_FIELD_OMITTED:
+        nonstream["service_tier"] = service_tier
     return Scenario(
         name="incomplete-response",
         stream_events=builder.events,
-        nonstream_response={
-            **_nonstream_response("resp_incomplete_nonstream", output),
-            "status": "incomplete",
-            "incomplete_details": {"reason": "max_output_tokens"},
-        },
+        nonstream_response=nonstream,
     )
 
 
@@ -1117,21 +1510,78 @@ def _wait_for_peer_close(
     return False
 
 
+# v1.3.6 (T2-C): live-realistic default response headers for SUCCESS (2xx) turns.
+# Before this, the mock success path emitted only Content-Type/Content-Length/
+# Connection, so the shim's header-driven observability (upstream_req_id extraction,
+# the chatgpt-lane quota_snapshot) always ran on empty input — live-unrealistic. These
+# sets are keyed by lane and merged DEFAULTS-FIRST in do_POST, so any scenario-injected
+# header (Scenario.stream_headers / attempt_headers) still wins (see the merge sites in
+# do_POST). Applied only to 2xx; error (>=400) responses keep their current header
+# behavior, matching the live captures where the openai 400 dropped x-ratelimit and the
+# chatgpt 4xx carried no x-codex quota surface (notes/04:72, notes/07:41).
+#
+# openai lane (notes/04:70-72, quoted from the live 200 turns): an opaque x-request-id,
+# an integer openai-processing-ms, and all six x-ratelimit-* members.
+_DEFAULT_OPENAI_SUCCESS_HEADERS = {
+    "x-request-id": "req_0f3c8a1b2d4e5f60718293a4b5c6d7e8",
+    "openai-processing-ms": "142",
+    "x-ratelimit-limit-requests": "5000",
+    "x-ratelimit-limit-tokens": "2000000",
+    "x-ratelimit-remaining-requests": "4999",
+    "x-ratelimit-remaining-tokens": "1999872",
+    "x-ratelimit-reset-requests": "12ms",
+    "x-ratelimit-reset-tokens": "8ms",
+}
+# chatgpt (Codex subscription) lane (notes/07:41-52): the request-id header is
+# x-oai-request-id (NOT x-request-id), and a 2xx carries the x-codex-* quota surface with
+# NO x-ratelimit-*. These are REPRESENTATIVE members of an evolving prefix FAMILY, not a
+# stable/exhaustive enumeration (map R8; notes/07:48-52 flags the live set drifting from
+# the survey) — the shim's allowlist is prefix-based (x-codex-*) precisely for this. The
+# secondary-window members are deliberately OMITTED: they were empty/absent on the live
+# capture (notes/07:44), and omitting them keeps the "absent header -> snapshot field
+# renders as '-'" contract that the quota tests pin (test_v131_quota_state.py,
+# test_v1214_heartbeat_and_quota.py) intact when they inject their own primary-only set.
+# Values are canonical (integer used-percent, integer window/reset), so the quota-state
+# writer records well-formed fields and introduces no validator noise.
+_DEFAULT_CHATGPT_SUCCESS_HEADERS = {
+    "x-oai-request-id": "req_5e6f708192a3b4c5d6e7f8091a2b3c4d",
+    "x-codex-plan-type": "pro",
+    "x-codex-active-limit": "premium",
+    "x-codex-primary-used-percent": "37",
+    "x-codex-primary-window-minutes": "10080",
+    "x-codex-primary-reset-after-seconds": "425000",
+    "x-codex-primary-reset-at": "1784984069",
+    "x-codex-credits-has-credits": "true",
+    "x-codex-credits-balance": "0",
+    "x-codex-credits-unlimited": "false",
+}
+
+
+def _default_success_headers(request_path: str) -> dict[str, str]:
+    """Return the lane-appropriate default 2xx header set for a backend request path.
+
+    Lane is read from the request path, which faithfully encodes the lane the shim
+    believes it is on: RealShim points the openai lane at ``{base}/v1`` and the chatgpt
+    lane at ``{base}`` (RealShim.__enter__), and the shim always posts to
+    ``{base}/responses`` — so an openai request arrives as ``/v1/responses`` and a chatgpt
+    request as ``/responses``. This is the same signal a real backend keys on (api.openai
+    .com/v1 vs chatgpt.com/backend-api/codex), so no synthetic lane flag is needed. A fresh
+    dict is returned each call so callers may mutate it while merging.
+    """
+    if request_path.startswith("/v1/"):
+        return dict(_DEFAULT_OPENAI_SUCCESS_HEADERS)
+    return dict(_DEFAULT_CHATGPT_SUCCESS_HEADERS)
+
+
 class MockResponsesServer(AbstractContextManager["MockResponsesServer"]):
-    """Threaded loopback Responses/OAuth server on an OS-assigned port."""
+    """Threaded loopback Responses server on an OS-assigned port."""
 
     def __init__(self, scenario: Scenario) -> None:
         self.scenario = scenario
         self.responses_requests: list[BackendRequest] = []
         self.response_timestamps: list[float] = []
-        self.oauth_requests: list[BackendRequest] = []
         self.first_response_request = threading.Event()
         self.second_response_request = threading.Event()
-        self.oauth_request_received = threading.Event()
-        self.oauth_response_release = threading.Event()
-        self.oauth_response_sent = threading.Event()
-        self.delay_oauth_response = False
-        self.rotated_access_token = _make_fake_jwt(int(time.time()) + 365 * 86400)
         self.body_prefix_flushed = threading.Event()
         self.peer_closed_before_delayed_send = threading.Event()
         self.delayed_send_failed = threading.Event()
@@ -1188,6 +1638,74 @@ def _send_abrupt_sse(self, frames: list[bytes]) -> None:
                     self.wfile.flush()
                 self.close_connection = True
 
+            def _send_chunked_sse(
+                self,
+                frames: list[bytes],
+                extra_headers: Optional[dict[str, str]] = None,
+            ) -> None:
+                # Preserve each non-empty fixture frame as one HTTP transfer chunk.
+                # This is a transport-segmentation control, not SSE framing: callers
+                # may split anywhere, including inside the literal "data: " prefix.
+                self.send_response(200)
+                self.send_header("Content-Type", "text/event-stream")
+                self.send_header("Transfer-Encoding", "chunked")
+                self.send_header("Connection", "close")
+                for name, value in (extra_headers or {}).items():
+                    self.send_header(name, value)
+                self.end_headers()
+                for frame in frames:
+                    if not frame:
+                        raise ValueError("preserved stream chunks must be non-empty")
+                    self.wfile.write(f"{len(frame):X}\r\n".encode("ascii"))
+                    self.wfile.write(frame)
+                    self.wfile.write(b"\r\n")
+                    self.wfile.flush()
+                self.wfile.write(b"0\r\n\r\n")
+                self.wfile.flush()
+                self.close_connection = True
+
+            def _send_chunked_sse_with_gap(
+                self,
+                events: list[dict[str, Any]],
+                append_done: bool,
+                gap_s: float,
+                extra_headers: Optional[dict[str, str]] = None,
+            ) -> None:
+                # v1.2.14 (R6): stream the content frames, then pause `gap_s` seconds
+                # just before the terminal (response.completed/incomplete) event —
+                # WITHOUT disconnecting — so the upstream is silent while the shim's
+                # downstream heartbeat must keep the connection warm with pings. Each
+                # SSE event is one HTTP transfer chunk; the terminal is sent after the
+                # gap and the stream is then closed cleanly.
+                self.send_response(200)
+                self.send_header("Content-Type", "text/event-stream")
+                self.send_header("Transfer-Encoding", "chunked")
+                self.send_header("Connection", "close")
+                for name, value in (extra_headers or {}).items():
+                    self.send_header(name, value)
+                self.end_headers()
+
+                def _write_frame(frame: bytes) -> None:
+                    self.wfile.write(f"{len(frame):X}\r\n".encode("ascii"))
+                    self.wfile.write(frame)
+                    self.wfile.write(b"\r\n")
+                    self.wfile.flush()
+
+                for event in events:
+                    if event.get("type") in ("response.completed", "response.incomplete"):
+                        time.sleep(gap_s)
+                    _write_frame(
+                        (
+                            f"event: {event.get('type', 'message')}\n"
+                            f"data: {json.dumps(event, separators=(',', ':'))}\n\n"
+                        ).encode("utf-8")
+                    )
+                if append_done:
+                    _write_frame(b"data: [DONE]\n\n")
+                self.wfile.write(b"0\r\n\r\n")
+                self.wfile.flush()
+                self.close_connection = True
+
             def _stream_bytes(self, events: list[dict[str, Any]], append_done: bool) -> bytes:
                 frames = []
                 for event in events:
@@ -1334,7 +1852,16 @@ def do_POST(self) -> None:
                             attempt_action = owner.scenario.attempt_statuses[
                                 min(attempt_index, len(owner.scenario.attempt_statuses) - 1)
                             ]
-                        attempt_headers = dict(owner.scenario.stream_headers)
+                        # v1.3.6 (T2-C): seed a 2xx response with the lane-appropriate
+                        # live default header set (openai x-request-id/processing-ms/
+                        # x-ratelimit-*, chatgpt x-oai-request-id + x-codex-* quota),
+                        # then let scenario injections override (defaults first;
+                        # stream_headers and attempt_headers win). Errors (>=400) and
+                        # non-int transport actions keep their prior bare-header behavior.
+                        attempt_headers = {}
+                        if isinstance(attempt_action, int) and 200 <= attempt_action < 400:
+                            attempt_headers.update(_default_success_headers(self.path))
+                        attempt_headers.update(owner.scenario.stream_headers)
                         if owner.scenario.attempt_headers:
                             attempt_headers.update(
                                 owner.scenario.attempt_headers[
@@ -1378,8 +1905,17 @@ def do_POST(self) -> None:
                                 )
                             if owner.scenario.append_done:
                                 frames.append(b"data: [DONE]\n\n")
-                        if owner.scenario.abrupt_eof:
+                        if owner.scenario.heartbeat_gap_s > 0:
+                            self._send_chunked_sse_with_gap(
+                                owner.scenario.stream_events,
+                                owner.scenario.append_done,
+                                owner.scenario.heartbeat_gap_s,
+                                attempt_headers,
+                            )
+                        elif owner.scenario.abrupt_eof:
                             self._send_abrupt_sse(frames)
+                        elif owner.scenario.preserve_raw_stream_chunks:
+                            self._send_chunked_sse(frames, attempt_headers)
                         else:
                             self._send_bytes(
                                 200,
@@ -1394,7 +1930,16 @@ def do_POST(self) -> None:
                             attempt_action = owner.scenario.attempt_statuses[
                                 min(attempt_index, len(owner.scenario.attempt_statuses) - 1)
                             ]
-                        attempt_headers = dict(owner.scenario.stream_headers)
+                        # v1.3.6 (T2-C): seed a 2xx response with the lane-appropriate
+                        # live default header set (openai x-request-id/processing-ms/
+                        # x-ratelimit-*, chatgpt x-oai-request-id + x-codex-* quota),
+                        # then let scenario injections override (defaults first;
+                        # stream_headers and attempt_headers win). Errors (>=400) and
+                        # non-int transport actions keep their prior bare-header behavior.
+                        attempt_headers = {}
+                        if isinstance(attempt_action, int) and 200 <= attempt_action < 400:
+                            attempt_headers.update(_default_success_headers(self.path))
+                        attempt_headers.update(owner.scenario.stream_headers)
                         if owner.scenario.attempt_headers:
                             attempt_headers.update(
                                 owner.scenario.attempt_headers[
@@ -1421,8 +1966,16 @@ def do_POST(self) -> None:
                                 attempt_headers,
                             )
                             return
+                        response_object = owner.scenario.nonstream_response
+                        if owner.scenario.nonstream_responses:
+                            response_object = owner.scenario.nonstream_responses[
+                                min(
+                                    request_number - 1,
+                                    len(owner.scenario.nonstream_responses) - 1,
+                                )
+                            ]
                         payload = json.dumps(
-                            owner.scenario.nonstream_response,
+                            response_object,
                             separators=(",", ":"),
                         ).encode("utf-8")
                         self._send_bytes(
@@ -1432,32 +1985,6 @@ def do_POST(self) -> None:
                             attempt_headers,
                         )
                     return
-                if self.path.endswith("/oauth/token"):
-                    with owner._lock:
-                        owner.oauth_requests.append(record)
-                    owner.oauth_request_received.set()
-                    if owner.delay_oauth_response:
-                        if not owner.oauth_response_release.wait(10.0):
-                            self._send_bytes(
-                                504,
-                                "application/json",
-                                b'{"error":"fixture oauth release timed out"}',
-                            )
-                            return
-                    refreshed = {
-                        "access_token": owner.rotated_access_token,
-                        "refresh_token": FAKE_REFRESH_TOKEN + "_ROTATED",
-                        "id_token": FAKE_ID_TOKEN + "_ROTATED",
-                        "expires_in": 365 * 86400,
-                        "token_type": "Bearer",
-                    }
-                    self._send_bytes(
-                        200,
-                        "application/json",
-                        json.dumps(refreshed, separators=(",", ":")).encode("utf-8"),
-                    )
-                    owner.oauth_response_sent.set()
-                    return
                 self._send_bytes(404, "application/json", b'{"error":"not found"}')
 
         self._server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
@@ -1475,7 +2002,6 @@ def do_POST(self) -> None:
 
     def __exit__(self, exc_type: Any, exc: Any, traceback: Any) -> None:
         self.release_delayed_send.set()
-        self.oauth_response_release.set()
         for release in self._response_request_release.values():
             release.set()
         if self._server is not None:
@@ -1492,10 +2018,6 @@ def __exit__(self, exc_type: Any, exc: Any, traceback: Any) -> None:
     def responses_url(self) -> str:
         return f"{self.base_url}/responses"
 
-    @property
-    def oauth_url(self) -> str:
-        return f"{self.base_url}/oauth/token"
-
     def gate_response_request(
         self,
         request_number: int,
@@ -1511,12 +2033,11 @@ def gate_response_request(
             self._response_request_release[request_number] = release
         return entered, release
 
-    def assert_request_counts(self, responses: int, oauth: int = 0) -> None:
-        actual = (len(self.responses_requests), len(self.oauth_requests))
-        expected = (responses, oauth)
-        if actual != expected:
+    def assert_request_counts(self, responses: int) -> None:
+        actual = len(self.responses_requests)
+        if actual != responses:
             raise AssertionError(
-                f"mock request counts differ: actual={actual!r} expected={expected!r}"
+                f"mock request counts differ: actual={actual!r} expected={responses!r}"
             )
 
 
@@ -1638,11 +2159,15 @@ def __call__(self) -> int:
             "request_start",
             "request_parsed",
             "upstream_attempt",
+            "transport_failure",
             "upstream_retry",
+            "reasoning_cache_stale_strip",
             "upstream_headers",
+            "quota_snapshot",
             "upstream_first_event",
             "downstream_first_content",
             "backend_error",
+            "request_shape",
             "disconnect",
             "terminal",
             "cleanup",
@@ -1791,15 +2316,46 @@ class RealShim(AbstractContextManager["RealShim"]):
         "LC_ALL": "C.UTF-8",
         "TZ": "UTC",
     }
+    _TEST_ENV_OVERRIDE_NAMES = frozenset({
+        "CLAUDE_CODE_DISABLE_FAST_MODE",
+        "DAAF_PROVIDER_SHIM",
+        "SHIM_REASONING_EFFORT",
+        "SHIM_SANITIZE_TOOLS",
+        "SHIM_STRIP_MODEL_PREFIX",
+        "SHIM_TEXT_VERBOSITY",
+        # v1.2.14 (R6): downstream heartbeat interval knob for the heartbeat tests.
+        "SHIM_PING_INTERVAL_S",
+        # v1.3.2: quota-state redirect seam. Seamed to per-instance scratch by default
+        # (see __enter__); individual tests may override it to a chosen path.
+        "DAAF_QUOTA_STATE_FILE",
+        # v1.3.3 (A2-R5): reasoning-cache persistence redirect seam. Per-instance scratch
+        # by default (see __enter__); tests may override it (e.g. a shared path to prove
+        # restart-restore across two RealShim instances).
+        "DAAF_REASONING_CACHE_FILE",
+    })
     _CONTROLLED_CHILD_ENV_NAMES = frozenset({
+        "HOME",
+        "DAAF_PROVIDER_SHIM",
         "SHIM_PORT",
         "SHIM_BACKEND_MODE",
         "SHIM_BACKEND_BASE_URL",
         "SHIM_BACKEND_API_KEY",
         "OPENAI_API_KEY",
         "CODEX_HOME",
-        "SHIM_OAUTH_TOKEN_URL",
-        "SHIM_OAUTH_CLIENT_ID",
+        # v1.3.0: delegated-refresh binary (replaces the deleted SHIM_OAUTH_* seams).
+        # SHIM_CODEX_TIMEOUT_S is intentionally not set by RealShim (the shim's 30s
+        # default suffices for subprocess fixtures); the in-process auth-delegation
+        # tests exercise it via their own env patch.
+        "SHIM_CODEX_BIN",
+        # v1.3.2: quota-state redirect seam, default-provisioned to per-instance scratch
+        # in __enter__ so a spawned production shim never writes the install-shared
+        # quota_state.json. Also test-overridable (see _TEST_ENV_OVERRIDE_NAMES).
+        "DAAF_QUOTA_STATE_FILE",
+        # v1.3.3 (A2-R5): reasoning-cache persistence seam, default-provisioned to
+        # per-instance scratch in __enter__ so a spawned production shim writes its
+        # reasoning cache inside its own isolated scratch dir (never the per-container
+        # $HOME default). Also test-overridable (see _TEST_ENV_OVERRIDE_NAMES).
+        "DAAF_REASONING_CACHE_FILE",
         "HTTP_PROXY",
         "HTTPS_PROXY",
         "ALL_PROXY",
@@ -1817,16 +2373,30 @@ def __init__(
         mode: str,
         *,
         port_selector: Optional[Callable[[], int]] = None,
+        env_overrides: Optional[dict[str, str]] = None,
     ) -> None:
         if mode not in {"openai", "chatgpt"}:
             raise ValueError(f"unsupported shim mode: {mode}")
+        overrides = dict(env_overrides or {})
+        rejected = set(overrides) - self._TEST_ENV_OVERRIDE_NAMES
+        if rejected:
+            raise ValueError(
+                f"test environment override is not allowlisted: {sorted(rejected)!r}"
+            )
+        non_strings = sorted(
+            name for name, value in overrides.items() if not isinstance(value, str)
+        )
+        if non_strings:
+            raise TypeError(
+                f"test environment override values must be strings: {non_strings!r}"
+            )
         self.backend = backend
         self.mode = mode
         self._port_selector = port_selector or _reserve_dynamic_port
+        self._env_overrides = overrides
         self.port = 0
         self.base_url = ""
         self.backend_base_url = ""
-        self.oauth_url = ""
         self.proxy_url = ""
         self.scratch_dir: Optional[Path] = None
         self.auth_path: Optional[Path] = None
@@ -1879,19 +2449,44 @@ def __enter__(self) -> "RealShim":
                 if self.mode == "openai"
                 else self.backend.base_url
             )
-            self.oauth_url = self.backend.oauth_url
-            for url in (self.backend_base_url, self.oauth_url, self.proxy_url):
+            for url in (self.backend_base_url, self.proxy_url):
                 _assert_loopback_url(url)
 
             env.update(
                 {
+                    # v1.3.8: strict GPT tier policy is fixed under HOME. Point each
+                    # real-shim subprocess at its isolated scratch home; no production
+                    # state-path override exists or is inherited.
+                    "HOME": str(self.scratch_dir),
+                    "DAAF_PROVIDER_SHIM": "openai",
                     "SHIM_BACKEND_MODE": self.mode,
                     "SHIM_BACKEND_BASE_URL": self.backend_base_url,
                     "SHIM_BACKEND_API_KEY": FAKE_OPENAI_KEY,
                     "OPENAI_API_KEY": FAKE_OPENAI_KEY,
                     "CODEX_HOME": str(self.scratch_dir),
-                    "SHIM_OAUTH_TOKEN_URL": self.oauth_url,
-                    "SHIM_OAUTH_CLIENT_ID": "app_FAKE_PROVIDER_SHIM_UNITTEST",
+                    # v1.3.2: seam the quota-state write to this instance's scratch dir so
+                    # a spawned production shim's chatgpt-lane 2xx writes never touch the
+                    # install-shared scripts/provider_shim/logs/quota_state.json. This child
+                    # env covers the *spawned-subprocess* context only; in-process module
+                    # loads in the test-runner process are covered separately by the module-
+                    # level os.environ.setdefault seam at the top of this file. Together the
+                    # two seams keep both write contexts off the install-shared file — no
+                    # single seam makes the whole suite hermetic on its own. Tests may
+                    # override via env_overrides (DAAF_QUOTA_STATE_FILE is allowlisted).
+                    "DAAF_QUOTA_STATE_FILE": str(self.scratch_dir / "quota_state.json"),
+                    # v1.3.3 (A2-R5): seam the reasoning-cache persistence write to this
+                    # instance's scratch dir, so a spawned production shim's reasoning cache
+                    # never lands on the per-container $HOME default and each RealShim is
+                    # isolated from every other. Tests may override via env_overrides
+                    # (DAAF_REASONING_CACHE_FILE is allowlisted) — e.g. a path SHARED between
+                    # two RealShim instances to exercise restart-restore end-to-end.
+                    "DAAF_REASONING_CACHE_FILE": str(
+                        self.scratch_dir / "reasoning_cache.json"
+                    ),
+                    # Point delegated refresh at the fake-codex stub. Existing chatgpt
+                    # fixtures seed a far-future token, so the stub is not actually
+                    # invoked; it defaults to a benign no-op if it ever is.
+                    "SHIM_CODEX_BIN": str(FAKE_CODEX_BIN),
                     "HTTP_PROXY": self.proxy_url,
                     "HTTPS_PROXY": self.proxy_url,
                     "ALL_PROXY": self.proxy_url,
@@ -1903,6 +2498,9 @@ def __enter__(self) -> "RealShim":
                     "PYTHONUNBUFFERED": "1",
                 }
             )
+            # Apply only the narrow, constructor-validated behavior knobs. Backend,
+            # credential, proxy, port, and auth-store defaults remain fixed by the rig.
+            env.update(self._env_overrides)
 
             # The reserve/release/start sequence has an unavoidable test-only bind
             # race. Retry at most twice, and only when uvicorn's captured startup
@@ -2093,6 +2691,7 @@ def post_messages(
         tools: Optional[list[dict[str, Any]]] = None,
         messages: Optional[list[dict[str, Any]]] = None,
         headers: Optional[dict[str, str]] = None,
+        timeout: float = 30.0,
     ) -> HTTPResult:
         body: dict[str, Any] = {
             "model": model,
@@ -2109,6 +2708,7 @@ def post_messages(
         return self.post_raw_messages(
             json.dumps(body, separators=(",", ":")).encode("utf-8"),
             headers=headers,
+            timeout=timeout,
         )
 
     def post_raw_messages(
@@ -2128,6 +2728,21 @@ def post_raw_messages(
         )
         return _direct_request(request, timeout=timeout)
 
+    def post_count_tokens(
+        self,
+        body: dict[str, Any],
+        *,
+        timeout: float = 2.0,
+    ) -> HTTPResult:
+        payload = json.dumps(body, separators=(",", ":")).encode("utf-8")
+        request = urllib.request.Request(
+            f"{self.base_url}/v1/messages/count_tokens",
+            data=payload,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        return _direct_request(request, timeout=timeout)
+
     def remove_auth_store(self) -> None:
         """Remove only the fabricated isolated auth store for an auth-error probe."""
 
@@ -2147,7 +2762,7 @@ def stop_for_disconnect_test(self) -> None:
     def assert_offline_contract(self) -> None:
         if self.scratch_dir is None or self.auth_path is None:
             raise AssertionError("shim context was not initialized")
-        for url in (self.base_url, self.backend_base_url, self.oauth_url, self.proxy_url):
+        for url in (self.base_url, self.backend_base_url, self.proxy_url):
             _assert_loopback_url(url)
         if Path(self.child_env["CODEX_HOME"]) != self.scratch_dir:
             raise AssertionError("child CODEX_HOME did not point to isolated scratch")
@@ -2157,14 +2772,20 @@ def assert_offline_contract(self) -> None:
             raise AssertionError("isolated credential directory is outside scripts/scratch")
         if self.child_env.get("OPENAI_API_KEY") != FAKE_OPENAI_KEY:
             raise AssertionError("child OpenAI key is not the fabricated test key")
-        allowed_names = set(self._CONTROLLED_BASE_ENV) | set(self._CONTROLLED_CHILD_ENV_NAMES)
+        allowed_names = (
+            set(self._CONTROLLED_BASE_ENV)
+            | set(self._CONTROLLED_CHILD_ENV_NAMES)
+            | set(self._TEST_ENV_OVERRIDE_NAMES)
+        )
         unexpected_names = set(self.child_env) - allowed_names
         if unexpected_names:
             raise AssertionError(
                 f"child environment contains non-allowlisted names: {sorted(unexpected_names)!r}"
             )
-        if "HOME" in self.child_env:
-            raise AssertionError("child environment inherited HOME unexpectedly")
+        if Path(self.child_env.get("HOME", "")) != self.scratch_dir:
+            raise AssertionError("child HOME did not point to isolated policy scratch")
+        if self.child_env.get("DAAF_PROVIDER_SHIM") != "openai":
+            raise AssertionError("child GPT provider control was not exact")
         for name in ("HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"):
             if self.child_env.get(name) != self.proxy_url:
                 raise AssertionError(f"{name} does not target the closed loopback proxy")
@@ -2269,6 +2890,11 @@ def outer_cancel_after_stream_enter_report() -> dict[str, Any]:
 
     async def exercise() -> dict[str, Any]:
         module_name = f"provider_shim_cancel_probe_{uuid.uuid4().hex}"
+        # v1.3.3 (A2-R5): clear the runner-default reasoning-cache seam before this fresh
+        # in-process load so its import-time restore starts cold (see the ASGI probe and
+        # the harness-top hazard note). This probe drives no reasoning turn so it never
+        # persists, but covering every in-process loader keeps the invariant uniform.
+        _purge_in_process_reasoning_cache_seam()
         spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
         if spec is None or spec.loader is None:
             raise RuntimeError("could not load production shim for ownership probe")
@@ -2360,9 +2986,19 @@ def controlled_asgi_probe(
     disconnect_during_enter: bool = False,
     invalid_request_shape: bool = False,
     raw_request_body: Optional[bytes] = None,
+    raw_scope_headers: Optional[list[tuple[bytes, bytes]]] = None,
     response_status: int = 200,
     response_headers: Optional[dict[str, str]] = None,
     http_version: str = "HTTP/1.1",
+    backend_mode: Optional[str] = None,
+    provider_shim_control: Optional[str] = "openai",
+    backend_mode_control: object = _SELECTED_BACKEND_CONTROL,
+    native_fast_disable: Optional[str] = "1",
+    preexisting_global_policy_enabled: Optional[bool] = None,
+    global_policy_enabled: Optional[bool] = None,
+    global_policy_backend: Optional[str] = None,
+    toggle_policy_on_first_receive: Optional[bool] = None,
+    inject_stale_restored_reasoning: bool = False,
 ) -> ASGIProbeReport:
     """Drive the production app with controlled receive/send and upstream seams.
 
@@ -2371,29 +3007,138 @@ def controlled_asgi_probe(
     cleanup all execute in the production module.
     """
 
+    probe_home_holder: list[Path] = []
+
     async def exercise() -> ASGIProbeReport:
         module_name = f"provider_shim_asgi_probe_{uuid.uuid4().hex}"
+        # NOTE: DAAF_QUOTA_STATE_FILE is deliberately NOT set here. This probe executes
+        # the real request path in-process, so a chatgpt-lane 2xx would drive the real
+        # _write_quota_state; the module-level setdefault at the top of this file already
+        # seams that write to scratch, and mock.patch.dict(..., clear=False) below inherits
+        # the runner-process env, so the seam carries into the freshly loaded module.
+        probe_home = SCRATCH_ROOT / f"provider-shim-policy-home-{uuid.uuid4().hex}"
+        probe_home.mkdir(mode=0o700)
+        probe_home_holder.append(probe_home)
+        selected_backend_mode = backend_mode or (
+            "chatgpt"
+            if auth_store_unavailable or lazy_401_refresh or lazy_401_refresh_failure
+            else "openai"
+        )
+        if selected_backend_mode not in {"openai", "chatgpt"}:
+            raise ValueError(f"unsupported controlled backend mode: {selected_backend_mode}")
+        raw_backend_control = (
+            selected_backend_mode
+            if backend_mode_control is _SELECTED_BACKEND_CONTROL
+            else backend_mode_control
+        )
+        if provider_shim_control is not None and not isinstance(
+            provider_shim_control, str
+        ):
+            raise TypeError("provider shim control must be a string or None")
+        if raw_backend_control is not None and not isinstance(raw_backend_control, str):
+            raise TypeError("backend mode control must be a string or None")
         controlled_env = {
-            "SHIM_BACKEND_MODE": (
-                "chatgpt"
-                if auth_store_unavailable or lazy_401_refresh or lazy_401_refresh_failure
-                else "openai"
-            ),
+            "HOME": str(probe_home),
             "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1/v1",
             "SHIM_BACKEND_API_KEY": FAKE_OPENAI_KEY,
             "OPENAI_API_KEY": FAKE_OPENAI_KEY,
         }
+        if provider_shim_control is not None:
+            controlled_env["DAAF_PROVIDER_SHIM"] = provider_shim_control
+        if raw_backend_control is not None:
+            controlled_env["SHIM_BACKEND_MODE"] = raw_backend_control
+        if native_fast_disable is not None:
+            controlled_env["CLAUDE_CODE_DISABLE_FAST_MODE"] = native_fast_disable
+        if preexisting_global_policy_enabled is not None:
+            policy_dir = probe_home / ".claude" / "provider_shim"
+            policy_dir.mkdir(parents=True, mode=0o700)
+            policy_dir.chmod(0o700)
+            policy_path = policy_dir / "gpt_fast_policy.json"
+            policy_path.write_text(
+                json.dumps(
+                    {
+                        "version": 1,
+                        "backend_mode": selected_backend_mode,
+                        "enabled": preexisting_global_policy_enabled,
+                    },
+                    separators=(",", ":"),
+                ),
+                encoding="utf-8",
+            )
+            policy_path.chmod(0o600)
         if auth_store_unavailable:
             controlled_env["CODEX_HOME"] = str(
                 SCRATCH_ROOT / f"provider-shim-missing-auth-{uuid.uuid4().hex}"
             )
+        else:
+            # Hermeticity: provision the SAME fabricated auth store RealShim writes
+            # for spawned shims, and pin CODEX_HOME to it. Without this pin the
+            # patch.dict(clear=False) below inherits the runner's CODEX_HOME — in
+            # the DAAF container the codex plugin exports one holding a REAL
+            # auth.json (so chatgpt-lane probes silently read live credentials),
+            # while CI runners export none (so the chatgpt lane fails closed with
+            # upstream_calls == 0). Both environments must see the fixture.
+            fake_access = _make_fake_jwt(int(time.time()) + 365 * 86400)
+            probe_auth = {
+                "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+                "auth_mode": "chatgpt",
+                "last_refresh": "2099-01-01T00:00:00.000000000Z",
+                "tokens": {
+                    "access_token": fake_access,
+                    "account_id": FAKE_ACCOUNT_ID,
+                    "id_token": FAKE_ID_TOKEN,
+                    "refresh_token": FAKE_REFRESH_TOKEN,
+                },
+            }
+            probe_auth_path = probe_home / "auth.json"
+            probe_auth_path.write_text(json.dumps(probe_auth), encoding="utf-8")
+            probe_auth_path.chmod(0o600)
+            controlled_env["CODEX_HOME"] = str(probe_home)
         with mock.patch.dict(os.environ, controlled_env, clear=False):
+            # Absence is itself a strict-boundary fixture. patch.dict(clear=False) keeps
+            # the runner's hermetic quota/reasoning seams, so explicitly remove only the
+            # two raw controls when a test requests omission; the context restores them.
+            if provider_shim_control is None:
+                os.environ.pop("DAAF_PROVIDER_SHIM", None)
+            if raw_backend_control is None:
+                os.environ.pop("SHIM_BACKEND_MODE", None)
+            # v1.3.3 (A2-R5): clear the runner-default reasoning-cache seam BEFORE this
+            # fresh module load so its import-time restore cannot pick up entries a prior
+            # in-process load persisted (which would leak call_ids and flip miss
+            # assertions). Runs inside the patch so it honors any outer per-test seam
+            # override. The quota seam needs no such purge (write-only, no import restore).
+            _purge_in_process_reasoning_cache_seam()
             spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
             if spec is None or spec.loader is None:
                 raise RuntimeError("could not load production shim for ASGI probe")
             module = importlib.util.module_from_spec(spec)
             spec.loader.exec_module(module)
 
+        if global_policy_enabled is not None:
+            module._GPT_FAST_STORE.write(
+                global_policy_backend or selected_backend_mode,
+                global_policy_enabled,
+            )
+
+        if inject_stale_restored_reasoning:
+            original_translation = module._anthropic_to_responses_request
+
+            def translation_with_restored_reasoning(*args, **kwargs):
+                translated = list(original_translation(*args, **kwargs))
+                translated[0]["input"].insert(
+                    0,
+                    {
+                        "type": "reasoning",
+                        "id": "rs_controlled_stale",
+                        "encrypted_content": "controlled-fixture-only",
+                    },
+                )
+                translated[5] = {"rs_controlled_stale"}
+                translated[6] = {"call_controlled_stale"}
+                return tuple(translated)
+
+            module._anthropic_to_responses_request = translation_with_restored_reasoning
+
         if lazy_401_refresh or lazy_401_refresh_failure:
             async def controlled_backend_headers(*args, **kwargs):
                 if lazy_401_refresh_failure and kwargs.get("force_token_refresh"):
@@ -2406,6 +3151,16 @@ async def controlled_backend_headers(*args, **kwargs):
 
             module._build_backend_headers = controlled_backend_headers
 
+        auth_calls = 0
+        original_build_backend_headers = module._build_backend_headers
+
+        async def observed_backend_headers(*args, **kwargs):
+            nonlocal auth_calls
+            auth_calls += 1
+            return await original_build_backend_headers(*args, **kwargs)
+
+        module._build_backend_headers = observed_backend_headers
+
         if translation_failure:
             def controlled_translation_failure(*args, **kwargs):
                 raise TypeError("controlled request translation failure")
@@ -2429,6 +3184,7 @@ def controlled_translation_failure(*args, **kwargs):
             for name, value in (response_headers or {}).items()
         ]
         upstream_calls = 0
+        outbound_payloads: list[dict[str, Any]] = []
         stream_close_calls = 0
         stream_close_attempts: list[int] = []
         close_after_cleanup: list[bool] = []
@@ -2437,10 +3193,37 @@ def controlled_translation_failure(*args, **kwargs):
         selected_outcomes = list(attempt_outcomes or [response_status])
         selected_close_failures = set(close_fail_attempts or set())
 
+        class MidbodyReadTimeoutStream(module.httpx.AsyncByteStream):
+            async def __aiter__(self):
+                yield (
+                    b'event: response.created\n'
+                    b'data: {"type":"response.created","response":'
+                    b'{"id":"resp_midbody","status":"in_progress"}}\n\n'
+                )
+                raise module.httpx.ReadTimeout("injected mid-body read timeout")
+
         def response_for_attempt(attempt_number: int):
             outcome = selected_outcomes[min(attempt_number - 1, len(selected_outcomes) - 1)]
-            if outcome == "transport":
-                raise module.httpx.ConnectError("injected stream transport failure")
+            injected_transport_errors = {
+                "transport": module.httpx.ConnectError,
+                "connect_timeout": module.httpx.ConnectTimeout,
+                "read_timeout": module.httpx.ReadTimeout,
+                "write_timeout": module.httpx.WriteTimeout,
+                "pool_timeout": module.httpx.PoolTimeout,
+            }
+            if outcome in injected_transport_errors:
+                error_class = injected_transport_errors[outcome]
+                raise error_class("injected transport failure")
+            if outcome == "midbody_read_timeout":
+                return module.httpx.Response(
+                    200,
+                    headers=headers,
+                    stream=MidbodyReadTimeoutStream(),
+                    request=module.httpx.Request(
+                        "POST", "http://127.0.0.1:1/v1/responses"
+                    ),
+                    extensions={"http_version": http_version.encode("ascii", "replace")},
+                )
             status = int(outcome)
             content = (
                 stream_payload
@@ -2465,10 +3248,12 @@ def response_for_attempt(attempt_number: int):
             )
 
         class ProbeStreamContext:
-            def __init__(self, attempt_number: int):
+            def __init__(self, attempt_number: int, payload: dict[str, Any]):
                 self.attempt_number = attempt_number
+                self.payload = payload
 
             async def __aenter__(self):
+                outbound_payloads.append(copy.deepcopy(self.payload))
                 if disconnect_during_enter:
                     receive_queue.put_nowait({"type": "http.disconnect"})
                     await upstream_hold.wait()
@@ -2496,11 +3281,12 @@ class ProbeClient:
             def stream(self, *args, **kwargs):
                 nonlocal upstream_calls
                 upstream_calls += 1
-                return ProbeStreamContext(upstream_calls)
+                return ProbeStreamContext(upstream_calls, kwargs.get("json"))
 
             async def post(self, *args, **kwargs):
                 nonlocal upstream_calls
                 upstream_calls += 1
+                outbound_payloads.append(copy.deepcopy(kwargs.get("json")))
                 return response_for_attempt(upstream_calls)
 
         original_client = module._client
@@ -2562,7 +3348,18 @@ async def observed_settle_owned_task(task, cancel=False):
             if pure_disconnect:
                 receive_queue.put_nowait({"type": "http.disconnect"})
 
+        first_receive = True
+
         async def receive() -> dict[str, Any]:
+            nonlocal first_receive
+            if first_receive:
+                first_receive = False
+                if toggle_policy_on_first_receive is not None:
+                    # app() has already created lifecycle state and captured its one
+                    # policy snapshot before its first body read reaches this seam.
+                    module._GPT_FAST_STORE.write(
+                        selected_backend_mode, toggle_policy_on_first_receive
+                    )
             return await receive_queue.get()
 
         messages: list[dict[str, Any]] = []
@@ -2649,7 +3446,14 @@ async def observed_asyncio_wait(fs, *, timeout=None, return_when=asyncio.ALL_COM
 
         raised: Optional[str] = None
         cancelled = False
-        scope = {"type": "http", "method": "POST", "path": "/v1/messages"}
+        # Raw ASGI pairs preserve duplicate names, original header-name case, and malformed
+        # bytes. Normal HTTP helpers stay unchanged and continue to delegate parsing to uvicorn.
+        scope = {
+            "type": "http",
+            "method": "POST",
+            "path": "/v1/messages",
+            "headers": list(raw_scope_headers or []),
+        }
         if send_action == "same_turn_terminal_disconnect":
             asyncio.wait = observed_asyncio_wait
         task = asyncio.create_task(module.app(scope, receive, send))
@@ -2685,13 +3489,16 @@ async def observed_asyncio_wait(fs, *, timeout=None, return_when=asyncio.ALL_COM
         lifecycle = parse_lifecycle_logs(logs)
         if lifecycle:
             assert_lifecycle_log_contract(lifecycle)
-        return ASGIProbeReport(
+        report = ASGIProbeReport(
             messages=messages,
             logs=logs,
             lifecycle=lifecycle,
             raised=raised,
             cancelled=cancelled,
             upstream_calls=upstream_calls,
+            auth_calls=auth_calls,
+            outbound_payloads=outbound_payloads,
+            gpt_service_tier_health=module._gpt_service_tier_health_block(),
             stream_close_calls=stream_close_calls,
             stream_close_attempts=stream_close_attempts,
             close_after_cleanup=close_after_cleanup,
@@ -2702,8 +3509,13 @@ async def observed_asyncio_wait(fs, *, timeout=None, return_when=asyncio.ALL_COM
             terminal_tie_children_done=terminal_tie_children_done,
             pending_task_count=pending_task_count,
         )
+        return report
 
-    return asyncio.run(exercise())
+    try:
+        return asyncio.run(exercise())
+    finally:
+        if probe_home_holder:
+            shutil.rmtree(probe_home_holder[0], ignore_errors=True)
 
 
 def parse_typed_sse(payload: bytes | str) -> list[TypedSSEFrame]:
diff --git a/tests/provider_shim/fake_codex.py b/tests/provider_shim/fake_codex.py
new file mode 100755
index 00000000..55f803a7
--- /dev/null
+++ b/tests/provider_shim/fake_codex.py
@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Fake `codex` CLI stub for provider-shim auth-delegation tests.
+
+The production shim (v1.3.0+) no longer refreshes ChatGPT OAuth tokens itself;
+it DELEGATES refresh to the codex CLI by spawning ``codex login status`` and then
+re-reading ``$CODEX_HOME/auth.json``. This stub stands in for that binary so the
+tests can drive every delegated-refresh outcome deterministically, entirely
+offline, with no real network or real credentials.
+
+It is injected via the ``SHIM_CODEX_BIN`` environment variable and behaves per the
+``FAKE_CODEX_MODE`` environment variable:
+
+  refresh-success  Rewrite auth.json's access_token with a fresh (far-future exp)
+                   fabricated JWT, preserving every other field; print the
+                   logged-in banner; exit 0. Models codex performing the refresh.
+  noop             Print the logged-in banner; leave auth.json untouched; exit 0.
+                   Models codex deciding no refresh is needed (or being unable to
+                   change the on-disk token). This is the default when unset.
+  not-logged-in    Print "Not logged in"; exit 1. Models a logged-out store.
+  hang             Sleep far longer than any test timeout. Exercises the shim's
+                   SHIM_CODEX_TIMEOUT_S kill path.
+
+Every invocation appends one line to ``$CODEX_HOME/.codex_calls`` so tests can
+assert single-flight behavior (the delegated refresh spawns codex exactly once
+under concurrency). All tokens/markers are transparently fabricated test-only
+values — no real secret material is ever produced or read.
+"""
+
+import base64
+import json
+import os
+import sys
+import time
+
+
+def _b64url(raw):
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+
+def _make_fresh_jwt(ttl_seconds):
+    # Minimal JWT the shim's _jwt_exp() can decode: header.payload.signature with a
+    # base64url payload carrying a future `exp`. Signature is inert fabricated bytes.
+    header = _b64url(json.dumps({"alg": "none", "typ": "JWT"}).encode("utf-8"))
+    payload = _b64url(
+        json.dumps(
+            {
+                "exp": int(time.time()) + int(ttl_seconds),
+                "marker": "FABRICATED_FAKE_CODEX_STUB_ONLY",
+            }
+        ).encode("utf-8")
+    )
+    signature = _b64url(b"fabricated-fake-codex-signature")
+    return f"{header}.{payload}.{signature}"
+
+
+codex_home = os.environ.get("CODEX_HOME", "")
+mode = os.environ.get("FAKE_CODEX_MODE", "noop").strip() or "noop"
+
+# Invocation counter (single-flight assertions). Best-effort; never fatal.
+if codex_home:
+    try:
+        with open(os.path.join(codex_home, ".codex_calls"), "a", encoding="utf-8") as f:
+            f.write(f"{mode}\n")
+    except OSError:
+        pass
+
+if mode == "hang":
+    time.sleep(3600)
+    sys.exit(0)
+
+if mode == "not-logged-in":
+    sys.stderr.write("Not logged in\n")
+    sys.exit(1)
+
+if mode == "refresh-success":
+    auth_path = os.path.join(codex_home, "auth.json")
+    try:
+        with open(auth_path, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        tokens = data.get("tokens")
+        if not isinstance(tokens, dict):
+            tokens = {}
+            data["tokens"] = tokens
+        tokens["access_token"] = _make_fresh_jwt(3600)
+        # Codex writes atomically; a plain write is sufficient for the test store.
+        with open(auth_path, "w", encoding="utf-8") as f:
+            json.dump(data, f)
+        os.chmod(auth_path, 0o600)
+    except (OSError, ValueError) as exc:
+        sys.stderr.write(f"fake-codex refresh-success failed: {type(exc).__name__}\n")
+        sys.exit(1)
+    sys.stdout.write("Logged in using ChatGPT\n")
+    sys.exit(0)
+
+# Default / "noop": codex reports logged-in but changes nothing on disk.
+sys.stdout.write("Logged in using ChatGPT\n")
+sys.exit(0)
diff --git a/tests/provider_shim/test_fast_priority_translation.py b/tests/provider_shim/test_fast_priority_translation.py
new file mode 100644
index 00000000..2808d723
--- /dev/null
+++ b/tests/provider_shim/test_fast_priority_translation.py
@@ -0,0 +1,644 @@
+"""Deterministic v1.3.9 contracts for canonical GPT tier translation.
+
+Every request drives the production ASGI app or a real production-shim subprocess.
+The loopback fixtures inject exact upstream values; they prove serializer/parser/state
+behavior only and do not reproduce or claim provider acceptance. No test in this module
+makes a live provider request.
+
+Fixture provenance:
+* The inbound ``speed`` plus beta-marker contract comes from current Anthropic
+  documentation/source reviewed for the v1.3.7 design.
+* Both exact GPT routes use canonical OpenAI Responses request value ``priority``;
+  ChatGPT presents that wire value as friendly Fast under plan/credit semantics.
+* The served-tier fixtures are deterministic exact-value probes. Canonical served
+  ``priority`` is current vocabulary; exact served ``fast`` is compatibility-only parser
+  coverage. There is no claimed live served-Fast capture. The historical subscription
+  probe that requested ``priority`` and was served ``default`` remains negative evidence.
+"""
+
+from __future__ import annotations
+
+import copy
+import json
+import unittest
+import urllib.parse
+
+from ._loopback_harness import (
+    READ_TOOL,
+    USAGE,
+    MockResponsesServer,
+    RealShim,
+    controlled_asgi_probe,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+    terminal_contract_scenario,
+)
+
+
+_FAST_BETA = "fast-mode-2026-02-01"
+_FAST_HEADER = [(b"anthropic-beta", _FAST_BETA.encode("ascii"))]
+_ABSENT_USAGE = {
+    "input_tokens": USAGE["input_tokens"],
+    "output_tokens": USAGE["output_tokens"],
+    "cache_read_input_tokens": 0,
+    "cache_creation_input_tokens": 0,
+}
+
+
+def _request_body(*, stream: bool, speed_marker: object = None) -> bytes:
+    body: dict[str, object] = {
+        "model": "gpt-fixture",
+        "max_tokens": 256,
+        "stream": stream,
+        "messages": [{"role": "user", "content": "Exercise Fast translation."}],
+    }
+    if speed_marker is not None:
+        body["speed"] = speed_marker
+    return json.dumps(body, separators=(",", ":")).encode("utf-8")
+
+
+def _fast_body(*, stream: bool) -> bytes:
+    return _request_body(stream=stream, speed_marker="fast")
+
+
+def _asgi_status_and_json(report) -> tuple[int, dict]:
+    starts = [
+        message
+        for message in report.messages
+        if message.get("type") == "http.response.start"
+    ]
+    if len(starts) != 1:
+        raise AssertionError(f"expected one ASGI response start, got {starts!r}")
+    body = b"".join(
+        message.get("body", b"")
+        for message in report.messages
+        if message.get("type") == "http.response.body"
+    )
+    return starts[0]["status"], json.loads(body)
+
+
+def _asgi_sse_events(report) -> list[dict]:
+    payload = b"".join(
+        message.get("body", b"")
+        for message in report.messages
+        if message.get("type") == "http.response.body"
+    )
+    frames = parse_typed_sse(payload)
+    lifecycle_report(frames)
+    return [frame.data for frame in frames if isinstance(frame.data, dict)]
+
+
+def _terminal_fields(lines) -> dict[str, str]:
+    terminals = [line.fields for line in lines if line.event == "terminal"]
+    if len(terminals) != 1:
+        raise AssertionError(f"expected one terminal lifecycle line, got {terminals!r}")
+    return terminals[0]
+
+
+def _terminal_scenario(name: str, event_type: str, service_tier=...):
+    kwargs = {
+        "status": "completed" if event_type == "response.completed" else "incomplete",
+        "output": [],
+        "usage": dict(USAGE),
+    }
+    if service_tier is not ...:
+        kwargs["service_tier"] = service_tier
+    return terminal_contract_scenario(name, event_type, **kwargs)
+
+
+class FastRequestTranslationTests(unittest.TestCase):
+    maxDiff = 16000
+
+    def test_fast_beta_maps_to_route_specific_outbound_tier(self) -> None:
+        # These are current docs/source-derived request contracts. The response fixtures
+        # are deterministic and do not claim a live served-Fast observation.
+        cases = (
+            ("openai", "priority", "priority"),
+            ("chatgpt", "priority", "priority"),
+        )
+        for mode, requested_tier, served_fixture in cases:
+            with self.subTest(mode=mode):
+                scenario = _terminal_scenario(
+                    f"fast-route-{mode}",
+                    "response.completed",
+                    served_fixture,
+                )
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        result = shim.post_raw_messages(
+                            _fast_body(stream=False),
+                            headers={"anthropic-beta": _FAST_BETA},
+                        )
+                        self.assertEqual(result.status, 200, result.text)
+                        backend.assert_request_counts(responses=1)
+                        outbound = backend.responses_requests[0].body
+                        self.assertEqual(outbound["service_tier"], requested_tier)
+                        self.assertEqual(result.json()["usage"]["speed"], "fast")
+                        fields = _terminal_fields(lifecycle_for_response(shim, result))
+                        self.assertEqual(fields["requested_service_tier"], requested_tier)
+                        self.assertEqual(fields["served_service_tier"], served_fixture)
+                        shim.assert_offline_contract()
+
+    def test_fast_without_beta_is_local_400_before_upstream(self) -> None:
+        report = controlled_asgi_probe(
+            stream=False,
+            raw_request_body=_fast_body(stream=False),
+        )
+        status, payload = _asgi_status_and_json(report)
+        self.assertEqual(status, 400)
+        self.assertEqual(payload["error"]["type"], "invalid_request_error")
+        self.assertIn("requires anthropic beta", payload["error"]["message"])
+        self.assertEqual(report.upstream_calls, 0)
+        self.assertEqual(report.outbound_payloads, [])
+
+    def test_invalid_and_non_string_speed_are_local_400_before_upstream(self) -> None:
+        invalid_values = (
+            None,
+            0,
+            True,
+            {},
+            [],
+            "standard",
+            "FAST",
+            " fast",
+            "fast ",
+            "fast\x00",
+        )
+        for value in invalid_values:
+            with self.subTest(speed=value):
+                body = {
+                    "model": "gpt-fixture",
+                    "max_tokens": 256,
+                    "stream": False,
+                    "messages": [{"role": "user", "content": "invalid speed"}],
+                    "speed": value,
+                }
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=json.dumps(
+                        body, separators=(",", ":")
+                    ).encode("utf-8"),
+                    raw_scope_headers=_FAST_HEADER,
+                )
+                status, payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 400)
+                self.assertEqual(payload["error"]["type"], "invalid_request_error")
+                self.assertEqual(payload["error"]["message"], "unsupported speed value")
+                self.assertEqual(report.upstream_calls, 0)
+                self.assertEqual(report.outbound_payloads, [])
+
+    def test_duplicate_top_level_speed_rejected_narrowly_before_auth_or_upstream(self) -> None:
+        duplicate_speed_bodies = (
+            (
+                "identical",
+                b'{"model":"gpt-fixture","max_tokens":256,"stream":false,'
+                b'"speed":"fast","speed":"fast","messages":'
+                b'[{"role":"user","content":"duplicate speed"}]}',
+            ),
+            (
+                "conflicting",
+                b'{"model":"gpt-fixture","max_tokens":256,"stream":false,'
+                b'"speed":"standard","speed":"fast","messages":'
+                b'[{"role":"user","content":"duplicate speed"}]}',
+            ),
+        )
+        for label, raw_body in duplicate_speed_bodies:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=raw_body,
+                    raw_scope_headers=_FAST_HEADER,
+                )
+                status, payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 400)
+                self.assertEqual(payload["error"]["type"], "invalid_request_error")
+                self.assertEqual(
+                    payload["error"]["message"], "duplicate top-level speed field"
+                )
+                self.assertEqual(report.auth_calls, 0)
+                self.assertEqual(report.upstream_calls, 0)
+                self.assertEqual(report.outbound_payloads, [])
+
+        unrelated_duplicate = controlled_asgi_probe(
+            stream=False,
+            raw_request_body=(
+                b'{"model":"gpt-first","model":"gpt-last","max_tokens":256,'
+                b'"stream":false,"messages":'
+                b'[{"role":"user","content":"ordinary duplicate"}]}'
+            ),
+        )
+        status, _payload = _asgi_status_and_json(unrelated_duplicate)
+        self.assertEqual(status, 200)
+        self.assertEqual(unrelated_duplicate.auth_calls, 1)
+        self.assertEqual(unrelated_duplicate.upstream_calls, 1)
+        self.assertEqual(unrelated_duplicate.outbound_payloads[0]["model"], "gpt-last")
+        self.assertNotIn("service_tier", unrelated_duplicate.outbound_payloads[0])
+
+        nested_speed_duplicate = controlled_asgi_probe(
+            stream=False,
+            raw_request_body=(
+                b'{"model":"gpt-fixture","max_tokens":256,"stream":false,'
+                b'"messages":[{"role":"user","content":"nested duplicate",'
+                b'"speed":"first","speed":"last"}]}'
+            ),
+        )
+        status, _payload = _asgi_status_and_json(nested_speed_duplicate)
+        self.assertEqual(status, 200)
+        self.assertEqual(nested_speed_duplicate.auth_calls, 1)
+        self.assertEqual(nested_speed_duplicate.upstream_calls, 1)
+        self.assertNotIn("service_tier", nested_speed_duplicate.outbound_payloads[0])
+
+    def test_beta_without_speed_and_ordinary_request_omit_service_tier(self) -> None:
+        for label, headers in (
+            ("beta-only", _FAST_HEADER),
+            ("ordinary", []),
+        ):
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=_request_body(stream=False),
+                    raw_scope_headers=headers,
+                )
+                status, payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 200)
+                self.assertEqual(payload["usage"], _ABSENT_USAGE)
+                self.assertEqual(report.upstream_calls, 1)
+                self.assertEqual(len(report.outbound_payloads), 1)
+                self.assertNotIn("service_tier", report.outbound_payloads[0])
+                terminal = _terminal_fields(report.lifecycle)
+                self.assertEqual(terminal["requested_service_tier"], "-")
+                self.assertEqual(terminal["served_service_tier"], "-")
+
+    def test_raw_asgi_beta_parsing_preserves_duplicate_comma_and_exactness(self) -> None:
+        accepted = (
+            (
+                "duplicate-case-insensitive-name",
+                [
+                    (b"anthropic-beta", b"unrelated-beta"),
+                    (b"AnThRoPiC-BeTa", _FAST_BETA.encode("ascii")),
+                ],
+            ),
+            (
+                "comma-list",
+                [
+                    (
+                        b"ANTHROPIC-BETA",
+                        f"unrelated-beta, {_FAST_BETA}, another-beta".encode("ascii"),
+                    )
+                ],
+            ),
+        )
+        for label, headers in accepted:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=_fast_body(stream=False),
+                    raw_scope_headers=headers,
+                )
+                status, _payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 200)
+                self.assertEqual(report.upstream_calls, 1)
+                self.assertEqual(report.outbound_payloads[0]["service_tier"], "priority")
+
+        rejected = (
+            (
+                "beta-token-case-sensitive",
+                [(b"anthropic-beta", b"Fast-mode-2026-02-01")],
+            ),
+            (
+                "malformed-value-bytes",
+                [(b"anthropic-beta", b"\xfffast-mode-2026-02-01")],
+            ),
+            (
+                "malformed-name-bytes",
+                [(b"anthropic-beta\xff", _FAST_BETA.encode("ascii"))],
+            ),
+        )
+        for label, headers in rejected:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=_fast_body(stream=False),
+                    raw_scope_headers=headers,
+                )
+                status, _payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 400)
+                self.assertEqual(report.upstream_calls, 0)
+                self.assertEqual(report.outbound_payloads, [])
+
+    def test_beta_token_trims_only_http_sp_htab_ows(self) -> None:
+        token = _FAST_BETA.encode("ascii")
+        accepted = (
+            ("sp-and-htab-around-token", [(b"anthropic-beta", b" \t" + token + b"\t ")]),
+            (
+                "sp-and-htab-in-comma-list",
+                [(b"anthropic-beta", b"unrelated,\t" + token + b" \t,another")],
+            ),
+        )
+        for label, headers in accepted:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=_fast_body(stream=False),
+                    raw_scope_headers=headers,
+                )
+                status, _payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 200)
+                self.assertEqual(report.upstream_calls, 1)
+                self.assertEqual(report.outbound_payloads[0]["service_tier"], "priority")
+
+        rejected = (
+            ("vertical-tab-leading", b"\x0b" + token),
+            ("vertical-tab-trailing", token + b"\x0b"),
+            ("form-feed-leading", b"\x0c" + token),
+            ("form-feed-trailing", token + b"\x0c"),
+            ("carriage-return-leading", b"\r" + token),
+            ("line-feed-trailing", token + b"\n"),
+            ("nul-leading", b"\x00" + token),
+            ("delete-trailing", token + b"\x7f"),
+        )
+        for label, tainted_token in rejected:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    raw_request_body=_fast_body(stream=False),
+                    raw_scope_headers=[(b"anthropic-beta", tainted_token)],
+                )
+                status, payload = _asgi_status_and_json(report)
+                self.assertEqual(status, 400)
+                self.assertEqual(payload["error"]["type"], "invalid_request_error")
+                self.assertIn("requires anthropic beta", payload["error"]["message"])
+                self.assertEqual(report.upstream_calls, 0)
+                self.assertEqual(report.outbound_payloads, [])
+
+    def test_fast_adds_only_tier_to_existing_model_reasoning_and_tools_translation(self) -> None:
+        scenario = _terminal_scenario(
+            "translation-unchanged",
+            "response.completed",
+            "priority",
+        )
+        body = {
+            "model": "gpt-fixture#low",
+            "max_tokens": 256,
+            "stream": False,
+            "messages": [{"role": "user", "content": "translate unchanged"}],
+            "tools": [READ_TOOL],
+            "tool_choice": {"type": "tool", "name": "Read"},
+        }
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                ordinary = shim.post_raw_messages(
+                    json.dumps(body, separators=(",", ":")).encode("utf-8")
+                )
+                self.assertEqual(ordinary.status, 200, ordinary.text)
+                fast_body = dict(body)
+                fast_body["speed"] = "fast"
+                fast = shim.post_raw_messages(
+                    json.dumps(fast_body, separators=(",", ":")).encode("utf-8"),
+                    headers={"Anthropic-Beta": _FAST_BETA},
+                )
+                self.assertEqual(fast.status, 200, fast.text)
+                backend.assert_request_counts(responses=2)
+                ordinary_out = copy.deepcopy(backend.responses_requests[0].body)
+                fast_out = copy.deepcopy(backend.responses_requests[1].body)
+                self.assertNotIn("service_tier", ordinary_out)
+                self.assertEqual(fast_out.pop("service_tier"), "priority")
+                self.assertEqual(fast_out, ordinary_out)
+                self.assertEqual(fast_out["model"], "gpt-fixture")
+                self.assertEqual(fast_out["reasoning"], {"summary": "auto", "effort": "low"})
+                self.assertEqual(fast_out["tools"][0]["name"], "Read")
+                self.assertEqual(
+                    fast_out["tool_choice"], {"type": "function", "name": "Read"}
+                )
+
+
+class ActualTierProjectionTests(unittest.TestCase):
+    maxDiff = 16000
+
+    def test_nonstream_actual_tier_exactness_and_absent_usage_compatibility(self) -> None:
+        # Explicit oracle table: exact terminal values are injected; expected Anthropic
+        # speed is asserted directly. This is data, not a helper that reimplements mapping.
+        cases = (
+            ("priority", "fast"),
+            ("fast", "fast"),
+            ("default", "standard"),
+            ("flex", "standard"),
+            ("scale", "standard"),
+            ("auto", "standard"),
+            (..., None),
+            ("unknown", None),
+            (7, None),
+            ("Priority", None),
+            (" priority", None),
+            ("priority ", None),
+            ("priority\x00", None),
+        )
+        scenario = _terminal_scenario("nonstream-tier-sequence", "response.completed")
+        responses = []
+        for tier, _expected_speed in cases:
+            response = copy.deepcopy(scenario.nonstream_response)
+            if tier is not ...:
+                response["service_tier"] = tier
+            responses.append(response)
+        scenario.nonstream_responses = responses
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                for index, (tier, expected_speed) in enumerate(cases):
+                    with self.subTest(index=index, tier=tier):
+                        result = shim.post_messages(stream=False)
+                        self.assertEqual(result.status, 200, result.text)
+                        usage = result.json()["usage"]
+                        expected_usage = dict(_ABSENT_USAGE)
+                        if expected_speed is not None:
+                            expected_usage["speed"] = expected_speed
+                        self.assertEqual(usage, expected_usage)
+                        fields = _terminal_fields(lifecycle_for_response(shim, result))
+                        if tier is ... or not isinstance(tier, str):
+                            self.assertEqual(fields["served_service_tier"], "-")
+                        else:
+                            expected_telemetry = {
+                                " priority": "priority",
+                                "priority ": "priority",
+                                "priority\x00": "priority",
+                            }.get(tier, tier)
+                            self.assertEqual(
+                                urllib.parse.unquote(fields["served_service_tier"]),
+                                expected_telemetry,
+                            )
+                backend.assert_request_counts(responses=len(cases))
+                shim.assert_offline_contract()
+
+    def test_streaming_exact_tiers_only_appear_on_terminal_message_delta(self) -> None:
+        cases = (
+            ("priority", "fast"),
+            ("fast", "fast"),
+            ("default", "standard"),
+            ("flex", "standard"),
+            ("scale", "standard"),
+            ("auto", "standard"),
+            (..., None),
+            ("unknown", None),
+            (False, None),
+            ("FAST", None),
+            (" fast", None),
+            ("fast ", None),
+            ("fast\x00", None),
+        )
+        for index, (tier, expected_speed) in enumerate(cases):
+            with self.subTest(index=index, tier=tier):
+                scenario = _terminal_scenario(
+                    f"stream-tier-{index}",
+                    "response.completed",
+                    tier,
+                ) if tier is not ... else _terminal_scenario(
+                    f"stream-tier-{index}",
+                    "response.completed",
+                )
+                report = controlled_asgi_probe(scenario=scenario, stream=True)
+                self.assertIsNone(report.raised)
+                self.assertEqual(report.upstream_calls, 1)
+                events = _asgi_sse_events(report)
+                message_start = next(
+                    event for event in events if event.get("type") == "message_start"
+                )
+                message_delta = next(
+                    event for event in events if event.get("type") == "message_delta"
+                )
+                self.assertNotIn("speed", message_start["message"]["usage"])
+                if expected_speed is None:
+                    self.assertNotIn("speed", message_delta["usage"])
+                else:
+                    self.assertEqual(message_delta["usage"]["speed"], expected_speed)
+
+    def test_streaming_incomplete_supports_fast_standard_and_absent_exactly(self) -> None:
+        for index, (tier, expected_speed) in enumerate(
+            (("fast", "fast"), ("default", "standard"), (..., None))
+        ):
+            with self.subTest(tier=tier):
+                scenario = _terminal_scenario(
+                    f"incomplete-tier-{index}",
+                    "response.incomplete",
+                    tier,
+                ) if tier is not ... else _terminal_scenario(
+                    f"incomplete-tier-{index}",
+                    "response.incomplete",
+                )
+                report = controlled_asgi_probe(scenario=scenario, stream=True)
+                events = _asgi_sse_events(report)
+                delta = next(
+                    event for event in events if event.get("type") == "message_delta"
+                )
+                self.assertEqual(delta["delta"]["stop_reason"], "max_tokens")
+                if expected_speed is None:
+                    self.assertNotIn("speed", delta["usage"])
+                else:
+                    self.assertEqual(delta["usage"]["speed"], expected_speed)
+
+
+class RetryFallbackAndTelemetryTests(unittest.TestCase):
+    maxDiff = 16000
+
+    def test_transient_retry_reuses_identical_priority_payload(self) -> None:
+        report = controlled_asgi_probe(
+            scenario=_terminal_scenario("retry-priority", "response.completed", "priority"),
+            stream=False,
+            raw_request_body=_fast_body(stream=False),
+            raw_scope_headers=_FAST_HEADER,
+            attempt_outcomes=[503, 200],
+        )
+        status, payload = _asgi_status_and_json(report)
+        self.assertEqual(status, 200)
+        self.assertEqual(payload["usage"]["speed"], "fast")
+        self.assertEqual(report.upstream_calls, 2)
+        self.assertEqual(len(report.outbound_payloads), 2)
+        self.assertEqual(report.outbound_payloads[0], report.outbound_payloads[1])
+        self.assertEqual(report.outbound_payloads[0]["service_tier"], "priority")
+        terminal = _terminal_fields(report.lifecycle)
+        self.assertEqual(terminal["attempts"], "2")
+        self.assertEqual(terminal["retries"], "1")
+
+    def test_context_rejection_has_no_standard_fallback(self) -> None:
+        scenario = _terminal_scenario("context-rejection", "response.completed")
+        scenario.stream_error_body = (
+            b'{"error":{"type":"invalid_request_error",'
+            b'"code":"context_length_exceeded",'
+            b'"message":"fixture context limit"}}'
+        )
+        report = controlled_asgi_probe(
+            scenario=scenario,
+            stream=False,
+            raw_request_body=_fast_body(stream=False),
+            raw_scope_headers=_FAST_HEADER,
+            response_status=400,
+        )
+        status, payload = _asgi_status_and_json(report)
+        self.assertEqual(status, 400)
+        self.assertEqual(payload["error"]["type"], "invalid_request_error")
+        self.assertEqual(report.upstream_calls, 1)
+        self.assertEqual(len(report.outbound_payloads), 1)
+        self.assertEqual(report.outbound_payloads[0]["service_tier"], "priority")
+        self.assertNotEqual(report.outbound_payloads[0]["service_tier"], "default")
+        terminal = _terminal_fields(report.lifecycle)
+        self.assertEqual(terminal["retries"], "0")
+        self.assertEqual(terminal["requested_service_tier"], "priority")
+        self.assertEqual(terminal["served_service_tier"], "-")
+
+    def test_historical_subscription_priority_default_is_negative_not_canonical(self) -> None:
+        # Historical live evidence: one guarded subscription request explicitly asking for
+        # PRIORITY was accepted but served DEFAULT. That is negative evidence only. The
+        # current canonical request is PRIORITY, asserted below; this deterministic DEFAULT
+        # response is serializer/parser/state evidence and makes no provider-acceptance claim.
+        scenario = _terminal_scenario(
+            "historical-negative-current-contract",
+            "response.completed",
+            "default",
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_raw_messages(
+                    _fast_body(stream=False),
+                    headers={"anthropic-beta": _FAST_BETA},
+                )
+                self.assertEqual(result.status, 200, result.text)
+                self.assertEqual(
+                    backend.responses_requests[0].body["service_tier"], "priority"
+                )
+                self.assertEqual(result.json()["usage"]["speed"], "standard")
+                terminal = _terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["requested_service_tier"], "priority")
+                self.assertEqual(terminal["served_service_tier"], "default")
+                backend.assert_request_counts(responses=1)
+
+    def test_requested_served_mismatch_and_control_scrub_are_encoded_safely(self) -> None:
+        tainted = "priority\r\nFORGED=1\x00"
+        report = controlled_asgi_probe(
+            scenario=_terminal_scenario(
+                "telemetry-control-scrub",
+                "response.completed",
+                tainted,
+            ),
+            stream=True,
+            raw_request_body=_fast_body(stream=True),
+            raw_scope_headers=_FAST_HEADER,
+        )
+        events = _asgi_sse_events(report)
+        delta = next(event for event in events if event.get("type") == "message_delta")
+        self.assertNotIn("speed", delta["usage"])
+        terminal = _terminal_fields(report.lifecycle)
+        self.assertEqual(terminal["requested_service_tier"], "priority")
+        self.assertEqual(
+            urllib.parse.unquote(terminal["served_service_tier"]),
+            "priority FORGED=1",
+        )
+        self.assertIn("%20", terminal["served_service_tier"])
+        self.assertIn("%3D", terminal["served_service_tier"])
+        self.assertNotIn("\r", report.logs)
+        self.assertNotIn("\nFORGED=1", report.logs)
+        for line in report.logs.splitlines():
+            self.assertNotRegex(line, r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_gpt_fast_control.py b/tests/provider_shim/test_gpt_fast_control.py
new file mode 100644
index 00000000..aed614bd
--- /dev/null
+++ b/tests/provider_shim/test_gpt_fast_control.py
@@ -0,0 +1,1358 @@
+"""Provider-free v1.3.9 tests for route-bound GPT service-tier control."""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import importlib.util
+import io
+import json
+import multiprocessing
+import os
+import shutil
+import stat
+import sys
+import threading
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from ._loopback_harness import (
+    MockResponsesServer,
+    RealShim,
+    controlled_asgi_probe,
+    full_response_scenario,
+    lifecycle_for_response,
+    terminal_contract_scenario,
+)
+
+DAAF_ROOT = Path(__file__).resolve().parents[2]
+SHIM_DIR = DAAF_ROOT / "scripts" / "provider_shim"
+SCRATCH_ROOT = DAAF_ROOT / "scripts" / "scratch"
+if str(SHIM_DIR) not in sys.path:
+    sys.path.insert(0, str(SHIM_DIR))
+
+import gpt_fast  # noqa: E402
+
+
+def _writer_process(home: str, backend: str, enabled: bool, start: multiprocessing.Event) -> None:
+    start.wait(5)
+    gpt_fast.PolicyStore(home=home).write(backend, enabled)
+
+
+def _terminal_fields(lines) -> dict[str, str]:
+    fields = [line.fields for line in lines if line.event == "terminal"]
+    if len(fields) != 1:
+        raise AssertionError(f"expected one terminal lifecycle record: {fields!r}")
+    return fields[0]
+
+
+def _request_body(*, stream: bool = False, speed: object = ...) -> bytes:
+    body: dict[str, object] = {
+        "model": "gpt-fixture",
+        "max_tokens": 256,
+        "stream": stream,
+        "messages": [{"role": "user", "content": "provider-free policy fixture"}],
+    }
+    if speed is not ...:
+        body["speed"] = speed
+    return json.dumps(body, separators=(",", ":")).encode("utf-8")
+
+
+class PolicyStoreTests(unittest.TestCase):
+    def setUp(self) -> None:
+        SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+        self.home = SCRATCH_ROOT / f"gpt-fast-unit-{uuid.uuid4().hex}"
+        self.home.mkdir(mode=0o700)
+        self.store = gpt_fast.PolicyStore(home=self.home)
+
+    def tearDown(self) -> None:
+        if self.home.exists() or self.home.is_symlink():
+            # The test owns this unique path. rmtree unlinks contained symlinks rather
+            # than following them, including every deliberately unsafe fixture below.
+            shutil.rmtree(self.home, ignore_errors=True)
+
+    def _seed_raw(self, raw: bytes, *, mode: int = 0o600) -> Path:
+        self.store.state_dir.mkdir(parents=True, mode=0o700, exist_ok=True)
+        self.store.state_dir.chmod(0o700)
+        self.store.state_path.write_bytes(raw)
+        self.store.state_path.chmod(mode)
+        return self.store.state_path
+
+    def test_missing_default_off_and_explicit_on_off_for_both_backends(self) -> None:
+        missing = self.store.read("chatgpt")
+        self.assertEqual(missing.status, "missing")
+        self.assertFalse(missing.enabled)
+        self.assertFalse(missing.effective)
+        for backend in ("chatgpt", "openai"):
+            with self.subTest(backend=backend):
+                enabled = self.store.write(backend, True)
+                self.assertEqual(enabled.status, "ok")
+                self.assertEqual(enabled.backend_mode, backend)
+                self.assertTrue(enabled.enabled)
+                self.assertTrue(enabled.effective)
+                self.assertFalse(self.store.read("openai" if backend == "chatgpt" else "chatgpt").effective)
+                disabled = self.store.write(backend, False)
+                self.assertEqual(disabled.status, "ok")
+                self.assertFalse(disabled.enabled)
+                self.assertFalse(disabled.effective)
+                self.assertEqual(
+                    self.store.state_path.read_bytes(),
+                    json.dumps(
+                        {"version": 1, "backend_mode": backend, "enabled": False},
+                        separators=(",", ":"),
+                    ).encode("utf-8"),
+                )
+
+    def test_strict_schema_duplicate_trailing_and_size_checks(self) -> None:
+        invalid = (
+            b"[]",
+            b"{}",
+            b'{"version":true,"backend_mode":"chatgpt","enabled":true}',
+            b'{"version":1.0,"backend_mode":"chatgpt","enabled":true}',
+            b'{"version":1,"backend_mode":"CHATGPT","enabled":true}',
+            b'{"version":1,"backend_mode":"chatgpt","enabled":1}',
+            b'{"version":1,"backend_mode":"chatgpt","enabled":true,"extra":0}',
+            b'{"version":1,"version":1,"backend_mode":"chatgpt","enabled":true}',
+            b'{"version":1,"backend_mode":"chatgpt","enabled":true}junk',
+            b"\xff",
+            b" " * 257,
+        )
+        for index, raw in enumerate(invalid):
+            with self.subTest(index=index):
+                self._seed_raw(raw)
+                snapshot = self.store.read("chatgpt")
+                self.assertEqual(snapshot.status, "invalid")
+                self.assertFalse(snapshot.effective)
+
+    def test_unsafe_directory_state_and_lock_objects_fail_closed(self) -> None:
+        self._seed_raw(b'{"version":1,"backend_mode":"chatgpt","enabled":true}')
+        self.store.state_dir.chmod(0o755)
+        self.assertEqual(self.store.read("chatgpt").status, "unsafe")
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", False)
+        self.store.state_dir.chmod(0o700)
+
+        self.store.state_path.chmod(0o644)
+        self.assertEqual(self.store.read("chatgpt").status, "unsafe")
+        before = self.store.state_path.read_bytes()
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", False)
+        self.assertEqual(self.store.state_path.read_bytes(), before)
+
+        self.store.state_path.unlink()
+        target = self.home / "target.json"
+        target.write_text("sentinel", encoding="utf-8")
+        self.store.state_path.symlink_to(target)
+        self.assertEqual(self.store.read("chatgpt").status, "unsafe")
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", True)
+        self.assertEqual(target.read_text(encoding="utf-8"), "sentinel")
+        self.store.state_path.unlink()
+
+        regular = self._seed_raw(b'{"version":1,"backend_mode":"chatgpt","enabled":true}')
+        hardlink = self.home / "policy-hardlink"
+        os.link(regular, hardlink)
+        self.assertEqual(self.store.read("chatgpt").status, "unsafe")
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", False)
+        hardlink.unlink()
+        regular.unlink()
+
+        os.mkfifo(self.store.state_path, 0o600)
+        self.assertEqual(self.store.read("chatgpt").status, "unsafe")
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", True)
+        self.store.state_path.unlink()
+
+        self.store.write("chatgpt", False)
+        os.link(self.store.lock_path, self.home / "lock-hardlink")
+        with self.assertRaises(gpt_fast.PolicyError):
+            self.store.write("chatgpt", True)
+
+    def test_home_symlink_is_rejected_before_policy_creation(self) -> None:
+        outside = SCRATCH_ROOT / f"gpt-fast-outside-{uuid.uuid4().hex}"
+        outside.mkdir(mode=0o700)
+        linked_home = self.home / "linked-home"
+        linked_home.symlink_to(outside, target_is_directory=True)
+        try:
+            linked_store = gpt_fast.PolicyStore(home=linked_home)
+            self.assertEqual(linked_store.read("chatgpt").status, "unsafe")
+            with self.assertRaises(gpt_fast.PolicyError):
+                linked_store.write("chatgpt", True)
+            self.assertFalse((outside / ".claude").exists())
+        finally:
+            shutil.rmtree(outside, ignore_errors=True)
+
+    def test_wrong_owner_metadata_fails_closed_without_chown_privilege(self) -> None:
+        self.store.write("chatgpt", True)
+        with mock.patch.object(gpt_fast.os, "getuid", return_value=os.getuid() + 1):
+            snapshot = self.store.read("chatgpt")
+            self.assertEqual(snapshot.status, "unsafe")
+            self.assertFalse(snapshot.effective)
+
+    def test_atomic_publish_fsync_and_error_cleanup(self) -> None:
+        fsync_fds: list[int] = []
+        store = gpt_fast.PolicyStore(home=self.home, fsync=lambda fd: fsync_fds.append(fd))
+        store.write("openai", True)
+        self.assertGreaterEqual(len(fsync_fds), 2)
+        self.assertEqual(stat.S_IMODE(store.state_dir.stat().st_mode), 0o700)
+        self.assertEqual(stat.S_IMODE(store.state_path.stat().st_mode), 0o600)
+        self.assertEqual(stat.S_IMODE(store.lock_path.stat().st_mode), 0o600)
+        self.assertEqual(list(store.state_dir.glob(".gpt_fast_policy.*.tmp")), [])
+
+        original = store.state_path.read_bytes()
+
+        def fail_replace(_source, _target, **_kwargs):
+            raise OSError("injected replace failure")
+
+        failing = gpt_fast.PolicyStore(home=self.home, replace=fail_replace)
+        with self.assertRaises(gpt_fast.PolicyError) as raised:
+            failing.write("openai", False)
+        self.assertNotIsInstance(
+            raised.exception, gpt_fast.PolicyDurabilityUncertain
+        )
+        self.assertEqual(store.state_path.read_bytes(), original)
+        self.assertEqual(list(store.state_dir.glob(".gpt_fast_policy.*.tmp")), [])
+
+    def test_directory_fsync_failure_reports_visible_commit_without_temp_leak(self) -> None:
+        fsync_calls = 0
+
+        def fail_directory_fsync(_fd: int) -> None:
+            nonlocal fsync_calls
+            fsync_calls += 1
+            if fsync_calls == 2:
+                raise OSError("injected directory fsync failure")
+
+        store = gpt_fast.PolicyStore(home=self.home, fsync=fail_directory_fsync)
+        with self.assertRaises(gpt_fast.PolicyDurabilityUncertain) as raised:
+            store.write("chatgpt", True)
+        self.assertEqual(raised.exception.backend_mode, "chatgpt")
+        self.assertTrue(raised.exception.enabled)
+        self.assertEqual(fsync_calls, 2)
+        visible = store.read("chatgpt")
+        self.assertEqual(visible.status, "ok")
+        self.assertTrue(visible.enabled)
+        self.assertTrue(visible.effective)
+        self.assertEqual(
+            store.state_path.read_bytes(),
+            b'{"version":1,"backend_mode":"chatgpt","enabled":true}',
+        )
+        self.assertEqual(list(store.state_dir.glob(".gpt_fast_policy.*.tmp")), [])
+
+    def test_reconciliation_preserves_post_replace_durability_uncertainty(self) -> None:
+        self.store.write("openai", True)
+        fsync_calls = 0
+
+        def fail_directory_fsync(_fd: int) -> None:
+            nonlocal fsync_calls
+            fsync_calls += 1
+            if fsync_calls == 2:
+                raise OSError("injected directory fsync failure")
+
+        store = gpt_fast.PolicyStore(home=self.home, fsync=fail_directory_fsync)
+        result = store.normalize_backend("openai", native_fast_disabled=False)
+        self.assertTrue(result.changed)
+        self.assertEqual(result.status, "durability_uncertain")
+        self.assertEqual(result.snapshot.status, "ok")
+        self.assertFalse(result.snapshot.enabled)
+        self.assertFalse(result.snapshot.effective)
+        self.assertEqual(list(store.state_dir.glob(".gpt_fast_policy.*.tmp")), [])
+
+    def test_concurrent_writers_serialize_and_readers_observe_only_complete_states(self) -> None:
+        self.store.write("chatgpt", False)
+        start = multiprocessing.Event()
+        processes = [
+            multiprocessing.Process(
+                target=_writer_process,
+                args=(str(self.home), backend, enabled, start),
+            )
+            for backend, enabled in (
+                ("chatgpt", True),
+                ("openai", True),
+                ("chatgpt", False),
+                ("openai", False),
+            )
+        ]
+        for process in processes:
+            process.start()
+        start.set()
+        observed: list[bytes] = []
+        while any(process.is_alive() for process in processes):
+            try:
+                observed.append(self.store.state_path.read_bytes())
+            except FileNotFoundError:
+                pass
+        for process in processes:
+            process.join(5)
+            self.assertEqual(process.exitcode, 0)
+        observed.append(self.store.state_path.read_bytes())
+        allowed = {
+            json.dumps(
+                {"version": 1, "backend_mode": backend, "enabled": enabled},
+                separators=(",", ":"),
+            ).encode("utf-8")
+            for backend in ("chatgpt", "openai")
+            for enabled in (True, False)
+        }
+        self.assertTrue(observed)
+        self.assertTrue(set(observed) <= allowed)
+        self.assertEqual(self.store.read().status, "ok")
+
+    def test_route_switch_reset_and_no_resurrection(self) -> None:
+        self.store.write("chatgpt", True)
+        switched = self.store.normalize_backend("openai")
+        self.assertTrue(switched.changed)
+        self.assertEqual(switched.status, "reset")
+        self.assertEqual(switched.snapshot.backend_mode, "openai")
+        self.assertFalse(switched.snapshot.enabled)
+        self.store.write("openai", True)
+        returned = self.store.normalize_backend("chatgpt")
+        self.assertTrue(returned.changed)
+        self.assertEqual(returned.snapshot.backend_mode, "chatgpt")
+        self.assertFalse(returned.snapshot.enabled)
+        self.assertFalse(self.store.read("chatgpt").effective)
+
+    def test_route_boundary_reconciliation_resets_current_route_on_distinctly(self) -> None:
+        self.store.write("chatgpt", True)
+        reconciled = self.store.normalize_backend(
+            "chatgpt", route_boundary_valid=False, native_fast_disabled=True
+        )
+        self.assertTrue(reconciled.changed)
+        self.assertEqual(reconciled.status, "reset_route_boundary")
+        self.assertEqual(reconciled.snapshot.backend_mode, "chatgpt")
+        self.assertFalse(reconciled.snapshot.enabled)
+        self.assertFalse(reconciled.snapshot.effective)
+        persisted = self.store.read("chatgpt")
+        self.assertFalse(persisted.enabled)
+        self.assertFalse(persisted.effective)
+
+    def test_native_boundary_reconciliation_resets_current_route_on(self) -> None:
+        self.store.write("chatgpt", True)
+        reconciled = self.store.normalize_backend(
+            "chatgpt", native_fast_disabled=False
+        )
+        self.assertTrue(reconciled.changed)
+        self.assertEqual(reconciled.status, "reset_native_boundary")
+        self.assertEqual(reconciled.snapshot.backend_mode, "chatgpt")
+        self.assertFalse(reconciled.snapshot.enabled)
+        self.assertFalse(reconciled.snapshot.effective)
+        persisted = self.store.read("chatgpt")
+        self.assertFalse(persisted.enabled)
+        self.assertFalse(persisted.effective)
+
+    def test_startup_normalization_preserves_concurrent_current_route_on(self) -> None:
+        self.store.write("chatgpt", True)
+        original_open_lock = self.store._open_writer_lock
+        normalization_has_lock = threading.Event()
+        allow_normalization = threading.Event()
+
+        def gated_lock(directory_fd: int) -> int:
+            lock_fd = original_open_lock(directory_fd)
+            normalization_has_lock.set()
+            allow_normalization.wait(3)
+            return lock_fd
+
+        gated = gpt_fast.PolicyStore(home=self.home)
+        gated._open_writer_lock = gated_lock
+        result: list[gpt_fast.NormalizationResult] = []
+        thread = threading.Thread(
+            target=lambda: result.append(gated.normalize_backend("openai")), daemon=True
+        )
+        thread.start()
+        self.assertTrue(normalization_has_lock.wait(3))
+        on_done = threading.Event()
+        writer = threading.Thread(
+            target=lambda: (self.store.write("openai", True), on_done.set()), daemon=True
+        )
+        writer.start()
+        allow_normalization.set()
+        thread.join(3)
+        writer.join(3)
+        self.assertTrue(on_done.is_set())
+        self.assertEqual(self.store.read("openai").health_dict(), {
+            "status": "ok", "backend_mode": "openai", "enabled": True, "effective": True
+        })
+
+    def test_invalid_and_unsafe_state_are_not_overwritten_by_normalization(self) -> None:
+        self._seed_raw(b"malformed")
+        before = self.store.state_path.read_bytes()
+        result = self.store.normalize_backend("openai")
+        self.assertFalse(result.changed)
+        self.assertEqual(result.status, "invalid")
+        self.assertEqual(self.store.state_path.read_bytes(), before)
+        self.store.state_path.unlink()
+        target = self.home / "unsafe-target"
+        target.write_text("sentinel", encoding="utf-8")
+        self.store.state_path.symlink_to(target)
+        result = self.store.normalize_backend("openai")
+        self.assertFalse(result.changed)
+        self.assertEqual(result.status, "unsafe")
+        self.assertEqual(target.read_text(encoding="utf-8"), "sentinel")
+
+
+class ShimStartupPolicyTests(unittest.TestCase):
+    def setUp(self) -> None:
+        SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+        self.home = SCRATCH_ROOT / f"gpt-fast-startup-{uuid.uuid4().hex}"
+        self.home.mkdir(mode=0o700)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.home, ignore_errors=True)
+
+    def _load_shim(
+        self,
+        backend: str | None,
+        native_fast_disable: str | None = "1",
+        provider_shim: str | None = "openai",
+    ):
+        module_name = f"gpt_fast_startup_shim_{uuid.uuid4().hex}"
+        environment = {
+            "HOME": str(self.home),
+            "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1/v1",
+            "SHIM_BACKEND_API_KEY": "FABRICATED_TEST_ONLY",
+            "OPENAI_API_KEY": "FABRICATED_TEST_ONLY",
+            "DAAF_QUOTA_STATE_FILE": str(self.home / "quota.json"),
+            "DAAF_REASONING_CACHE_FILE": str(self.home / "reasoning.json"),
+        }
+        if backend is not None:
+            environment["SHIM_BACKEND_MODE"] = backend
+        if provider_shim is not None:
+            environment["DAAF_PROVIDER_SHIM"] = provider_shim
+        if native_fast_disable is not None:
+            environment["CLAUDE_CODE_DISABLE_FAST_MODE"] = native_fast_disable
+        with mock.patch.dict(os.environ, environment, clear=True):
+            spec = importlib.util.spec_from_file_location(
+                module_name, SHIM_DIR / "anthropic_openai_shim.py"
+            )
+            if spec is None or spec.loader is None:
+                raise RuntimeError("could not load production shim")
+            module = importlib.util.module_from_spec(spec)
+            spec.loader.exec_module(module)
+        return module
+
+    def test_shim_startup_resets_other_route_on_and_recreation_clears_latest(self) -> None:
+        store = gpt_fast.PolicyStore(home=self.home)
+        store.write("chatgpt", True)
+        first = self._load_shim("openai")
+        try:
+            reset = store.read("openai")
+            self.assertEqual(reset.status, "ok")
+            self.assertEqual(reset.backend_mode, "openai")
+            self.assertFalse(reset.enabled)
+            first._LATEST_TERMINAL = {
+                "model": "gpt-fixture",
+                "requested_service_tier": "priority",
+                "requested_source": "shim_global",
+                "served_service_tier": "priority",
+                "completed_at": "2099-01-01T00:00:00Z",
+            }
+            store.write("openai", True)
+            second = self._load_shim("openai")
+            try:
+                self.assertIsNone(second._LATEST_TERMINAL)
+                self.assertTrue(store.read("openai").effective)
+            finally:
+                asyncio.run(second._client.aclose())
+        finally:
+            asyncio.run(first._client.aclose())
+
+    def test_stale_on_is_reset_for_absent_empty_case_whitespace_and_malformed_native_boundary(self) -> None:
+        variants = (
+            ("absent", None),
+            ("empty", ""),
+            ("wrong-value", "0"),
+            ("wrong-case", "TRUE"),
+            ("leading-space", " 1"),
+            ("trailing-space", "1 "),
+            ("malformed", "01"),
+        )
+        store = gpt_fast.PolicyStore(home=self.home)
+        for label, value in variants:
+            with self.subTest(case=label, value=value):
+                store.write("openai", True)
+                module = self._load_shim("openai", value)
+                try:
+                    self.assertFalse(module._GPT_FAST_NATIVE_DISABLED)
+                    self.assertEqual(
+                        module._GPT_FAST_STARTUP_NORMALIZATION.status,
+                        "reset_native_boundary",
+                    )
+                    persisted = store.read("openai")
+                    self.assertEqual(persisted.status, "ok")
+                    self.assertFalse(persisted.enabled)
+                    self.assertFalse(persisted.effective)
+                    health = module._gpt_service_tier_health_block()
+                    self.assertFalse(health["native_fast_disabled"])
+                    self.assertFalse(health["policy"]["enabled"])
+                    self.assertFalse(health["policy"]["effective"])
+                    requested, source = module._requested_service_tier(
+                        {}, set(), module._GPT_FAST_STORE.read("openai")
+                    )
+                    self.assertIsNone(requested)
+                    self.assertEqual(source, "none")
+                finally:
+                    asyncio.run(module._client.aclose())
+
+    def test_raw_provider_backend_pair_controls_startup_health_and_activation(self) -> None:
+        invalid_cases = (
+            ("absent-provider-openai", None, "openai", "openai"),
+            ("case-provider-openai", "OpenAI", "openai", "openai"),
+            ("space-provider-chatgpt", " openai", "chatgpt", "chatgpt"),
+            ("malformed-provider-openai", "other", "openai", "openai"),
+            ("absent-backend", "openai", None, "openai"),
+            ("case-backend", "openai", "OPENAI", "openai"),
+            ("space-backend", "openai", " chatgpt ", "chatgpt"),
+            ("malformed-backend", "openai", "other", "openai"),
+        )
+        store = gpt_fast.PolicyStore(home=self.home)
+        for label, provider, raw_backend, selected_backend in invalid_cases:
+            with self.subTest(case=label):
+                store.write(selected_backend, True)
+                module = self._load_shim(
+                    raw_backend, provider_shim=provider
+                )
+                try:
+                    self.assertEqual(module.SHIM_BACKEND_MODE, selected_backend)
+                    self.assertFalse(module._GPT_FAST_ROUTE_VALID)
+                    self.assertEqual(
+                        module._GPT_FAST_STARTUP_NORMALIZATION.status,
+                        "reset_route_boundary",
+                    )
+                    persisted = store.read(selected_backend)
+                    self.assertEqual(persisted.status, "ok")
+                    self.assertFalse(persisted.enabled)
+                    self.assertFalse(persisted.effective)
+                    health = module._gpt_service_tier_health_block()
+                    self.assertFalse(health["policy"]["enabled"])
+                    self.assertFalse(health["policy"]["effective"])
+                    requested, source = module._requested_service_tier(
+                        {}, set(), module._GPT_FAST_STORE.read(None)
+                    )
+                    self.assertIsNone(requested)
+                    self.assertEqual(source, "none")
+                finally:
+                    asyncio.run(module._client.aclose())
+
+        for backend, expected_tier in (("openai", "priority"), ("chatgpt", "priority")):
+            with self.subTest(case=f"exact-{backend}"):
+                store.write(backend, True)
+                module = self._load_shim(backend, provider_shim="openai")
+                try:
+                    self.assertTrue(module._GPT_FAST_ROUTE_VALID)
+                    self.assertEqual(module._GPT_FAST_STARTUP_NORMALIZATION.status, "ok")
+                    health = module._gpt_service_tier_health_block()
+                    self.assertTrue(health["policy"]["enabled"])
+                    self.assertTrue(health["policy"]["effective"])
+                    requested, source = module._requested_service_tier(
+                        {}, set(), module._GPT_FAST_STORE.read(backend)
+                    )
+                    self.assertEqual(requested, expected_tier)
+                    self.assertEqual(source, "shim_global")
+                finally:
+                    asyncio.run(module._client.aclose())
+
+    def test_invalid_pair_health_and_request_fail_closed_when_reset_cannot_run(self) -> None:
+        store = gpt_fast.PolicyStore(home=self.home)
+        store.write("openai", True)
+        before = store.state_path.read_bytes()
+        with mock.patch.object(
+            gpt_fast.PolicyStore,
+            "normalize_backend",
+            side_effect=gpt_fast.PolicyError("injected normalization failure"),
+        ):
+            module = self._load_shim("openai", provider_shim=None)
+        try:
+            self.assertFalse(module._GPT_FAST_ROUTE_VALID)
+            self.assertIsNone(module._GPT_FAST_STARTUP_NORMALIZATION)
+            self.assertEqual(store.state_path.read_bytes(), before)
+            health = module._gpt_service_tier_health_block()
+            self.assertEqual(health["policy"]["status"], "ok")
+            self.assertTrue(health["policy"]["enabled"])
+            self.assertFalse(health["policy"]["effective"])
+            snapshot = module._GPT_FAST_STORE.read(None)
+            requested, source = module._requested_service_tier({}, set(), snapshot)
+            self.assertIsNone(requested)
+            self.assertEqual(source, "none")
+        finally:
+            asyncio.run(module._client.aclose())
+
+    def test_latest_terminal_cannot_regress_when_earlier_update_finishes_late(self) -> None:
+        module = self._load_shim("openai")
+        earlier_started = threading.Event()
+        release_earlier = threading.Event()
+
+        class DelayedEarlier(dict):
+            def get(self, key, default=None):
+                if key == "service_tier":
+                    earlier_started.set()
+                    if not release_earlier.wait(3):
+                        raise RuntimeError("timed out waiting to release earlier terminal")
+                return super().get(key, default)
+
+        errors: list[BaseException] = []
+
+        def record_earlier() -> None:
+            try:
+                module._actual_speed_from_response(
+                    DelayedEarlier(model="gpt-earlier", service_tier="default")
+                )
+            except BaseException as error:
+                errors.append(error)
+
+        thread = threading.Thread(target=record_earlier, daemon=True)
+        try:
+            thread.start()
+            self.assertTrue(earlier_started.wait(3))
+            module._actual_speed_from_response(
+                {"model": "gpt-later", "service_tier": "priority"}
+            )
+            release_earlier.set()
+            thread.join(3)
+            self.assertFalse(thread.is_alive())
+            self.assertEqual(errors, [])
+            self.assertEqual(module._LATEST_TERMINAL["model"], "gpt-later")
+            self.assertEqual(
+                module._LATEST_TERMINAL["served_service_tier"], "priority"
+            )
+        finally:
+            release_earlier.set()
+            asyncio.run(module._client.aclose())
+
+
+class CLITests(unittest.TestCase):
+    def setUp(self) -> None:
+        SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+        self.home = SCRATCH_ROOT / f"gpt-fast-cli-{uuid.uuid4().hex}"
+        self.home.mkdir(mode=0o700)
+        self.store = gpt_fast.PolicyStore(home=self.home)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.home, ignore_errors=True)
+
+    def _run(self, command: str, environment: dict[str, str]) -> tuple[int, str, str]:
+        stdout = io.StringIO()
+        stderr = io.StringIO()
+        with mock.patch.dict(os.environ, environment, clear=True):
+            with contextlib.redirect_stdout(stdout), contextlib.redirect_stderr(stderr):
+                code = gpt_fast.main([command], store=self.store)
+        return code, stdout.getvalue(), stderr.getvalue()
+
+    def test_exact_route_guard_matrix_and_rejected_mutations_are_byte_identical(self) -> None:
+        valid = {
+            "DAAF_PROVIDER_SHIM": "openai",
+            "SHIM_BACKEND_MODE": "chatgpt",
+            "CLAUDE_CODE_DISABLE_FAST_MODE": "1",
+        }
+        self.store.write("chatgpt", False)
+        before = self.store.state_path.read_bytes()
+        invalid_envs = (
+            {},
+            {"DAAF_PROVIDER_SHIM": "OpenAI", "SHIM_BACKEND_MODE": "chatgpt"},
+            {"DAAF_PROVIDER_SHIM": "openai"},
+            {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "CHATGPT"},
+            {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "other"},
+        )
+        for environment in invalid_envs:
+            for command in ("on", "off", "status"):
+                with self.subTest(environment=environment, command=command):
+                    code, _stdout, stderr = self._run(command, environment)
+                    self.assertEqual(code, 20)
+                    self.assertIn("exact", stderr)
+                    self.assertEqual(self.store.state_path.read_bytes(), before)
+        code, _stdout, _stderr = self._run("on", valid)
+        self.assertEqual(code, 0)
+
+    def test_on_requires_native_disable_while_off_and_status_remain_available(self) -> None:
+        route = {"DAAF_PROVIDER_SHIM": "openai", "SHIM_BACKEND_MODE": "chatgpt"}
+        invalid_values = (None, "", "0", "TRUE", " 1", "1 ", "01")
+        self.store.write("chatgpt", True)
+        persisted_on = self.store.state_path.read_bytes()
+        for value in invalid_values:
+            environment = dict(route)
+            if value is not None:
+                environment["CLAUDE_CODE_DISABLE_FAST_MODE"] = value
+            with self.subTest(value=value):
+                code, _stdout, stderr = self._run("on", environment)
+                self.assertEqual(code, 20)
+                self.assertIn("CLAUDE_CODE_DISABLE_FAST_MODE=1", stderr)
+                self.assertEqual(self.store.state_path.read_bytes(), persisted_on)
+                with mock.patch.object(gpt_fast, "_bounded_health", return_value=None):
+                    code, stdout, _stderr = self._run("status", environment)
+                self.assertEqual(code, 0)
+                self.assertIn("Persisted requested policy: ON", stdout)
+                self.assertIn("Effective requested policy: OFF", stdout)
+                self.assertIn("Native Claude Code Fast disabled: no", stdout)
+                self.assertIn("Shim: unavailable", stdout)
+                self.assertIn("Latest terminal: unknown", stdout)
+        code, stdout, _stderr = self._run("off", route)
+        self.assertEqual(code, 0)
+        self.assertIn("OFF", stdout)
+
+    def test_status_labels_configured_and_latest_terminal_models_separately(self) -> None:
+        environment = {
+            "DAAF_PROVIDER_SHIM": "openai",
+            "SHIM_BACKEND_MODE": "chatgpt",
+            "SHIM_PORT": "4141",
+            "ANTHROPIC_DEFAULT_OPUS_MODEL": "gpt-configured",
+        }
+        health = {
+            "service": gpt_fast.HEALTH_SERVICE_ID,
+            "version": "1.3.9",
+            "backend_mode": "chatgpt",
+            "gpt_service_tier": {
+                "backend_mode": "chatgpt",
+                "requested_tier_vocabulary": "priority",
+                "policy": {
+                    "status": "ok",
+                    "backend_mode": "chatgpt",
+                    "enabled": True,
+                    "effective": True,
+                },
+                "native_fast_disabled": True,
+                "latest_terminal": {
+                    "model": "gpt-terminal",
+                    "requested_service_tier": "priority",
+                    "requested_source": "shim_global",
+                    "served_service_tier": "default",
+                    "completed_at": "2099-01-01T00:00:00Z",
+                },
+            },
+        }
+        self.store.write("chatgpt", True)
+        with mock.patch.object(gpt_fast, "_bounded_health", return_value=health):
+            code, stdout, _stderr = self._run("status", environment)
+        self.assertEqual(code, 0)
+        self.assertIn("Configured model: gpt-configured", stdout)
+        self.assertIn("Latest terminal: model=gpt-terminal", stdout)
+        self.assertIn("requested=priority", stdout)
+        self.assertIn("friendly ChatGPT Fast label", stdout)
+        self.assertIn("not API Priority billing", stdout)
+        self.assertIn("served=default", stdout)
+        self.assertIn("not proof", stdout)
+
+    def test_health_reader_rejects_duplicates_and_returns_only_bounded_projection(self) -> None:
+        payload = {
+            "service": gpt_fast.HEALTH_SERVICE_ID,
+            "version": "1.3.9",
+            "backend_mode": "openai",
+            "backend": "file:///sensitive/unrelated/path",
+            "unrelated": {"content": "must-not-be-returned"},
+            "gpt_service_tier": {
+                "backend_mode": "openai",
+                "requested_tier_vocabulary": "priority",
+                "policy": {
+                    "status": "ok",
+                    "backend_mode": "openai",
+                    "enabled": True,
+                    "effective": True,
+                },
+                "native_fast_disabled": True,
+                "latest_terminal": {
+                    "model": "gpt-terminal",
+                    "requested_service_tier": "priority",
+                    "requested_source": "shim_global",
+                    "served_service_tier": "default",
+                    "completed_at": "2099-01-01T00:00:00Z",
+                },
+            },
+        }
+
+        class FakeResponse:
+            status = 200
+
+            def __init__(self, raw: bytes):
+                self.raw = raw
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, traceback):
+                return None
+
+            def read(self, limit: int) -> bytes:
+                self.read_limit = limit
+                return self.raw[:limit]
+
+        class FakeOpener:
+            def __init__(self, raw: bytes):
+                self.raw = raw
+
+            def open(self, _request, timeout):
+                self.timeout = timeout
+                self.response = FakeResponse(self.raw)
+                return self.response
+
+        raw = json.dumps(payload, separators=(",", ":")).encode("utf-8")
+        fake_opener = FakeOpener(raw)
+        with mock.patch.object(
+            gpt_fast.urllib.request,
+            "build_opener",
+            return_value=fake_opener,
+        ) as build:
+            bounded = gpt_fast._bounded_health("http://127.0.0.1:1/health")
+        self.assertEqual(
+            set(bounded),
+            {"service", "version", "backend_mode", "gpt_service_tier"},
+        )
+        self.assertEqual(fake_opener.timeout, gpt_fast.HEALTH_TIMEOUT_SECONDS)
+        self.assertEqual(
+            fake_opener.response.read_limit, gpt_fast.HEALTH_BODY_LIMIT + 1
+        )
+        handlers = build.call_args.args
+        self.assertTrue(
+            any(
+                isinstance(item, gpt_fast.urllib.request.ProxyHandler)
+                and item.proxies == {}
+                for item in handlers
+            )
+        )
+        redirect = next(
+            item for item in handlers if isinstance(item, gpt_fast._RejectRedirects)
+        )
+        self.assertIsNone(
+            redirect.redirect_request(
+                None, None, 302, "Found", {}, "http://example.invalid"
+            )
+        )
+        serialized = json.dumps(bounded)
+        self.assertNotIn("sensitive", serialized)
+        self.assertNotIn("must-not-be-returned", serialized)
+
+        with mock.patch.object(gpt_fast.urllib.request, "build_opener") as external:
+            self.assertIsNone(gpt_fast._bounded_health("http://example.invalid/health"))
+        external.assert_not_called()
+
+        duplicate = raw.replace(
+            b'{"service":',
+            b'{"service":"duplicate","service":',
+            1,
+        )
+        with mock.patch.object(
+            gpt_fast.urllib.request,
+            "build_opener",
+            return_value=FakeOpener(duplicate),
+        ):
+            self.assertIsNone(
+                gpt_fast._bounded_health("http://127.0.0.1:1/health")
+            )
+
+        oversized = b"{" + b"x" * gpt_fast.HEALTH_BODY_LIMIT
+        with mock.patch.object(
+            gpt_fast.urllib.request,
+            "build_opener",
+            return_value=FakeOpener(oversized),
+        ):
+            self.assertIsNone(
+                gpt_fast._bounded_health("http://127.0.0.1:1/health")
+            )
+
+    def test_health_latest_terminal_requires_route_source_tier_and_real_utc_semantics(self) -> None:
+        class FakeResponse:
+            status = 200
+
+            def __init__(self, raw: bytes):
+                self.raw = raw
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, exc_type, exc, traceback):
+                return None
+
+            def read(self, limit: int) -> bytes:
+                self.read_limit = limit
+                return self.raw[:limit]
+
+        class FakeOpener:
+            def __init__(self, raw: bytes):
+                self.raw = raw
+
+            def open(self, _request, timeout):
+                return FakeResponse(self.raw)
+
+        def bounded(payload):
+            raw = json.dumps(payload, separators=(",", ":")).encode("utf-8")
+            with mock.patch.object(
+                gpt_fast.urllib.request, "build_opener", return_value=FakeOpener(raw)
+            ):
+                return gpt_fast._bounded_health("http://127.0.0.1:1/health")
+
+        for backend, expected_tier in (("chatgpt", "priority"), ("openai", "priority")):
+            base = {
+                "service": gpt_fast.HEALTH_SERVICE_ID,
+                "version": "1.3.9",
+                "backend_mode": backend,
+                "gpt_service_tier": {
+                    "backend_mode": backend,
+                    "requested_tier_vocabulary": expected_tier,
+                    "policy": {
+                        "status": "ok", "backend_mode": backend,
+                        "enabled": False, "effective": False,
+                    },
+                    "native_fast_disabled": True,
+                    "latest_terminal": {
+                        "model": "gpt-5.6-sol",
+                        "requested_service_tier": expected_tier,
+                        "requested_source": "shim_global",
+                        "served_service_tier": None,
+                        "completed_at": "2026-07-25T20:00:00Z",
+                    },
+                },
+            }
+            with self.subTest(backend=backend, case="valid-null-served"):
+                self.assertIsNotNone(bounded(base))
+            compatibility = json.loads(json.dumps(base))
+            compatibility["gpt_service_tier"]["latest_terminal"][
+                "served_service_tier"
+            ] = "fast"
+            with self.subTest(backend=backend, case="compatibility-only-served-fast"):
+                self.assertIsNotNone(bounded(compatibility))
+            legacy_vocabulary = json.loads(json.dumps(base))
+            legacy_vocabulary["gpt_service_tier"]["requested_tier_vocabulary"] = "fast"
+            with self.subTest(backend=backend, case="legacy-requested-vocabulary-fast"):
+                self.assertIsNone(bounded(legacy_vocabulary))
+            invalid_changes = (
+                # Legacy requested `fast` is never authoritative requested vocabulary.
+                ("requested_service_tier", "fast"),
+                ("requested_service_tier", f" {expected_tier}"),
+                ("requested_source", "Shim_Global"),
+                ("requested_source", ["shim_global"]),
+                ("requested_source", " shim_global"),
+                ("served_service_tier", "FAST"),
+                ("served_service_tier", {"tier": "fast"}),
+                ("served_service_tier", "fast "),
+                ("completed_at", "2026-02-30T20:00:00Z"),
+                ("completed_at", "2026-07-25t20:00:00Z"),
+            )
+            for field, value in invalid_changes:
+                payload = json.loads(json.dumps(base))
+                payload["gpt_service_tier"]["latest_terminal"][field] = value
+                with self.subTest(backend=backend, field=field, value=value):
+                    self.assertIsNone(bounded(payload))
+            for source, requested in (("none", expected_tier), ("shim_global", None)):
+                payload = json.loads(json.dumps(base))
+                latest = payload["gpt_service_tier"]["latest_terminal"]
+                latest["requested_source"] = source
+                latest["requested_service_tier"] = requested
+                with self.subTest(backend=backend, source=source, requested=requested):
+                    self.assertIsNone(bounded(payload))
+            payload = json.loads(json.dumps(base))
+            latest = payload["gpt_service_tier"]["latest_terminal"]
+            latest["requested_source"] = "none"
+            latest["requested_service_tier"] = None
+            with self.subTest(backend=backend, case="valid-null-requested"):
+                self.assertIsNotNone(bounded(payload))
+
+    def test_cli_reports_visible_on_with_uncertain_durability_honestly(self) -> None:
+        fsync_calls = 0
+
+        def fail_directory_fsync(_fd: int) -> None:
+            nonlocal fsync_calls
+            fsync_calls += 1
+            if fsync_calls == 2:
+                raise OSError("injected directory fsync failure")
+
+        self.store = gpt_fast.PolicyStore(
+            home=self.home, fsync=fail_directory_fsync
+        )
+        environment = {
+            "DAAF_PROVIDER_SHIM": "openai",
+            "SHIM_BACKEND_MODE": "chatgpt",
+            "CLAUDE_CODE_DISABLE_FAST_MODE": "1",
+        }
+        code, stdout, stderr = self._run("on", environment)
+        self.assertEqual(code, 1)
+        self.assertEqual(stdout, "")
+        self.assertIn("policy ON is visible", stderr)
+        self.assertIn("durability is uncertain", stderr)
+        self.assertIn("not rolled back", stderr)
+        self.assertNotIn("could not enable", stderr)
+        self.assertLess(len(stderr), 500)
+        visible = self.store.read("chatgpt")
+        self.assertTrue(visible.enabled)
+        self.assertTrue(visible.effective)
+        self.assertEqual(list(self.store.state_dir.glob(".gpt_fast_policy.*.tmp")), [])
+
+    def test_api_on_prints_cost_warning_and_status_never_claims_served(self) -> None:
+        environment = {
+            "DAAF_PROVIDER_SHIM": "openai",
+            "SHIM_BACKEND_MODE": "openai",
+            "CLAUDE_CODE_DISABLE_FAST_MODE": "1",
+            "ANTHROPIC_DEFAULT_OPUS_MODEL": "gpt-5.6-sol",
+        }
+        code, stdout, stderr = self._run("on", environment)
+        self.assertEqual(code, 0)
+        self.assertIn("Priority", stdout)
+        self.assertIn("change API cost", stderr)
+        with mock.patch.object(gpt_fast, "_bounded_health", return_value=None):
+            code, status, _stderr = self._run("status", environment)
+        self.assertEqual(code, 0)
+        self.assertIn("Configured model: gpt-5.6-sol", status)
+        self.assertIn("requested", status.lower())
+        self.assertIn("not proof", status)
+        self.assertNotIn("served Priority: yes", status)
+
+
+class ShimPolicyIntegrationTests(unittest.TestCase):
+    maxDiff = 16000
+
+    def test_off_omits_and_on_adds_route_specific_tier_with_source(self) -> None:
+        for backend, tier in (("openai", "priority"), ("chatgpt", "priority")):
+            for enabled in (False, True):
+                with self.subTest(backend=backend, enabled=enabled):
+                    report = controlled_asgi_probe(
+                        stream=False,
+                        backend_mode=backend,
+                        global_policy_enabled=enabled,
+                    )
+                    self.assertIsNone(report.raised)
+                    self.assertEqual(report.upstream_calls, 1)
+                    outbound = report.outbound_payloads[0]
+                    terminal = _terminal_fields(report.lifecycle)
+                    if enabled:
+                        self.assertEqual(outbound["service_tier"], tier)
+                        self.assertEqual(terminal["requested_service_tier"], tier)
+                        self.assertEqual(
+                            terminal["requested_service_tier_source"], "shim_global"
+                        )
+                    else:
+                        self.assertNotIn("service_tier", outbound)
+                        self.assertEqual(terminal["requested_service_tier"], "-")
+                        self.assertEqual(
+                            terminal["requested_service_tier_source"], "none"
+                        )
+
+    def test_inbound_fast_additive_precedence_and_invalid_contract_under_global_on(self) -> None:
+        beta = [(b"anthropic-beta", b"fast-mode-2026-02-01")]
+        for backend in ("openai", "chatgpt"):
+            for enabled, expected_source in ((False, "anthropic"), (True, "both")):
+                with self.subTest(backend=backend, enabled=enabled):
+                    report = controlled_asgi_probe(
+                        stream=False,
+                        backend_mode=backend,
+                        global_policy_enabled=enabled,
+                        raw_request_body=_request_body(speed="fast"),
+                        raw_scope_headers=beta,
+                    )
+                    self.assertEqual(
+                        report.outbound_payloads[0]["service_tier"], "priority"
+                    )
+                    self.assertEqual(
+                        _terminal_fields(report.lifecycle)[
+                            "requested_service_tier_source"
+                        ],
+                        expected_source,
+                    )
+            invalid = controlled_asgi_probe(
+                stream=False,
+                backend_mode=backend,
+                global_policy_enabled=True,
+                raw_request_body=_request_body(speed="FAST"),
+                raw_scope_headers=beta,
+            )
+            self.assertEqual(invalid.upstream_calls, 0)
+            self.assertEqual(invalid.outbound_payloads, [])
+            starts = [
+                message
+                for message in invalid.messages
+                if message["type"] == "http.response.start"
+            ]
+            self.assertEqual(starts[0]["status"], 400)
+            self.assertIsNone(invalid.gpt_service_tier_health["latest_terminal"])
+
+    def test_request_snapshot_precedes_body_read_and_survives_toggle(self) -> None:
+        old_off = controlled_asgi_probe(
+            stream=False,
+            backend_mode="openai",
+            global_policy_enabled=False,
+            toggle_policy_on_first_receive=True,
+        )
+        self.assertNotIn("service_tier", old_off.outbound_payloads[0])
+        old_on = controlled_asgi_probe(
+            stream=False,
+            backend_mode="openai",
+            global_policy_enabled=True,
+            toggle_policy_on_first_receive=False,
+        )
+        self.assertEqual(old_on.outbound_payloads[0]["service_tier"], "priority")
+
+    def test_retry_reuses_global_snapshot_and_identical_payload(self) -> None:
+        scenario = terminal_contract_scenario(
+            "global-retry",
+            "response.completed",
+            status="completed",
+            output=[],
+            usage={"input_tokens": 10, "output_tokens": 2},
+            service_tier="priority",
+        )
+        report = controlled_asgi_probe(
+            scenario=scenario,
+            stream=False,
+            backend_mode="openai",
+            global_policy_enabled=True,
+            attempt_outcomes=[503, 200],
+        )
+        self.assertEqual(report.upstream_calls, 2)
+        self.assertEqual(report.outbound_payloads[0], report.outbound_payloads[1])
+        self.assertEqual(report.outbound_payloads[0]["service_tier"], "priority")
+        terminal = _terminal_fields(report.lifecycle)
+        self.assertEqual(terminal["attempts"], "2")
+        self.assertEqual(terminal["requested_service_tier_source"], "shim_global")
+
+    def test_auth_and_stale_reasoning_retries_preserve_snapshotted_tier(self) -> None:
+        auth = controlled_asgi_probe(
+            stream=False,
+            backend_mode="chatgpt",
+            global_policy_enabled=True,
+            lazy_401_refresh=True,
+            attempt_outcomes=[401, 200],
+        )
+        self.assertIsNone(auth.raised)
+        self.assertEqual(auth.upstream_calls, 2)
+        self.assertEqual(
+            [payload["service_tier"] for payload in auth.outbound_payloads],
+            ["priority", "priority"],
+        )
+        self.assertEqual(
+            _terminal_fields(auth.lifecycle)["requested_service_tier_source"],
+            "shim_global",
+        )
+
+        scenario = terminal_contract_scenario(
+            "stale-reasoning-tier",
+            "response.completed",
+            status="completed",
+            output=[],
+            usage={"input_tokens": 10, "output_tokens": 2},
+            service_tier="priority",
+        )
+        scenario.stream_error_body = (
+            b'{"error":{"type":"invalid_request_error",'
+            b'"message":"invalid encrypted_content reasoning fixture"}}'
+        )
+        stale = controlled_asgi_probe(
+            scenario=scenario,
+            stream=False,
+            backend_mode="openai",
+            global_policy_enabled=True,
+            inject_stale_restored_reasoning=True,
+            attempt_outcomes=[400, 200],
+        )
+        self.assertIsNone(stale.raised)
+        self.assertEqual(stale.upstream_calls, 2)
+        self.assertEqual(
+            [payload["service_tier"] for payload in stale.outbound_payloads],
+            ["priority", "priority"],
+        )
+        stale_terminal = _terminal_fields(stale.lifecycle)
+        self.assertEqual(stale_terminal["retry_reason"], "stale_reasoning_400")
+        self.assertEqual(stale_terminal["requested_service_tier_source"], "shim_global")
+
+    def test_strict_pair_matrix_fails_global_policy_closed_without_retry_drift(self) -> None:
+        invalid_cases = (
+            ("absent-provider", None, "openai", "openai"),
+            ("case-provider", "OpenAI", "openai", "openai"),
+            ("space-provider", " openai", "chatgpt", "chatgpt"),
+            ("malformed-provider", "other", "openai", "openai"),
+            ("absent-backend", "openai", None, "openai"),
+            ("case-backend", "openai", "OPENAI", "openai"),
+            ("space-backend", "openai", " chatgpt ", "chatgpt"),
+            ("malformed-backend", "openai", "other", "openai"),
+        )
+        for label, provider, raw_backend, selected_backend in invalid_cases:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    backend_mode=selected_backend,
+                    provider_shim_control=provider,
+                    backend_mode_control=raw_backend,
+                    preexisting_global_policy_enabled=True,
+                    attempt_outcomes=[503, 200],
+                )
+                self.assertIsNone(report.raised)
+                self.assertEqual(report.upstream_calls, 2)
+                self.assertEqual(report.outbound_payloads[0], report.outbound_payloads[1])
+                self.assertNotIn("service_tier", report.outbound_payloads[0])
+                health = report.gpt_service_tier_health
+                self.assertEqual(health["policy"]["status"], "ok")
+                self.assertFalse(health["policy"]["enabled"])
+                self.assertFalse(health["policy"]["effective"])
+                terminal = _terminal_fields(report.lifecycle)
+                self.assertEqual(terminal["attempts"], "2")
+                self.assertEqual(terminal["retries"], "1")
+                self.assertEqual(terminal["requested_service_tier"], "-")
+                self.assertEqual(terminal["requested_service_tier_source"], "none")
+
+    def test_invalid_pair_request_and_health_fail_closed_with_persisted_on(self) -> None:
+        report = controlled_asgi_probe(
+            stream=False,
+            backend_mode="openai",
+            provider_shim_control=None,
+            backend_mode_control="openai",
+            global_policy_enabled=True,
+        )
+        self.assertIsNone(report.raised)
+        self.assertNotIn("service_tier", report.outbound_payloads[0])
+        health = report.gpt_service_tier_health
+        self.assertEqual(health["policy"]["status"], "ok")
+        self.assertTrue(health["policy"]["enabled"])
+        self.assertFalse(health["policy"]["effective"])
+        terminal = _terminal_fields(report.lifecycle)
+        self.assertEqual(terminal["requested_service_tier"], "-")
+        self.assertEqual(terminal["requested_service_tier_source"], "none")
+
+    def test_inbound_fast_remains_independent_when_strict_pair_is_absent(self) -> None:
+        beta = [(b"anthropic-beta", b"fast-mode-2026-02-01")]
+        cases = (
+            ("legacy-default-openai", None, None, "openai", "priority"),
+            (
+                "legacy-normalized-chatgpt",
+                None,
+                " CHATGPT ",
+                "chatgpt",
+                "priority",
+            ),
+        )
+        for label, provider, raw_backend, selected_backend, tier in cases:
+            with self.subTest(case=label):
+                report = controlled_asgi_probe(
+                    stream=False,
+                    backend_mode=selected_backend,
+                    provider_shim_control=provider,
+                    backend_mode_control=raw_backend,
+                    preexisting_global_policy_enabled=True,
+                    raw_request_body=_request_body(speed="fast"),
+                    raw_scope_headers=beta,
+                )
+                self.assertIsNone(report.raised)
+                self.assertEqual(report.outbound_payloads[0]["service_tier"], tier)
+                self.assertFalse(report.gpt_service_tier_health["policy"]["effective"])
+                terminal = _terminal_fields(report.lifecycle)
+                self.assertEqual(terminal["requested_service_tier"], tier)
+                self.assertEqual(
+                    terminal["requested_service_tier_source"], "anthropic"
+                )
+
+    def test_request_fails_closed_after_stale_on_with_invalid_native_boundary(self) -> None:
+        variants = (None, "", "0", "TRUE", " 1", "1 ", "01")
+        for value in variants:
+            with self.subTest(value=value):
+                # The harness intentionally inherits runner seams. Make the absent case
+                # independent of the developer container's own route configuration.
+                with mock.patch.dict(os.environ, {}, clear=False):
+                    if value is None:
+                        os.environ.pop("CLAUDE_CODE_DISABLE_FAST_MODE", None)
+                    report = controlled_asgi_probe(
+                        stream=False,
+                        backend_mode="openai",
+                        native_fast_disable=value,
+                        preexisting_global_policy_enabled=True,
+                    )
+                self.assertIsNone(report.raised)
+                self.assertEqual(report.auth_calls, 1)
+                self.assertEqual(report.upstream_calls, 1)
+                self.assertNotIn("service_tier", report.outbound_payloads[0])
+                health = report.gpt_service_tier_health
+                self.assertFalse(health["native_fast_disabled"])
+                self.assertEqual(health["policy"]["status"], "ok")
+                self.assertFalse(health["policy"]["enabled"])
+                self.assertFalse(health["policy"]["effective"])
+                terminal = _terminal_fields(report.lifecycle)
+                self.assertEqual(terminal["requested_service_tier"], "-")
+                self.assertEqual(
+                    terminal["requested_service_tier_source"], "none"
+                )
+
+    def test_request_time_exact_route_match_is_required(self) -> None:
+        # Import/startup selects openai, then a deliberately other-bound valid policy is
+        # published before request acceptance. The lock-free request read must fail OFF.
+        report = controlled_asgi_probe(
+            stream=False,
+            backend_mode="openai",
+            global_policy_enabled=True,
+            global_policy_backend="chatgpt",
+        )
+        self.assertNotIn("service_tier", report.outbound_payloads[0])
+
+    def test_immediate_off_on_off_in_one_running_shim_and_latest_health(self) -> None:
+        scenario = full_response_scenario()
+        scenario.nonstream_response["service_tier"] = "priority"
+        scenario.nonstream_response["model"] = "gpt-fixture-terminal"
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend,
+                "openai",
+                env_overrides={"CLAUDE_CODE_DISABLE_FAST_MODE": "1"},
+            ) as shim:
+                assert shim.scratch_dir is not None
+                store = gpt_fast.PolicyStore(home=shim.scratch_dir)
+                store.write("openai", False)
+                off1 = shim.post_messages(stream=False)
+                store.write("openai", True)
+                on = shim.post_messages(stream=False)
+                on_latest = shim.get_health().json()["gpt_service_tier"]["latest_terminal"]
+                self.assertEqual(on_latest["requested_service_tier"], "priority")
+                self.assertEqual(on_latest["requested_source"], "shim_global")
+                self.assertEqual(on_latest["served_service_tier"], "priority")
+                store.write("openai", False)
+                off2 = shim.post_messages(stream=False)
+                self.assertEqual(
+                    ["service_tier" in request.body for request in backend.responses_requests],
+                    [False, True, False],
+                )
+                self.assertEqual(
+                    backend.responses_requests[1].body["service_tier"], "priority"
+                )
+                self.assertEqual(
+                    _terminal_fields(lifecycle_for_response(shim, on))[
+                        "requested_service_tier_source"
+                    ],
+                    "shim_global",
+                )
+                health = shim.get_health().json()["gpt_service_tier"]
+                self.assertEqual(
+                    set(health),
+                    {
+                        "backend_mode",
+                        "requested_tier_vocabulary",
+                        "policy",
+                        "native_fast_disabled",
+                        "latest_terminal",
+                    },
+                )
+                self.assertEqual(health["backend_mode"], "openai")
+                self.assertEqual(health["requested_tier_vocabulary"], "priority")
+                self.assertFalse(health["policy"]["effective"])
+                latest = health["latest_terminal"]
+                self.assertEqual(latest["model"], "gpt-fixture-terminal")
+                self.assertIsNone(latest["requested_service_tier"])
+                self.assertEqual(latest["requested_source"], "none")
+                self.assertEqual(latest["served_service_tier"], "priority")
+                self.assertRegex(latest["completed_at"], r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z$")
+                for forbidden in ("request_id", "prompt", "messages", "tools", "path", "credential"):
+                    self.assertNotIn(forbidden, json.dumps(health).lower())
+                self.assertEqual(off1.status, 200)
+                self.assertEqual(off2.status, 200)
+
+    def test_latest_terminal_unknown_or_malformed_served_tier_stays_null(self) -> None:
+        scenario = full_response_scenario()
+        scenario.nonstream_response["service_tier"] = " Priority\r\nFORGED=1"
+        scenario.nonstream_response["model"] = "bad model\nforged"
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 200)
+                latest = shim.get_health().json()["gpt_service_tier"]["latest_terminal"]
+                self.assertIsNone(latest["model"])
+                self.assertIsNone(latest["served_service_tier"])
+                self.assertEqual(latest["requested_source"], "none")
+                serialized = json.dumps(latest)
+                self.assertNotIn("FORGED", serialized)
+                self.assertNotIn("bad model", serialized)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_historical_regressions.py b/tests/provider_shim/test_historical_regressions.py
new file mode 100644
index 00000000..9d3d5c77
--- /dev/null
+++ b/tests/provider_shim/test_historical_regressions.py
@@ -0,0 +1,665 @@
+"""Historical provider-shim contracts driven through the real subprocess path."""
+
+from __future__ import annotations
+
+import copy
+import json
+import threading
+import unittest
+
+from ._loopback_harness import (
+    READ_TOOL,
+    USAGE,
+    MockResponsesServer,
+    RealShim,
+    events_scenario,
+    full_response_scenario,
+    lifecycle_for_response,
+)
+
+
+_HEALTH_KEYS = {
+    "service",
+    "status",
+    "backend",
+    "backend_mode",
+    "codex_home_present",
+    "version",
+    "sanitize_tools",
+    "reasoning_effort",
+    "text_verbosity",
+    # v1.3.0 (A1-R4): read-only auth-validity snapshot block.
+    "auth",
+    # v1.3.3 (A2-R6): reasoning-cache continuity block (entries/restored counts only).
+    "reasoning_cache",
+    # v1.3.6 (V6-R4): prompt-cache observability block (cumulative counts only).
+    "prompt_cache",
+    # v1.3.8: bounded route-bound GPT requested/served observability.
+    "gpt_service_tier",
+}
+
+
+def _response(response_id: str, output: list[dict[str, object]], usage: object = None):
+    body: dict[str, object] = {
+        "id": response_id,
+        "model": "gpt-fixture",
+        "status": "completed",
+        "output": copy.deepcopy(output),
+        "incomplete_details": None,
+        "error": None,
+    }
+    if usage is not None:
+        body["usage"] = copy.deepcopy(usage)
+    return body
+
+
+def _message_payload(
+    *,
+    model: str = "gpt-fixture",
+    output_config: object = None,
+    thinking: object = None,
+    messages: list[dict[str, object]] | None = None,
+) -> bytes:
+    body: dict[str, object] = {
+        "model": model,
+        "max_tokens": 256,
+        "stream": False,
+        "messages": messages or [{"role": "user", "content": "Historical rig."}],
+    }
+    if output_config is not None:
+        body["output_config"] = output_config
+    if thinking is not None:
+        body["thinking"] = thinking
+    return json.dumps(body, separators=(",", ":")).encode("utf-8")
+
+
+def _tool_item(
+    item_id: str,
+    call_id: str,
+    name: str,
+    arguments: dict[str, object],
+) -> dict[str, object]:
+    return {
+        "type": "function_call",
+        "id": item_id,
+        "call_id": call_id,
+        "name": name,
+        "arguments": json.dumps(arguments, separators=(",", ":")),
+        "status": "completed",
+    }
+
+
+class ProviderShimHistoricalRegressionTests(unittest.TestCase):
+    maxDiff = 16000
+
+    def test_count_tokens_rejects_poison_then_real_request_calibrates(self) -> None:
+        scenario = full_response_scenario()
+        template = copy.deepcopy(scenario.nonstream_response)
+        invalid_responses: list[dict[str, object]] = []
+
+        missing_usage = copy.deepcopy(template)
+        missing_usage.pop("usage", None)
+        invalid_responses.append(missing_usage)
+
+        nonobject_usage = copy.deepcopy(template)
+        nonobject_usage["usage"] = "malformed"
+        invalid_responses.append(nonobject_usage)
+
+        missing_input = copy.deepcopy(template)
+        missing_input["usage"] = {"output_tokens": 17}
+        invalid_responses.append(missing_input)
+
+        malformed_input = copy.deepcopy(template)
+        malformed_input["usage"] = {"input_tokens": "bad", "output_tokens": 17}
+        invalid_responses.append(malformed_input)
+
+        zero_input = copy.deepcopy(template)
+        zero_input["usage"] = {"input_tokens": 0, "output_tokens": 17}
+        invalid_responses.append(zero_input)
+
+        negative_input = copy.deepcopy(template)
+        negative_input["usage"] = {"input_tokens": -1, "output_tokens": 17}
+        invalid_responses.append(negative_input)
+
+        outlier_input = copy.deepcopy(template)
+        outlier_input["usage"] = {
+            "input_tokens": 999_999_999,
+            "output_tokens": 17,
+        }
+        invalid_responses.append(outlier_input)
+
+        valid_input = copy.deepcopy(template)
+        valid_input["usage"] = {"input_tokens": 50, "output_tokens": 17}
+        scenario.nonstream_responses = invalid_responses + [valid_input]
+
+        count_body = {
+            "model": "gpt-fixture#low",
+            "messages": [{"role": "user", "content": "x" * 5000}],
+            "tools": [{"name": "Read", "input_schema": {"type": "object"}}],
+        }
+        request_payload = _message_payload()
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                baseline_result = shim.post_count_tokens(count_body)
+                self.assertEqual(baseline_result.status, 200, baseline_result.text)
+                baseline = baseline_result.json()["input_tokens"]
+                self.assertGreater(baseline, 1)
+
+                for expected_count in range(1, len(invalid_responses) + 1):
+                    result = shim.post_raw_messages(request_payload)
+                    self.assertEqual(result.status, 200, result.text)
+                    unchanged = shim.post_count_tokens(count_body)
+                    self.assertEqual(unchanged.status, 200, unchanged.text)
+                    self.assertEqual(unchanged.json()["input_tokens"], baseline)
+                    self.assertEqual(len(backend.responses_requests), expected_count)
+
+                calibrated_request = shim.post_raw_messages(request_payload)
+                self.assertEqual(calibrated_request.status, 200, calibrated_request.text)
+                calibrated_result = shim.post_count_tokens(count_body)
+                self.assertEqual(calibrated_result.status, 200, calibrated_result.text)
+                calibrated = calibrated_result.json()["input_tokens"]
+                self.assertGreater(calibrated, 1)
+                self.assertNotEqual(calibrated, baseline)
+
+                logs = shim.captured_stderr()
+                self.assertEqual(logs.count("count_tokens calibration rejected"), 1)
+                self.assertEqual(logs.count("count_tokens calibrated ratio="), 1)
+                backend.assert_request_counts(responses=8)
+
+    def test_effort_suffix_and_precedence_matrix(self) -> None:
+        scenario = full_response_scenario()
+        default_cases = [
+            (
+                "gpt-fixture#low",
+                {"effort": "medium"},
+                None,
+                "gpt-fixture",
+                "medium",
+            ),
+            (
+                "gpt-fixture#low",
+                {"effort": "high"},
+                None,
+                "gpt-fixture",
+                "low",
+            ),
+            (
+                "gpt-fixture#medium",
+                {"effort": "invalid"},
+                None,
+                "gpt-fixture",
+                "medium",
+            ),
+            (
+                "gpt-fixture",
+                {"effort": "   "},
+                None,
+                "gpt-fixture",
+                "high",
+            ),
+            (
+                "gpt-fixture#max",
+                None,
+                {"type": "disabled"},
+                "gpt-fixture",
+                "none",
+            ),
+            (
+                "gpt-fixture#max",
+                {"effort": "high"},
+                {"type": "disabled"},
+                "gpt-fixture",
+                "none",
+            ),
+            (
+                "gpt-fixture#max",
+                {"effort": "low"},
+                {"type": "disabled"},
+                "gpt-fixture",
+                "low",
+            ),
+            (
+                "gpt-fixture#future",
+                None,
+                None,
+                "gpt-fixture",
+                "high",
+            ),
+        ]
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                self.assertIsNone(shim.health["reasoning_effort"])
+                for model, output_config, thinking, bare_model, effort in default_cases:
+                    result = shim.post_raw_messages(
+                        _message_payload(
+                            model=model,
+                            output_config=output_config,
+                            thinking=thinking,
+                        )
+                    )
+                    self.assertEqual(result.status, 200, result.text)
+                    outgoing = backend.responses_requests[-1].body
+                    self.assertEqual(outgoing["model"], bare_model)
+                    self.assertEqual(outgoing["reasoning"]["effort"], effort)
+                backend.assert_request_counts(responses=len(default_cases))
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend,
+                "openai",
+                env_overrides={"SHIM_REASONING_EFFORT": " xhigh "},
+            ) as shim:
+                self.assertEqual(shim.health["reasoning_effort"], "xhigh")
+                env_cases = [
+                    ("gpt-fixture", None, "xhigh"),
+                    ("gpt-fixture", {"effort": "high"}, "xhigh"),
+                    ("gpt-fixture#", None, "xhigh"),
+                    ("gpt-fixture#invalid", None, "xhigh"),
+                    ("gpt-fixture#low", {"effort": "high"}, "low"),
+                ]
+                for model, output_config, effort in env_cases:
+                    result = shim.post_raw_messages(
+                        _message_payload(model=model, output_config=output_config)
+                    )
+                    self.assertEqual(result.status, 200, result.text)
+                    outgoing = backend.responses_requests[-1].body
+                    self.assertEqual(outgoing["model"], "gpt-fixture")
+                    self.assertEqual(outgoing["reasoning"]["effort"], effort)
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend,
+                "openai",
+                env_overrides={"SHIM_REASONING_EFFORT": "invalid"},
+            ) as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 200, result.text)
+                self.assertEqual(shim.health["reasoning_effort"], "invalid")
+                self.assertEqual(
+                    backend.responses_requests[0].body["reasoning"]["effort"],
+                    "high",
+                )
+
+    def test_verbosity_startup_health_warning_and_payload_matrix(self) -> None:
+        cases = [
+            ("unset", None, "high", 0),
+            ("low", "low", "low", 0),
+            ("medium", " MeDiUm ", "medium", 0),
+            ("high", "high", "high", 0),
+            ("blank", "   ", "high", 1),
+            ("invalid", "verbose", "high", 1),
+        ]
+        scenario = full_response_scenario()
+        for name, raw, expected, warning_count in cases:
+            with self.subTest(case=name):
+                overrides = {} if raw is None else {"SHIM_TEXT_VERBOSITY": raw}
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(
+                        backend,
+                        "openai",
+                        env_overrides=overrides,
+                    ) as shim:
+                        result = shim.post_messages(stream=False)
+                        self.assertEqual(result.status, 200, result.text)
+                        self.assertEqual(shim.health["text_verbosity"], expected)
+                        self.assertEqual(
+                            backend.responses_requests[0].body["text"],
+                            {"verbosity": expected},
+                        )
+                        logs = shim.captured_stderr()
+                        self.assertEqual(
+                            logs.count("SHIM_TEXT_VERBOSITY"),
+                            warning_count,
+                            logs,
+                        )
+                        self.assertIn(f"text_verbosity={expected}", logs)
+
+    def test_complete_stable_health_contract_both_lanes_and_overrides(self) -> None:
+        scenario = full_response_scenario()
+        cases = [
+            (
+                "openai",
+                {
+                    "SHIM_SANITIZE_TOOLS": "false",
+                    "SHIM_REASONING_EFFORT": "low",
+                    "SHIM_TEXT_VERBOSITY": "medium",
+                    "SHIM_STRIP_MODEL_PREFIX": "provider/",
+                },
+                False,
+                "low",
+                "medium",
+            ),
+            (
+                "chatgpt",
+                {
+                    "SHIM_SANITIZE_TOOLS": "1",
+                    "SHIM_REASONING_EFFORT": "max",
+                    "SHIM_TEXT_VERBOSITY": "low",
+                },
+                True,
+                "max",
+                "low",
+            ),
+        ]
+        for mode, overrides, sanitize, effort, verbosity in cases:
+            with self.subTest(mode=mode):
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(
+                        backend,
+                        mode,
+                        env_overrides=overrides,
+                    ) as shim:
+                        health_result = shim.get_health()
+                        self.assertEqual(health_result.status, 200, health_result.text)
+                        health = health_result.json()
+                        self.assertEqual(set(health), _HEALTH_KEYS)
+                        self.assertEqual(health["service"], "daaf-anthropic-openai-shim")
+                        self.assertEqual(health["status"], "ok")
+                        self.assertEqual(health["version"], "1.3.9")
+                        self.assertEqual(health["backend_mode"], mode)
+                        self.assertEqual(health["sanitize_tools"], sanitize)
+                        self.assertEqual(health["reasoning_effort"], effort)
+                        self.assertEqual(health["text_verbosity"], verbosity)
+                        self.assertIs(health["codex_home_present"], True)
+                        tier = health["gpt_service_tier"]
+                        self.assertEqual(
+                            set(tier),
+                            {
+                                "backend_mode",
+                                "requested_tier_vocabulary",
+                                "policy",
+                                "native_fast_disabled",
+                                "latest_terminal",
+                            },
+                        )
+                        self.assertEqual(tier["backend_mode"], mode)
+                        self.assertEqual(
+                            tier["requested_tier_vocabulary"],
+                            "priority",
+                        )
+                        self.assertEqual(
+                            set(tier["policy"]),
+                            {"status", "backend_mode", "enabled", "effective"},
+                        )
+                        self.assertIs(tier["native_fast_disabled"], False)
+                        self.assertIsNone(tier["latest_terminal"])
+                        # v1.3.0 (A1-R4): the auth block. The openai lane does not use
+                        # the codex OAuth store -> "n/a" (no token material). The chatgpt
+                        # lane seeds a far-future fabricated token -> "valid", with an
+                        # expiry/day-count and NO recovery command (recovery is present
+                        # only for the four actionable states).
+                        auth = health["auth"]
+                        if mode == "openai":
+                            self.assertEqual(auth, {"state": "n/a"})
+                        else:
+                            self.assertEqual(auth["state"], "valid")
+                            self.assertNotIn("recovery", auth)
+                            self.assertIsInstance(auth["expires_at"], str)
+                            self.assertGreater(auth["days_left"], 1)
+                        expected_backend = (
+                            f"{backend.base_url}/v1"
+                            if mode == "openai"
+                            else backend.base_url
+                        )
+                        self.assertEqual(health["backend"], expected_backend)
+                        for forbidden in (
+                            "port",
+                            "pid",
+                            "api_key",
+                            "credential_path",
+                            "codex_home",
+                        ):
+                            self.assertNotIn(forbidden, health)
+
+                        result = shim.post_messages(
+                            stream=False,
+                            model="provider/gpt-fixture",
+                        )
+                        self.assertEqual(result.status, 200, result.text)
+                        outgoing = backend.responses_requests[0].body
+                        expected_model = (
+                            "gpt-fixture" if mode == "openai" else "provider/gpt-fixture"
+                        )
+                        self.assertEqual(outgoing["model"], expected_model)
+                        self.assertEqual(outgoing["reasoning"]["effort"], effort)
+                        self.assertEqual(outgoing["text"], {"verbosity": verbosity})
+
+    def test_two_turn_reasoning_cache_replay_is_paired_and_conversation_local(self) -> None:
+        scenario = full_response_scenario()
+        first_response = copy.deepcopy(scenario.nonstream_response)
+        quiet_response = _response(
+            "resp_replay_followup",
+            [],
+            {"input_tokens": 31, "output_tokens": 1, "total_tokens": 32},
+        )
+        scenario.nonstream_responses = [first_response, quiet_response, quiet_response]
+        cached_reasoning = copy.deepcopy(first_response["output"][0])
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                first = shim.post_messages(stream=False, tools=[READ_TOOL])
+                self.assertEqual(first.status, 200, first.text)
+                first_content = first.json()["content"]
+                paired_messages = [
+                    {"role": "assistant", "content": first_content},
+                    {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "tool_use_id": "call_full_fixture",
+                                "content": "paired result",
+                            }
+                        ],
+                    },
+                ]
+                unrelated_messages = [
+                    {
+                        "role": "assistant",
+                        "content": [
+                            {
+                                "type": "tool_use",
+                                "id": "call_unrelated",
+                                "name": "Read",
+                                "input": {"file_path": "/daaf/CONTRIBUTING.md"},
+                            }
+                        ],
+                    },
+                    {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "tool_use_id": "call_unrelated",
+                                "content": "unrelated result",
+                            }
+                        ],
+                    },
+                ]
+                results: dict[str, object] = {}
+                failures: list[BaseException] = []
+
+                def call(label: str, messages: list[dict[str, object]]) -> None:
+                    try:
+                        results[label] = shim.post_messages(
+                            stream=False,
+                            tools=[READ_TOOL],
+                            messages=messages,
+                        )
+                    except BaseException as error:
+                        failures.append(error)
+
+                threads = [
+                    threading.Thread(
+                        target=call,
+                        args=("paired", paired_messages),
+                        daemon=True,
+                    ),
+                    threading.Thread(
+                        target=call,
+                        args=("unrelated", unrelated_messages),
+                        daemon=True,
+                    ),
+                ]
+                for thread in threads:
+                    thread.start()
+                for thread in threads:
+                    thread.join(timeout=20.0)
+                self.assertTrue(all(not thread.is_alive() for thread in threads))
+                self.assertEqual(failures, [])
+                self.assertEqual(set(results), {"paired", "unrelated"})
+
+                requests_by_call: dict[str, dict[str, object]] = {}
+                for request in backend.responses_requests[1:]:
+                    call_ids = [
+                        item.get("call_id")
+                        for item in request.body["input"]
+                        if item.get("type") == "function_call"
+                    ]
+                    if "call_full_fixture" in call_ids:
+                        requests_by_call["paired"] = request.body
+                    if "call_unrelated" in call_ids:
+                        requests_by_call["unrelated"] = request.body
+                self.assertEqual(set(requests_by_call), {"paired", "unrelated"})
+
+                paired_input = requests_by_call["paired"]["input"]
+                function_at = next(
+                    index
+                    for index, item in enumerate(paired_input)
+                    if item.get("type") == "function_call"
+                    and item.get("call_id") == "call_full_fixture"
+                )
+                self.assertGreater(function_at, 0)
+                self.assertEqual(paired_input[function_at - 1], cached_reasoning)
+                self.assertEqual(
+                    paired_input[function_at - 1]["encrypted_content"],
+                    "ENC_rs_full",
+                )
+                self.assertFalse(
+                    any(
+                        item.get("type") == "reasoning"
+                        for item in requests_by_call["unrelated"]["input"]
+                    )
+                )
+
+                paired_lifecycle = lifecycle_for_response(shim, results["paired"])
+                unrelated_lifecycle = lifecycle_for_response(shim, results["unrelated"])
+                paired_terminal = next(
+                    line for line in paired_lifecycle if line.event == "terminal"
+                )
+                unrelated_terminal = next(
+                    line for line in unrelated_lifecycle if line.event == "terminal"
+                )
+                self.assertEqual(paired_terminal.fields["reasoning_cache_miss"], "0")
+                self.assertEqual(
+                    unrelated_terminal.fields["reasoning_cache_miss"], "1"
+                )
+                backend.assert_request_counts(responses=3)
+
+    def test_tool_argument_sanitization_matrix_and_disabled_passthrough(self) -> None:
+        originals = [
+            ("call_read_empty", "Read", {"file_path": "/daaf/README.md", "pages": "", "note": ""}),
+            ("call_read_pages", "Read", {"file_path": "/daaf/a.pdf", "pages": "1-3"}),
+            ("call_agent", "Agent", {"prompt": "", "isolation": "remote", "model": "opus"}),
+            ("call_task", "Task", {"prompt": "task", "isolation": "", "model": "sonnet"}),
+            ("call_bash_false", "Bash", {"command": "pwd", "dangerouslyDisableSandbox": False, "description": ""}),
+            ("call_bash_true", "Bash", {"command": "pwd", "dangerouslyDisableSandbox": True}),
+        ]
+        output = [
+            _tool_item(f"fc_{index}", call_id, name, arguments)
+            for index, (call_id, name, arguments) in enumerate(originals)
+        ]
+        response = _response("resp_sanitize", output, dict(USAGE))
+        scenario = events_scenario(
+            "sanitize-matrix",
+            [],
+            nonstream_response=response,
+        )
+        tools = [
+            {
+                "name": name,
+                "description": "fixture",
+                "input_schema": {"type": "object", "properties": {}},
+            }
+            for name in ("Read", "Agent", "Task", "Bash")
+        ]
+        expected = {
+            "call_read_empty": {"file_path": "/daaf/README.md", "note": ""},
+            "call_read_pages": {"file_path": "/daaf/a.pdf", "pages": "1-3"},
+            "call_agent": {"prompt": "", "model": "opus"},
+            "call_task": {"prompt": "task", "model": "sonnet"},
+            "call_bash_false": {"command": "pwd", "description": ""},
+            "call_bash_true": {"command": "pwd", "dangerouslyDisableSandbox": True},
+        }
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=False, tools=tools)
+                self.assertEqual(result.status, 200, result.text)
+                actual = {
+                    block["id"]: block["input"]
+                    for block in result.json()["content"]
+                    if block.get("type") == "tool_use"
+                }
+                self.assertEqual(actual, expected)
+                self.assertEqual(shim.health["sanitize_tools"], True)
+                self.assertEqual(
+                    [tool["name"] for tool in backend.responses_requests[0].body["tools"]],
+                    ["Read", "Agent", "Task", "Bash"],
+                )
+                replay = shim.post_messages(
+                    stream=False,
+                    tools=tools,
+                    messages=[{"role": "assistant", "content": result.json()["content"]}],
+                )
+                self.assertEqual(replay.status, 200, replay.text)
+                replayed_arguments = {
+                    item["call_id"]: json.loads(item["arguments"])
+                    for item in backend.responses_requests[1].body["input"]
+                    if item.get("type") == "function_call"
+                }
+                self.assertEqual(replayed_arguments, expected)
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend,
+                "openai",
+                env_overrides={"SHIM_SANITIZE_TOOLS": "false"},
+            ) as shim:
+                result = shim.post_messages(stream=False, tools=tools)
+                self.assertEqual(result.status, 200, result.text)
+                actual = {
+                    block["id"]: block["input"]
+                    for block in result.json()["content"]
+                    if block.get("type") == "tool_use"
+                }
+                original_map = {
+                    call_id: arguments for call_id, _name, arguments in originals
+                }
+                self.assertEqual(actual, original_map)
+                self.assertEqual(shim.health["sanitize_tools"], False)
+                replay = shim.post_messages(
+                    stream=False,
+                    tools=tools,
+                    messages=[{"role": "assistant", "content": result.json()["content"]}],
+                )
+                self.assertEqual(replay.status, 200, replay.text)
+                replayed_arguments = {
+                    item["call_id"]: json.loads(item["arguments"])
+                    for item in backend.responses_requests[1].body["input"]
+                    if item.get("type") == "function_call"
+                }
+                self.assertEqual(replayed_arguments, original_map)
+
+    def test_realshim_env_override_seam_rejects_security_sensitive_keys(self) -> None:
+        scenario = full_response_scenario()
+        with MockResponsesServer(scenario) as backend:
+            for name in ("OPENAI_API_KEY", "SHIM_BACKEND_BASE_URL", "MY_SECRET"):
+                with self.subTest(name=name):
+                    with self.assertRaisesRegex(ValueError, "not allowlisted"):
+                        RealShim(backend, "openai", env_overrides={name: "forbidden"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_reasoning_formatting.py b/tests/provider_shim/test_reasoning_formatting.py
index 1385e6a5..80eabcfa 100644
--- a/tests/provider_shim/test_reasoning_formatting.py
+++ b/tests/provider_shim/test_reasoning_formatting.py
@@ -47,7 +47,7 @@ def _chatgpt_stream_text(self, scenario: object) -> str:
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 return "".join(thinking_delta_values(frames))
 
     def test_openai_streaming_legacy_bytes_unchanged(self) -> None:
@@ -59,7 +59,7 @@ def test_openai_streaming_legacy_bytes_unchanged(self) -> None:
                 frames = parse_typed_sse(result.body)
                 lifecycle = lifecycle_report(frames)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual(thinking_delta_values(frames), CENTRAL_SOURCE_DELTAS)
                 self.assertEqual("".join(thinking_delta_values(frames)), CENTRAL_LEGACY_TEXT)
@@ -71,8 +71,22 @@ def test_openai_streaming_legacy_bytes_unchanged(self) -> None:
                     backend.responses_requests[0].path,
                     "/v1/responses",
                 )
+                self.assertEqual(
+                    shim.health.get("service"), "daaf-anthropic-openai-shim"
+                )
+                self.assertEqual(shim.health.get("status"), "ok")
                 self.assertEqual(shim.health.get("backend_mode"), "openai")
-                self.assertEqual(shim.health.get("version"), "1.2.11")
+                self.assertEqual(shim.health.get("version"), "1.3.9")
+                self.assertEqual(
+                    set(shim.health["gpt_service_tier"]),
+                    {
+                        "backend_mode",
+                        "requested_tier_vocabulary",
+                        "policy",
+                        "native_fast_disabled",
+                        "latest_terminal",
+                    },
+                )
 
     def test_openai_nonstreaming_legacy_bytes_unchanged(self) -> None:
         scenario = central_multipart_scenario()
@@ -82,7 +96,7 @@ def test_openai_nonstreaming_legacy_bytes_unchanged(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 message = result.json()
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual(extract_nonstream_thinking(message), CENTRAL_LEGACY_TEXT)
                 thinking_blocks = [
@@ -104,7 +118,7 @@ def test_chatgpt_boundary_streaming_multipart(self) -> None:
                 frames = parse_typed_sse(result.body)
                 lifecycle = lifecycle_report(frames)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 values = thinking_delta_values(frames)
                 self.assertEqual(
@@ -142,7 +156,7 @@ def test_chatgpt_boundary_nonstreaming_parity(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 message = result.json()
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual(extract_nonstream_thinking(message), CENTRAL_DESIRED_TEXT)
                 self.assertEqual(message.get("stop_reason"), "end_turn")
@@ -164,7 +178,7 @@ def test_chatgpt_empty_first_middle_parts_no_extra_separators(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 text = "".join(thinking_delta_values(frames))
                 self.assertEqual(text, "A\n\nB")
                 self.assertFalse(text.startswith("\n\n"))
@@ -179,7 +193,7 @@ def test_chatgpt_missing_malformed_identity_falls_back_to_legacy_append(self) ->
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual(thinking_delta_values(frames), ["M", "N", "O"])
                 self.assertEqual("".join(thinking_delta_values(frames)), "MNO")
 
@@ -191,7 +205,7 @@ def test_chatgpt_mixed_identity_disables_later_boundary_synthesis(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 values = thinking_delta_values(frames)
                 self.assertEqual(values, ["A", "B", "C"])
@@ -342,7 +356,7 @@ def test_chatgpt_nonstreaming_whitespace_only_summary_is_preserved_content(self)
                 self.assertEqual(result.status, 200, result.text)
                 message = result.json()
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual(extract_nonstream_thinking(message), " \t\n\nB")
 
     def test_chatgpt_duplicate_same_part_chunks_have_no_separator(self) -> None:
@@ -363,7 +377,7 @@ def test_chatgpt_duplicate_same_part_chunks_have_no_separator(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual(thinking_delta_values(frames), ["A", "B", "C"])
                 self.assertEqual("".join(thinking_delta_values(frames)), "ABC")
 
@@ -382,7 +396,7 @@ def test_chatgpt_out_of_order_first_seen_identities_preserve_arrival_order(self)
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual(
                     "".join(thinking_delta_values(frames)),
                     "Fifth\n\nSecond\n\nNinth",
@@ -396,7 +410,7 @@ def test_chatgpt_multiple_reasoning_items_summary_reset_uses_composite_identity(
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual("".join(thinking_delta_values(frames)), CENTRAL_DESIRED_TEXT)
                 self.assertTrue(CENTRAL_DESIRED_TEXT.endswith("\n\n**Checking reset**"))
 
@@ -409,7 +423,7 @@ def test_chatgpt_thinking_to_text_lifecycle_signature_stop_and_end_turn(self) ->
                 frames = parse_typed_sse(result.body)
                 lifecycle = lifecycle_report(frames)
                 events = event_dicts(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual([kind for _, kind in lifecycle.starts], ["thinking", "text"])
                 thinking_index, text_index = [index for index, _ in lifecycle.starts]
@@ -450,7 +464,7 @@ def test_chatgpt_thinking_to_tool_lifecycle_arguments_and_stop_reason(self) -> N
                 frames = parse_typed_sse(result.body)
                 lifecycle = lifecycle_report(frames)
                 events = event_dicts(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual([kind for _, kind in lifecycle.starts], ["thinking", "tool_use"])
                 thinking_index, tool_index = [index for index, _ in lifecycle.starts]
@@ -498,7 +512,7 @@ def test_chatgpt_reopened_thinking_block_resets_boundary_state(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 frames = parse_typed_sse(result.body)
                 lifecycle = lifecycle_report(frames)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
                 self.assertEqual(
                     [kind for _, kind in lifecycle.starts],
@@ -516,7 +530,7 @@ def test_dual_mode_isolation_legacy_vs_boundary_modes(self) -> None:
                 self.assertEqual(openai_result.status, 200, openai_result.text)
                 openai_frames = parse_typed_sse(openai_result.body)
                 lifecycle_report(openai_frames)
-                openai_backend.assert_request_counts(responses=1, oauth=0)
+                openai_backend.assert_request_counts(responses=1)
                 openai_body = openai_backend.responses_requests[0].body
                 openai_headers = openai_backend.responses_requests[0].headers
 
@@ -526,7 +540,7 @@ def test_dual_mode_isolation_legacy_vs_boundary_modes(self) -> None:
                 self.assertEqual(chatgpt_result.status, 200, chatgpt_result.text)
                 chatgpt_frames = parse_typed_sse(chatgpt_result.body)
                 lifecycle_report(chatgpt_frames)
-                chatgpt_backend.assert_request_counts(responses=1, oauth=0)
+                chatgpt_backend.assert_request_counts(responses=1)
                 chatgpt_body = chatgpt_backend.responses_requests[0].body
                 chatgpt_headers = chatgpt_backend.responses_requests[0].headers
 
@@ -566,9 +580,14 @@ def test_harness_security_child_environment_omits_parent_secrets(self) -> None:
                     result = shim.post_messages(stream=False)
                     self.assertEqual(result.status, 200, result.text)
                     shim.assert_offline_contract()
-                    backend.assert_request_counts(responses=1, oauth=0)
+                    backend.assert_request_counts(responses=1)
                     for name in seeded_names:
-                        self.assertNotIn(name, shim.child_env, name)
+                        if name == "HOME":
+                            self.assertEqual(
+                                shim.child_env[name], str(shim.scratch_dir), name
+                            )
+                        else:
+                            self.assertNotIn(name, shim.child_env, name)
                     allowed_names = (
                         set(RealShim._CONTROLLED_BASE_ENV)
                         | set(RealShim._CONTROLLED_CHILD_ENV_NAMES)
@@ -616,7 +635,6 @@ def test_harness_offline_contract_cleanup_and_mock_accounting(self) -> None:
         with MockResponsesServer(scenario) as backend:
             self.assertTrue(is_loopback_url(backend.base_url))
             self.assertTrue(is_loopback_url(backend.responses_url))
-            self.assertTrue(is_loopback_url(backend.oauth_url))
             with RealShim(backend, "chatgpt") as shim:
                 scratch_dir = shim.scratch_dir
                 auth_path = shim.auth_path
@@ -634,7 +652,7 @@ def test_harness_offline_contract_cleanup_and_mock_accounting(self) -> None:
                 shim.assert_offline_contract()
                 result = shim.post_messages(stream=False)
                 self.assertEqual(result.status, 200, result.text)
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 request = backend.responses_requests[0]
                 self.assertEqual(request.headers.get("accept"), "text/event-stream")
                 self.assertTrue(request.headers.get("authorization", "").startswith("Bearer "))
diff --git a/tests/provider_shim/test_request_translation.py b/tests/provider_shim/test_request_translation.py
new file mode 100644
index 00000000..4750f2de
--- /dev/null
+++ b/tests/provider_shim/test_request_translation.py
@@ -0,0 +1,716 @@
+"""Production-subprocess regressions for request translation and v1.2.12 diagnostics."""
+
+from __future__ import annotations
+
+import base64
+import json
+import threading
+import unittest
+import urllib.parse
+
+from ._loopback_harness import (
+    USAGE,
+    MockResponsesServer,
+    RealShim,
+    controlled_asgi_probe,
+    events_scenario,
+    full_response_scenario,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+)
+
+
+_IMAGE_BYTES = b"fabricated-provider-shim-image-bytes"
+_IMAGE_B64 = base64.b64encode(_IMAGE_BYTES).decode("ascii")
+_IMAGE_URL = "https://images.example.invalid/visual.png?private=URL_SENTINEL_92Q"
+_FILE_ID = "file_PROVIDER_SCOPED_SENTINEL_71K"
+
+
+def _image(media_type: str = "image/png", data: str = _IMAGE_B64) -> dict[str, object]:
+    return {
+        "type": "image",
+        "source": {"type": "base64", "media_type": media_type, "data": data},
+    }
+
+
+def _missing_name_scenario(count: int = 50):
+    events: list[dict[str, object]] = []
+    output: list[dict[str, object]] = []
+    for index in range(count):
+        item_id = f"fc_aggregate_{index}"
+        call_id = f"call_aggregate_{index}"
+        arguments = "{}"
+        events.extend(
+            [
+                {
+                    "type": "response.output_item.added",
+                    "item": {
+                        "type": "function_call",
+                        "id": item_id,
+                        "call_id": call_id,
+                        "name": "Noop",
+                    },
+                },
+                {
+                    "type": "response.function_call_arguments.done",
+                    "item_id": item_id,
+                    "arguments": arguments,
+                },
+                {
+                    "type": "response.output_item.done",
+                    "item": {
+                        "type": "function_call",
+                        "id": item_id,
+                        "call_id": call_id,
+                        "name": "Noop",
+                        "arguments": arguments,
+                    },
+                },
+            ]
+        )
+        output.append(
+            {
+                "type": "function_call",
+                "id": item_id,
+                "call_id": call_id,
+                "name": "Noop",
+                "arguments": arguments,
+            }
+        )
+    events.append(
+        {
+            "type": "response.completed",
+            "response": {
+                "id": "resp_warning_aggregate",
+                "status": "completed",
+                "output": output,
+                "usage": dict(USAGE),
+            },
+        }
+    )
+    return events_scenario("warning-aggregate", events)
+
+
+class ProviderShimRequestTranslationTests(unittest.TestCase):
+    maxDiff = 12000
+
+    def test_supported_base64_images_map_in_both_lanes(self) -> None:
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        for media_type in (
+                            "image/jpeg",
+                            "image/png",
+                            "image/gif",
+                            "image/webp",
+                        ):
+                            result = shim.post_messages(
+                                stream=False,
+                                messages=[
+                                    {
+                                        "role": "user",
+                                        "content": [_image(media_type)],
+                                    }
+                                ],
+                            )
+                            self.assertEqual(result.status, 200, media_type)
+                        self.assertEqual(len(backend.responses_requests), 4)
+                        for request, media_type in zip(
+                            backend.responses_requests,
+                            ("image/jpeg", "image/png", "image/gif", "image/webp"),
+                        ):
+                            content = request.body["input"][0]["content"]
+                            self.assertEqual(
+                                content,
+                                [
+                                    {
+                                        "type": "input_image",
+                                        "image_url": f"data:{media_type};base64,{_IMAGE_B64}",
+                                        "detail": "auto",
+                                    }
+                                ],
+                            )
+                        logs = shim.captured_stderr()
+                        self.assertNotIn(_IMAGE_B64, logs)
+                        self.assertNotIn(_IMAGE_BYTES.decode("ascii"), logs)
+
+    def test_url_image_and_tool_result_preserve_content_order_both_lanes(self) -> None:
+        messages = [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "before"},
+                    {"type": "image", "source": {"type": "url", "url": _IMAGE_URL}},
+                    {"type": "text", "text": "after"},
+                ],
+            },
+            {
+                "role": "user",
+                "content": [
+                    {
+                        "type": "tool_result",
+                        "tool_use_id": "call_image_result",
+                        "content": [
+                            {"type": "text", "text": "tool-before"},
+                            _image(),
+                            {"type": "text", "text": "tool-after"},
+                        ],
+                    }
+                ],
+            },
+        ]
+        expected_user = [
+            {"type": "input_text", "text": "before"},
+            {"type": "input_image", "image_url": _IMAGE_URL, "detail": "auto"},
+            {"type": "input_text", "text": "after"},
+        ]
+        expected_tool = [
+            {"type": "input_text", "text": "tool-before"},
+            {
+                "type": "input_image",
+                "image_url": f"data:image/png;base64,{_IMAGE_B64}",
+                "detail": "auto",
+            },
+            {"type": "input_text", "text": "tool-after"},
+        ]
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        result = shim.post_messages(stream=False, messages=messages)
+                        self.assertEqual(result.status, 200, result.text)
+                        request_input = backend.responses_requests[0].body["input"]
+                        self.assertEqual(request_input[0]["content"], expected_user)
+                        self.assertEqual(
+                            request_input[1],
+                            {
+                                "type": "function_call_output",
+                                "call_id": "call_image_result",
+                                "output": expected_tool,
+                            },
+                        )
+                        logs = shim.captured_stderr()
+                        self.assertNotIn(_IMAGE_URL, logs)
+                        self.assertNotIn(_IMAGE_B64, logs)
+
+    def test_invalid_visual_and_unknown_blocks_are_local_400_without_backend(self) -> None:
+        cases = (
+            ("invalid-base64", _image(data="abcd===")),
+            ("unsupported-mime", _image(media_type="image/svg+xml")),
+            (
+                "unsupported-source",
+                {"type": "image", "source": {"type": "future", "data": "hidden"}},
+            ),
+            (
+                "file-source",
+                {"type": "image", "source": {"type": "file", "file_id": _FILE_ID}},
+            ),
+            (
+                "invalid-url-scheme",
+                {"type": "image", "source": {"type": "url", "url": "file:///secret"}},
+            ),
+            (
+                "invalid-url-credentials",
+                {
+                    "type": "image",
+                    "source": {"type": "url", "url": "https://user:pass@example.invalid/x"},
+                },
+            ),
+            ("unknown-block", {"type": "future_block", "payload": "PROMPT_SENTINEL_4X"}),
+        )
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        for name, block in cases:
+                            with self.subTest(case=name):
+                                result = shim.post_messages(
+                                    stream=False,
+                                    messages=[{"role": "user", "content": [block]}],
+                                )
+                                self.assertEqual(result.status, 400, (name, result.text))
+                                self.assertEqual(
+                                    result.json()["error"]["type"],
+                                    "invalid_request_error",
+                                )
+                        assistant = shim.post_messages(
+                            stream=False,
+                            messages=[{"role": "assistant", "content": [_image()]}],
+                        )
+                        self.assertEqual(assistant.status, 400, assistant.text)
+                        self.assertEqual(len(backend.responses_requests), 0)
+                        logs = shim.captured_stderr()
+                        for forbidden in (
+                            _IMAGE_B64,
+                            _IMAGE_URL,
+                            _FILE_ID,
+                            "PROMPT_SENTINEL_4X",
+                            "https://user:pass@example.invalid/x",
+                        ):
+                            self.assertNotIn(forbidden, logs)
+
+    def test_malformed_history_is_local_400_in_both_lanes(self) -> None:
+        sentinels = (
+            "INVALID_ROLE_PROMPT_SENTINEL_7V",
+            "MISPLACED_TOOL_INPUT_SENTINEL_8W",
+            "MISPLACED_RESULT_SENTINEL_9X",
+            "INVALID_RESULT_CONTENT_SENTINEL_0Y",
+            "PRIVATE_TOOL_USE_ID_SENTINEL_1Z",
+        )
+        cases = (
+            (
+                "invalid-role",
+                [
+                    {
+                        "role": sentinels[0],
+                        "content": "private prompt text",
+                    }
+                ],
+            ),
+            (
+                "missing-role",
+                [{"content": "private prompt text"}],
+            ),
+            (
+                "tool-use-in-user-message",
+                [
+                    {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_use",
+                                "id": sentinels[4],
+                                "name": "PrivateTool",
+                                "input": {"secret": sentinels[1]},
+                            }
+                        ],
+                    }
+                ],
+            ),
+            (
+                "tool-result-in-assistant-message",
+                [
+                    {
+                        "role": "assistant",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "tool_use_id": sentinels[4],
+                                "content": sentinels[2],
+                            }
+                        ],
+                    }
+                ],
+            ),
+            (
+                "tool-result-object-content",
+                [
+                    {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "tool_use_id": sentinels[4],
+                                "content": {"private": sentinels[3]},
+                            }
+                        ],
+                    }
+                ],
+            ),
+            (
+                "tool-result-null-content",
+                [
+                    {
+                        "role": "user",
+                        "content": [
+                            {
+                                "type": "tool_result",
+                                "tool_use_id": sentinels[4],
+                                "content": None,
+                            }
+                        ],
+                    }
+                ],
+            ),
+        )
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        response_texts = []
+                        for name, messages in cases:
+                            with self.subTest(mode=mode, case=name):
+                                result = shim.post_messages(
+                                    stream=False,
+                                    messages=messages,
+                                )
+                                response_texts.append(result.text)
+                                self.assertEqual(result.status, 400, result.text)
+                                self.assertEqual(
+                                    result.json().get("error", {}).get("type"),
+                                    "invalid_request_error",
+                                )
+                        backend.assert_request_counts(responses=0)
+                        privacy_surfaces = "\n".join(response_texts) + shim.captured_stderr()
+                        for sentinel in sentinels:
+                            self.assertNotIn(sentinel, privacy_surfaces)
+
+                control = full_response_scenario()
+                with MockResponsesServer(control) as backend:
+                    with RealShim(backend, mode) as shim:
+                        result = shim.post_messages(
+                            stream=False,
+                            messages=[
+                                {"role": "user", "content": "valid user text"},
+                                {"role": "assistant", "content": "valid assistant text"},
+                                {
+                                    "role": "assistant",
+                                    "content": [
+                                        {
+                                            "type": "tool_use",
+                                            "id": "call_valid_history",
+                                            "name": "ValidTool",
+                                            "input": {"value": 1},
+                                        }
+                                    ],
+                                },
+                                {
+                                    "role": "user",
+                                    "content": [
+                                        {
+                                            "type": "tool_result",
+                                            "tool_use_id": "call_valid_history",
+                                            "content": "valid string result",
+                                        }
+                                    ],
+                                },
+                            ],
+                        )
+                        self.assertEqual(result.status, 200, result.text)
+                        request_input = backend.responses_requests[0].body["input"]
+                        self.assertEqual(request_input[-2]["type"], "function_call")
+                        self.assertEqual(
+                            request_input[-1],
+                            {
+                                "type": "function_call_output",
+                                "call_id": "call_valid_history",
+                                "output": "valid string result",
+                            },
+                        )
+                        backend.assert_request_counts(responses=1)
+
+    def test_text_only_tool_result_retains_string_compatibility(self) -> None:
+        scenario = full_response_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(
+                    stream=False,
+                    messages=[
+                        {
+                            "role": "user",
+                            "content": [
+                                {
+                                    "type": "tool_result",
+                                    "tool_use_id": "call_text_only",
+                                    "content": [
+                                        {"type": "text", "text": "one"},
+                                        {"type": "text", "text": "two"},
+                                    ],
+                                }
+                            ],
+                        }
+                    ],
+                )
+                self.assertEqual(result.status, 200, result.text)
+                self.assertEqual(
+                    backend.responses_requests[0].body["input"][0]["output"],
+                    "one\ntwo",
+                )
+
+    def test_system_role_messages_fold_to_user_in_both_lanes(self) -> None:
+        # v1.2.13 regression (live outage 2026-07-19): current Claude Code appends
+        # a role:"system" message inside `messages` (alongside top-level
+        # context_management/output_config). The v1.2.12 user/assistant-only role
+        # checks rejected every real conversation turn with the static 400.
+        # System-role messages must pass validation and fold to user-role input.
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        body = {
+                            "model": "gpt-fixture",
+                            "max_tokens": 256,
+                            "stream": False,
+                            "metadata": {"user_id": "user_fixture_session_0001"},
+                            "context_management": {"edits": []},
+                            "output_config": {"verbosity": "high"},
+                            "system": [{"type": "text", "text": "system prompt"}],
+                            "messages": [
+                                {
+                                    "role": "user",
+                                    "content": [{"type": "text", "text": "hello"}],
+                                },
+                                {
+                                    "role": "system",
+                                    "content": "trailing system reminder",
+                                },
+                            ],
+                        }
+                        result = shim.post_raw_messages(
+                            json.dumps(body, separators=(",", ":")).encode("utf-8"),
+                        )
+                        self.assertEqual(result.status, 200, result.text)
+                        request = backend.responses_requests[-1]
+                        input_items = request.body["input"]
+                        folded = input_items[-1]
+                        self.assertEqual(folded.get("role"), "user")
+                        self.assertEqual(
+                            folded.get("content"),
+                            [{
+                                "type": "input_text",
+                                "text": "trailing system reminder",
+                            }],
+                        )
+                        roles = {
+                            item.get("role")
+                            for item in input_items
+                            if isinstance(item, dict)
+                        }
+                        self.assertNotIn("system", roles)
+
+    def test_system_role_tool_blocks_stay_fail_closed(self) -> None:
+        # v1.2.13 companion: the validation gauntlet checks RAW roles, so a
+        # system-role message carrying tool_use/tool_result must still be
+        # rejected with the static 400 BEFORE any backend round-trip — the
+        # translator's fold-to-user must never launder tool blocks into a
+        # role placement the gauntlet would have refused.
+        for mode in ("openai", "chatgpt"):
+            for block in (
+                {"type": "tool_use", "id": "toolu_x", "name": "Noop", "input": {}},
+                {"type": "tool_result", "tool_use_id": "toolu_x", "content": "ok"},
+            ):
+                with self.subTest(mode=mode, block=block["type"]):
+                    scenario = full_response_scenario()
+                    with MockResponsesServer(scenario) as backend:
+                        with RealShim(backend, mode) as shim:
+                            body = {
+                                "model": "gpt-fixture",
+                                "max_tokens": 256,
+                                "stream": False,
+                                "messages": [
+                                    {"role": "system", "content": [block]},
+                                ],
+                            }
+                            result = shim.post_raw_messages(
+                                json.dumps(
+                                    body, separators=(",", ":"),
+                                ).encode("utf-8"),
+                            )
+                            self.assertEqual(result.status, 400, result.text)
+                            self.assertEqual(
+                                result.json()["error"]["message"],
+                                "invalid request structure",
+                            )
+                            self.assertEqual(len(backend.responses_requests), 0)
+
+    def test_trailing_thinking_history_replay_is_accepted_and_consumed(self) -> None:
+        # F2 / Quality-review adjudication 2 (the R3 trailing shape): an assistant
+        # HISTORY turn whose content is [text, tool_use, thinking] — thinking NOT first —
+        # followed by a tool_result user turn. Two invariants:
+        #   (1) the shim ACCEPTS it (no 400): the validation gauntlet checks only role
+        #       placement of tool_use/tool_result and text-block typing, so a trailing
+        #       thinking block passes.
+        #   (2) the translator CONSUMES the thinking block position-independently
+        #       (shim L2646-2650) — neither its prose nor its signature appears in the
+        #       outbound Responses `input`. Continuity rides the encrypted reasoning
+        #       cache, never replayed Anthropic thinking text (Claude Code replays
+        #       history to the SHIM, the terminating API, so the documented thinking-
+        #       first replay invariant never engages).
+        thinking_sentinel = "TRAILING_THINKING_PROSE_SENTINEL_5J"
+        signature_sentinel = "TRAILING_THINKING_SIGNATURE_SENTINEL_6K"
+        messages = [
+            {"role": "user", "content": "kick off the tool"},
+            {
+                "role": "assistant",
+                "content": [
+                    {"type": "text", "text": "Let me read the file."},
+                    {
+                        "type": "tool_use",
+                        "id": "call_trailing_think",
+                        "name": "Read",
+                        "input": {"file_path": "/daaf/README.md"},
+                    },
+                    {
+                        "type": "thinking",
+                        "thinking": thinking_sentinel,
+                        "signature": signature_sentinel,
+                    },
+                ],
+            },
+            {
+                "role": "user",
+                "content": [
+                    {
+                        "type": "tool_result",
+                        "tool_use_id": "call_trailing_think",
+                        "content": "file contents",
+                    }
+                ],
+            },
+        ]
+        for mode in ("openai", "chatgpt"):
+            with self.subTest(mode=mode):
+                scenario = full_response_scenario()
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        result = shim.post_messages(stream=False, messages=messages)
+                        self.assertEqual(result.status, 200, result.text)
+                        request_input = backend.responses_requests[0].body["input"]
+                        serialized = json.dumps(request_input)
+                        # (2a) trailing thinking prose + signature are consumed, never
+                        # forwarded to the backend.
+                        self.assertNotIn(thinking_sentinel, serialized)
+                        self.assertNotIn(signature_sentinel, serialized)
+                        # (2b) no reasoning item is synthesized from replayed thinking
+                        # (nothing was cached for this call_id in a fresh process).
+                        self.assertFalse(
+                            any(
+                                isinstance(item, dict)
+                                and item.get("type") == "reasoning"
+                                for item in request_input
+                            )
+                        )
+                        # The surrounding turn still translated: the assistant text and
+                        # the function_call / function_call_output round-trip survive.
+                        self.assertTrue(
+                            any(
+                                isinstance(item, dict)
+                                and item.get("type") == "function_call"
+                                for item in request_input
+                            )
+                        )
+                        self.assertTrue(
+                            any(
+                                isinstance(item, dict)
+                                and item.get("type") == "function_call_output"
+                                for item in request_input
+                            )
+                        )
+                        logs = shim.captured_stderr()
+                        self.assertNotIn(thinking_sentinel, logs)
+                        self.assertNotIn(signature_sentinel, logs)
+
+    def test_request_ids_and_transport_timeout_families_are_bounded(self) -> None:
+        scenario = full_response_scenario()
+        scenario.stream_headers = {"x-request-id": "provider-request-17"}
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_report(parse_typed_sse(result.body))
+                lines = lifecycle_for_response(shim, result)
+                local_id = result.headers["x-daaf-request-id"]
+                self.assertEqual(
+                    backend.responses_requests[0].headers.get("x-client-request-id"),
+                    local_id,
+                )
+                upstream = next(line for line in lines if line.event == "upstream_headers")
+                self.assertEqual(upstream.fields["upstream_req_id"], "provider-request-17")
+                terminal = next(line for line in lines if line.event == "terminal")
+                self.assertEqual(terminal.fields["client_req_id"], local_id)
+                self.assertEqual(terminal.fields["upstream_req_id"], "provider-request-17")
+
+        expected = {
+            "connect_timeout": ("ConnectTimeout", "connect"),
+            "read_timeout": ("ReadTimeout", "header_wait_or_body_read"),
+            "write_timeout": ("WriteTimeout", "request_body_write"),
+            "pool_timeout": ("PoolTimeout", "connection_pool_wait"),
+        }
+        for outcome, (exception_class, phase) in expected.items():
+            with self.subTest(timeout=outcome):
+                report = controlled_asgi_probe(attempt_outcomes=[outcome, 200])
+                failures = [line for line in report.lifecycle if line.event == "transport_failure"]
+                self.assertEqual(len(failures), 1)
+                self.assertEqual(failures[0].fields["exception_class"], exception_class)
+                self.assertEqual(failures[0].fields["failure_phase"], phase)
+                self.assertEqual(failures[0].fields["retryable"], "y")
+                retry = next(line for line in report.lifecycle if line.event == "upstream_retry")
+                self.assertEqual(retry.fields["source"], "shim_policy")
+                self.assertEqual(retry.fields["reason"], "transport")
+
+        midbody = controlled_asgi_probe(attempt_outcomes=["midbody_read_timeout"])
+        midbody_failures = [
+            line for line in midbody.lifecycle if line.event == "transport_failure"
+        ]
+        self.assertEqual(len(midbody_failures), 1)
+        self.assertEqual(
+            midbody_failures[0].fields["exception_class"], "ReadTimeout"
+        )
+        self.assertEqual(
+            midbody_failures[0].fields["failure_phase"],
+            "post_stream_start_body_read",
+        )
+        self.assertEqual(midbody_failures[0].fields["retryable"], "n")
+        midbody_terminal = next(
+            line for line in midbody.lifecycle if line.event == "terminal"
+        )
+        self.assertEqual(
+            midbody_terminal.fields["failure_phase"],
+            "post_stream_start_body_read",
+        )
+        self.assertEqual(midbody.upstream_calls, 1)
+
+    def test_missing_name_warning_is_concurrency_safe_and_bounded(self) -> None:
+        scenario = _missing_name_scenario(150)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                results: list[object] = []
+                failures: list[BaseException] = []
+
+                def call() -> None:
+                    try:
+                        results.append(shim.post_messages(stream=True))
+                    except BaseException as error:
+                        failures.append(error)
+
+                threads = [threading.Thread(target=call, daemon=True) for _ in range(2)]
+                for thread in threads:
+                    thread.start()
+                for thread in threads:
+                    thread.join(timeout=20.0)
+                self.assertTrue(all(not thread.is_alive() for thread in threads))
+                self.assertEqual(failures, [])
+                self.assertEqual(len(results), 2)
+                for result in results:
+                    self.assertEqual(result.status, 200, result.text)
+                    lifecycle_report(parse_typed_sse(result.body))
+                warning_lines = [
+                    line
+                    for line in shim.captured_stderr().splitlines()
+                    if "arguments.done_missing_name" in line
+                ]
+                self.assertEqual(len(warning_lines), 4, warning_lines)
+                expected = (
+                    (1, None),
+                    (100, 98),
+                    (200, 99),
+                    (300, 99),
+                )
+                for line, (observed, suppressed) in zip(warning_lines, expected):
+                    self.assertIn(f"observed={observed}", line)
+                    if suppressed is None:
+                        self.assertNotIn("suppressed=", line)
+                    else:
+                        self.assertIn(f"suppressed={suppressed}", line)
+                backend.assert_request_counts(responses=2)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_stream_hardening.py b/tests/provider_shim/test_stream_hardening.py
index c172468c..814735a2 100644
--- a/tests/provider_shim/test_stream_hardening.py
+++ b/tests/provider_shim/test_stream_hardening.py
@@ -21,6 +21,7 @@
     TypedSSEFrame,
     abrupt_eof_scenario,
     backend_status_scenario,
+    block_starts,
     assert_lifecycle_log_contract,
     controlled_asgi_probe,
     delayed_body_disconnect_scenario,
@@ -47,6 +48,8 @@
     structured_error_scenario,
     terminal_contract_scenario,
     terminal_failure_scenario,
+    text_delta_values,
+    thinking_delta_values,
 )
 
 
@@ -81,7 +84,7 @@ def _assert_terminal_error(
                 except AssertionError as error:
                     self.fail(f"{marker}: {error}")
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertEqual(
                     [kind for _index, kind in lifecycle.starts],
                     [expected_kind],
@@ -110,7 +113,7 @@ def _assert_stream_failure(
                 frames = parse_typed_sse(result.body)
                 lifecycle = failure_lifecycle_report(frames, expected_error_type)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=expected_requests, oauth=0)
+                backend.assert_request_counts(responses=expected_requests)
                 self.assertEqual(
                     [kind for _index, kind in lifecycle.starts],
                     expected_kinds,
@@ -137,7 +140,7 @@ def _assert_nonstream_api_error(
                 self.assertIsInstance(error.get("message"), str, marker)
                 self.assertLessEqual(len(error.get("message", "")), 200, marker)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_chatgpt_nonstream_forces_upstream_sse_and_aggregates(self) -> None:
         scenario = full_response_scenario(reject_nonstream=True)
@@ -153,7 +156,7 @@ def test_chatgpt_nonstream_forces_upstream_sse_and_aggregates(self) -> None:
                 )
                 message = result.json()
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertIs(backend.responses_requests[0].body.get("stream"), True)
                 self.assertEqual(
                     [block.get("type") for block in message.get("content", [])],
@@ -172,6 +175,9 @@ def test_chatgpt_nonstream_forces_upstream_sse_and_aggregates(self) -> None:
                     {
                         "input_tokens": USAGE["input_tokens"],
                         "output_tokens": USAGE["output_tokens"],
+                        # v1.3.6 (V6-R3, always-emit): absent cache detail -> both fields 0.
+                        "cache_read_input_tokens": 0,
+                        "cache_creation_input_tokens": 0,
                     },
                 )
 
@@ -183,7 +189,7 @@ def test_openai_nonstream_preserves_real_upstream_json_mode(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 message = result.json()
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
                 self.assertIs(backend.responses_requests[0].body.get("stream"), False)
                 self.assertEqual(result.headers.get("content-type"), "application/json")
                 self.assertEqual(
@@ -241,19 +247,53 @@ def test_inband_error_uses_terminal_error_contract(self) -> None:
                     marker=f"INBAND_ERROR_{prefix.upper()}",
                 )
 
-    def test_reasoning_while_text_open_fails_cleanly(self) -> None:
-        self._assert_terminal_error(
-            scenario=reasoning_while_text_open_scenario(),
-            expected_kind="text",
-            marker="REASONING_WHILE_TEXT_OPEN_TERMINAL_ERROR",
-        )
+    def test_reasoning_while_text_open_defers_to_trailing_thinking(self) -> None:
+        # v1.2.14 (R3, adjudicated flip): out-of-order reasoning that arrives while a
+        # text block is open is TOLERATED — buffered and emitted as a TRAILING thinking
+        # block after the text block closes (ratified downstream shape), not failed as
+        # the pre-R3 strict contract required.
+        scenario = reasoning_while_text_open_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["text", "thinking"],
+                    "text block, then a trailing thinking block",
+                )
+                self.assertEqual(report.open_at_end, set())
+                self.assertEqual(text_delta_values(frames), ["Partial text."])
+                self.assertEqual(
+                    thinking_delta_values(frames), ["Out-of-order thinking."]
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
 
-    def test_reasoning_while_tool_open_fails_cleanly(self) -> None:
-        self._assert_terminal_error(
-            scenario=reasoning_while_tool_open_scenario(),
-            expected_kind="tool_use",
-            marker="REASONING_WHILE_TOOL_OPEN_TERMINAL_ERROR",
-        )
+    def test_reasoning_while_tool_open_defers_to_trailing_thinking(self) -> None:
+        # v1.2.14 (R3, adjudicated flip): out-of-order reasoning while a tool block is
+        # open is tolerated — the tool block closes first, then the buffered reasoning
+        # is emitted as a TRAILING thinking block (ratified shape).
+        scenario = reasoning_while_tool_open_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["tool_use", "thinking"],
+                    "tool_use block, then a trailing thinking block",
+                )
+                self.assertEqual(report.open_at_end, set())
+                self.assertEqual(
+                    thinking_delta_values(frames), ["Out-of-order thinking."]
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
 
     def test_missing_terminal_response_fails_cleanly(self) -> None:
         self._assert_terminal_error(
@@ -354,7 +394,7 @@ def _nonstream_backend_status(
                 self.assertIsInstance(error.get("message"), str, marker)
                 self.assertLessEqual(len(error.get("message", "")), 200, marker)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=expected_requests, oauth=0)
+                backend.assert_request_counts(responses=expected_requests)
 
     def test_nonstream_backend_400_passes_through_as_invalid_request_error(self) -> None:
         # v1.2.10 (a): a deterministic 400 reaches the client as its real 400 with
@@ -393,7 +433,7 @@ def test_chatgpt_claude_slug_fast_fails_nonstream_without_round_trip(self) -> No
                 self.assertIn("ChatGPT (Codex)", error.get("message", ""))
                 self.assertIn("environment_settings.txt", error.get("message", ""))
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=0, oauth=0)
+                backend.assert_request_counts(responses=0)
 
     def test_chatgpt_claude_slug_fast_fails_stream_without_round_trip(self) -> None:
         # v1.2.10 (c): the same fast-fail applies to a streaming inbound request —
@@ -407,7 +447,7 @@ def test_chatgpt_claude_slug_fast_fails_stream_without_round_trip(self) -> None:
                 error = (result.json().get("error") or {})
                 self.assertEqual(error.get("type"), "invalid_request_error")
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=0, oauth=0)
+                backend.assert_request_counts(responses=0)
 
     def test_chatgpt_provider_prefixed_claude_slug_fast_fails_without_round_trip(self) -> None:
         # v1.2.10 review-amendment: a PROVIDER-PREFIXED claude slug
@@ -424,7 +464,7 @@ def test_chatgpt_provider_prefixed_claude_slug_fast_fails_without_round_trip(sel
                 self.assertEqual(error.get("type"), "invalid_request_error")
                 self.assertIn("ChatGPT (Codex)", error.get("message", ""))
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=0, oauth=0)
+                backend.assert_request_counts(responses=0)
 
     def test_openai_lane_does_not_fast_fail_claude_slug(self) -> None:
         # v1.2.10 (c): the openai/API-key lane forwards any slug unchanged — no
@@ -435,7 +475,7 @@ def test_openai_lane_does_not_fast_fail_claude_slug(self) -> None:
                 result = shim.post_messages(stream=False, model="claude-fable-5")
                 self.assertEqual(result.status, 200, result.text)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_terminal_incomplete_stream_and_nonstream_maps_max_tokens(self) -> None:
         scenario = incomplete_response_scenario()
@@ -451,7 +491,7 @@ def test_terminal_incomplete_stream_and_nonstream_maps_max_tokens(self) -> None:
                 self.assertEqual(terminal["usage"]["input_tokens"], USAGE["input_tokens"])
                 self.assertEqual(terminal["usage"]["output_tokens"], USAGE["output_tokens"])
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
         with MockResponsesServer(scenario) as backend:
             with RealShim(backend, "chatgpt") as shim:
                 result = shim.post_messages(stream=False)
@@ -463,10 +503,13 @@ def test_terminal_incomplete_stream_and_nonstream_maps_max_tokens(self) -> None:
                     {
                         "input_tokens": USAGE["input_tokens"],
                         "output_tokens": USAGE["output_tokens"],
+                        # v1.3.6 (V6-R3, always-emit): absent cache detail -> both fields 0.
+                        "cache_read_input_tokens": 0,
+                        "cache_creation_input_tokens": 0,
                     },
                 )
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_completed_event_rejects_failed_missing_and_incomplete_status_both_modes(self) -> None:
         cases = (
@@ -547,24 +590,32 @@ def test_terminal_malformed_usage_degrades_to_dropped_fields_both_modes(self) ->
         # the established defaults: nonstream missing fields render as 0; the
         # streaming path estimates a missing output count from accumulated text
         # (empty here -> floor of 1) and defaults a missing input count to 0.
+        # v1.3.6 (V6-R3, always-emit): every malformed-usage case carries NO cache detail,
+        # so the expected client-visible usage gains cache_read/cache_creation as 0.
         cases = (
             (
                 "usage-list",
                 [],
-                {"input_tokens": 0, "output_tokens": 0},
-                {"input_tokens": 0, "output_tokens": 1},
+                {"input_tokens": 0, "output_tokens": 0,
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
+                {"input_tokens": 0, "output_tokens": 1,
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
             ),
             (
                 "usage-bool",
                 {"input_tokens": True, "output_tokens": USAGE["output_tokens"]},
-                {"input_tokens": 0, "output_tokens": USAGE["output_tokens"]},
-                {"input_tokens": 0, "output_tokens": USAGE["output_tokens"]},
+                {"input_tokens": 0, "output_tokens": USAGE["output_tokens"],
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
+                {"input_tokens": 0, "output_tokens": USAGE["output_tokens"],
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
             ),
             (
                 "usage-negative",
                 {"input_tokens": USAGE["input_tokens"], "output_tokens": -1},
-                {"input_tokens": USAGE["input_tokens"], "output_tokens": 0},
-                {"input_tokens": USAGE["input_tokens"], "output_tokens": 1},
+                {"input_tokens": USAGE["input_tokens"], "output_tokens": 0,
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
+                {"input_tokens": USAGE["input_tokens"], "output_tokens": 1,
+                 "cache_read_input_tokens": 0, "cache_creation_input_tokens": 0},
             ),
         )
         for label, usage, expected_nonstream, expected_stream in cases:
@@ -595,7 +646,7 @@ def test_terminal_malformed_usage_degrades_to_dropped_fields_both_modes(self) ->
                         )
                         self.assertEqual(terminal["usage"], expected_stream)
                         shim.assert_offline_contract()
-                        backend.assert_request_counts(responses=1, oauth=0)
+                        backend.assert_request_counts(responses=1)
             with self.subTest(case=label, mode="nonstream"):
                 with MockResponsesServer(scenario) as backend:
                     with RealShim(backend, "chatgpt") as shim:
@@ -605,7 +656,7 @@ def test_terminal_malformed_usage_degrades_to_dropped_fields_both_modes(self) ->
                         self.assertEqual(message.get("stop_reason"), "end_turn")
                         self.assertEqual(message.get("usage"), expected_nonstream)
                         shim.assert_offline_contract()
-                        backend.assert_request_counts(responses=1, oauth=0)
+                        backend.assert_request_counts(responses=1)
 
     def test_response_failed_never_converts_as_nonstream_success(self) -> None:
         self._assert_nonstream_api_error(
@@ -708,7 +759,12 @@ def test_malformed_tool_output_item_done_fails_both_modes(self) -> None:
             marker="MALFORMED_TOOL_OUTPUT_DONE_NONSTREAM",
         )
 
-    def test_sse_complete_data_line_without_blank_boundary_fails(self) -> None:
+    def test_sse_complete_data_line_without_blank_boundary_flushes(self) -> None:
+        # v1.2.14 (R5): a fully-formed terminal event whose trailing blank-line
+        # boundary a proxy trimmed is now flushed at EOF and finalizes SUCCESS. Before
+        # R5 this raised a framing failure (B7 — a completed response reported as an
+        # error). The payload is complete and parses cleanly, so downstream strict
+        # validation still applies; only the missing blank line is tolerated.
         terminal = {
             "type": "response.completed",
             "response": {
@@ -722,11 +778,17 @@ def test_sse_complete_data_line_without_blank_boundary_fails(self) -> None:
             "unterminated-complete-data-line",
             [f"data: {json.dumps(terminal, separators=(',', ':'))}\n".encode()],
         )
-        self._assert_stream_failure(
-            scenario=scenario,
-            marker="SSE_COMPLETE_LINE_WITHOUT_BLANK_BOUNDARY",
-            expected_kinds=[],
-        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(
+                    result.status,
+                    200,
+                    f"SSE_COMPLETE_LINE_WITHOUT_BLANK_BOUNDARY {result.text}",
+                )
+                lifecycle_report(parse_typed_sse(result.body))
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
 
     def test_sse_partial_line_at_eof_fails(self) -> None:
         scenario = raw_sse_scenario(
@@ -739,6 +801,133 @@ def test_sse_partial_line_at_eof_fails(self) -> None:
             expected_kinds=[],
         )
 
+    def test_sse_event_size_limit_is_transport_segmentation_invariant(self) -> None:
+        limit = 16 * 1024 * 1024
+        template = {
+            "type": "response.completed",
+            "response": {
+                "id": "resp_size_boundary",
+                "status": "completed",
+                "output": [],
+                "usage": dict(USAGE),
+                "padding": "",
+            },
+        }
+        empty_payload = json.dumps(template, separators=(",", ":"))
+        marker = '"padding":""'
+        self.assertIn(marker, empty_payload)
+        prefix, suffix = empty_payload.split(marker)
+        payload_overhead = len((prefix + '"padding":""' + suffix).encode("utf-8"))
+
+        for label, target_size, should_succeed in (
+            ("below", limit - 1, True),
+            ("at", limit, True),
+            ("above", limit + 1, False),
+        ):
+            padding_size = target_size - payload_overhead
+            self.assertGreaterEqual(padding_size, 0)
+            payload = (
+                prefix + '"padding":"' + ("X" * padding_size) + '"' + suffix
+            ).encode("utf-8")
+            self.assertEqual(len(payload), target_size)
+            segmentations = (
+                (
+                    "joined-by-harness",
+                    [b"data: ", payload, b"\n\n"],
+                    False,
+                ),
+                (
+                    "prefix-and-terminator-fragmented",
+                    [b"d", b"a", b"t", b"a", b":", b" ", payload, b"\n", b"\n"],
+                    True,
+                ),
+            )
+            for segmentation, chunks, preserve_chunks in segmentations:
+                with self.subTest(boundary=label, segmentation=segmentation):
+                    scenario = raw_sse_scenario(
+                        f"event-size-{label}-{segmentation}",
+                        chunks,
+                        preserve_chunks=preserve_chunks,
+                    )
+                    with MockResponsesServer(scenario) as backend:
+                        with RealShim(backend, "chatgpt") as shim:
+                            result = shim.post_messages(stream=True, timeout=60.0)
+                            self.assertEqual(result.status, 200)
+                            frames = parse_typed_sse(result.body)
+                            if should_succeed:
+                                lifecycle_report(frames)
+                            else:
+                                failure_lifecycle_report(frames)
+                            backend.assert_request_counts(responses=1)
+
+    def test_sse_event_size_counts_repeated_data_field_newline_join(self) -> None:
+        limit = 16 * 1024 * 1024
+        template = {
+            "type": "response.completed",
+            "response": {
+                "id": "resp_multidata_size_boundary",
+                "status": "completed",
+                "output": [],
+                "usage": dict(USAGE),
+                "padding": "",
+            },
+        }
+        empty_payload = json.dumps(template, separators=(",", ":"))
+        marker = '"padding":""'
+        prefix, suffix = empty_payload.split(marker)
+        payload_overhead = len((prefix + '"padding":""' + suffix).encode("utf-8"))
+
+        for label, logical_size, should_succeed in (
+            ("at", limit, True),
+            ("above", limit + 1, False),
+        ):
+            # Repeated SSE data fields insert one logical newline. Size the JSON bytes
+            # one byte below the target, then split after a comma where JSON permits
+            # that newline as insignificant whitespace.
+            padding_size = logical_size - 1 - payload_overhead
+            payload = (
+                prefix + '"padding":"' + ("Y" * padding_size) + '"' + suffix
+            ).encode("utf-8")
+            split_at = payload.find(b',"response"') + 1
+            self.assertGreater(split_at, 0)
+            self.assertEqual(len(payload) + 1, logical_size)
+            scenario = raw_sse_scenario(
+                f"multidata-event-size-{label}",
+                [
+                    b"data: ",
+                    payload[:split_at],
+                    b"\n",
+                    b"data: ",
+                    payload[split_at:],
+                    b"\n",
+                    b"\n",
+                ],
+                preserve_chunks=True,
+            )
+            with self.subTest(boundary=label):
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, "chatgpt") as shim:
+                        result = shim.post_messages(stream=True, timeout=60.0)
+                        self.assertEqual(result.status, 200)
+                        frames = parse_typed_sse(result.body)
+                        if should_succeed:
+                            lifecycle_report(frames)
+                        else:
+                            failure_lifecycle_report(frames)
+                        backend.assert_request_counts(responses=1)
+
+    def test_sse_oversized_partial_line_eof_fails_without_dispatch(self) -> None:
+        limit = 16 * 1024 * 1024
+        scenario = raw_sse_scenario(
+            "oversized-partial-line-eof",
+            [b"data: " + (b"Z" * (limit + 1))],
+        )
+        self._assert_stream_failure(
+            scenario=scenario,
+            marker="SSE_OVERSIZED_PARTIAL_LINE_EOF",
+            expected_kinds=[],
+        )
+
     def test_sse_crlf_blank_line_framing_succeeds(self) -> None:
         terminal = {
             "type": "response.completed",
@@ -760,7 +949,7 @@ def test_sse_crlf_blank_line_framing_succeeds(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 lifecycle_report(parse_typed_sse(result.body))
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_sse_multiple_data_lines_join_with_newline_and_succeed(self) -> None:
         first = '{"type":"response.completed",'
@@ -784,7 +973,7 @@ def test_sse_multiple_data_lines_join_with_newline_and_succeed(self) -> None:
                 self.assertEqual(result.status, 200, result.text)
                 lifecycle_report(parse_typed_sse(result.body))
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_first_valid_terminal_stops_later_semantic_processing_both_modes(self) -> None:
         first_output = [
@@ -849,7 +1038,7 @@ def test_first_valid_terminal_stops_later_semantic_processing_both_modes(self) -
                 self.assertEqual(terminal["delta"]["stop_reason"], "end_turn")
                 self.assertEqual(terminal["usage"]["input_tokens"], USAGE["input_tokens"])
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
         with MockResponsesServer(scenario) as backend:
             with RealShim(backend, "chatgpt") as shim:
                 result = shim.post_messages(stream=False)
@@ -859,7 +1048,7 @@ def test_first_valid_terminal_stops_later_semantic_processing_both_modes(self) -
                 self.assertEqual(message["stop_reason"], "end_turn")
                 self.assertEqual(message["usage"]["input_tokens"], USAGE["input_tokens"])
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_duplicate_identical_arguments_done_emits_one_delta(self) -> None:
         base = full_response_scenario()
@@ -889,7 +1078,7 @@ def test_duplicate_identical_arguments_done_emits_one_delta(self) -> None:
                 self.assertEqual(len(tool_indexes), 1)
                 self.assertEqual(lifecycle.stops.count(tool_indexes[0]), 1)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_duplicate_conflicting_arguments_done_is_protocol_failure(self) -> None:
         base = full_response_scenario()
@@ -936,7 +1125,7 @@ def test_arguments_done_public_api_name_shapes(self) -> None:
                 self.assertEqual(len(tool_indexes), 1)
                 self.assertEqual(lifecycle.stops.count(tool_indexes[0]), 1)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
         conflicting = json.loads(json.dumps(events))
         conflicting[index]["name"] = "Edit"
@@ -983,7 +1172,7 @@ def test_arguments_done_after_closed_tool_identical_is_ignored(self) -> None:
                 ]
                 self.assertEqual(len(argument_deltas), 1)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_arguments_done_after_closed_tool_conflict_fails(self) -> None:
         base = full_response_scenario()
@@ -1028,7 +1217,7 @@ def test_duplicate_identical_output_item_done_emits_one_stop(self) -> None:
                 self.assertEqual(len(tool_indexes), 1)
                 self.assertEqual(lifecycle.stops.count(tool_indexes[0]), 1)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_duplicate_conflicting_output_item_done_is_protocol_failure(self) -> None:
         base = full_response_scenario()
@@ -1072,7 +1261,10 @@ def test_duplicate_output_item_added_is_protocol_failure_without_second_start(se
         ]
         self.assertEqual(len(tool_starts), 1)
 
-    def test_text_while_tool_open_is_protocol_failure(self) -> None:
+    def test_text_while_tool_open_defers_to_trailing_text(self) -> None:
+        # v1.2.14 (R3, adjudicated flip): text emitted while a tool block is open is
+        # TOLERATED — buffered and emitted as a TRAILING text block after the tool
+        # closes (ratified shape), not failed as the pre-R3 strict contract required.
         base = full_response_scenario()
         events = json.loads(json.dumps(base.stream_events))
         index = next(
@@ -1089,13 +1281,31 @@ def test_text_while_tool_open_is_protocol_failure(self) -> None:
                 "delta": "overlapping text",
             },
         )
-        self._assert_stream_failure(
-            scenario=events_scenario("text-while-tool-open", events),
-            marker="TEXT_WHILE_TOOL_OPEN",
-            expected_kinds=["thinking", "text", "tool_use"],
-        )
+        scenario = events_scenario("text-while-tool-open", events)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["thinking", "text", "tool_use", "text"],
+                    "leading thinking+text, the tool, then a trailing text block",
+                )
+                self.assertEqual(report.open_at_end, set())
+                # Leading streamed text, then the deferred out-of-order text trailing.
+                self.assertEqual(
+                    text_delta_values(frames),
+                    ["Aggregated answer.", "overlapping text"],
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
 
-    def test_second_tool_while_first_open_is_protocol_failure(self) -> None:
+    def test_second_tool_while_first_open_defers_to_sequential_blocks(self) -> None:
+        # v1.2.14 (R3, adjudicated flip): a second tool added while the first is open
+        # is TOLERATED — DEFERRED and drained after the first closes, yielding two
+        # NON-OVERLAPPING tool_use blocks in added order (ratified shape), not failed.
         base = full_response_scenario()
         events = json.loads(json.dumps(base.stream_events))
         index = next(
@@ -1117,11 +1327,32 @@ def test_second_tool_while_first_open_is_protocol_failure(self) -> None:
                 },
             },
         )
-        self._assert_stream_failure(
-            scenario=events_scenario("second-tool-while-first-open", events),
-            marker="SECOND_TOOL_WHILE_FIRST_OPEN",
-            expected_kinds=["thinking", "text", "tool_use"],
-        )
+        scenario = events_scenario("second-tool-while-first-open", events)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["thinking", "text", "tool_use", "tool_use"],
+                    "leading thinking+text, then two non-overlapping tool blocks",
+                )
+                self.assertEqual(report.open_at_end, set())
+                # Both tool_use blocks carry the correct call ids in added order; the
+                # deferred second tool supplied no arguments, so its input stays empty.
+                tool_starts = [
+                    start
+                    for start in block_starts(frames)
+                    if (start.get("content_block") or {}).get("type") == "tool_use"
+                ]
+                self.assertEqual(
+                    [start["content_block"]["id"] for start in tool_starts],
+                    ["call_full_fixture", "call_overlap_second"],
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
 
     def test_normal_sequential_two_tools_remains_supported(self) -> None:
         scenario = sequential_two_tools_scenario()
@@ -1137,7 +1368,7 @@ def test_normal_sequential_two_tools_remains_supported(self) -> None:
                 self.assertEqual(len(lifecycle.stops), 2)
                 self.assertEqual(len(set(lifecycle.stops)), 2)
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_lifecycle_oracles_reject_duplicate_terminal_grammar(self) -> None:
         failure_frames = [
@@ -1176,7 +1407,7 @@ def test_realshim_retries_address_in_use(self) -> None:
                         result = shim.post_messages(stream=False)
                         self.assertEqual(result.status, 200, result.text)
                         shim.assert_offline_contract()
-                        backend.assert_request_counts(responses=1, oauth=0)
+                        backend.assert_request_counts(responses=1)
                 except (OSError, RuntimeError, TimeoutError) as error:
                     self.fail(
                         "REALSHIM_ADDRESS_IN_USE_RETRY_REQUIRED "
@@ -1215,9 +1446,20 @@ def test_client_disconnect_cancels_stream_header_wait(self) -> None:
                 )
                 health = shim.get_health()
                 self.assertEqual(health.status, 200, health.text)
-                self.assertEqual(health.json().get("status"), "ok")
+                health_payload = health.json()
+                self.assertEqual(health_payload.get("status"), "ok")
+                self.assertEqual(
+                    set(health_payload["gpt_service_tier"]),
+                    {
+                        "backend_mode",
+                        "requested_tier_vocabulary",
+                        "policy",
+                        "native_fast_disabled",
+                        "latest_terminal",
+                    },
+                )
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
         self.assertEqual(provider_scratch_residue(), before)
 
     def test_client_disconnect_cancels_stream_body_read(self) -> None:
@@ -1251,81 +1493,17 @@ def test_client_disconnect_cancels_stream_body_read(self) -> None:
                 self.assertEqual(health.status, 200, health.text)
                 self.assertEqual(health.json().get("status"), "ok")
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
         self.assertEqual(provider_scratch_residue(), before)
 
-    def test_disconnect_during_rotating_oauth_refresh_persists_new_token(self) -> None:
-        before = provider_scratch_residue()
-        scenario = full_response_scenario()
-        with MockResponsesServer(scenario) as backend:
-            backend.delay_oauth_response = True
-            with RealShim(backend, "chatgpt") as shim:
-                shim.expire_auth_access_token()
-                client_errors: list[BaseException] = []
-
-                def disconnecting_client() -> None:
-                    try:
-                        raw_disconnect_messages(
-                            shim,
-                            close_after_event=backend.oauth_request_received,
-                            timeout=4.0,
-                        )
-                    except BaseException as error:
-                        client_errors.append(error)
-
-                client = threading.Thread(
-                    target=disconnecting_client,
-                    name="provider-shim-oauth-disconnect-client",
-                    daemon=True,
-                )
-                client.start()
-                self.assertTrue(
-                    backend.oauth_request_received.wait(4.0),
-                    "ROTATING_OAUTH_REQUEST_NOT_RECEIVED",
-                )
-                client.join(timeout=2.0)
-                self.assertFalse(client.is_alive(), "ROTATING_OAUTH_CLIENT_DID_NOT_DISCONNECT")
-                self.assertEqual(client_errors, [])
-                backend.oauth_response_release.set()
-                self.assertTrue(
-                    backend.oauth_response_sent.wait(2.0),
-                    "ROTATING_OAUTH_RESPONSE_NOT_SENT_AFTER_DISCONNECT",
-                )
-
-                persisted = False
-                persisted_deadline = time.monotonic() + 3.0
-                while time.monotonic() < persisted_deadline:
-                    auth = json.loads(shim.auth_path.read_text(encoding="utf-8"))
-                    tokens = auth.get("tokens") or {}
-                    if (
-                        tokens.get("access_token") == backend.rotated_access_token
-                        and tokens.get("refresh_token") == FAKE_REFRESH_TOKEN + "_ROTATED"
-                    ):
-                        persisted = True
-                        break
-                    time.sleep(0.02)
-                self.assertTrue(persisted, "ROTATING_OAUTH_TOKEN_PAIR_NOT_PERSISTED")
-                self.assertEqual(len(backend.oauth_requests), 1)
-                self.assertTrue(
-                    backend.oauth_requests[0].body.get("refresh_token")
-                    == FAKE_REFRESH_TOKEN,
-                    "ROTATING_OAUTH_SERVER_DID_NOT_CONSUME_ORIGINAL_REFRESH_TOKEN",
-                )
-
-                result = shim.post_messages(stream=True)
-                self.assertEqual(result.status, 200, result.text)
-                lifecycle_report(parse_typed_sse(result.body))
-                self.assertEqual(len(backend.responses_requests), 1)
-                self.assertTrue(
-                    backend.responses_requests[0].headers.get("authorization")
-                    == "Bearer " + backend.rotated_access_token,
-                    "NEXT_REQUEST_DID_NOT_USE_ROTATED_ACCESS_TOKEN",
-                )
-                backend.assert_request_counts(responses=1, oauth=1)
-                health = shim.get_health()
-                self.assertEqual(health.status, 200, health.text)
-                shim.assert_offline_contract()
-        self.assertEqual(provider_scratch_residue(), before)
+    # v1.3.0 (A1): test_disconnect_during_rotating_oauth_refresh_persists_new_token
+    # was DELETED here. It pinned the deleted Python OAuth-refresh path — the shim
+    # POSTing to /oauth/token, atomically persisting the ROTATED refresh/access token
+    # pair into auth.json, and reusing it on the next request. Under the delegation
+    # design (A1-R2) the shim never writes auth.json and never performs an OAuth POST;
+    # codex is the single writer. The disconnect-mid-refresh persistence hazard this
+    # test guarded is structurally gone (no shim-side write to strand). Delegated
+    # refresh is covered in test_v130_auth_delegation.py.
 
     def test_outer_task_cancel_after_stream_enter_closes_context(self) -> None:
         report = outer_cancel_after_stream_enter_report()
@@ -1427,7 +1605,7 @@ def delayed_disconnect_client() -> None:
                     "CLIENT_DISCONNECT_RETRY_ISSUED_SECOND_REQUEST "
                     f"requests={len(backend.responses_requests)}",
                 )
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
         self.assertEqual(provider_scratch_residue(), before)
 
     def test_v1211_request_id_headers_and_lifecycle_correlation(self) -> None:
@@ -1484,7 +1662,7 @@ def test_v1211_request_id_headers_and_lifecycle_correlation(self) -> None:
                 startup_records = [
                     line
                     for line in shim.captured_stderr().splitlines()
-                    if "req_id=- phase=process shim v1.2.11 starting" in line
+                    if "req_id=- phase=process shim v1.3.9 starting" in line
                 ]
                 self.assertEqual(len(startup_records), 1, startup_records)
                 self.assertIn(
@@ -1492,7 +1670,7 @@ def test_v1211_request_id_headers_and_lifecycle_correlation(self) -> None:
                     [line.event for line in sse_lines],
                 )
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=2, oauth=0)
+                backend.assert_request_counts(responses=2)
 
     def test_v1211_concurrent_requests_keep_request_local_state(self) -> None:
         scenario = full_response_scenario()
@@ -1545,7 +1723,7 @@ def call(label: str) -> None:
                     self.assertEqual({line.req_id for line in groups[req_id]}, {req_id})
                     assert_lifecycle_log_contract(groups[req_id])
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=2, oauth=0)
+                backend.assert_request_counts(responses=2)
 
     def test_v1211_attempt_and_retry_accounting_matrix(self) -> None:
         cases = (
@@ -1595,7 +1773,7 @@ def test_v1211_attempt_and_retry_accounting_matrix(self) -> None:
                             name,
                         )
                         shim.assert_offline_contract()
-                        backend.assert_request_counts(responses=attempts, oauth=0)
+                        backend.assert_request_counts(responses=attempts)
 
         for name, statuses, expected_status, attempts, retries, outcome in (
             ("buffered-transport-retry", ["transport", 200], 200, 2, 1, "success"),
@@ -1612,7 +1790,7 @@ def test_v1211_attempt_and_retry_accounting_matrix(self) -> None:
                         self.assertEqual(terminal["attempts"], str(attempts))
                         self.assertEqual(terminal["retries"], str(retries))
                         self.assertEqual(terminal["outcome"], outcome)
-                        backend.assert_request_counts(responses=attempts, oauth=0)
+                        backend.assert_request_counts(responses=attempts)
 
     def test_v1211_upstream_metadata_allowlist_precedence_and_length_cap(self) -> None:
         secret = "sk-FAKE_METADATA_SECRET_123456789"
@@ -2282,7 +2460,7 @@ def test_v1211_reflected_backend_prose_never_reaches_logs_or_client_errors(self)
                             name,
                         )
                         shim.assert_offline_contract()
-                        backend.assert_request_counts(responses=1, oauth=0)
+                        backend.assert_request_counts(responses=1)
 
     def test_v1211_same_turn_terminal_send_disconnect_prefers_completed_send(self) -> None:
         report = controlled_asgi_probe(send_action="same_turn_terminal_disconnect")
@@ -2809,7 +2987,7 @@ def test_v1211_max_tokens_rejects_nonpositive_noninteger_and_nonfinite_values(se
                     16,
                 )
                 shim.assert_offline_contract()
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_v1211_failure_phase_identifies_parse_translation_and_auth_boundaries(self) -> None:
         invalid_json = controlled_asgi_probe(raw_request_body=b"{invalid-json")
@@ -3068,7 +3246,7 @@ def test_v1211_prestart_and_poststart_failures_have_single_accounting(self) -> N
                 self.assertEqual(terminal["terminal_frame_send"], "send_completed")
                 self.assertEqual(terminal["body_close_send"], "send_completed")
                 self.assertNotIn("upstream_attempt", [line.event for line in lines])
-                backend.assert_request_counts(responses=0, oauth=0)
+                backend.assert_request_counts(responses=0)
 
         scenario = abrupt_eof_scenario("text")
         with MockResponsesServer(scenario) as backend:
@@ -3084,7 +3262,7 @@ def test_v1211_prestart_and_poststart_failures_have_single_accounting(self) -> N
                 self.assertEqual(terminal["terminal_frame_send"], "send_completed")
                 self.assertEqual(terminal["body_close_send"], "send_completed")
                 self.assertIn("backend_error", [line.event for line in lines])
-                backend.assert_request_counts(responses=1, oauth=0)
+                backend.assert_request_counts(responses=1)
 
     def test_v1211_auth_error_has_one_terminal_and_cleanup(self) -> None:
         scenario = full_response_scenario()
@@ -3108,7 +3286,7 @@ def test_v1211_auth_error_has_one_terminal_and_cleanup(self) -> None:
                     [line.event for line in lines].count("cleanup"),
                     1,
                 )
-                backend.assert_request_counts(responses=0, oauth=0)
+                backend.assert_request_counts(responses=0)
 
 
 if __name__ == "__main__":
diff --git a/tests/provider_shim/test_v1214_heartbeat_and_quota.py b/tests/provider_shim/test_v1214_heartbeat_and_quota.py
new file mode 100644
index 00000000..4291af73
--- /dev/null
+++ b/tests/provider_shim/test_v1214_heartbeat_and_quota.py
@@ -0,0 +1,211 @@
+"""Deterministic contracts for the v1.2.14 A3b work: R6 downstream heartbeat +
+idle-gap telemetry, and D1 quota-window header capture / allowlist prefix.
+
+1. R6 heartbeat: during a held-open silent upstream phase (content already
+   emitted, terminal delayed without a disconnect), Anthropic ``ping`` frames are
+   emitted between the content and the terminal, never splitting a downstream
+   frame; ``SHIM_PING_INTERVAL_S=0`` disables them in an otherwise identical run.
+2. R6 idle-gap telemetry: the terminal record carries ``max_idle_gap_ms`` sized to
+   the held-open gap.
+3. D1 quota snapshot: a chatgpt-lane 2xx with synthetic ``x-codex-*`` headers emits
+   exactly one ``event=quota_snapshot`` line of numeric/enum fields (absent headers
+   render as ``-``); the openai lane and a chatgpt 4xx emit none.
+4. D1 allowlist prefix: an ``x-codex-*`` header is captured in the diagnostic
+   header line while an unrelated header stays excluded.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from ._loopback_harness import (
+    MockResponsesServer,
+    RealShim,
+    backend_status_scenario,
+    full_response_scenario,
+    heartbeat_text_scenario,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+)
+
+
+# Synthetic subscription-quota header surface modeled on the live chatgpt-lane
+# capture (notes/07 §8). Secondary-window headers are intentionally omitted so the
+# "absent header -> field renders as -" contract is exercised.
+QUOTA_HEADERS = {
+    "x-codex-plan-type": "pro",
+    "x-codex-active-limit": "premium",
+    "x-codex-primary-used-percent": "30",
+    "x-codex-primary-window-minutes": "10080",
+    "x-codex-primary-reset-after-seconds": "425943",
+    "x-codex-credits-has-credits": "true",
+    "x-codex-credits-balance": "0",
+    "x-codex-credits-unlimited": "false",
+}
+
+
+class ProviderShimV1214HeartbeatTests(unittest.TestCase):
+    maxDiff = 12000
+
+    def _terminal_fields(self, lines: list[object]) -> dict[str, str]:
+        matches = [line for line in lines if line.event == "terminal"]
+        self.assertEqual(len(matches), 1, [line.raw for line in lines])
+        return matches[0].fields
+
+    def test_pings_bridge_silent_gap_between_content_and_terminal(self) -> None:
+        # A single text turn whose terminal is delayed by a silent 0.8s gap; with a
+        # 0.1s ping interval the shim must bridge it with several ping frames.
+        scenario = heartbeat_text_scenario("hb-basic", gap_s=0.8)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend, "chatgpt", env_overrides={"SHIM_PING_INTERVAL_S": "0.1"}
+            ) as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                # Frame-integrity oracle: the full success-stream shape still holds
+                # (one message_start/delta/stop, non-overlapping monotonic blocks,
+                # message_stop last) even with pings interleaved.
+                report = lifecycle_report(frames)
+                self.assertEqual([kind for _idx, kind in report.starts], ["text"])
+                # A ping that split a content frame would surface as a raw (non-dict)
+                # parsed frame; every frame must be a well-formed dict or [DONE].
+                for frame in frames:
+                    self.assertTrue(
+                        isinstance(frame.data, dict) or frame.data == "[DONE]",
+                        ("split/garbled frame", frame.raw_data),
+                    )
+                types = [
+                    frame.data.get("type")
+                    for frame in frames
+                    if isinstance(frame.data, dict)
+                ]
+                # Multiple pings, all strictly between message_start and message_delta.
+                self.assertGreaterEqual(types.count("ping"), 2, types)
+                start_at = types.index("message_start")
+                delta_at = types.index("message_delta")
+                for position, kind in enumerate(types):
+                    if kind == "ping":
+                        self.assertGreater(position, start_at)
+                        self.assertLess(
+                            position, delta_at, "ping after terminal message_delta"
+                        )
+                # Every ping frame is exactly {"type": "ping"} — never a content frame.
+                for frame in frames:
+                    if isinstance(frame.data, dict) and frame.data.get("type") == "ping":
+                        self.assertEqual(frame.data, {"type": "ping"})
+                terminal = self._terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["outcome"], "success")
+                # max_idle_gap_ms is present and plausibly sized for the ~0.8s gap.
+                self.assertIn("max_idle_gap_ms", terminal)
+                self.assertGreaterEqual(int(terminal["max_idle_gap_ms"]), 400)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_ping_interval_zero_disables_heartbeat(self) -> None:
+        # The identical held-open scenario with SHIM_PING_INTERVAL_S=0 must produce
+        # no ping frames while still completing cleanly.
+        scenario = heartbeat_text_scenario("hb-disabled", gap_s=0.8)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend, "chatgpt", env_overrides={"SHIM_PING_INTERVAL_S": "0"}
+            ) as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual([kind for _idx, kind in report.starts], ["text"])
+                types = [
+                    frame.data.get("type")
+                    for frame in frames
+                    if isinstance(frame.data, dict)
+                ]
+                self.assertNotIn("ping", types)
+                terminal = self._terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["outcome"], "success")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+
+class ProviderShimV1214QuotaSnapshotTests(unittest.TestCase):
+    maxDiff = 12000
+
+    def _quota_lines(self, lines: list[object]) -> list[object]:
+        return [line for line in lines if line.event == "quota_snapshot"]
+
+    def test_chatgpt_2xx_emits_one_quota_snapshot_with_expected_fields(self) -> None:
+        scenario = full_response_scenario()
+        scenario.stream_headers = dict(QUOTA_HEADERS)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                parse_typed_sse(result.body)
+                lines = lifecycle_for_response(shim, result)
+                quota = self._quota_lines(lines)
+                self.assertEqual(len(quota), 1, [line.raw for line in lines])
+                fields = quota[0].fields
+                self.assertEqual(fields["plan_type"], "pro")
+                self.assertEqual(fields["active_limit"], "premium")
+                self.assertEqual(fields["primary_used_pct"], "30")
+                self.assertEqual(fields["primary_window_min"], "10080")
+                self.assertEqual(fields["primary_reset_s"], "425943")
+                self.assertEqual(fields["credits_has"], "true")
+                self.assertEqual(fields["credits_balance"], "0")
+                self.assertEqual(fields["credits_unlimited"], "false")
+                # Absent secondary-window headers render as "-".
+                self.assertEqual(fields["secondary_used_pct"], "-")
+                self.assertEqual(fields["secondary_window_min"], "-")
+                self.assertEqual(fields["secondary_reset_s"], "-")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_openai_lane_emits_no_quota_snapshot(self) -> None:
+        scenario = full_response_scenario()
+        scenario.stream_headers = dict(QUOTA_HEADERS)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                parse_typed_sse(result.body)
+                lines = lifecycle_for_response(shim, result)
+                self.assertEqual(self._quota_lines(lines), [])
+                shim.assert_offline_contract()
+
+    def test_chatgpt_4xx_emits_no_quota_snapshot(self) -> None:
+        scenario = backend_status_scenario("quota-4xx", 400)
+        scenario.stream_headers = dict(QUOTA_HEADERS)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                # In-band error stream: HTTP 200, error surfaced as an SSE event.
+                self.assertEqual(result.status, 200, result.text)
+                lines = lifecycle_for_response(shim, result)
+                self.assertEqual(self._quota_lines(lines), [])
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_allowlist_prefix_captures_x_codex_excludes_unrelated(self) -> None:
+        # A chatgpt 4xx routes its headers through _diag_headers. The x-codex-*
+        # header must be captured by the new prefix rule; an unrelated header (not
+        # exact- or prefix-allowlisted) must stay excluded from the diagnostic line.
+        scenario = backend_status_scenario("prefix-4xx", 400)
+        scenario.stream_headers = {
+            "x-codex-anything": "capturedval",
+            "x-unrelated-header": "excludedval",
+        }
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_for_response(shim, result)
+                logs = shim.captured_stderr()
+                self.assertIn("x-codex-anything=capturedval", logs)
+                self.assertNotIn("x-unrelated-header", logs)
+                self.assertNotIn("excludedval", logs)
+                shim.assert_offline_contract()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v1214_observability.py b/tests/provider_shim/test_v1214_observability.py
new file mode 100644
index 00000000..b4eac707
--- /dev/null
+++ b/tests/provider_shim/test_v1214_observability.py
@@ -0,0 +1,428 @@
+"""Deterministic contracts for the v1.2.14 A1 observability/classification work.
+
+Covers the four turnkey test families handed off from Dispatch A1 (shim frozen):
+
+1. R1 unknown-wire counting: an unknown SSE event type and an unmodeled
+   ``output_item`` type are counted on the terminal record while the turn still
+   completes cleanly downstream; a clean stream reports zero.
+2. R1 ``obfuscation`` tolerance: a known-but-unmodeled ``obfuscation`` field on
+   ``arguments.delta`` is silently accepted (no unknown_events, no failure).
+3. R2 unified code-driven classification: each recognized backend code maps to its
+   Anthropic error type across the four captured error-envelope shapes; the two
+   status-only rows and the adjudicated bare-503 -> api_error behavior are pinned.
+4. D5 request-shape diagnosis line: an invalid_request_error emits exactly one
+   ``event=request_shape`` line of key NAMES only, never request values.
+
+Retry expectations honor the A1 build: retries are still RETRY_STATUSES-gated
+(A2 lands the classification-driven gating later), so a retryable 5xx is attempted
+MAX_RETRIES+1 = 4 times and a 4xx is attempted once.
+"""
+
+from __future__ import annotations
+
+import json
+import unittest
+import urllib.parse
+
+from ._loopback_harness import (
+    READ_TOOL,
+    MockResponsesServer,
+    RealShim,
+    backend_status_scenario,
+    failure_lifecycle_report,
+    full_response_scenario,
+    lifecycle_for_response,
+    lifecycle_report,
+    obfuscation_tool_scenario,
+    parse_typed_sse,
+    structured_error_scenario,
+    unknown_wire_scenario,
+)
+
+
+class ProviderShimV1214ObservabilityTests(unittest.TestCase):
+    maxDiff = 12000
+
+    # --- shared lifecycle-line helpers (mirror the stream-hardening suite) ---
+
+    def _event_line(self, lines: list[object], event: str) -> object:
+        matches = [line for line in lines if line.event == event]
+        self.assertEqual(len(matches), 1, (event, [line.raw for line in lines]))
+        return matches[0]
+
+    def _terminal_fields(self, lines: list[object]) -> dict[str, str]:
+        return self._event_line(lines, "terminal").fields
+
+    def _inband_error(
+        self,
+        name: str,
+        error_payload: dict[str, object],
+        expected_type: str,
+    ) -> tuple[object, dict[str, str]]:
+        """Drive one in-band SSE ``error`` event through real classification.
+
+        An in-band error carries no HTTP status, so classification is code/type
+        driven; it also arrives after ``message_start`` and is therefore never
+        retried (responses == 1).
+        """
+
+        scenario = structured_error_scenario(name, "error", error_payload)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                failure = failure_lifecycle_report(
+                    parse_typed_sse(result.body), expected_type
+                )
+                lines = lifecycle_for_response(shim, result)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+                return failure, self._terminal_fields(lines)
+
+    def _http_failure(
+        self,
+        scenario: object,
+        expected_type: str,
+        expected_requests: int,
+    ) -> tuple[object, dict[str, str]]:
+        """Drive one pre-content backend HTTP failure through status classification."""
+
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                failure = failure_lifecycle_report(
+                    parse_typed_sse(result.body), expected_type
+                )
+                lines = lifecycle_for_response(shim, result)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=expected_requests)
+                return failure, self._terminal_fields(lines)
+
+    # --- Group 1: R1 unknown-wire counting ---
+
+    def test_unknown_event_and_item_counted_while_turn_completes(self) -> None:
+        # One unknown SSE event type (response.audio.delta) and one unmodeled
+        # output_item.added type (web_search_call). The downstream Anthropic stream
+        # must still be a well-formed success (single text block), and the terminal
+        # record must surface exactly one unknown event and one unknown item.
+        scenario = unknown_wire_scenario("unknown-both")
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["text"],
+                    "unknown wire must not disturb the clean text block",
+                )
+                self.assertEqual(report.open_at_end, set())
+                terminal = self._terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["outcome"], "success")
+                self.assertEqual(terminal["unknown_events"], "1")
+                self.assertEqual(terminal["unknown_items"], "1")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_clean_stream_reports_zero_unknown_counts(self) -> None:
+        # A fully modeled reasoning+text+tool turn must report unknown_events=0 and
+        # unknown_items=0 — the "0 when clean" invariant the allowlists protect.
+        scenario = full_response_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_report(parse_typed_sse(result.body))
+                terminal = self._terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["outcome"], "success")
+                self.assertEqual(terminal["unknown_events"], "0")
+                self.assertEqual(terminal["unknown_items"], "0")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_unknown_event_only_and_item_only_isolated(self) -> None:
+        # Isolate each dimension so a future regression cannot cross-contaminate the
+        # event vs item counters.
+        for label, kwargs, expect in (
+            ("event-only", {"unknown_item_type": None}, ("1", "0")),
+            ("item-only", {"unknown_event_type": None}, ("0", "1")),
+        ):
+            with self.subTest(dimension=label):
+                scenario = unknown_wire_scenario(f"unknown-{label}", **kwargs)
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, "chatgpt") as shim:
+                        result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                        self.assertEqual(result.status, 200, result.text)
+                        lifecycle_report(parse_typed_sse(result.body))
+                        terminal = self._terminal_fields(
+                            lifecycle_for_response(shim, result)
+                        )
+                        self.assertEqual(terminal["unknown_events"], expect[0], label)
+                        self.assertEqual(terminal["unknown_items"], expect[1], label)
+                        shim.assert_offline_contract()
+
+    # --- Group 2: R1 obfuscation tolerance ---
+
+    def test_obfuscation_field_on_arguments_delta_is_tolerated(self) -> None:
+        # A live `obfuscation` field on arguments.delta is a known-but-unmodeled
+        # field: tolerated silently (unknown_events stays 0) while the tool call
+        # still translates to a clean tool_use block.
+        scenario = obfuscation_tool_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                report = lifecycle_report(parse_typed_sse(result.body))
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["tool_use"],
+                )
+                self.assertEqual(report.open_at_end, set())
+                terminal = self._terminal_fields(lifecycle_for_response(shim, result))
+                self.assertEqual(terminal["outcome"], "success")
+                self.assertEqual(terminal["unknown_events"], "0")
+                self.assertEqual(terminal["unknown_items"], "0")
+                self.assertEqual(terminal["tools_called"], "1")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- Group 3: R2 code/status classification + envelope shapes ---
+
+    def test_inband_recognized_code_rows_across_envelope_shapes(self) -> None:
+        # Each recognized backend code maps to its Anthropic error type, and each is
+        # carried by a DIFFERENT captured envelope shape so both dimensions (code
+        # classification + envelope tolerance) are proven together. A recognized
+        # envelope never increments the unknown-envelope counter (unknown_events=0).
+        cases = (
+            # (label, error_payload, expected anthropic type)
+            # Shape 3: flat root {code, message}
+            (
+                "insufficient_quota/flat-root",
+                {"code": "insufficient_quota", "message": "plan exhausted"},
+                "invalid_request_error",
+            ),
+            # Shape 2: {status, error:{...}} (chatgpt lane); top-level status is
+            # metadata only — classification is code-driven.
+            (
+                "rate_limit_exceeded/status-wrapped",
+                {"status": 429, "error": {"code": "rate_limit_exceeded"}},
+                "rate_limit_error",
+            ),
+            # Shape 1: bare {error:{...}} (openai lane).
+            (
+                "server_is_overloaded/bare-error",
+                {"error": {"code": "server_is_overloaded"}},
+                "overloaded_error",
+            ),
+            # Shape 3 again, distinct code -> authentication_error.
+            (
+                "token_invalidated/flat-root",
+                {"code": "token_invalidated", "message": "session expired"},
+                "authentication_error",
+            ),
+        )
+        for label, payload, expected_type in cases:
+            with self.subTest(row=label):
+                failure, terminal = self._inband_error(
+                    f"classify-{label.split('/')[0]}", payload, expected_type
+                )
+                self.assertEqual(failure.error.get("type"), expected_type, label)
+                self.assertIsInstance(failure.error.get("message"), str, label)
+                self.assertLessEqual(len(failure.error.get("message", "")), 200, label)
+                self.assertEqual(terminal["outcome"], "error", label)
+                # Recognized envelope: no unknown-envelope increment.
+                self.assertEqual(terminal["unknown_events"], "0", label)
+
+    def test_http_status_only_rows(self) -> None:
+        # Unknown backend type + no code -> pure HTTP-status classification. 422 is a
+        # 4xx (non-retryable, one request); 500 is a retryable 5xx (RETRY_STATUSES,
+        # exhausted after MAX_RETRIES -> four requests).
+        with self.subTest(row="unknown-code-4xx"):
+            failure, terminal = self._http_failure(
+                backend_status_scenario("status-422", 422),
+                "invalid_request_error",
+                expected_requests=1,
+            )
+            self.assertEqual(failure.error.get("type"), "invalid_request_error")
+            self.assertEqual(terminal["outcome"], "error")
+
+        with self.subTest(row="unknown-code-5xx"):
+            failure, terminal = self._http_failure(
+                backend_status_scenario("status-500", 500, retry_after="0"),
+                "api_error",
+                expected_requests=4,
+            )
+            self.assertEqual(failure.error.get("type"), "api_error")
+            self.assertEqual(terminal["retries"], "3")
+
+    def test_bare_503_classifies_as_api_error(self) -> None:
+        # Adjudicated (2026-07-20): a bare/unknown-code 503 -> api_error, NOT
+        # overloaded_error. overloaded_error is reserved for the recognized overload
+        # codes (server_is_overloaded/slow_down) and status 529. Both classes stay
+        # retryable, so client behavior is equivalent; this pins the type explicitly.
+        failure, terminal = self._http_failure(
+            backend_status_scenario("status-503-bare", 503, retry_after="0"),
+            "api_error",
+            expected_requests=4,
+        )
+        self.assertEqual(failure.error.get("type"), "api_error")
+        self.assertEqual(terminal["outcome"], "error")
+        self.assertEqual(terminal["retries"], "3")
+
+    def test_detail_envelope_is_recognized_and_status_classified(self) -> None:
+        # Codex model-rejection shape {detail: "..."} is a RECOGNIZED envelope (no
+        # unknown-envelope increment) even though it is code-less; it classifies by
+        # HTTP status (400 -> invalid_request_error).
+        scenario = backend_status_scenario("detail-400", 400)
+        scenario.stream_error_body = json.dumps(
+            {"detail": "The requested model is not available."},
+            separators=(",", ":"),
+        ).encode("utf-8")
+        failure, terminal = self._http_failure(
+            scenario, "invalid_request_error", expected_requests=1
+        )
+        self.assertEqual(failure.error.get("type"), "invalid_request_error")
+        self.assertEqual(terminal["outcome"], "error")
+        # {detail} is recognized shape -> NOT counted as an unknown envelope.
+        self.assertEqual(terminal["unknown_events"], "0")
+
+    def test_unstructured_envelope_is_counted(self) -> None:
+        # Contrast to {detail}: a dict with no error-ish fields is UNRECOGNIZED, so
+        # R1 counts it (unknown_events=1) before classifying it by HTTP status.
+        scenario = backend_status_scenario("unstructured-400", 400)
+        scenario.stream_error_body = json.dumps(
+            {"foo": "bar"}, separators=(",", ":")
+        ).encode("utf-8")
+        failure, terminal = self._http_failure(
+            scenario, "invalid_request_error", expected_requests=1
+        )
+        self.assertEqual(failure.error.get("type"), "invalid_request_error")
+        self.assertEqual(terminal["unknown_events"], "1")
+
+    # --- Group 4: D5 request-shape diagnosis line ---
+
+    def test_request_shape_line_on_invalid_request_leaks_no_values(self) -> None:
+        # On a backend invalid_request_error, exactly one `event=request_shape` line
+        # is emitted carrying only sorted key NAMES (keys=, and text_keys=/
+        # reasoning_keys= where applicable). No request VALUE may appear on that line
+        # or anywhere in the captured logs (sentinel-absence, mirroring
+        # test_v1211_reflected_backend_prose...).
+        system_sentinel = "FABRICATED_SYSTEM_VALUE_D5_A1B"
+        tool_desc_sentinel = "FABRICATED_TOOL_DESC_VALUE_D5_A1B"
+        tool_input_sentinel = "FABRICATED_TOOL_INPUT_VALUE_D5_A1B"
+        prompt_sentinel = "FABRICATED_PROMPT_VALUE_D5_A1B"
+        sentinels = (
+            system_sentinel,
+            tool_desc_sentinel,
+            tool_input_sentinel,
+            prompt_sentinel,
+        )
+        request_body = {
+            "model": "gpt-fixture",
+            "max_tokens": 256,
+            "stream": True,
+            "system": system_sentinel,
+            "tools": [
+                {
+                    "name": "ShapeFixture",
+                    "description": tool_desc_sentinel,
+                    "input_schema": {
+                        "type": "object",
+                        "properties": {"payload": {"type": "string"}},
+                    },
+                }
+            ],
+            "messages": [
+                {
+                    "role": "assistant",
+                    "content": [
+                        {
+                            "type": "tool_use",
+                            "id": "call_shape_fixture",
+                            "name": "ShapeFixture",
+                            "input": {"payload": tool_input_sentinel},
+                        }
+                    ],
+                },
+                {
+                    "role": "user",
+                    "content": [
+                        {
+                            "type": "tool_result",
+                            "tool_use_id": "call_shape_fixture",
+                            "content": prompt_sentinel,
+                        }
+                    ],
+                },
+            ],
+        }
+        # insufficient_quota -> invalid_request_error triggers the request_shape line.
+        scenario = structured_error_scenario(
+            "d5-request-shape",
+            "error",
+            {"code": "insufficient_quota", "message": "plan exhausted"},
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_raw_messages(
+                    json.dumps(request_body, separators=(",", ":")).encode("utf-8")
+                )
+                self.assertEqual(result.status, 200, result.text)
+                failure_lifecycle_report(
+                    parse_typed_sse(result.body),
+                    expected_error_type="invalid_request_error",
+                )
+                lines = lifecycle_for_response(shim, result)
+
+                shape_lines = [line for line in lines if line.event == "request_shape"]
+                self.assertEqual(
+                    len(shape_lines),
+                    1,
+                    ("exactly one request_shape line", [ln.raw for ln in lines]),
+                )
+                shape = shape_lines[0]
+                # keys= present, non-empty, and includes the always-present outbound
+                # Responses `input` key. The comma-joined name list is percent-encoded
+                # by the v1.2.11 injection-safe machine-field encoder (commas -> %2C),
+                # so decode with the stdlib oracle before splitting — production
+                # helpers are intentionally not imported.
+                keys_field = shape.fields.get("keys")
+                self.assertIsInstance(keys_field, str)
+                self.assertTrue(keys_field, "request_shape keys= is empty")
+                decoded_keys = urllib.parse.unquote(keys_field).split(",")
+                self.assertIn("input", decoded_keys)
+                # Names only — never a request value.
+                self.assertEqual(decoded_keys, sorted(decoded_keys))
+                # text_keys/reasoning_keys, if present, are also name-lists only.
+                for optional_field in ("text_keys", "reasoning_keys"):
+                    if optional_field in shape.fields:
+                        self.assertTrue(shape.fields[optional_field])
+                        sub_keys = urllib.parse.unquote(
+                            shape.fields[optional_field]
+                        ).split(",")
+                        self.assertEqual(sub_keys, sorted(sub_keys))
+
+                # No request VALUE may appear on the request_shape line, in any
+                # lifecycle line, or anywhere in the captured stderr.
+                logs = shim.captured_stderr()
+                for sentinel in sentinels:
+                    self.assertNotIn(sentinel, shape.raw, sentinel)
+                    for line in lines:
+                        self.assertNotIn(sentinel, line.raw, (sentinel, line.event))
+                    self.assertNotIn(sentinel, logs, sentinel)
+                    self.assertNotIn(sentinel, result.text, sentinel)
+                # The sentinels DID reach the backend request (proving non-reflection,
+                # not mere absence from an unsent payload).
+                backend_request = json.dumps(
+                    backend.responses_requests[0].body, separators=(",", ":")
+                )
+                for sentinel in (tool_desc_sentinel, tool_input_sentinel, prompt_sentinel):
+                    self.assertIn(sentinel, backend_request, sentinel)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v1214_retry_and_tail.py b/tests/provider_shim/test_v1214_retry_and_tail.py
new file mode 100644
index 00000000..23590726
--- /dev/null
+++ b/tests/provider_shim/test_v1214_retry_and_tail.py
@@ -0,0 +1,172 @@
+"""v1.2.14 R4 (classification-driven retry policy) + R5 (SSE tail tolerance).
+
+These deterministic red/green contracts exercise the two behaviors added in
+Dispatch A2 against the real shim subprocess via the loopback harness:
+
+- R4: retry gating is driven by the unified error classifier. A recognized
+  deterministic code overrides the bare-status fallback (insufficient_quota-coded
+  429 fails fast; rate_limit_exceeded is retried with a parsed/advertised delay),
+  while a bare status still reproduces today's RETRY_STATUSES behavior. A
+  rate-limit-class delay beyond the 60s cap fails fast instead of stalling.
+- R5: a fully-formed terminal event at EOF whose trailing blank line was trimmed
+  is flushed (see test_stream_hardening for the clean-tail pin); a malformed tail
+  AFTER a terminal frame is counted and ignored (this file).
+"""
+
+from __future__ import annotations
+
+import json
+import time
+import unittest
+
+from ._loopback_harness import (
+    USAGE,
+    MockResponsesServer,
+    RealShim,
+    backend_status_scenario,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+    raw_sse_scenario,
+    sequenced_attempt_scenario,
+)
+
+
+class ProviderShimRetryAndTailTests(unittest.TestCase):
+    maxDiff = 12000
+
+    def _terminal(self, shim: object, result: object) -> dict[str, str]:
+        lines = lifecycle_for_response(shim, result)
+        terminals = [line for line in lines if line.event == "terminal"]
+        self.assertEqual(len(terminals), 1, [line.raw for line in lines])
+        return terminals[0].fields
+
+    # --- R4: classification-driven retry gating ---
+
+    def test_insufficient_quota_429_fails_fast_no_retry(self) -> None:
+        # A recognized deterministic code OVERRIDES the retryable 429 status: an
+        # insufficient_quota-coded 429 is non-retryable and surfaces as
+        # invalid_request_error, with exactly one upstream request (no retry).
+        scenario = backend_status_scenario("quota-429", 429)
+        scenario.stream_error_body = (
+            b'{"error":{"type":"insufficient_quota","code":"insufficient_quota",'
+            b'"message":"You exceeded your current quota."}}'
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 429, result.text)
+                self.assertEqual(
+                    result.json()["error"]["type"], "invalid_request_error")
+                backend.assert_request_counts(responses=1)
+                terminal = self._terminal(shim, result)
+                self.assertEqual(terminal["retries"], "0")
+                self.assertEqual(terminal["retry_delay_source"], "-")
+
+    def test_rate_limit_exceeded_429_parsed_delay_retries(self) -> None:
+        # A rate_limit_exceeded code with an embedded "try again in <n>s" hint is
+        # retried; the delay is parsed from the message NUMBER only and the source
+        # is recorded as `parsed`. A tiny 0.05s delay keeps the suite fast.
+        scenario = sequenced_attempt_scenario("rl-parsed", [429, 200])
+        scenario.stream_error_body = (
+            b'{"error":{"type":"rate_limit_exceeded","code":"rate_limit_exceeded",'
+            b'"message":"Rate limit reached. Please try again in 0.05s. Contact us."}}'
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 200, result.text)
+                backend.assert_request_counts(responses=2)
+                terminal = self._terminal(shim, result)
+                self.assertEqual(terminal["retries"], "1")
+                self.assertEqual(terminal["retry_delay_source"], "parsed")
+
+    def test_bare_429_retries_with_header_delay_source(self) -> None:
+        # A bare 429 (no recognized code) still retries via the RETRY_STATUSES
+        # fallback. With a Retry-After header present the delay source is `header`
+        # (value 0 keeps the retry instant).
+        scenario = sequenced_attempt_scenario(
+            "bare-429", [429, 200], headers=[{"Retry-After": "0"}, {}])
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 200, result.text)
+                backend.assert_request_counts(responses=2)
+                terminal = self._terminal(shim, result)
+                self.assertEqual(terminal["retries"], "1")
+                self.assertEqual(terminal["retry_delay_source"], "header")
+
+    def test_rate_limit_delay_beyond_cap_fails_fast(self) -> None:
+        # A rate-limit-class advertised delay beyond the 60s cap fails fast with
+        # rate_limit_error rather than sleeping — the client owns the long wait. One
+        # upstream request, no multi-minute internal stall.
+        scenario = backend_status_scenario("rl-over-cap", 429, retry_after="120")
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                start = time.monotonic()
+                result = shim.post_messages(stream=False)
+                elapsed = time.monotonic() - start
+                self.assertEqual(result.status, 429, result.text)
+                self.assertEqual(
+                    result.json()["error"]["type"], "rate_limit_error")
+                backend.assert_request_counts(responses=1)
+                self.assertLess(elapsed, 30.0, "must not sleep the 120s advertised delay")
+                terminal = self._terminal(shim, result)
+                self.assertEqual(terminal["retries"], "0")
+                self.assertEqual(terminal["retry_delay_source"], "header")
+
+    def test_oversized_error_body_is_bounded_and_classified_by_status(self) -> None:
+        # F3: a >=400 error body far larger than any real envelope (2 MiB of junk on a
+        # 503) must not drive an unbounded parse in _open_backend_stream's retry path.
+        # The body is truncated to MAX_ERROR_BODY_BYTES (1 MiB) before _plan_retry; the
+        # truncated junk fails envelope parse and falls back to HTTP-status gating (503
+        # is in RETRY_STATUSES), so the attempt is retried and the next (200) succeeds.
+        # Retry-After: 0 keeps the retry instant and pins the delay source deterministically.
+        scenario = sequenced_attempt_scenario(
+            "f3-oversized-error-body", [503, 200], headers=[{"Retry-After": "0"}, {}])
+        scenario.stream_error_body = b"x" * (2 * 1024 * 1024)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_report(parse_typed_sse(result.body))
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=2)
+                terminal = self._terminal(shim, result)
+                self.assertEqual(terminal["retries"], "1")
+                self.assertEqual(terminal["retry_delay_source"], "header")
+
+    # --- R5: SSE tail tolerance ---
+
+    def test_eof_malformed_tail_after_terminal_flushes_and_counts(self) -> None:
+        # A complete terminal event missing its blank-line boundary, followed by a
+        # truncated non-data field at EOF: the terminal event is flushed (success)
+        # and the trailing malformed bytes are counted for observability, not raised.
+        terminal = {
+            "type": "response.completed",
+            "response": {
+                "id": "resp_tail",
+                "status": "completed",
+                "output": [],
+                "usage": dict(USAGE),
+            },
+        }
+        frame = (
+            b"data: "
+            + json.dumps(terminal, separators=(",", ":")).encode()
+            + b"\nevent: response.trailing-truncated"
+        )
+        scenario = raw_sse_scenario("eof-malformed-tail-after-terminal", [frame])
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_report(parse_typed_sse(result.body))
+                shim.assert_offline_contract()
+                terminal_fields = self._terminal(shim, result)
+                self.assertGreaterEqual(int(terminal_fields["unknown_events"]), 1)
+                backend.assert_request_counts(responses=1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v1214_tolerant_reducer.py b/tests/provider_shim/test_v1214_tolerant_reducer.py
new file mode 100644
index 00000000..f746f36b
--- /dev/null
+++ b/tests/provider_shim/test_v1214_tolerant_reducer.py
@@ -0,0 +1,520 @@
+"""Deterministic contracts for the v1.2.14 R3 tolerant stream reducer (Dispatch A3a).
+
+The R3 doctrine is STRICT EMIT, TOLERANT ACCEPT: the reducer accepts interleaved /
+out-of-order / null / malformed-non-load-bearing upstream shapes that pre-R3 failed
+on, while the DOWNSTREAM Anthropic SSE stream stays strictly non-overlapping and
+serialized. These tests pin:
+
+1. Serialized wire is BYTE-IDENTICAL to the pre-R3 single-slot reducer (the
+   non-negotiable regression gate — the tolerant scheduler must not perturb the
+   common serialized path).
+2. Interleaved two-tool wire (second tool added while first open, alternating arg
+   deltas) → two non-overlapping tool_use blocks in added order, inputs correct.
+3. `response.completed` with `output: null` / `output: []` after a tool turn is
+   tolerated (streamed state is the fallback source).
+4. A text turn with NO `content_part.added` opens the text block on the first
+   `output_text.delta` (R3.4, pinned by test only — no shim change).
+5. Malformed-JSON tolerance is TYPE-GATED: a malformed non-load-bearing status frame
+   (`response.in_progress`) is counted and skipped (success); a malformed
+   load-bearing frame (`output_text.delta`) still fails the stream strictly.
+6. Reasoning-summary deltas BETWEEN two completed tools reduce to a clean thinking
+   block between two tool_use blocks.
+"""
+
+from __future__ import annotations
+
+import json
+import unittest
+
+from ._loopback_harness import (
+    USAGE,
+    READ_TOOL,
+    MockResponsesServer,
+    RealShim,
+    Scenario,
+    _EventBuilder,
+    _append_reasoning_item,
+    _append_tool_item,
+    _finish_response,
+    _nonstream_response,
+    block_starts,
+    events_scenario,
+    failure_lifecycle_report,
+    interleaved_two_tools_scenario,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+    sequential_two_tools_scenario,
+    text_delta_values,
+    thinking_delta_values,
+)
+
+
+# Golden captured from the serialized-two-tools path (msg id normalized). This is the
+# byte-identical baseline the R3 scheduler must not perturb: two non-overlapping
+# tool_use blocks at monotonic indices 0 and 1, each with one sanitized input delta.
+_SERIALIZED_TWO_TOOL_NAMES = [
+    "message_start",
+    "content_block_start",
+    "content_block_delta",
+    "content_block_stop",
+    "content_block_start",
+    "content_block_delta",
+    "content_block_stop",
+    "message_delta",
+    "message_stop",
+]
+_SERIALIZED_TWO_TOOL_PROJECTION = [
+    {
+        "type": "message_start",
+        "message": {
+            "id": "<dynamic-message-id>",
+            "type": "message",
+            "role": "assistant",
+            "model": "gpt-fixture",
+            "content": [],
+            "stop_reason": None,
+            "stop_sequence": None,
+            # v1.3.6 (V6-R3, always-emit): the message_start zero-usage seed gains the two
+            # cache fields as 0 for a deterministic usage shape.
+            "usage": {
+                "input_tokens": 0,
+                "output_tokens": 0,
+                "cache_read_input_tokens": 0,
+                "cache_creation_input_tokens": 0,
+            },
+        },
+    },
+    {
+        "type": "content_block_start",
+        "index": 0,
+        "content_block": {
+            "type": "tool_use",
+            "id": "call_sequential_1",
+            "name": "Read",
+            "input": {},
+        },
+    },
+    {
+        "type": "content_block_delta",
+        "index": 0,
+        "delta": {
+            "type": "input_json_delta",
+            "partial_json": '{"file_path": "/daaf/README.md"}',
+        },
+    },
+    {"type": "content_block_stop", "index": 0},
+    {
+        "type": "content_block_start",
+        "index": 1,
+        "content_block": {
+            "type": "tool_use",
+            "id": "call_sequential_2",
+            "name": "Read",
+            "input": {},
+        },
+    },
+    {
+        "type": "content_block_delta",
+        "index": 1,
+        "delta": {
+            "type": "input_json_delta",
+            "partial_json": '{"file_path": "/daaf/README.md"}',
+        },
+    },
+    {"type": "content_block_stop", "index": 1},
+    {
+        "type": "message_delta",
+        "delta": {"stop_reason": "tool_use", "stop_sequence": None},
+        # v1.3.6 (V6-R3, always-emit): absent cache detail -> both fields 0.
+        "usage": {
+            "input_tokens": USAGE["input_tokens"],
+            "output_tokens": USAGE["output_tokens"],
+            "cache_read_input_tokens": 0,
+            "cache_creation_input_tokens": 0,
+        },
+    },
+    {"type": "message_stop"},
+]
+
+
+def _normalize_message_id(frames):
+    """Project frames to (event, data) with the dynamic message id normalized."""
+
+    projected = []
+    for frame in frames:
+        data = json.loads(json.dumps(frame.data)) if isinstance(frame.data, dict) else frame.data
+        if isinstance(data, dict) and data.get("type") == "message_start":
+            message = data.get("message") or {}
+            if "id" in message:
+                message["id"] = "<dynamic-message-id>"
+        projected.append(data)
+    return projected
+
+
+def _tool_input_by_index(frames):
+    """Reconstruct each tool block's input JSON from its input_json_delta stream."""
+
+    partials: dict[int, str] = {}
+    for event in (f.data for f in frames if isinstance(f.data, dict)):
+        if event.get("type") != "content_block_delta":
+            continue
+        delta = event.get("delta") or {}
+        if delta.get("type") == "input_json_delta":
+            index = event.get("index")
+            partials[index] = partials.get(index, "") + delta.get("partial_json", "")
+    return {index: json.loads(raw or "{}") for index, raw in partials.items()}
+
+
+class ProviderShimV1214TolerantReducerTests(unittest.TestCase):
+    maxDiff = 20000
+
+    def _event_line(self, lines, event):
+        matches = [line for line in lines if line.event == event]
+        self.assertEqual(len(matches), 1, (event, [line.raw for line in lines]))
+        return matches[0]
+
+    def _terminal_fields(self, lines):
+        return self._event_line(lines, "terminal").fields
+
+    # --- 1. serialized byte-identical pin (non-negotiable regression gate) ---
+
+    def test_serialized_two_tools_is_byte_identical(self) -> None:
+        scenario = sequential_two_tools_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                # Success lifecycle still holds (non-overlap, monotonic, clean stop).
+                lifecycle_report(frames)
+                self.assertEqual(
+                    [frame.event for frame in frames],
+                    _SERIALIZED_TWO_TOOL_NAMES,
+                )
+                self.assertEqual(
+                    _normalize_message_id(frames),
+                    _SERIALIZED_TWO_TOOL_PROJECTION,
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- 2. interleaved two-tool success ---
+
+    def test_interleaved_two_tools_yields_ordered_blocks(self) -> None:
+        scenario = interleaved_two_tools_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["tool_use", "tool_use"],
+                )
+                self.assertEqual(report.open_at_end, set())
+                # Non-overlapping blocks in ADDED order, each with the correct input.
+                tool_starts = [
+                    start
+                    for start in block_starts(frames)
+                    if (start.get("content_block") or {}).get("type") == "tool_use"
+                ]
+                self.assertEqual(
+                    [start["content_block"]["id"] for start in tool_starts],
+                    ["call_interleaved_1", "call_interleaved_2"],
+                )
+                self.assertEqual(
+                    _tool_input_by_index(frames),
+                    {0: {"file_path": "/daaf/A.md"}, 1: {"file_path": "/daaf/B.md"}},
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- 3. completed output null / [] after a tool turn ---
+
+    def _tool_turn_with_terminal_output(self, name, terminal_output):
+        args = '{"file_path":"/daaf/README.md"}'
+        events = [
+            {"type": "response.created",
+             "response": {"id": f"resp_{name}", "status": "in_progress"}},
+            {"type": "response.output_item.added", "output_index": 0,
+             "item": {"type": "function_call", "id": "fc_null_1",
+                      "call_id": "call_null_1", "name": "Read", "status": "in_progress"}},
+            {"type": "response.function_call_arguments.delta",
+             "item_id": "fc_null_1", "output_index": 0, "delta": args},
+            {"type": "response.function_call_arguments.done",
+             "item_id": "fc_null_1", "output_index": 0, "arguments": args},
+            {"type": "response.output_item.done", "output_index": 0,
+             "item": {"type": "function_call", "id": "fc_null_1", "call_id": "call_null_1",
+                      "name": "Read", "arguments": args, "status": "completed"}},
+            {"type": "response.completed",
+             "response": {"id": f"resp_{name}", "status": "completed",
+                          "output": terminal_output, "usage": dict(USAGE)}},
+        ]
+        return events_scenario(name, events)
+
+    def test_completed_null_or_empty_output_after_tool_is_tolerated(self) -> None:
+        for label, terminal_output in (("null", None), ("empty", [])):
+            with self.subTest(output=label):
+                scenario = self._tool_turn_with_terminal_output(
+                    f"tool-{label}-output", terminal_output
+                )
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, "chatgpt") as shim:
+                        result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                        self.assertEqual(result.status, 200, result.text)
+                        frames = parse_typed_sse(result.body)
+                        report = lifecycle_report(frames)
+                        self.assertEqual(
+                            [kind for _index, kind in report.starts],
+                            ["tool_use"],
+                            label,
+                        )
+                        self.assertEqual(report.open_at_end, set())
+                        self.assertEqual(
+                            _tool_input_by_index(frames),
+                            {0: {"file_path": "/daaf/README.md"}},
+                            label,
+                        )
+                        shim.assert_offline_contract()
+                        backend.assert_request_counts(responses=1)
+
+    # --- 4. content_part-omitted text turn (R3.4 pin) ---
+
+    def test_text_turn_without_content_part_opens_on_first_delta(self) -> None:
+        text = "No content_part first."
+        events = [
+            {"type": "response.created",
+             "response": {"id": "resp_cp", "status": "in_progress"}},
+            {"type": "response.output_item.added", "output_index": 0,
+             "item": {"type": "message", "id": "msg_cp", "role": "assistant",
+                      "status": "in_progress", "content": []}},
+            # NOTE: no response.content_part.added is emitted before the delta.
+            {"type": "response.output_text.delta", "item_id": "msg_cp",
+             "output_index": 0, "content_index": 0, "delta": text},
+            {"type": "response.output_item.done", "output_index": 0,
+             "item": {"type": "message", "id": "msg_cp", "role": "assistant",
+                      "status": "completed",
+                      "content": [{"type": "output_text", "text": text}]}},
+            {"type": "response.completed",
+             "response": {"id": "resp_cp", "status": "completed",
+                          "output": [{"type": "message", "id": "msg_cp",
+                                      "role": "assistant", "status": "completed",
+                                      "content": [{"type": "output_text", "text": text}]}],
+                          "usage": dict(USAGE)}},
+        ]
+        scenario = events_scenario("content-part-omitted", events)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts], ["text"]
+                )
+                self.assertEqual(text_delta_values(frames), [text])
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- 4b. fully-realistic no-reasoning text turn (F1 completeness pin) ---
+
+    def test_no_reasoning_turn_is_tolerated(self) -> None:
+        # A live-capture-realistic streamed text turn that carries NO reasoning items
+        # or summary deltas at all: created -> in_progress -> output_item.added(message)
+        # -> content_part.added -> output_text.delta -> output_text.done ->
+        # content_part.done -> output_item.done -> completed. The reducer must produce a
+        # clean single text block (no synthesized thinking block), the text must survive,
+        # and every event is a known type so unknown_events stays 0.
+        text = "A plain answer with no reasoning at all."
+        events = [
+            {"type": "response.created",
+             "response": {"id": "resp_noreason", "status": "in_progress"}},
+            {"type": "response.in_progress",
+             "response": {"id": "resp_noreason", "status": "in_progress"}},
+            {"type": "response.output_item.added", "output_index": 0,
+             "item": {"type": "message", "id": "msg_noreason", "role": "assistant",
+                      "status": "in_progress", "content": []}},
+            {"type": "response.content_part.added", "item_id": "msg_noreason",
+             "output_index": 0, "content_index": 0,
+             "part": {"type": "output_text", "text": ""}},
+            {"type": "response.output_text.delta", "item_id": "msg_noreason",
+             "output_index": 0, "content_index": 0, "delta": text},
+            {"type": "response.output_text.done", "item_id": "msg_noreason",
+             "output_index": 0, "content_index": 0, "text": text},
+            {"type": "response.content_part.done", "item_id": "msg_noreason",
+             "output_index": 0, "content_index": 0,
+             "part": {"type": "output_text", "text": text}},
+            {"type": "response.output_item.done", "output_index": 0,
+             "item": {"type": "message", "id": "msg_noreason", "role": "assistant",
+                      "status": "completed",
+                      "content": [{"type": "output_text", "text": text}]}},
+            {"type": "response.completed",
+             "response": {"id": "resp_noreason", "status": "completed",
+                          "output": [{"type": "message", "id": "msg_noreason",
+                                      "role": "assistant", "status": "completed",
+                                      "content": [{"type": "output_text", "text": text}]}],
+                          "usage": dict(USAGE)}},
+        ]
+        scenario = events_scenario("no-reasoning-turn", events)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                # Exactly one text block, no thinking block anywhere.
+                self.assertEqual([kind for _index, kind in report.starts], ["text"])
+                self.assertEqual(report.open_at_end, set())
+                self.assertEqual(text_delta_values(frames), [text])
+                # No reasoning arrived, so the observability counter stays clean.
+                terminal_fields = self._terminal_fields(
+                    lifecycle_for_response(shim, result)
+                )
+                self.assertEqual(terminal_fields["outcome"], "success")
+                self.assertEqual(int(terminal_fields["unknown_events"]), 0)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- 5. malformed-JSON tolerance is type-gated ---
+
+    def _raw_frame(self, event_type, obj):
+        return (
+            f"event: {event_type}\n"
+            f"data: {json.dumps(obj, separators=(',', ':'))}\n\n"
+        ).encode("utf-8")
+
+    def _malformed_prefix_frames(self):
+        return [
+            self._raw_frame(
+                "response.created",
+                {"type": "response.created",
+                 "response": {"id": "resp_mal", "status": "in_progress"}},
+            ),
+            self._raw_frame(
+                "response.output_item.added",
+                {"type": "response.output_item.added", "output_index": 0,
+                 "item": {"type": "message", "id": "msg_mal", "role": "assistant",
+                          "status": "in_progress", "content": []}},
+            ),
+            self._raw_frame(
+                "response.output_text.delta",
+                {"type": "response.output_text.delta", "item_id": "msg_mal",
+                 "output_index": 0, "content_index": 0, "delta": "Prefix."},
+            ),
+        ]
+
+    def test_malformed_non_load_bearing_frame_is_tolerated(self) -> None:
+        # A malformed `response.in_progress` frame: json.loads fails, but the probe
+        # recovers a non-load-bearing type, so it is counted (R1) and skipped and the
+        # stream still completes via the following valid terminal frame.
+        frames = self._malformed_prefix_frames()
+        frames.append(
+            b'event: response.in_progress\n'
+            b'data: {"type":"response.in_progress","x":}\n\n'
+        )
+        terminal = {
+            "type": "response.completed",
+            "response": {"id": "resp_mal", "status": "completed",
+                         "output": [{"type": "message", "id": "msg_mal",
+                                     "role": "assistant", "status": "completed",
+                                     "content": [{"type": "output_text", "text": "Prefix."}]}],
+                         "usage": dict(USAGE)},
+        }
+        frames.append(self._raw_frame("response.completed", terminal))
+        frames.append(b"data: [DONE]\n\n")
+        scenario = Scenario(
+            name="malformed-in-progress-tolerated",
+            stream_events=[],
+            nonstream_response=_nonstream_response("resp_mal_ns", []),
+            append_done=False,
+            raw_stream_frames=frames,
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                sse = parse_typed_sse(result.body)
+                report = lifecycle_report(sse)
+                self.assertEqual([kind for _index, kind in report.starts], ["text"])
+                self.assertEqual(text_delta_values(sse), ["Prefix."])
+                terminal_fields = self._terminal_fields(
+                    lifecycle_for_response(shim, result)
+                )
+                self.assertEqual(terminal_fields["outcome"], "success")
+                self.assertGreaterEqual(int(terminal_fields["unknown_events"]), 1)
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_malformed_load_bearing_frame_still_fails(self) -> None:
+        # Contrast: a malformed `output_text.delta` frame carries a load-bearing type,
+        # so even though the probe recovers the type it is NOT in the tolerant set —
+        # the stream fails strictly (terminal error), never presenting partial success.
+        frames = self._malformed_prefix_frames()
+        frames.append(
+            b'event: response.output_text.delta\n'
+            b'data: {"type":"response.output_text.delta","delta":}\n\n'
+        )
+        frames.append(b"data: [DONE]\n\n")
+        scenario = Scenario(
+            name="malformed-output-text-fails",
+            stream_events=[],
+            nonstream_response=_nonstream_response("resp_mal_fail_ns", []),
+            append_done=False,
+            raw_stream_frames=frames,
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                failure = failure_lifecycle_report(parse_typed_sse(result.body))
+                self.assertEqual(failure.error.get("type"), "api_error")
+                self.assertEqual(failure.open_at_end, set())
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- 6. reasoning-summary deltas between two completed tools ---
+
+    def test_reasoning_between_completed_tools_is_a_thinking_block(self) -> None:
+        builder = _EventBuilder()
+        builder.add(
+            "response.created",
+            response={"id": "resp_between", "status": "in_progress"},
+        )
+        output = [
+            _append_tool_item(
+                builder, 0, call_id="call_between_1", item_id="fc_between_1"
+            ),
+            _append_reasoning_item(
+                builder, "rs_between", 1,
+                [{"summary_index": 0, "deltas": ["Between the tools."]}],
+            ),
+            _append_tool_item(
+                builder, 2, call_id="call_between_2", item_id="fc_between_2"
+            ),
+        ]
+        _finish_response(builder, "resp_between", output)
+        scenario = Scenario(
+            name="reasoning-between-tools",
+            stream_events=builder.events,
+            nonstream_response=_nonstream_response("resp_between_ns", output),
+        )
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                frames = parse_typed_sse(result.body)
+                report = lifecycle_report(frames)
+                self.assertEqual(
+                    [kind for _index, kind in report.starts],
+                    ["tool_use", "thinking", "tool_use"],
+                )
+                self.assertEqual(report.open_at_end, set())
+                self.assertEqual(thinking_delta_values(frames), ["Between the tools."])
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v130_auth_delegation.py b/tests/provider_shim/test_v130_auth_delegation.py
new file mode 100644
index 00000000..d9efb858
--- /dev/null
+++ b/tests/provider_shim/test_v130_auth_delegation.py
@@ -0,0 +1,417 @@
+"""v1.3.0 (Tier 3 A1) — ChatGPT-lane auth delegation to the codex CLI.
+
+The shim no longer refreshes ChatGPT OAuth tokens itself. It READS
+``$CODEX_HOME/auth.json``, and when the access_token is near expiry (proactive) or
+a backend 401 rejects it (reactive), it DELEGATES the refresh to the codex CLI by
+spawning ``codex login status`` and then re-reading auth.json — judging success
+ONLY by the re-read result, never by the subprocess's exit code or output. Codex is
+the single writer; the shim never writes auth.json.
+
+These are in-process unit contracts: each test imports a fresh copy of the
+production shim module under a controlled environment (chatgpt mode, an isolated
+CODEX_HOME, and SHIM_CODEX_BIN pointed at the fake-codex stub), then drives the auth
+primitives directly. The env patch stays live across the async calls so the codex
+subprocess the shim spawns inherits CODEX_HOME + FAKE_CODEX_MODE. No network, no real
+credentials, no real codex binary is involved.
+
+Coverage:
+- proactive trigger refreshes a near-expiry token (and a valid token does not spawn);
+- reactive 401 refresh returns the fresh token;
+- an unrecoverable refresh (codex no-op on an expired token) raises an error whose
+  message literally contains ``codex login --device-auth``;
+- the codex binary missing, and codex hanging past SHIM_CODEX_TIMEOUT_S, both surface
+  the actionable error rather than crashing or hanging;
+- single-flight: concurrent refreshes spawn codex exactly once;
+- an absent or unreadable auth.json surfaces the actionable error.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import importlib.util
+import json
+import os
+import shutil
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from ._loopback_harness import (
+    FAKE_CODEX_BIN,
+    PRODUCTION_SHIM,
+    SCRATCH_ROOT,
+    _make_fake_jwt,
+    _purge_in_process_reasoning_cache_seam,
+)
+
+RECOVERY_COMMAND = "codex login --device-auth"
+FAKE_OPENAI_KEY = "sk-FAKE_PROVIDER_SHIM_AUTHTEST_000000000000"
+
+
+def _load_fresh_shim():
+    """Import a pristine copy of the production shim under the current environment."""
+
+    module_name = f"provider_shim_authtest_{uuid.uuid4().hex}"
+    # v1.3.3 (A2-R5): clear the runner-default reasoning-cache seam before this fresh
+    # in-process load so its import-time restore starts cold — otherwise an entry a prior
+    # in-process load persisted to the shared runner-default seam would leak into this
+    # module's cache. These auth tests do not assert on the reasoning cache, so the leak
+    # is harmless today, but keeping every in-process loader cold makes the invariant
+    # uniform and future-proof (see the hazard note at the top of _loopback_harness.py).
+    _purge_in_process_reasoning_cache_seam()
+    spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("could not load production shim for auth-delegation test")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class AuthDelegationTest(unittest.TestCase):
+    def setUp(self) -> None:
+        SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+        self.codex_home = SCRATCH_ROOT / f"provider-shim-authtest-{uuid.uuid4().hex}"
+        self.codex_home.mkdir(mode=0o700)
+        self.auth_path = self.codex_home / "auth.json"
+
+    def tearDown(self) -> None:
+        # Restore readability so an unreadable-store test can still be cleaned up.
+        if self.auth_path.exists():
+            try:
+                self.auth_path.chmod(0o600)
+            except OSError:
+                pass
+        if self.codex_home.exists():
+            shutil.rmtree(self.codex_home, ignore_errors=True)
+
+    # --- helpers ---
+
+    def _seed_auth(self, exp_offset_s: int) -> str:
+        """Write an auth.json whose access_token expires `exp_offset_s` from now."""
+
+        token = _make_fake_jwt(int(time.time()) + exp_offset_s)
+        auth = {
+            "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+            "auth_mode": "chatgpt",
+            "last_refresh": "2099-01-01T00:00:00.000000000Z",
+            "tokens": {
+                "access_token": token,
+                "account_id": "acct_authtest",
+                "id_token": "FAKE_ID_TOKEN",
+                "refresh_token": "FAKE_REFRESH_TOKEN",
+            },
+        }
+        self.auth_path.write_text(json.dumps(auth), encoding="utf-8")
+        self.auth_path.chmod(0o600)
+        return token
+
+    def _disk_token(self):
+        auth = json.loads(self.auth_path.read_text(encoding="utf-8"))
+        return (auth.get("tokens") or {}).get("access_token")
+
+    def _codex_call_count(self) -> int:
+        marker = self.codex_home / ".codex_calls"
+        if not marker.exists():
+            return 0
+        return len(
+            [line for line in marker.read_text(encoding="utf-8").splitlines() if line]
+        )
+
+    def _env(self, *, mode="noop", timeout=None, codex_bin=None):
+        env = {
+            "SHIM_BACKEND_MODE": "chatgpt",
+            "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1",
+            "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+            "CODEX_HOME": str(self.codex_home),
+            "SHIM_CODEX_BIN": codex_bin if codex_bin is not None else str(FAKE_CODEX_BIN),
+            "FAKE_CODEX_MODE": mode,
+        }
+        if timeout is not None:
+            env["SHIM_CODEX_TIMEOUT_S"] = str(timeout)
+        return env
+
+    # --- proactive path ---
+
+    def test_proactive_trigger_refreshes_near_expiry_token(self) -> None:
+        seeded = self._seed_auth(exp_offset_s=60)  # inside the 5-min margin
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            returned = asyncio.run(module._get_access_token())
+        fresh = self._disk_token()
+        self.assertNotEqual(fresh, seeded, "codex should have rewritten the token")
+        self.assertEqual(returned, fresh, "shim must return the freshly re-read token")
+        self.assertEqual(self._codex_call_count(), 1, "codex must be invoked exactly once")
+
+    def test_proactive_valid_token_does_not_spawn_codex(self) -> None:
+        seeded = self._seed_auth(exp_offset_s=365 * 86400)  # far future
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            returned = asyncio.run(module._get_access_token())
+        self.assertEqual(returned, seeded, "a comfortably-valid token is returned as-is")
+        self.assertEqual(self._codex_call_count(), 0, "no refresh should be delegated")
+
+    # --- reactive (401) path ---
+
+    def test_reactive_401_refresh_returns_fresh_token(self) -> None:
+        seeded = self._seed_auth(exp_offset_s=365 * 86400)  # exp-valid but rejected
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            returned = asyncio.run(
+                module._get_access_token(force_refresh=True, rejected_token=seeded)
+            )
+        fresh = self._disk_token()
+        self.assertNotEqual(fresh, seeded)
+        self.assertEqual(returned, fresh)
+        self.assertEqual(self._codex_call_count(), 1)
+
+    def test_reactive_401_unrecoverable_raises_actionable_error(self) -> None:
+        # Expired on disk + codex that cannot refresh (no-op) -> the re-read is still
+        # invalid, so delegated refresh fails with the actionable recovery command.
+        seeded = self._seed_auth(exp_offset_s=-3600)
+        with mock.patch.dict(os.environ, self._env(mode="noop"), clear=False):
+            module = _load_fresh_shim()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(
+                    module._get_access_token(force_refresh=True, rejected_token=seeded)
+                )
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+        self.assertEqual(self._codex_call_count(), 1)
+
+    def test_reactive_401_codex_not_logged_in_raises_actionable_error(self) -> None:
+        seeded = self._seed_auth(exp_offset_s=-3600)
+        with mock.patch.dict(os.environ, self._env(mode="not-logged-in"), clear=False):
+            module = _load_fresh_shim()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(
+                    module._get_access_token(force_refresh=True, rejected_token=seeded)
+                )
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+
+    # --- resilience: missing binary, timeout ---
+
+    def test_codex_binary_missing_surfaces_actionable_error(self) -> None:
+        self._seed_auth(exp_offset_s=-3600)
+        missing = str(self.codex_home / "nonexistent-codex-binary")
+        with mock.patch.dict(
+            os.environ, self._env(mode="noop", codex_bin=missing), clear=False
+        ):
+            module = _load_fresh_shim()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(module.delegated_refresh())
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+
+    def test_codex_hang_is_killed_and_surfaces_actionable_error(self) -> None:
+        self._seed_auth(exp_offset_s=-3600)
+        with mock.patch.dict(
+            os.environ, self._env(mode="hang", timeout=0.5), clear=False
+        ):
+            module = _load_fresh_shim()
+            self.assertEqual(module.SHIM_CODEX_TIMEOUT_S, 0.5)
+            start = time.monotonic()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(module.delegated_refresh())
+            elapsed = time.monotonic() - start
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+        # Bounded by the timeout knob, not the stub's 3600s sleep.
+        self.assertLess(elapsed, 20.0, "hung codex must be killed near the timeout")
+
+    def test_timeout_env_unparseable_falls_back_to_default(self) -> None:
+        self._seed_auth(exp_offset_s=365 * 86400)
+        env = self._env(mode="noop")
+        env["SHIM_CODEX_TIMEOUT_S"] = "not-a-number"
+        with mock.patch.dict(os.environ, env, clear=False):
+            module = _load_fresh_shim()
+            self.assertEqual(module.SHIM_CODEX_TIMEOUT_S, 30.0)
+
+    # --- single-flight ---
+
+    def test_single_flight_concurrent_refreshes_spawn_codex_once(self) -> None:
+        self._seed_auth(exp_offset_s=60)  # near expiry -> all callers want a refresh
+
+        async def _race(module):
+            return await asyncio.gather(
+                *[module.delegated_refresh() for _ in range(8)]
+            )
+
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            results = asyncio.run(_race(module))
+        fresh = self._disk_token()
+        self.assertTrue(all(token == fresh for token in results))
+        self.assertEqual(
+            self._codex_call_count(), 1, "single-flight must spawn codex exactly once"
+        )
+
+    # --- absent / unreadable store ---
+
+    def test_auth_json_absent_surfaces_actionable_error(self) -> None:
+        # No auth.json is written at all.
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(module._get_access_token())
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+
+    def test_auth_json_unreadable_surfaces_actionable_error(self) -> None:
+        self._seed_auth(exp_offset_s=365 * 86400)
+        self.auth_path.chmod(0o000)
+        with mock.patch.dict(os.environ, self._env(mode="refresh-success"), clear=False):
+            module = _load_fresh_shim()
+            with self.assertRaises(RuntimeError) as ctx:
+                asyncio.run(module._get_access_token())
+        self.assertIn(RECOVERY_COMMAND, str(ctx.exception))
+
+    # --- invariant: the recovery command is always in the canonical message ---
+
+    def test_relogin_message_contains_recovery_command(self) -> None:
+        with mock.patch.dict(os.environ, self._env(mode="noop"), clear=False):
+            module = _load_fresh_shim()
+            self.assertIn(RECOVERY_COMMAND, module._RELOGIN_MSG)
+
+
+class AuthHealthBlockTest(unittest.TestCase):
+    """A1-R4: the read-only `auth` block surfaced by /health.
+
+    Exercises `_auth_health_block()` directly in-process across all five chatgpt-lane
+    states (valid | expiring | expired | absent | unreadable) plus the openai-lane
+    "n/a". The function is a pure reader of auth.json presence + the JWT exp; it never
+    returns token material, never writes, and never raises. Driving it in-process
+    (rather than through a RealShim subprocess) gives deterministic control of the
+    crafted exp and the store's readability. The far-future "valid" case is additionally
+    asserted end-to-end through /health by test_historical_regressions.
+    """
+
+    def setUp(self) -> None:
+        SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+        self.codex_home = SCRATCH_ROOT / f"provider-shim-healthtest-{uuid.uuid4().hex}"
+        self.codex_home.mkdir(mode=0o700)
+        self.auth_path = self.codex_home / "auth.json"
+
+    def tearDown(self) -> None:
+        if self.auth_path.exists():
+            try:
+                self.auth_path.chmod(0o600)
+            except OSError:
+                pass
+        if self.codex_home.exists():
+            shutil.rmtree(self.codex_home, ignore_errors=True)
+
+    def _seed_auth(self, exp_offset_s: int) -> None:
+        auth = {
+            "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+            "auth_mode": "chatgpt",
+            "tokens": {
+                "access_token": _make_fake_jwt(int(time.time()) + exp_offset_s),
+                "account_id": "acct_healthtest",
+            },
+        }
+        self.auth_path.write_text(json.dumps(auth), encoding="utf-8")
+        self.auth_path.chmod(0o600)
+
+    def _chatgpt_env(self):
+        return {
+            "SHIM_BACKEND_MODE": "chatgpt",
+            "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1",
+            "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+            "CODEX_HOME": str(self.codex_home),
+            "SHIM_CODEX_BIN": str(FAKE_CODEX_BIN),
+        }
+
+    def _block(self):
+        module = _load_fresh_shim()
+        return module._auth_health_block()
+
+    def test_state_valid_far_future_token(self) -> None:
+        self._seed_auth(exp_offset_s=365 * 86400)
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "valid")
+        self.assertNotIn("recovery", block)  # recovery only for actionable states
+        self.assertIsInstance(block["expires_at"], str)
+        self.assertGreater(block["days_left"], 300)
+
+    def test_state_expiring_within_48h_window(self) -> None:
+        self._seed_auth(exp_offset_s=24 * 3600)  # inside the 48h expiring horizon
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "expiring")
+        self.assertEqual(block["recovery"], RECOVERY_COMMAND)
+        self.assertLessEqual(block["days_left"], 2)
+        self.assertGreater(block["days_left"], 0)
+
+    def test_state_expired_past_token(self) -> None:
+        self._seed_auth(exp_offset_s=-3600)
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "expired")
+        self.assertEqual(block["recovery"], RECOVERY_COMMAND)
+        self.assertLessEqual(block["days_left"], 0)
+
+    def test_state_absent_no_auth_file(self) -> None:
+        # No auth.json written; CODEX_HOME exists but the store is missing.
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "absent")
+        self.assertEqual(block["recovery"], RECOVERY_COMMAND)
+        self.assertIsNone(block["expires_at"])
+        self.assertIsNone(block["days_left"])
+
+    def test_state_unreadable_malformed_json(self) -> None:
+        # File present + readable, but its content yields no decodable access_token exp.
+        self.auth_path.write_text("this is not json{", encoding="utf-8")
+        self.auth_path.chmod(0o600)
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "unreadable")
+        self.assertEqual(block["recovery"], RECOVERY_COMMAND)
+        self.assertIsNone(block["expires_at"])
+
+    def test_state_unreadable_non_jwt_token(self) -> None:
+        # Valid JSON, but the access_token is opaque (not a decodable JWT) -> unreadable.
+        auth = {"tokens": {"access_token": "opaque-not-a-jwt"}}
+        self.auth_path.write_text(json.dumps(auth), encoding="utf-8")
+        self.auth_path.chmod(0o600)
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertEqual(block["state"], "unreadable")
+
+    def test_state_unreadable_overflow_exp(self) -> None:
+        # A garbage-but-numeric exp (corrupt/partial-write auth.json, or a non-codex
+        # writer) can overflow platform time_t inside time.gmtime/strftime. The block
+        # must classify "unreadable" rather than raise -- the /health probe must never
+        # 500. (_jwt_exp returns int(10**19); time.gmtime(10**19) raises OverflowError.)
+        auth = {"tokens": {"access_token": _make_fake_jwt(10 ** 19)}}
+        self.auth_path.write_text(json.dumps(auth), encoding="utf-8")
+        self.auth_path.chmod(0o600)
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()  # must not raise
+        self.assertEqual(block["state"], "unreadable")
+        self.assertEqual(block["recovery"], RECOVERY_COMMAND)
+        self.assertIsNone(block["expires_at"])
+
+    def test_openai_lane_reports_na(self) -> None:
+        # The API-key lane does not use the codex OAuth store -> "n/a", no token surface.
+        env = {
+            "SHIM_BACKEND_MODE": "openai",
+            "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1",
+            "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+        }
+        with mock.patch.dict(os.environ, env, clear=False):
+            block = self._block()
+        self.assertEqual(block, {"state": "n/a"})
+
+    def test_block_never_contains_token_material(self) -> None:
+        # Credential-safety invariant: no state exposes the access_token value.
+        self._seed_auth(exp_offset_s=365 * 86400)
+        token = json.loads(self.auth_path.read_text(encoding="utf-8"))["tokens"][
+            "access_token"
+        ]
+        with mock.patch.dict(os.environ, self._chatgpt_env(), clear=False):
+            block = self._block()
+        self.assertNotIn(token, json.dumps(block))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v131_quota_state.py b/tests/provider_shim/test_v131_quota_state.py
new file mode 100644
index 00000000..fca11d06
--- /dev/null
+++ b/tests/provider_shim/test_v131_quota_state.py
@@ -0,0 +1,473 @@
+"""Deterministic contracts for the v1.3.1 quota-state cache write.
+
+The v1.3.1 shim, on every chatgpt-lane 2xx, additionally caches the quota snapshot
+to ``<log dir>/quota_state.json`` (an atomic, 0600, absolutely-fail-open write) so
+the statusline can render a "Plan usage:" segment on shim-lane sessions. These tests
+exercise the write helper and its guard IN-PROCESS: the production shim module is
+imported via importlib (the same seam the harness uses for its ownership probe) so the
+module-level state-file path and ``SHIM_BACKEND_MODE`` can be monkeypatched to a tmp
+directory — no subprocess, and the real ``scripts/provider_shim/logs/`` directory is
+never touched.
+
+1. chatgpt-lane 2xx writes the state file: correct JSON keys, ``captured_at`` within
+   the test wall-clock bounds, header values passed through, absent headers -> "-".
+2. The guard holds: the openai lane and a chatgpt non-2xx write no file.
+3. Overwrite semantics: a second 2xx replaces the content and leaves no ``.tmp``
+   sibling behind.
+4. Write failure is swallowed: an unwritable log dir or an ``os.replace`` that raises
+   leaves the response path unaffected (no exception escapes) and no stale ``.tmp``.
+
+v1.3.2 adds the ``DAAF_QUOTA_STATE_FILE`` redirect seam (the same env var the reader,
+context-bar.sh, already honors) plus its end-to-end consequences, verified with the
+spawned production shim via the loopback harness:
+
+5. Seam honored: a spawned chatgpt-lane shim writes its snapshot to the seam path (the
+   harness's per-instance scratch dir), with the expected content shape and 0600 mode.
+6. Production-file non-pollution (the regression that matters): a representative spawned
+   chatgpt-lane exchange leaves the install-shared ``scripts/provider_shim/logs/
+   quota_state.json`` byte- and mtime-identical, because the harness seams every spawned
+   shim away from it.
+7. Default derivation unchanged: with the env var unset/empty the module-level state
+   path resolves to the ``__file__``-derived location (and to the seam value when set),
+   probed via an out-of-process ``python -c`` import of the two module constants so no
+   unseamed production shim is ever spawned against the live file.
+
+The v1.3.2 fix cycle closes the residual in-process pollution path (2026-07-21 incident):
+``e665fbe`` seamed spawned shims and the in-process unit tests here, but
+``controlled_asgi_probe`` loads a fresh production module *in the test-runner process*
+and drives the real request path, so its chatgpt-lane 2xx wrote the install-shared file
+because ``DAAF_QUOTA_STATE_FILE`` was unset in the runner. A runner-level
+``os.environ.setdefault`` in the loopback harness now seams every in-process load:
+
+8. In-process non-pollution: running tonight's exact polluter case through
+   ``controlled_asgi_probe`` under a PER-TEST ``DAAF_QUOTA_STATE_FILE`` seam leaves the
+   install-shared ``quota_state.json`` byte- and mtime-identical, AND lands the probe's
+   snapshot at the per-test seam path (proving the write genuinely fired — non-vacuous).
+   The per-test value carries into the freshly loaded module's import-time state-path
+   constant exactly as the runner-level default does. Both non-pollution guards (6 and 8)
+   wrap their production-file check in a retry-once bracket: a bursty live write from the
+   neighbor container on the shared /daaf mount passes on the retry, while deterministic
+   suite pollution dirties both brackets and still fails.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import os
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+import httpx
+
+from ._loopback_harness import (
+    PRODUCTION_SHIM,
+    MockResponsesServer,
+    RealShim,
+    _purge_in_process_reasoning_cache_seam,
+    controlled_asgi_probe,
+    full_response_scenario,
+    lifecycle_for_response,
+    parse_typed_sse,
+)
+
+
+def _load_shim_module():
+    """Import a fresh instance of the production shim in-process (no subprocess)."""
+    module_name = f"provider_shim_quota_state_probe_{uuid.uuid4().hex}"
+    # v1.3.3 (A2-R5): clear the runner-default reasoning-cache seam before this fresh
+    # in-process load so its import-time restore starts cold — otherwise an entry a prior
+    # in-process load persisted to the shared runner-default seam would leak into this
+    # module's cache. These quota-state tests make no reasoning-cache assertions, so the
+    # leak is harmless today, but keeping every in-process loader cold makes the invariant
+    # uniform and future-proof (see the hazard note atop _loopback_harness.py, and the
+    # matching purge in test_v130_auth_delegation.py:63).
+    _purge_in_process_reasoning_cache_seam()
+    spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
+    if spec is None or spec.loader is None:
+        raise RuntimeError("could not load production shim for quota-state probe")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+# Synthetic subscription-quota header surface modeled on the live chatgpt-lane
+# capture. Secondary-window headers are intentionally omitted so the
+# "absent header -> field renders as -" contract is exercised end to end.
+QUOTA_HEADERS = {
+    "x-codex-plan-type": "pro",
+    "x-codex-active-limit": "premium",
+    "x-codex-primary-used-percent": "73",
+    "x-codex-primary-window-minutes": "10080",
+    "x-codex-primary-reset-after-seconds": "402168",
+    "x-codex-credits-has-credits": "False",
+    "x-codex-credits-balance": "0",
+    "x-codex-credits-unlimited": "False",
+}
+
+_ALL_SNAPSHOT_FIELDS = (
+    "plan_type",
+    "active_limit",
+    "primary_used_pct",
+    "primary_window_min",
+    "primary_reset_s",
+    "secondary_used_pct",
+    "secondary_window_min",
+    "secondary_reset_s",
+    "credits_has",
+    "credits_balance",
+    "credits_unlimited",
+)
+
+
+class _FakeResponse:
+    """Minimal stand-in for the httpx response _record_upstream_headers reads."""
+
+    def __init__(self, status_code, headers=None, http_version="HTTP/1.1"):
+        self.status_code = status_code
+        self.headers = httpx.Headers(headers or {})
+        self.http_version = http_version
+
+
+class ProviderShimV131QuotaStateTests(unittest.TestCase):
+    maxDiff = 12000
+
+    def setUp(self) -> None:
+        self.module = _load_shim_module()
+        # Redirect the install-shared state file into a per-test tmp directory so the
+        # real scripts/provider_shim/logs/ directory is never written during tests.
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        self.state_dir = Path(self._tmp.name)
+        self.state_path = self.state_dir / "quota_state.json"
+        self.module._QUOTA_STATE_DIR = str(self.state_dir)
+        self.module._QUOTA_STATE_PATH = str(self.state_path)
+
+    def _drive_record(self, mode, response) -> None:
+        # Exercise the real call site (_record_upstream_headers) with a live request
+        # state, exactly as the request path would, under the chosen backend lane.
+        self.module.SHIM_BACKEND_MODE = mode
+        state = self.module._RequestLifecycleState()
+        token = self.module._REQUEST_STATE.set(state)
+        try:
+            self.module._record_upstream_headers(response)
+        finally:
+            self.module._REQUEST_STATE.reset(token)
+
+    def _tmp_siblings(self):
+        return sorted(p.name for p in self.state_dir.glob("quota_state.*.tmp"))
+
+    def test_chatgpt_2xx_writes_state_file_with_expected_fields(self) -> None:
+        before = int(time.time())
+        self._drive_record("chatgpt", _FakeResponse(200, QUOTA_HEADERS))
+        after = int(time.time())
+
+        self.assertTrue(self.state_path.exists(), "state file was not written")
+        payload = json.loads(self.state_path.read_text(encoding="utf-8"))
+
+        # captured_at is an int recorded at write time, within the test's wall clock.
+        self.assertIsInstance(payload["captured_at"], int)
+        self.assertGreaterEqual(payload["captured_at"], before)
+        self.assertLessEqual(payload["captured_at"], after)
+
+        # Every one of the 11 snapshot fields is present.
+        for field in _ALL_SNAPSHOT_FIELDS:
+            self.assertIn(field, payload)
+
+        # Present headers pass through as their raw string values.
+        self.assertEqual(payload["plan_type"], "pro")
+        self.assertEqual(payload["active_limit"], "premium")
+        self.assertEqual(payload["primary_used_pct"], "73")
+        self.assertEqual(payload["primary_window_min"], "10080")
+        self.assertEqual(payload["primary_reset_s"], "402168")
+        self.assertEqual(payload["credits_has"], "False")
+        self.assertEqual(payload["credits_balance"], "0")
+        self.assertEqual(payload["credits_unlimited"], "False")
+
+        # Absent secondary-window headers render as "-".
+        self.assertEqual(payload["secondary_used_pct"], "-")
+        self.assertEqual(payload["secondary_window_min"], "-")
+        self.assertEqual(payload["secondary_reset_s"], "-")
+
+        # Locks the telemetry-hygiene contract (0600) against a future refactor
+        # to the write call that silently loses the mkstemp-inherited mode.
+        self.assertEqual(stat.S_IMODE(os.stat(self.state_path).st_mode), 0o600)
+
+        # No temp sibling is left behind after a successful atomic publish.
+        self.assertEqual(self._tmp_siblings(), [])
+
+    def test_openai_lane_writes_no_state_file(self) -> None:
+        self._drive_record("openai", _FakeResponse(200, QUOTA_HEADERS))
+        self.assertFalse(self.state_path.exists())
+        self.assertEqual(self._tmp_siblings(), [])
+
+    def test_chatgpt_non_2xx_writes_no_state_file(self) -> None:
+        self._drive_record("chatgpt", _FakeResponse(429, QUOTA_HEADERS))
+        self.assertFalse(self.state_path.exists())
+        self.assertEqual(self._tmp_siblings(), [])
+
+    def test_second_2xx_overwrites_and_leaves_no_temp_sibling(self) -> None:
+        self._drive_record("chatgpt", _FakeResponse(200, QUOTA_HEADERS))
+        first = json.loads(self.state_path.read_text(encoding="utf-8"))
+        self.assertEqual(first["primary_used_pct"], "73")
+
+        second_headers = dict(QUOTA_HEADERS)
+        second_headers["x-codex-primary-used-percent"] = "88"
+        second_headers["x-codex-secondary-used-percent"] = "5"
+        second_headers["x-codex-secondary-window-minutes"] = "300"
+        second_headers["x-codex-secondary-reset-after-seconds"] = "600"
+        self._drive_record("chatgpt", _FakeResponse(200, second_headers))
+
+        replaced = json.loads(self.state_path.read_text(encoding="utf-8"))
+        self.assertEqual(replaced["primary_used_pct"], "88")
+        self.assertEqual(replaced["secondary_used_pct"], "5")
+        self.assertEqual(replaced["secondary_window_min"], "300")
+        self.assertGreaterEqual(replaced["captured_at"], first["captured_at"])
+
+        # Overwrite still leaves no stale temp sibling.
+        self.assertEqual(self._tmp_siblings(), [])
+
+    def test_write_failure_on_unwritable_dir_is_swallowed(self) -> None:
+        # Point the state dir at a path that is a FILE, not a directory, so mkstemp
+        # raises NotADirectoryError. The response path must be unaffected: no
+        # exception escapes and no file is created.
+        not_a_dir = self.state_dir / "regular_file"
+        not_a_dir.write_text("x", encoding="utf-8")
+        self.module._QUOTA_STATE_DIR = str(not_a_dir / "logs")
+        self.module._QUOTA_STATE_PATH = str(not_a_dir / "logs" / "quota_state.json")
+
+        # Must not raise.
+        self._drive_record("chatgpt", _FakeResponse(200, QUOTA_HEADERS))
+        self.assertFalse((not_a_dir / "logs" / "quota_state.json").exists())
+
+    def test_os_replace_raising_is_swallowed_and_leaves_no_temp(self) -> None:
+        # Directly exercise the helper with os.replace monkeypatched to raise: the
+        # write must be swallowed and the uniquely-named temp sibling cleaned up.
+        original_replace = os.replace
+
+        def _raising_replace(src, dst):  # noqa: ANN001
+            raise RuntimeError("synthetic replace failure")
+
+        os.replace = _raising_replace
+        try:
+            # Must not raise.
+            self.module._write_quota_state({field: "-" for field in _ALL_SNAPSHOT_FIELDS})
+        finally:
+            os.replace = original_replace
+
+        self.assertFalse(self.state_path.exists())
+        self.assertEqual(self._tmp_siblings(), [])
+
+
+# The install-shared quota-state file the shim writes when NOT seamed. The v1.3.2
+# regression proves a seamed spawned shim never touches this path.
+_INSTALL_SHARED_STATE = PRODUCTION_SHIM.parent / "logs" / "quota_state.json"
+
+
+def _stat_snapshot(path: Path):
+    """Return (st_mtime_ns, raw bytes) for path, or None if it does not exist."""
+    try:
+        return (path.stat().st_mtime_ns, path.read_bytes())
+    except FileNotFoundError:
+        return None
+
+
+# Out-of-process probe: import the production shim by file and print the two module-
+# level state-path constants as JSON. Run under a controlled env so DAAF_QUOTA_STATE_FILE
+# is either explicitly absent or explicitly set. Importing the module only evaluates the
+# constant/def bodies (it never calls _write_quota_state), so this probe touches no state
+# file — the reason it is used instead of spawning an unseamed production shim.
+_PATH_PROBE = (
+    "import importlib.util, json, sys\n"
+    "spec = importlib.util.spec_from_file_location('shim_path_probe', sys.argv[1])\n"
+    "m = importlib.util.module_from_spec(spec)\n"
+    "spec.loader.exec_module(m)\n"
+    "print(json.dumps({'dir': m._QUOTA_STATE_DIR, 'path': m._QUOTA_STATE_PATH}))\n"
+)
+
+
+class ProviderShimV132QuotaStateSeamTests(unittest.TestCase):
+    """v1.3.2 DAAF_QUOTA_STATE_FILE redirect-seam contracts (spawned production shim)."""
+
+    maxDiff = 12000
+
+    def _run_path_probe(self, extra_env):
+        env = {k: v for k, v in os.environ.items() if k != "DAAF_QUOTA_STATE_FILE"}
+        env.update(extra_env)
+        completed = subprocess.run(
+            [sys.executable, "-c", _PATH_PROBE, str(PRODUCTION_SHIM)],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+        return json.loads(completed.stdout.strip())
+
+    def test_spawned_chatgpt_shim_writes_snapshot_to_seam_path(self) -> None:
+        scenario = full_response_scenario()
+        scenario.stream_headers = dict(QUOTA_HEADERS)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                parse_typed_sse(result.body)
+                # Drain the lifecycle log; the state write fires on upstream headers,
+                # so it has certainly landed by the time the full body is parsed.
+                lifecycle_for_response(shim, result)
+
+                # The harness seams the write into this instance's scratch dir.
+                seam_path = Path(shim.child_env["DAAF_QUOTA_STATE_FILE"])
+                self.assertEqual(seam_path, shim.scratch_dir / "quota_state.json")
+                self.assertTrue(
+                    seam_path.exists(), "snapshot did not land at the seam path"
+                )
+
+                payload = json.loads(seam_path.read_text(encoding="utf-8"))
+                self.assertIsInstance(payload["captured_at"], int)
+                for field in _ALL_SNAPSHOT_FIELDS:
+                    self.assertIn(field, payload)
+                self.assertEqual(payload["primary_used_pct"], "73")
+                self.assertEqual(payload["primary_window_min"], "10080")
+                # Absent secondary headers pass through as "-".
+                self.assertEqual(payload["secondary_used_pct"], "-")
+
+                # Same telemetry-hygiene contract as the in-process write: 0600.
+                self.assertEqual(
+                    stat.S_IMODE(os.stat(seam_path).st_mode), 0o600
+                )
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    def test_spawned_chatgpt_shim_does_not_touch_install_shared_file(self) -> None:
+        # The regression that matters: a full spawned chatgpt-lane exchange must leave the
+        # install-shared state file byte- and mtime-identical (or still-absent).
+        #
+        # Retry-once bracket: both containers on the shared /daaf mount run live shims that
+        # legitimately write this production file, so a bursty neighbor write landing inside
+        # a single before/after window would false-fail the strict equality. We take up to
+        # two independent brackets and pass on the first clean one. A bursty external live
+        # write passes on the retry; genuine suite pollution writes deterministically on
+        # every run (as the original 2026-07-21 defect did) and so dirties BOTH brackets,
+        # still failing. Zero risk on CI (single checkout, no neighbor); this only tolerates
+        # the real dev-time flake window.
+        dirty = True
+        for _attempt in range(2):
+            before = _stat_snapshot(_INSTALL_SHARED_STATE)
+            scenario = full_response_scenario()
+            scenario.stream_headers = dict(QUOTA_HEADERS)
+            with MockResponsesServer(scenario) as backend:
+                with RealShim(backend, "chatgpt") as shim:
+                    result = shim.post_messages(stream=True)
+                    self.assertEqual(result.status, 200, result.text)
+                    parse_typed_sse(result.body)
+                    lifecycle_for_response(shim, result)
+                    # Confirm the shim really did write a snapshot (to its seam), so this
+                    # test cannot pass vacuously by the write never happening at all.
+                    seam_path = Path(shim.child_env["DAAF_QUOTA_STATE_FILE"])
+                    self.assertTrue(seam_path.exists())
+                    shim.assert_offline_contract()
+            after = _stat_snapshot(_INSTALL_SHARED_STATE)
+            if before == after:
+                dirty = False
+                break
+        self.assertFalse(
+            dirty,
+            "spawned shim polluted the install-shared quota_state.json",
+        )
+
+    def test_in_process_asgi_probe_does_not_touch_install_shared_file(self) -> None:
+        # Locks the v1.3.2 fix-cycle contract: an in-process load of the production shim
+        # in the test-runner process must not write the install-shared quota_state.json.
+        #
+        # 2026-07-21 in-process pollution incident: e665fbe seamed spawned shims (child
+        # env) and the in-process unit tests here (setUp constant patching), but missed a
+        # third context — controlled_asgi_probe loads a FRESH production module in-process
+        # and drives the real request path, so a chatgpt-lane case reaching a mocked 200
+        # ran the real _record_upstream_headers -> _write_quota_state. With
+        # DAAF_QUOTA_STATE_FILE unset in the runner process, that module resolved
+        # _QUOTA_STATE_PATH to the live install-shared file and rewrote it (all-dash
+        # snapshot) on every run. The fix is a runner-level os.environ.setdefault in the
+        # loopback harness; this test runs the exact polluter case and asserts the
+        # production file is untouched.
+        #
+        # Non-vacuity via a PER-TEST seam: we override DAAF_QUOTA_STATE_FILE to a per-test
+        # tmp path around the probe call. The probe loads a fresh shim inside its own
+        # mock.patch.dict(os.environ, ..., clear=False), so this per-test value carries
+        # into the module's import-time _QUOTA_STATE_PATH constant — the exact mechanism
+        # the runner-level default uses. We then assert the per-test seam file WAS created
+        # with the expected snapshot shape, proving the probe genuinely drove a quota write
+        # (so the "production untouched" assertion cannot pass merely because no write ever
+        # happened). Retry-once bracket on the SHARED production file: a bursty live write
+        # from the neighbor container on /daaf could false-fail a single before/after
+        # window, so we take up to two independent brackets and pass on the first clean one;
+        # deterministic suite pollution (the original defect) dirties both and still fails.
+        seam_tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(seam_tmp.cleanup)
+        seam_path = Path(seam_tmp.name) / "quota_state.json"
+
+        dirty = True
+        for _attempt in range(2):
+            before = _stat_snapshot(_INSTALL_SHARED_STATE)
+            # tonight's exact deterministic polluter: chatgpt-lane (lazy_401_refresh), a 401
+            # then a mocked 200, with a local cleanup failure on attempt 1. The per-test
+            # seam redirects its _write_quota_state to seam_path instead of production.
+            with mock.patch.dict(
+                os.environ, {"DAAF_QUOTA_STATE_FILE": str(seam_path)}
+            ):
+                controlled_asgi_probe(
+                    attempt_outcomes=[401, 200],
+                    close_fail_attempts={1},
+                    lazy_401_refresh=True,
+                )
+            after = _stat_snapshot(_INSTALL_SHARED_STATE)
+            if before == after:
+                dirty = False
+                break
+        self.assertFalse(
+            dirty,
+            "in-process ASGI probe polluted the install-shared quota_state.json",
+        )
+
+        # Non-vacuity: the probe genuinely reached _write_quota_state, landing a snapshot
+        # at the per-test seam (proves the "production untouched" result is not vacuous).
+        self.assertTrue(
+            seam_path.exists(),
+            "probe did not drive a quota write to the per-test seam",
+        )
+        payload = json.loads(seam_path.read_text(encoding="utf-8"))
+        self.assertIsInstance(payload["captured_at"], int)
+        for field in _ALL_SNAPSHOT_FIELDS:
+            self.assertIn(field, payload)
+
+    def test_default_path_derivation_is_file_relative_without_seam(self) -> None:
+        # Unset/empty seam -> the __file__-derived default, byte-identical to prior
+        # behavior. Probed out-of-process so no unseamed shim runs against the live file.
+        expected_dir = PRODUCTION_SHIM.parent / "logs"
+        for extra_env in ({}, {"DAAF_QUOTA_STATE_FILE": ""}):
+            with self.subTest(extra_env=extra_env):
+                got = self._run_path_probe(extra_env)
+                self.assertEqual(got["dir"], str(expected_dir))
+                self.assertEqual(
+                    got["path"], str(expected_dir / "quota_state.json")
+                )
+
+    def test_seam_env_redirects_module_state_path(self) -> None:
+        # Set + non-empty seam -> the module constants resolve to the seam path and its
+        # dirname (the other direction of the same probe).
+        with tempfile.TemporaryDirectory() as tmp:
+            seam = str(Path(tmp) / "redirected_quota.json")
+            got = self._run_path_probe({"DAAF_QUOTA_STATE_FILE": seam})
+            self.assertEqual(got["path"], seam)
+            self.assertEqual(got["dir"], str(Path(tmp)))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v133_reasoning_cache_persistence.py b/tests/provider_shim/test_v133_reasoning_cache_persistence.py
new file mode 100644
index 00000000..8e0448e6
--- /dev/null
+++ b/tests/provider_shim/test_v133_reasoning_cache_persistence.py
@@ -0,0 +1,635 @@
+"""Deterministic contracts for the v1.3.3 reasoning-cache persistence layer (A2).
+
+The in-memory ``_REASONING_CACHE`` (an LRU ``OrderedDict`` keyed by ``call_id`` ->
+reasoning item WITH its opaque ``encrypted_content`` blob) is module-global and, before
+v1.3.3, was lost on every restart — a restart mid-session then replayed the tool history
+WITHOUT its reasoning items (graceful misses, but degraded model context for the rest of
+a long tool loop). v1.3.3 persists a bounded newest-first snapshot on each cache mutation
+and restores it at module import, so reasoning continuity survives a restart.
+
+Precedent: the write path mirrors ``_write_quota_state`` exactly (atomic mkstemp +
+os.replace, 0600, whole-body fail-open) and the ``DAAF_REASONING_CACHE_FILE`` seam mirrors
+``DAAF_QUOTA_STATE_FILE`` (resolved at module import). The one NEW hazard restore
+introduces over quota_state (which is write-only) is that a seam file written by one
+in-process shim load would be RESTORED into a later fresh in-process load — the harness
+neutralizes this by unlinking the runner-default seam before each in-process fresh load
+(``_purge_in_process_reasoning_cache_seam``) and by giving each spawned RealShim its own
+per-instance scratch seam. Tests here that load the module in-process always pin a UNIQUE
+per-test seam so their import-time restore is hermetic.
+
+Design note (A2-R4, amended): the production default path is HOME-derived
+(``$HOME/.claude/provider_shim/reasoning_cache.json``) — deliberately OUTSIDE the /daaf
+repo tree, on the per-container claude-config volume — because reasoning blobs are
+relatively private and must not sit in a shareable/committable directory. quota_state.json
+(scrubbed operational telemetry) stays in the repo's logs/ dir; only the content-bearing
+artifact moves.
+
+Tests (design § 6):
+
+1. Spawned shim writes the seam file after a reasoning+tool response: exists, 0600, shape
+   valid, entries ordered.
+2. Restart-restore end-to-end (the money test): RealShim #1 completes a reasoning+tool
+   turn -> shutdown; RealShim #2 pointed at the SAME seam file -> turn-2 replay -> the
+   reasoning item is injected immediately before its function_call, terminal
+   reasoning_cache_miss=0.
+3. Missing/corrupt file -> clean start, miss=1, no raise (fail-open).
+4. Stale file (captured_at older than the 30-day sanity ceiling) -> not restored.
+5. Restore preserves LRU order; restored entries evict in correct order.
+6. Entry-count and byte bounds keep the NEWEST entries.
+7. Non-pollution guards for the production HOME default path (spawned + in-process
+   variants, retry-once bracket + non-vacuity, mirroring test_v131_quota_state.py).
+8. LRU eviction/cap unit test for the in-memory cache (pre-existing coverage gap).
+9. Out-of-process path-derivation probe: seam wins; default derives from HOME.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import json
+import os
+import site
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from ._loopback_harness import (
+    PRODUCTION_SHIM,
+    READ_TOOL,
+    MockResponsesServer,
+    RealShim,
+    _nonstream_response,
+    controlled_asgi_probe,
+    full_response_scenario,
+    lifecycle_for_response,
+    parse_typed_sse,
+)
+
+
+def _load_shim_module(seam_path: Path):
+    """Import a fresh production shim in-process, pinning DAAF_REASONING_CACHE_FILE to
+    ``seam_path`` for the duration of the load so the module's import-time restore reads
+    exactly that file (or nothing, if absent) — never a leaked runner-default seam."""
+    module_name = f"provider_shim_reasoning_probe_{uuid.uuid4().hex}"
+    with mock.patch.dict(
+        os.environ, {"DAAF_REASONING_CACHE_FILE": str(seam_path)}
+    ):
+        spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
+        if spec is None or spec.loader is None:
+            raise RuntimeError("could not load production shim for reasoning-cache probe")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+    return module
+
+
+def _reasoning(item_id: str) -> dict[str, object]:
+    """A minimal, well-shaped reasoning item carrying an opaque encrypted_content blob."""
+    return {
+        "type": "reasoning",
+        "id": item_id,
+        "status": "completed",
+        "summary": [],
+        "encrypted_content": f"ENC_{item_id}",
+    }
+
+
+def _seam_payload(pairs, captured_at=None) -> dict[str, object]:
+    """Build a persisted-file payload from (call_id, item) pairs in oldest->newest order."""
+    return {
+        "captured_at": int(time.time()) if captured_at is None else int(captured_at),
+        "entries": [[cid, item] for cid, item in pairs],
+    }
+
+
+def _tool_use_replay_messages(call_id: str):
+    """A two-message turn whose assistant tool_use references ``call_id`` (so the shim's
+    re-injection path looks the reasoning item up in the restored cache) followed by its
+    user tool_result."""
+    return [
+        {
+            "role": "assistant",
+            "content": [
+                {
+                    "type": "tool_use",
+                    "id": call_id,
+                    "name": "Read",
+                    "input": {"file_path": "/daaf/README.md"},
+                }
+            ],
+        },
+        {
+            "role": "user",
+            "content": [
+                {
+                    "type": "tool_result",
+                    "tool_use_id": call_id,
+                    "content": "replay result",
+                }
+            ],
+        },
+    ]
+
+
+class ReasoningCacheWriteAndRestoreTests(unittest.TestCase):
+    """Tests 1-6, 8: write shape, restart-restore, fail-open, staleness, bounds, LRU."""
+
+    maxDiff = 12000
+
+    def _fresh_module(self, *, existing_payload=None):
+        """Load a fresh in-process shim against a unique per-test seam. If
+        ``existing_payload`` is given it is written to the seam BEFORE the load so the
+        module restores it at import; otherwise the seam is absent and the module starts
+        cold. Returns (module, seam_path)."""
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        seam_path = Path(tmp.name) / "reasoning_cache.json"
+        if existing_payload is not None:
+            seam_path.write_text(
+                json.dumps(existing_payload), encoding="utf-8"
+            )
+        return _load_shim_module(seam_path), seam_path
+
+    # --- Test 1: spawned shim writes the seam file after a reasoning+tool response ---
+    def test_spawned_shim_writes_seam_file_after_reasoning_tool_response(self) -> None:
+        scenario = full_response_scenario()
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "openai") as shim:
+                # __enter__ seams DAAF_REASONING_CACHE_FILE to this instance's scratch dir.
+                seam_path = Path(shim.child_env["DAAF_REASONING_CACHE_FILE"])
+                self.assertEqual(seam_path, shim.scratch_dir / "reasoning_cache.json")
+
+                result = shim.post_messages(stream=False, tools=[READ_TOOL])
+                self.assertEqual(result.status, 200, result.text)
+                # The write fires synchronously inside the non-stream translation, so it
+                # has certainly landed by the time the 200 body is in hand; drain the
+                # lifecycle log for good measure.
+                lifecycle_for_response(shim, result)
+
+                self.assertTrue(
+                    seam_path.exists(), "reasoning cache was not persisted to the seam"
+                )
+                # Same telemetry-hygiene contract as quota_state: 0600.
+                self.assertEqual(
+                    stat.S_IMODE(os.stat(seam_path).st_mode), 0o600
+                )
+                payload = json.loads(seam_path.read_text(encoding="utf-8"))
+                self.assertIsInstance(payload["captured_at"], int)
+                entries = payload["entries"]
+                self.assertIsInstance(entries, list)
+                self.assertGreaterEqual(len(entries), 1)
+                # The fixture pairs reasoning rs_full with function_call call_full_fixture.
+                by_call = {cid: item for cid, item in entries}
+                self.assertIn("call_full_fixture", by_call)
+                self.assertEqual(
+                    by_call["call_full_fixture"]["encrypted_content"], "ENC_rs_full"
+                )
+                self.assertEqual(by_call["call_full_fixture"]["type"], "reasoning")
+                # No temp sibling left behind after the atomic publish.
+                siblings = sorted(seam_path.parent.glob("reasoning_cache.*.tmp"))
+                self.assertEqual(siblings, [])
+
+    # --- Test 2: restart-restore end-to-end (the money test) ---
+    def test_restart_restore_end_to_end_replays_reasoning(self) -> None:
+        # A shared seam OUTSIDE either RealShim's scratch dir so it survives shim #1's
+        # __exit__ (which rmtrees only that instance's scratch).
+        shared_tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(shared_tmp.cleanup)
+        shared_seam = Path(shared_tmp.name) / "reasoning_cache.json"
+
+        # Turn 1: shim #1 completes a reasoning+tool turn -> persists to the shared seam.
+        scenario1 = full_response_scenario()
+        with MockResponsesServer(scenario1) as backend1:
+            with RealShim(
+                backend1,
+                "openai",
+                env_overrides={"DAAF_REASONING_CACHE_FILE": str(shared_seam)},
+            ) as shim1:
+                first = shim1.post_messages(stream=False, tools=[READ_TOOL])
+                self.assertEqual(first.status, 200, first.text)
+                first_content = first.json()["content"]
+                lifecycle_for_response(shim1, first)
+        # shim #1 is now shut down; the persisted snapshot must survive.
+        self.assertTrue(
+            shared_seam.exists(), "shim #1 did not persist a snapshot to the shared seam"
+        )
+
+        # Turn 2: shim #2 (fresh process, SAME seam) restores at import and replays.
+        scenario2 = full_response_scenario()
+        scenario2.nonstream_responses = [
+            _nonstream_response("resp_replay_followup", [])
+        ]
+        with MockResponsesServer(scenario2) as backend2:
+            with RealShim(
+                backend2,
+                "openai",
+                env_overrides={"DAAF_REASONING_CACHE_FILE": str(shared_seam)},
+            ) as shim2:
+                # /health reports the restore (counts only).
+                health = shim2.get_health().json()
+                self.assertIn("reasoning_cache", health)
+                self.assertGreaterEqual(health["reasoning_cache"]["restored"], 1)
+                self.assertGreaterEqual(health["reasoning_cache"]["entries"], 1)
+
+                replay = shim2.post_messages(
+                    stream=False,
+                    tools=[READ_TOOL],
+                    messages=[
+                        {"role": "assistant", "content": first_content},
+                        {
+                            "role": "user",
+                            "content": [
+                                {
+                                    "type": "tool_result",
+                                    "tool_use_id": "call_full_fixture",
+                                    "content": "paired result",
+                                }
+                            ],
+                        },
+                    ],
+                )
+                self.assertEqual(replay.status, 200, replay.text)
+
+                # The outgoing backend request must carry the restored reasoning item
+                # immediately BEFORE its function_call (the pinned before-call ordering).
+                replay_request = backend2.responses_requests[-1].body
+                replay_input = replay_request["input"]
+                function_at = next(
+                    index
+                    for index, item in enumerate(replay_input)
+                    if item.get("type") == "function_call"
+                    and item.get("call_id") == "call_full_fixture"
+                )
+                self.assertGreater(function_at, 0)
+                injected = replay_input[function_at - 1]
+                self.assertEqual(injected.get("type"), "reasoning")
+                self.assertEqual(injected.get("encrypted_content"), "ENC_rs_full")
+
+                # Terminal telemetry: the restored entry produced a HIT, not a miss.
+                replay_lifecycle = lifecycle_for_response(shim2, replay)
+                terminal = next(
+                    line for line in replay_lifecycle if line.event == "terminal"
+                )
+                self.assertEqual(terminal.fields["reasoning_cache_miss"], "0")
+
+    # --- Test 3: missing / corrupt file -> clean start, miss=1, no raise ---
+    def test_missing_file_starts_cold(self) -> None:
+        module, seam_path = self._fresh_module()  # seam absent
+        self.assertFalse(seam_path.exists())
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 0)
+        self.assertEqual(len(module._REASONING_CACHE), 0)
+
+    def test_corrupt_file_starts_cold_without_raising(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        seam_path = Path(tmp.name) / "reasoning_cache.json"
+        seam_path.write_text("{ this is not valid json ]", encoding="utf-8")
+        # Must not raise on import; restore silently yields nothing.
+        module = _load_shim_module(seam_path)
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 0)
+        self.assertEqual(len(module._REASONING_CACHE), 0)
+
+    def test_uncached_replay_counts_a_miss_with_corrupt_file(self) -> None:
+        # End-to-end fail-open: a spawned shim pointed at a corrupt seam starts cold, and a
+        # replay referencing an uncached call_id degrades gracefully (miss=1, 200, no raise).
+        corrupt_tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(corrupt_tmp.cleanup)
+        corrupt_seam = Path(corrupt_tmp.name) / "reasoning_cache.json"
+        corrupt_seam.write_text("<<not json>>", encoding="utf-8")
+
+        scenario = full_response_scenario()
+        scenario.nonstream_responses = [
+            _nonstream_response("resp_uncached_followup", [])
+        ]
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(
+                backend,
+                "openai",
+                env_overrides={"DAAF_REASONING_CACHE_FILE": str(corrupt_seam)},
+            ) as shim:
+                health = shim.get_health().json()
+                self.assertEqual(health["reasoning_cache"]["restored"], 0)
+
+                result = shim.post_messages(
+                    stream=False,
+                    tools=[READ_TOOL],
+                    messages=_tool_use_replay_messages("call_never_cached"),
+                )
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle = lifecycle_for_response(shim, result)
+                terminal = next(
+                    line for line in lifecycle if line.event == "terminal"
+                )
+                self.assertEqual(terminal.fields["reasoning_cache_miss"], "1")
+
+    # --- Test 4: stale file -> not restored ---
+    def test_stale_file_is_not_restored(self) -> None:
+        # captured_at older than the 30-day sanity ceiling.
+        stale_captured_at = int(time.time()) - (2_592_000 + 100_000)
+        payload = _seam_payload(
+            [("call_stale", _reasoning("rs_stale"))], captured_at=stale_captured_at
+        )
+        module, _ = self._fresh_module(existing_payload=payload)
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 0)
+        self.assertEqual(len(module._REASONING_CACHE), 0)
+
+    def test_future_timestamp_is_not_restored(self) -> None:
+        # A captured_at in the future (clock skew / tampering) is rejected too.
+        future_captured_at = int(time.time()) + 100_000
+        payload = _seam_payload(
+            [("call_future", _reasoning("rs_future"))], captured_at=future_captured_at
+        )
+        module, _ = self._fresh_module(existing_payload=payload)
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 0)
+        self.assertEqual(len(module._REASONING_CACHE), 0)
+
+    # --- Test 5: restore preserves LRU order; restored entries evict in correct order ---
+    def test_restore_preserves_lru_order_and_eviction(self) -> None:
+        pairs = [(f"call_{i}", _reasoning(f"rs_{i}")) for i in range(3)]
+        module, _ = self._fresh_module(existing_payload=_seam_payload(pairs))
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 3)
+        # File order is oldest->newest, so the cache keys land in that exact order.
+        self.assertEqual(
+            list(module._REASONING_CACHE.keys()),
+            ["call_0", "call_1", "call_2"],
+        )
+        # Lower the cap and add one more: the genuinely-oldest (call_0) must evict first,
+        # proving restore reconstructed the LRU order (not an arbitrary dict order).
+        module._REASONING_CACHE_CAP = 3
+        module._cache_reasoning("call_3", _reasoning("rs_3"))
+        self.assertEqual(
+            list(module._REASONING_CACHE.keys()),
+            ["call_1", "call_2", "call_3"],
+        )
+
+    # --- Test 6: entry-count and byte bounds keep the newest entries ---
+    def test_entry_count_bound_keeps_newest(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        seam_path = Path(tmp.name) / "reasoning_cache.json"
+        module = _load_shim_module(seam_path)  # cold start
+        total = module._REASONING_PERSIST_MAX_ENTRIES + 44  # cap-symbolic: MAX_ENTRIES + 44
+        for i in range(total):
+            module._cache_reasoning(f"call_{i}", _reasoning(f"rs_{i}"))
+        module._write_reasoning_cache_state()
+
+        payload = json.loads(seam_path.read_text(encoding="utf-8"))
+        entries = payload["entries"]
+        self.assertEqual(len(entries), module._REASONING_PERSIST_MAX_ENTRIES)
+        call_ids = [cid for cid, _ in entries]
+        # The retained window is the NEWEST cap entries, in oldest->newest order.
+        first_kept = total - module._REASONING_PERSIST_MAX_ENTRIES
+        self.assertEqual(call_ids[0], f"call_{first_kept}")
+        self.assertEqual(call_ids[-1], f"call_{total - 1}")
+
+    def test_byte_bound_keeps_newest(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        seam_path = Path(tmp.name) / "reasoning_cache.json"
+        module = _load_shim_module(seam_path)  # cold start
+        # Ten entries, each carrying a sizeable opaque blob.
+        blob = "X" * 400
+        for i in range(10):
+            module._cache_reasoning(
+                f"call_{i}",
+                {"type": "reasoning", "id": f"rs_{i}", "encrypted_content": blob},
+            )
+        # Shrink the byte cap so only a handful of the newest entries fit.
+        module._REASONING_PERSIST_MAX_BYTES = 1500
+        module._write_reasoning_cache_state()
+
+        payload = json.loads(seam_path.read_text(encoding="utf-8"))
+        entries = payload["entries"]
+        self.assertGreaterEqual(len(entries), 1)
+        self.assertLess(len(entries), 10)  # the byte cap really did bind
+        call_ids = [cid for cid, _ in entries]
+        # Whatever survived is a contiguous NEWEST suffix, ending at the most recent.
+        self.assertEqual(call_ids[-1], "call_9")
+        kept = len(entries)
+        expected = [f"call_{i}" for i in range(10 - kept, 10)]
+        self.assertEqual(call_ids, expected)
+        # And the serialized file is within the cap.
+        self.assertLessEqual(
+            len(seam_path.read_bytes()), module._REASONING_PERSIST_MAX_BYTES
+        )
+
+    # --- A2 review fold-in: oversized on-disk file -> restore skipped (pre-read size guard) ---
+    def test_oversized_file_is_not_restored(self) -> None:
+        # A well-formed but oversized file (> the persist byte cap) must be skipped by the
+        # pre-read size guard: WITHOUT the guard this single fat entry would restore fine;
+        # WITH it, restore is skipped, the cache stays empty, and import does not raise.
+        # The oversized blob is derived from the cap SYMBOLICALLY (cold-load precedent, same
+        # pattern as test_restored_count_clamped_to_cache_cap below) so a future cap resize
+        # keeps the test valid without an edit.
+        cold_module, _ = self._fresh_module()  # cold load only to read the persist byte cap
+        big_blob = "X" * (cold_module._REASONING_PERSIST_MAX_BYTES + 200_000)  # over the cap
+        payload = _seam_payload(
+            [(
+                "call_big",
+                {"type": "reasoning", "id": "rs_big", "encrypted_content": big_blob},
+            )]
+        )
+        module, seam_path = self._fresh_module(existing_payload=payload)
+        # Sanity: the fixture genuinely exceeds the cap (else the test would be vacuous).
+        self.assertGreater(
+            seam_path.stat().st_size, module._REASONING_PERSIST_MAX_BYTES
+        )
+        # Fail-open skip: nothing restored, cache empty, no exception raised on import.
+        self.assertEqual(module._REASONING_CACHE_RESTORED, 0)
+        self.assertEqual(len(module._REASONING_CACHE), 0)
+
+    # --- A2 review fold-in: >cap file -> /health `restored` is clamped to resident count ---
+    def test_restored_count_clamped_to_cache_cap(self) -> None:
+        # A hand-tampered file with MORE entries than the in-memory cap would, without the
+        # clamp, make restore return its raw insert count while the cache only holds
+        # _REASONING_CACHE_CAP entries — overstating /health.reasoning_cache.restored (the
+        # /health block surfaces _REASONING_CACHE_RESTORED verbatim). The clamp reports the
+        # resident count instead.
+        cold_module, _ = self._fresh_module()  # cold load only to read the cap constant
+        cap = cold_module._REASONING_CACHE_CAP
+        over = cap + 5
+        pairs = [
+            (f"call_{i}", {"type": "reasoning", "id": f"rs_{i}", "encrypted_content": "E"})
+            for i in range(over)
+        ]
+        module, _ = self._fresh_module(existing_payload=_seam_payload(pairs))
+        # Every pair inserts (returns True) but the oldest evict at the cap, so `over` entries
+        # were inserted while the cache holds exactly `cap`. The reported count is clamped to
+        # the resident size and so never exceeds the cap.
+        self.assertEqual(len(module._REASONING_CACHE), cap)
+        self.assertLessEqual(module._REASONING_CACHE_RESTORED, cap)
+        self.assertEqual(module._REASONING_CACHE_RESTORED, cap)
+
+    # --- Test 8: in-memory LRU eviction / cap unit test (pre-existing coverage gap) ---
+    def test_in_memory_lru_eviction_and_cap(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        seam_path = Path(tmp.name) / "reasoning_cache.json"
+        module = _load_shim_module(seam_path)  # cold start
+        module._REASONING_CACHE_CAP = 3
+        for i in range(5):
+            self.assertTrue(
+                module._cache_reasoning(f"call_{i}", _reasoning(f"rs_{i}"))
+            )
+        # Cap enforced; the three most-recent survive, oldest-two evicted.
+        self.assertEqual(len(module._REASONING_CACHE), 3)
+        self.assertEqual(
+            list(module._REASONING_CACHE.keys()),
+            ["call_2", "call_3", "call_4"],
+        )
+        # A refresh of an existing key moves it to most-recent (LRU touch).
+        module._cache_reasoning("call_3", _reasoning("rs_3b"))
+        self.assertEqual(
+            list(module._REASONING_CACHE.keys()),
+            ["call_2", "call_4", "call_3"],
+        )
+        # A no-op reject (empty call_id / non-dict item) returns False and mutates nothing.
+        self.assertFalse(module._cache_reasoning("", _reasoning("rs_x")))
+        self.assertFalse(module._cache_reasoning("call_z", "not-a-dict"))
+        self.assertEqual(len(module._REASONING_CACHE), 3)
+
+
+# The production HOME-default reasoning-cache file the shim would write when NOT seamed.
+# The suite must never create or modify it. "absent-stays-absent" is a valid bracket on a
+# container that runs no shim.
+_PRODUCTION_DEFAULT_CACHE = (
+    Path(os.path.expanduser("~")) / ".claude" / "provider_shim" / "reasoning_cache.json"
+)
+
+
+def _stat_snapshot(path: Path):
+    """Return (st_mtime_ns, raw bytes) for path, or None if it does not exist."""
+    try:
+        return (path.stat().st_mtime_ns, path.read_bytes())
+    except FileNotFoundError:
+        return None
+
+
+# Out-of-process probe: import the production shim by file and print the two module-level
+# reasoning-cache path constants as JSON. Importing only evaluates the constant/def bodies
+# and the import-time restore (a READ of an absent/other file) — it never calls the writer,
+# so the probe creates no reasoning-cache file. HOME is set explicitly by the caller so the
+# default derivation is pinned to a controlled directory.
+_PATH_PROBE = (
+    "import importlib.util, json, sys\n"
+    "spec = importlib.util.spec_from_file_location('shim_reasoning_path_probe', sys.argv[1])\n"
+    "m = importlib.util.module_from_spec(spec)\n"
+    "spec.loader.exec_module(m)\n"
+    "print(json.dumps({'dir': m._REASONING_CACHE_DIR, 'path': m._REASONING_CACHE_PATH}))\n"
+)
+
+
+class ReasoningCacheNonPollutionAndPathTests(unittest.TestCase):
+    """Tests 7 and 9: production HOME-default non-pollution + path derivation."""
+
+    maxDiff = 12000
+
+    def _run_path_probe(self, extra_env, home=None):
+        # Inherit the runner env (so DAAF_QUOTA_STATE_FILE stays seamed to scratch and the
+        # module imports cleanly) but strip DAAF_REASONING_CACHE_FILE so default derivation
+        # is exercised unless the caller sets it back via extra_env.
+        env = {k: v for k, v in os.environ.items() if k != "DAAF_REASONING_CACHE_FILE"}
+        if home is not None:
+            env["HOME"] = home
+        env.update(extra_env)
+        # Python derives the pip --user site-packages dir from HOME at interpreter
+        # startup, so overriding HOME above silently drops per-user-installed deps
+        # (httpx on GitHub runners) off the child's sys.path and the shim import dies
+        # before the probe prints. Pass the REAL user-site (computed under the real
+        # HOME, here in the parent) through PYTHONPATH: the shim derives its cache
+        # path from HOME, not PYTHONPATH, so the derivation assertion is unaffected.
+        env["PYTHONPATH"] = os.pathsep.join(
+            filter(None, [site.getusersitepackages(), env.get("PYTHONPATH", "")])
+        )
+        completed = subprocess.run(
+            [sys.executable, "-c", _PATH_PROBE, str(PRODUCTION_SHIM)],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+        self.assertEqual(completed.returncode, 0, completed.stderr)
+        return json.loads(completed.stdout.strip())
+
+    # --- Test 7 (spawned): a spawned reasoning+tool turn never touches the HOME default ---
+    def test_spawned_shim_does_not_touch_production_default(self) -> None:
+        dirty = True
+        for _attempt in range(2):
+            before = _stat_snapshot(_PRODUCTION_DEFAULT_CACHE)
+            scenario = full_response_scenario()
+            with MockResponsesServer(scenario) as backend:
+                with RealShim(backend, "openai") as shim:
+                    result = shim.post_messages(stream=False, tools=[READ_TOOL])
+                    self.assertEqual(result.status, 200, result.text)
+                    lifecycle_for_response(shim, result)
+                    # Non-vacuity: the shim really did persist (to its per-instance seam),
+                    # so a clean production bracket is not merely a write-that-never-happened.
+                    seam_path = Path(shim.child_env["DAAF_REASONING_CACHE_FILE"])
+                    self.assertTrue(seam_path.exists())
+            after = _stat_snapshot(_PRODUCTION_DEFAULT_CACHE)
+            if before == after:
+                dirty = False
+                break
+        self.assertFalse(
+            dirty, "spawned shim polluted the production HOME-default reasoning_cache.json"
+        )
+
+    # --- Test 7 (in-process): a fresh in-process load never touches the HOME default ---
+    def test_in_process_probe_does_not_touch_production_default(self) -> None:
+        seam_tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(seam_tmp.cleanup)
+        seam_path = Path(seam_tmp.name) / "reasoning_cache.json"
+
+        dirty = True
+        for _attempt in range(2):
+            before = _stat_snapshot(_PRODUCTION_DEFAULT_CACHE)
+            # A per-test seam carries into the freshly loaded module exactly as the runner
+            # default would; the probe drives a streaming reasoning+tool turn so the real
+            # populate -> _write_reasoning_cache_state path runs against the seam.
+            with mock.patch.dict(
+                os.environ, {"DAAF_REASONING_CACHE_FILE": str(seam_path)}
+            ):
+                controlled_asgi_probe(scenario=full_response_scenario(), stream=True)
+            after = _stat_snapshot(_PRODUCTION_DEFAULT_CACHE)
+            if before == after:
+                dirty = False
+                break
+        self.assertFalse(
+            dirty,
+            "in-process probe polluted the production HOME-default reasoning_cache.json",
+        )
+        # Non-vacuity: the probe genuinely persisted to the per-test seam.
+        self.assertTrue(
+            seam_path.exists(),
+            "in-process probe did not drive a reasoning-cache write to the per-test seam",
+        )
+        payload = json.loads(seam_path.read_text(encoding="utf-8"))
+        self.assertIsInstance(payload["captured_at"], int)
+        self.assertIn("call_full_fixture", {cid for cid, _ in payload["entries"]})
+
+    # --- Test 9: out-of-process path derivation (seam wins; default derives from HOME) ---
+    def test_seam_env_redirects_module_cache_path(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            seam = str(Path(tmp) / "redirected_reasoning.json")
+            got = self._run_path_probe({"DAAF_REASONING_CACHE_FILE": seam})
+            self.assertEqual(got["path"], seam)
+            self.assertEqual(got["dir"], str(Path(tmp)))
+
+    def test_default_path_derives_from_home_without_seam(self) -> None:
+        with tempfile.TemporaryDirectory() as home:
+            expected_dir = Path(home) / ".claude" / "provider_shim"
+            for extra_env in ({}, {"DAAF_REASONING_CACHE_FILE": ""}):
+                with self.subTest(extra_env=extra_env):
+                    got = self._run_path_probe(extra_env, home=home)
+                    self.assertEqual(got["dir"], str(expected_dir))
+                    self.assertEqual(
+                        got["path"], str(expected_dir / "reasoning_cache.json")
+                    )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v134_stale_blob_insurance.py b/tests/provider_shim/test_v134_stale_blob_insurance.py
new file mode 100644
index 00000000..1f3f4cbb
--- /dev/null
+++ b/tests/provider_shim/test_v134_stale_blob_insurance.py
@@ -0,0 +1,505 @@
+"""Deterministic contracts for the v1.3.4 stale-blob reasoning-cache insurance (V4-R1..R4).
+
+v1.3.3 made the reasoning cache persist across shim restarts. A RESTORED encrypted_content
+blob has an undocumented backend-side validity lifetime: if the backend ever rejects a
+re-injected restored blob with a 400, v1.3.3 fails the request outright (400s are never
+retried). v1.3.4 closes that hole. When a 400 (a) names reasoning material in its error
+body AND (b) the request injected >=1 restored reasoning item AND (c) the one-shot budget is
+unused, the shim strips exactly the injected restored reasoning items from the reused
+payload, evicts+persists them as proven stale, and retries once. Every non-triggering 400
+stays fail-fast, byte-identical to v1.3.3.
+
+These tests seed a restored cache by writing a persisted-snapshot seam file and loading a
+fresh in-process shim pinned to it (the module's import-time restore then populates both the
+in-memory cache and the V4-R1 restored-id set). A compact in-test driver seams the module's
+httpx client to script per-attempt outcomes ([400-reasoning, 200], etc.) and captures a
+deep copy of each outbound payload so the "second request carries no reasoning items"
+contract is directly observable. Hermeticity: every seam lives under scripts/scratch (never
+/tmp, never the production HOME default reasoning_cache.json or logs/quota_state.json), and
+each test pins a UNIQUE per-test seam via DAAF_REASONING_CACHE_FILE so import-time restore is
+isolated.
+
+Test plan (design § Test Plan items 1-7, 10):
+ 1. Strip-retry happy path (JSON loop): 2 upstream calls, second body has no reasoning item,
+    outcome=success, retry_reason=stale_reasoning_400, distinct strip log event.
+ 2. Both lane envelopes trigger: chatgpt {status,error:{...}} and openai bare {error:{...}}.
+ 3. One-shot gate: 400-reasoning then 400-reasoning -> exactly 2 attempts, then failure.
+ 4. Negative: generic 400 body + restored items injected -> no retry (fail-fast preserved).
+ 5. Negative: reasoning-naming 400 but only live-populated items -> no retry, no strip.
+ 6. Eviction: stripped call_ids absent from in-memory cache AND persisted seam; unrelated
+    restored entry untouched.
+ 7. Existing 400 pins unbroken (asserted by running the v1214 400-family modules).
+10. Hit-path non-mutation: a hit-only request does not advance the cache file.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import copy
+import importlib.util
+import io
+import json
+import logging
+import os
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from ._loopback_harness import (
+    FAKE_OPENAI_KEY,
+    PRODUCTION_SHIM,
+    SCRATCH_ROOT,
+    full_response_scenario,
+    parse_lifecycle_logs,
+)
+
+
+# --- Local fixtures (self-contained copies of the v133 helper patterns) ---
+
+def _reasoning(item_id: str) -> dict[str, object]:
+    """A minimal, well-shaped reasoning item carrying an opaque encrypted_content blob."""
+    return {
+        "type": "reasoning",
+        "id": item_id,
+        "status": "completed",
+        "summary": [],
+        "encrypted_content": f"ENC_{item_id}",
+    }
+
+
+def _seam_payload(pairs, captured_at=None) -> dict[str, object]:
+    """Build a persisted-file payload from (call_id, item) pairs in oldest->newest order."""
+    return {
+        "captured_at": int(time.time()) if captured_at is None else int(captured_at),
+        "entries": [[cid, item] for cid, item in pairs],
+    }
+
+
+def _tool_use_replay_messages(call_ids):
+    """One assistant message replaying tool_use for each call_id (so the shim's re-injection
+    path looks each reasoning item up in the restored cache), followed by matching user
+    tool_results. A single call_id may be passed as a string."""
+    if isinstance(call_ids, str):
+        call_ids = [call_ids]
+    tool_uses = [
+        {
+            "type": "tool_use",
+            "id": cid,
+            "name": "Read",
+            "input": {"file_path": f"/daaf/README_{cid}.md"},
+        }
+        for cid in call_ids
+    ]
+    tool_results = [
+        {"type": "tool_result", "tool_use_id": cid, "content": "replay result"}
+        for cid in call_ids
+    ]
+    return [
+        {"role": "assistant", "content": tool_uses},
+        {"role": "user", "content": tool_results},
+    ]
+
+
+# A text-only Responses object: NO reasoning/function_call, so a 200 success carrying it
+# never repopulates the reasoning cache (keeps hit-non-mutation / eviction assertions clean).
+_TEXT_SUCCESS = {
+    "id": "resp_text_success",
+    "model": "gpt-fixture",
+    "status": "completed",
+    "output": [
+        {
+            "type": "message",
+            "id": "msg_text_success",
+            "role": "assistant",
+            "status": "completed",
+            "content": [{"type": "output_text", "text": "ok"}],
+        }
+    ],
+    "usage": {"input_tokens": 5, "output_tokens": 3, "total_tokens": 8},
+    "incomplete_details": None,
+    "error": None,
+}
+
+# Reasoning-naming 400 error bodies in each observed lane envelope.
+_CHATGPT_REASONING_400 = (
+    b'{"status":400,"error":{"type":"invalid_request_error",'
+    b'"message":"Invalid reasoning item: encrypted_content is no longer valid"}}'
+)
+_OPENAI_REASONING_400 = (
+    b'{"error":{"type":"invalid_request_error","param":"input",'
+    b'"message":"reasoning blob rejected"}}'
+)
+# A generic 400 with NO reasoning marker (mirrors the pinned observability fixture body).
+_GENERIC_400 = b'{"error":{"type":"fixture_status","message":"fixture rejection"}}'
+
+
+def _sse_bytes(scenario) -> bytes:
+    """Serialize a scenario's semantic events into the SSE wire bytes the shim consumes,
+    mirroring the loopback harness's own success-stream construction."""
+    payload = b"".join(
+        (
+            f"event: {event.get('type', 'message')}\n"
+            f"data: {json.dumps(event, separators=(',', ':'))}\n\n"
+        ).encode("utf-8")
+        for event in scenario.stream_events
+    )
+    if scenario.append_done:
+        payload += b"data: [DONE]\n\n"
+    return payload
+
+
+def _seam_path() -> Path:
+    """A unique per-test reasoning-cache seam path under scripts/scratch (never /tmp)."""
+    SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+    return SCRATCH_ROOT / f"v134_stale_blob_{uuid.uuid4().hex}.json"
+
+
+def _load_probe_module(seam_path: Path, backend_mode: str = "openai"):
+    """Import a fresh production shim in-process pinned to ``seam_path`` (so its import-time
+    restore reads exactly that seeded seam and populates the V4-R1 restored-id set). No
+    purge: this loader deliberately preserves the seeded file, unlike the ASGI probe."""
+    module_name = f"provider_shim_stale_blob_{uuid.uuid4().hex}"
+    env = {
+        "DAAF_REASONING_CACHE_FILE": str(seam_path),
+        "SHIM_BACKEND_MODE": backend_mode,
+        "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1/v1",
+        "SHIM_BACKEND_API_KEY": FAKE_OPENAI_KEY,
+        "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+    }
+    with mock.patch.dict(os.environ, env, clear=False):
+        spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
+        if spec is None or spec.loader is None:
+            raise RuntimeError("could not load production shim for stale-blob probe")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+    return module
+
+
+class _ProbeReport:
+    def __init__(self):
+        self.upstream_calls = 0
+        self.payloads: list[dict] = []
+        self.logs = ""
+        self.terminal: dict[str, str] = {}
+        self.raised = None
+
+
+def _drive(
+    module,
+    *,
+    messages,
+    attempt_outcomes,
+    error_body,
+    stream=False,
+    success_nonstream=None,
+    success_stream_bytes=b"",
+) -> _ProbeReport:
+    """Drive one production request through ``module.app`` with a seamed httpx client that
+    scripts per-attempt HTTP outcomes and captures a deep copy of each outbound payload."""
+
+    report = _ProbeReport()
+
+    def response_for_attempt(n: int, payload):
+        report.payloads.append(copy.deepcopy(payload))
+        outcome = attempt_outcomes[min(n - 1, len(attempt_outcomes) - 1)]
+        status = int(outcome)
+        if status >= 400:
+            content = bytes(error_body)
+        elif stream:
+            content = success_stream_bytes
+        else:
+            content = json.dumps(success_nonstream or _TEXT_SUCCESS).encode("utf-8")
+        return module.httpx.Response(
+            status,
+            content=content,
+            request=module.httpx.Request("POST", "http://127.0.0.1:1/v1/responses"),
+        )
+
+    class ProbeStreamContext:
+        def __init__(self, n, payload):
+            self.n = n
+            self.payload = payload
+
+        async def __aenter__(self):
+            return response_for_attempt(self.n, self.payload)
+
+        async def __aexit__(self, exc_type, exc, tb):
+            return False
+
+    class ProbeClient:
+        def stream(self, *args, **kwargs):
+            report.upstream_calls += 1
+            return ProbeStreamContext(report.upstream_calls, kwargs.get("json"))
+
+        async def post(self, *args, **kwargs):
+            report.upstream_calls += 1
+            return response_for_attempt(report.upstream_calls, kwargs.get("json"))
+
+    original_client = module._client
+    module._client = ProbeClient()
+
+    log_buffer = io.StringIO()
+    handler = logging.StreamHandler(log_buffer)
+    handler.setFormatter(
+        logging.Formatter(
+            "%(asctime)s %(levelname)s req_id=%(req_id)s phase=%(phase)s %(message)s"
+        )
+    )
+    handler.addFilter(module._RequestLogFilter())
+    original_handlers = list(module.log.handlers)
+    original_propagate = module.log.propagate
+    module.log.handlers = [handler]
+    module.log.propagate = False
+    module.log.setLevel(logging.INFO)
+
+    request_body = json.dumps(
+        {
+            "model": "gpt-fixture",
+            "max_tokens": 256,
+            "stream": stream,
+            "messages": messages,
+        },
+        separators=(",", ":"),
+    ).encode("utf-8")
+
+    async def exercise():
+        receive_queue: asyncio.Queue = asyncio.Queue()
+        receive_queue.put_nowait(
+            {"type": "http.request", "body": request_body, "more_body": False}
+        )
+
+        async def receive():
+            return await receive_queue.get()
+
+        sent: list[dict] = []
+
+        async def send(message):
+            sent.append(message)
+
+        scope = {"type": "http", "method": "POST", "path": "/v1/messages"}
+        try:
+            await asyncio.wait_for(module.app(scope, receive, send), timeout=5.0)
+        except Exception as error:  # noqa: BLE001 - recorded for assertions
+            report.raised = type(error).__name__
+
+    try:
+        asyncio.run(exercise())
+    finally:
+        module._client = ProbeClient() if original_client is None else original_client
+        module.log.handlers = original_handlers
+        module.log.propagate = original_propagate
+
+    report.logs = log_buffer.getvalue()
+    for line in parse_lifecycle_logs(report.logs):
+        if line.event == "terminal":
+            report.terminal = line.fields
+    return report
+
+
+def _reasoning_item_ids(payload) -> list[str]:
+    """The ids of every reasoning item present in an outbound payload's input[]."""
+    return [
+        item.get("id")
+        for item in (payload or {}).get("input", [])
+        if isinstance(item, dict) and item.get("type") == "reasoning"
+    ]
+
+
+class StaleBlobStripRetryTests(unittest.TestCase):
+    maxDiff = 8000
+
+    def _seed(self, pairs, captured_at=None, backend_mode="openai"):
+        seam = _seam_path()
+        seam.write_text(json.dumps(_seam_payload(pairs, captured_at)), encoding="utf-8")
+        self.addCleanup(lambda: seam.unlink(missing_ok=True))
+        module = _load_probe_module(seam, backend_mode=backend_mode)
+        return module, seam
+
+    # --- Test 1: strip-retry happy path (JSON loop) ---
+    def test_strip_retry_happy_path(self) -> None:
+        call_id, rs_id = "call_stale_1", "rs_stale_1"
+        module, _seam = self._seed([(call_id, _reasoning(rs_id))])
+        # Precondition: the seeded blob restored and is marked restored.
+        self.assertIn(call_id, module._REASONING_CACHE)
+        self.assertIn(call_id, module._REASONING_CACHE_RESTORED_IDS)
+
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[400, 200],
+            error_body=_OPENAI_REASONING_400,
+        )
+
+        self.assertEqual(report.upstream_calls, 2, report.logs)
+        # First outbound request carried the restored reasoning item; the second did not.
+        self.assertIn(rs_id, _reasoning_item_ids(report.payloads[0]))
+        self.assertEqual(_reasoning_item_ids(report.payloads[1]), [])
+        self.assertEqual(report.terminal.get("outcome"), "success")
+        self.assertEqual(report.terminal.get("retry_reason"), "stale_reasoning_400")
+        self.assertEqual(report.terminal.get("retry_source"), "body")
+        self.assertIn("event=reasoning_cache_stale_strip stripped=1", report.logs)
+        # v1.3.4 (V4-R6): the terminal record surfaces the stripped count (additive assertion
+        # over the V4-ii telemetry; the strip stripped exactly the one injected restored item).
+        self.assertEqual(report.terminal.get("reasoning_cache_stripped"), "1")
+        # Counts-only discipline: the stripped blob's opaque content never reaches a log line.
+        self.assertNotIn("ENC_", report.logs)
+
+    # --- Test 2: both lane envelopes trigger ---
+    def test_both_lane_envelopes_trigger(self) -> None:
+        for label, body in (
+            ("chatgpt", _CHATGPT_REASONING_400),
+            ("openai", _OPENAI_REASONING_400),
+        ):
+            with self.subTest(envelope=label):
+                call_id, rs_id = f"call_{label}", f"rs_{label}"
+                module, _seam = self._seed([(call_id, _reasoning(rs_id))])
+                report = _drive(
+                    module,
+                    messages=_tool_use_replay_messages(call_id),
+                    attempt_outcomes=[400, 200],
+                    error_body=body,
+                )
+                self.assertEqual(report.upstream_calls, 2, report.logs)
+                self.assertEqual(report.terminal.get("outcome"), "success")
+                self.assertEqual(
+                    report.terminal.get("retry_reason"), "stale_reasoning_400"
+                )
+
+    # --- Test 1b: strip-retry also fires on the SSE loop (_open_backend_stream) ---
+    def test_strip_retry_streaming_loop(self) -> None:
+        # R2 spans BOTH retry loops; the JSON-loop tests above exercise _post_with_retry, so
+        # this drives the streaming path (stream=True -> _open_backend_stream) end to end.
+        call_id, rs_id = "call_stream", "rs_stream"
+        module, _seam = self._seed([(call_id, _reasoning(rs_id))])
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[400, 200],
+            error_body=_CHATGPT_REASONING_400,
+            stream=True,
+            success_stream_bytes=_sse_bytes(full_response_scenario()),
+        )
+        self.assertEqual(report.upstream_calls, 2, report.logs)
+        self.assertIn(rs_id, _reasoning_item_ids(report.payloads[0]))
+        self.assertEqual(_reasoning_item_ids(report.payloads[1]), [])
+        self.assertEqual(report.terminal.get("outcome"), "success")
+        self.assertEqual(report.terminal.get("retry_reason"), "stale_reasoning_400")
+        self.assertIn("event=reasoning_cache_stale_strip stripped=1", report.logs)
+
+    # --- Test 3: one-shot gate ---
+    def test_one_shot_gate(self) -> None:
+        call_id, rs_id = "call_oneshot", "rs_oneshot"
+        module, _seam = self._seed([(call_id, _reasoning(rs_id))])
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[400, 400],
+            error_body=_OPENAI_REASONING_400,
+        )
+        # Exactly two attempts: the original + the single strip-retry, then fail-fast.
+        self.assertEqual(report.upstream_calls, 2, report.logs)
+        self.assertEqual(report.terminal.get("outcome"), "error")
+        # The strip fired exactly once.
+        self.assertEqual(report.logs.count("event=reasoning_cache_stale_strip"), 1)
+
+    # --- Test 4: negative — generic 400 body, restored items injected, no retry ---
+    def test_generic_400_with_restored_items_does_not_retry(self) -> None:
+        call_id, rs_id = "call_generic", "rs_generic"
+        module, _seam = self._seed([(call_id, _reasoning(rs_id))])
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[400, 200],
+            error_body=_GENERIC_400,
+        )
+        # Fail-fast preserved: a single attempt, no strip, no retry.
+        self.assertEqual(report.upstream_calls, 1, report.logs)
+        self.assertNotIn("event=reasoning_cache_stale_strip", report.logs)
+        self.assertEqual(report.terminal.get("outcome"), "error")
+
+    # --- Test 5: negative — reasoning-naming 400 but only live-populated items ---
+    def test_reasoning_400_with_only_live_items_does_not_strip(self) -> None:
+        # Seed an empty cache (nothing restored). A live tool_use then MISSES the cache, so
+        # no reasoning item is injected and no restored-id is recorded — the detector's
+        # restored-items-present gate stays closed even though the body names reasoning.
+        module, _seam = self._seed([])
+        self.assertEqual(len(module._REASONING_CACHE_RESTORED_IDS), 0)
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages("call_live_only"),
+            attempt_outcomes=[400, 200],
+            error_body=_OPENAI_REASONING_400,
+        )
+        self.assertEqual(report.upstream_calls, 1, report.logs)
+        self.assertNotIn("event=reasoning_cache_stale_strip", report.logs)
+        self.assertEqual(report.terminal.get("outcome"), "error")
+
+    # --- Test 6: eviction + persist of stripped entries; unrelated restored untouched ---
+    def test_eviction_and_persist_of_stripped_entries(self) -> None:
+        stale_id, stale_rs = "call_stale_evict", "rs_stale_evict"
+        keep_id, keep_rs = "call_keep", "rs_keep"
+        # Two restored entries; only the first is referenced by the request (so only it is
+        # injected, stripped, and evicted). The second must survive untouched.
+        module, seam = self._seed(
+            [(keep_id, _reasoning(keep_rs)), (stale_id, _reasoning(stale_rs))]
+        )
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(stale_id),
+            attempt_outcomes=[400, 200],
+            error_body=_OPENAI_REASONING_400,
+        )
+        self.assertEqual(report.upstream_calls, 2, report.logs)
+        # In-memory: the stale call_id is gone from both the cache and the restored set;
+        # the unrelated restored entry is untouched.
+        self.assertNotIn(stale_id, module._REASONING_CACHE)
+        self.assertNotIn(stale_id, module._REASONING_CACHE_RESTORED_IDS)
+        self.assertIn(keep_id, module._REASONING_CACHE)
+        self.assertIn(keep_id, module._REASONING_CACHE_RESTORED_IDS)
+        # Persisted: the rewritten seam no longer carries the stale call_id but keeps the
+        # unrelated one (the text-only 200 adds no new live entry).
+        persisted = json.loads(seam.read_text(encoding="utf-8"))
+        persisted_call_ids = {cid for cid, _ in persisted["entries"]}
+        self.assertNotIn(stale_id, persisted_call_ids)
+        self.assertIn(keep_id, persisted_call_ids)
+
+    # --- Test 10: hit-path non-mutation (stat-snapshot retry-once bracket) ---
+    def test_hit_only_request_does_not_advance_cache_file(self) -> None:
+        # A restored hit with a 200-first success must not mutate the cache file: the hit
+        # path is read-only (.get(), never move_to_end) and the text-only success populates
+        # nothing, so no persist fires. Retry-once bracket per test_v133 precedent.
+        call_id, rs_id = "call_hit", "rs_hit"
+
+        def snapshot(path: Path):
+            try:
+                st = path.stat()
+                return (st.st_mtime_ns, path.read_bytes())
+            except FileNotFoundError:
+                return None
+
+        dirty = True
+        last_report = None
+        for _attempt in range(2):
+            module, seam = self._seed([(call_id, _reasoning(rs_id))])
+            before = snapshot(seam)
+            last_report = _drive(
+                module,
+                messages=_tool_use_replay_messages(call_id),
+                attempt_outcomes=[200],
+                error_body=_OPENAI_REASONING_400,
+            )
+            after = snapshot(seam)
+            if before == after:
+                dirty = False
+                break
+        self.assertEqual(last_report.upstream_calls, 1, last_report.logs)
+        # The restored item WAS injected (genuine hit), proving non-vacuity.
+        self.assertIn(rs_id, _reasoning_item_ids(last_report.payloads[0]))
+        self.assertEqual(last_report.terminal.get("outcome"), "success")
+        self.assertFalse(dirty, "hit-only request advanced the reasoning-cache seam file")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v134_telemetry_and_allowlist.py b/tests/provider_shim/test_v134_telemetry_and_allowlist.py
new file mode 100644
index 00000000..8a6b9bcb
--- /dev/null
+++ b/tests/provider_shim/test_v134_telemetry_and_allowlist.py
@@ -0,0 +1,449 @@
+"""Deterministic contracts for the v1.3.4 telemetry + allowlist riders (V4-R5..R7).
+
+This module covers the V4-ii features that ride alongside the stale-blob insurance
+(V4-R1..R4, exercised by test_v134_stale_blob_insurance.py):
+
+  * V4-R5 — known-events allowlist absorption. `keepalive` and `response.metadata`
+    joined the ignored status/lifecycle group of _KNOWN_EVENT_TYPES, so a clean stream
+    that interleaves them completes with unknown_events=0 rather than throttle-logging
+    them as unknown wire. The three v1.2.14 R1 allowlist-guard tests still key off
+    response.audio.delta / web_search_call and pass unmodified (run by the suite).
+  * V4-R6 — reasoning-cache HIT counter on the terminal record. reasoning_cache_hit is
+    the per-request hit count (parallel to reasoning_cache_miss); reasoning_cache_stripped
+    is 0 on a clean request (nonzero exercised by the V4-i strip tests).
+  * V4-R7 — /health restore-effectiveness. The existing NESTED reasoning_cache block
+    gains hits (process-cumulative) and restored_hits (the subset whose call_id was still
+    disk-restored at hit time). No new top-level /health key (the _HEALTH_KEYS money test
+    in test_historical_regressions.py stays intact with only its version-pin edit).
+
+Hermeticity mirrors test_v134_stale_blob_insurance.py: every reasoning-cache seam lives
+under scripts/scratch (never /tmp, never the production HOME default), each test pins a
+UNIQUE per-test DAAF_REASONING_CACHE_FILE, and the in-process shim is imported fresh per
+test so its import-time restore and its process-cumulative counters start clean. The
+seeded-seam importer pattern (not the ASGI probe, which purges the reasoning seam before
+load) is required for the restored-blob scenarios.
+
+Test plan (design § Test Plan items 8, 9, 11, 12):
+ 8. Allowlist: a stream carrying keepalive + response.metadata -> unknown_events=0.
+ 9. HIT counter: seeded restored cache + replay -> reasoning_cache_hit=1/miss=0; a mixed
+    hit/miss request reports both; reasoning_cache_stripped=0 on a clean request.
+11. /health: nested block carries hits/restored_hits; restored_hits increments ONLY for
+    restored-id hits (a live-populated hit bumps hits but not restored_hits).
+12. Version pins swept + full suite green (asserted by the suite gate, not a test here).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import copy
+import importlib.util
+import io
+import json
+import logging
+import os
+import time
+import unittest
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from ._loopback_harness import (
+    FAKE_OPENAI_KEY,
+    PRODUCTION_SHIM,
+    SCRATCH_ROOT,
+    full_response_scenario,
+    parse_lifecycle_logs,
+)
+
+
+# --- Local fixtures (self-contained copies of the v133/v134 helper patterns) ---
+
+def _reasoning(item_id: str) -> dict[str, object]:
+    """A minimal, well-shaped reasoning item carrying an opaque encrypted_content blob."""
+    return {
+        "type": "reasoning",
+        "id": item_id,
+        "status": "completed",
+        "summary": [],
+        "encrypted_content": f"ENC_{item_id}",
+    }
+
+
+def _seam_payload(pairs, captured_at=None) -> dict[str, object]:
+    """Build a persisted-file payload from (call_id, item) pairs in oldest->newest order."""
+    return {
+        "captured_at": int(time.time()) if captured_at is None else int(captured_at),
+        "entries": [[cid, item] for cid, item in pairs],
+    }
+
+
+def _tool_use_replay_messages(call_ids):
+    """One assistant message replaying tool_use for each call_id (so the shim's re-injection
+    path looks each reasoning item up in the cache), followed by matching user tool_results.
+    A single call_id may be passed as a string."""
+    if isinstance(call_ids, str):
+        call_ids = [call_ids]
+    tool_uses = [
+        {
+            "type": "tool_use",
+            "id": cid,
+            "name": "Read",
+            "input": {"file_path": f"/daaf/README_{cid}.md"},
+        }
+        for cid in call_ids
+    ]
+    tool_results = [
+        {"type": "tool_result", "tool_use_id": cid, "content": "replay result"}
+        for cid in call_ids
+    ]
+    return [
+        {"role": "assistant", "content": tool_uses},
+        {"role": "user", "content": tool_results},
+    ]
+
+
+# A text-only Responses object: NO reasoning/function_call, so a 200 success carrying it
+# repopulates nothing (keeps hit-count / restored-set assertions clean).
+_TEXT_SUCCESS = {
+    "id": "resp_text_success",
+    "model": "gpt-fixture",
+    "status": "completed",
+    "output": [
+        {
+            "type": "message",
+            "id": "msg_text_success",
+            "role": "assistant",
+            "status": "completed",
+            "content": [{"type": "output_text", "text": "ok"}],
+        }
+    ],
+    "usage": {"input_tokens": 5, "output_tokens": 3, "total_tokens": 8},
+    "incomplete_details": None,
+    "error": None,
+}
+
+
+def _sse_bytes_from_events(events, append_done: bool = True) -> bytes:
+    """Serialize a list of semantic event dicts into the SSE wire bytes the shim consumes,
+    mirroring the loopback harness's own success-stream construction."""
+    payload = b"".join(
+        (
+            f"event: {event.get('type', 'message')}\n"
+            f"data: {json.dumps(event, separators=(',', ':'))}\n\n"
+        ).encode("utf-8")
+        for event in events
+    )
+    if append_done:
+        payload += b"data: [DONE]\n\n"
+    return payload
+
+
+def _seam_path() -> Path:
+    """A unique per-test reasoning-cache seam path under scripts/scratch (never /tmp)."""
+    SCRATCH_ROOT.mkdir(parents=True, exist_ok=True)
+    return SCRATCH_ROOT / f"v134_telemetry_{uuid.uuid4().hex}.json"
+
+
+def _load_probe_module(seam_path: Path, backend_mode: str = "openai"):
+    """Import a fresh production shim in-process pinned to ``seam_path`` (so its import-time
+    restore reads exactly that seeded seam and populates the V4-R1 restored-id set, and its
+    process-cumulative /health hit counters start at 0). No purge: this loader deliberately
+    preserves the seeded file, unlike the ASGI probe."""
+    module_name = f"provider_shim_telemetry_{uuid.uuid4().hex}"
+    env = {
+        "DAAF_REASONING_CACHE_FILE": str(seam_path),
+        "SHIM_BACKEND_MODE": backend_mode,
+        "SHIM_BACKEND_BASE_URL": "http://127.0.0.1:1/v1",
+        "SHIM_BACKEND_API_KEY": FAKE_OPENAI_KEY,
+        "OPENAI_API_KEY": FAKE_OPENAI_KEY,
+    }
+    with mock.patch.dict(os.environ, env, clear=False):
+        spec = importlib.util.spec_from_file_location(module_name, PRODUCTION_SHIM)
+        if spec is None or spec.loader is None:
+            raise RuntimeError("could not load production shim for telemetry probe")
+        module = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(module)
+    return module
+
+
+class _ProbeReport:
+    def __init__(self):
+        self.upstream_calls = 0
+        self.payloads: list[dict] = []
+        self.logs = ""
+        self.terminal: dict[str, str] = {}
+        self.raised = None
+
+
+def _drive(
+    module,
+    *,
+    messages,
+    attempt_outcomes,
+    error_body=b"{}",
+    stream=False,
+    success_nonstream=None,
+    success_stream_bytes=b"",
+) -> _ProbeReport:
+    """Drive one production request through ``module.app`` with a seamed httpx client that
+    scripts per-attempt HTTP outcomes and captures a deep copy of each outbound payload."""
+
+    report = _ProbeReport()
+
+    def response_for_attempt(n: int, payload):
+        report.payloads.append(copy.deepcopy(payload))
+        outcome = attempt_outcomes[min(n - 1, len(attempt_outcomes) - 1)]
+        status = int(outcome)
+        if status >= 400:
+            content = bytes(error_body)
+        elif stream:
+            content = success_stream_bytes
+        else:
+            content = json.dumps(success_nonstream or _TEXT_SUCCESS).encode("utf-8")
+        return module.httpx.Response(
+            status,
+            content=content,
+            request=module.httpx.Request("POST", "http://127.0.0.1:1/v1/responses"),
+        )
+
+    class ProbeStreamContext:
+        def __init__(self, n, payload):
+            self.n = n
+            self.payload = payload
+
+        async def __aenter__(self):
+            return response_for_attempt(self.n, self.payload)
+
+        async def __aexit__(self, exc_type, exc, tb):
+            return False
+
+    class ProbeClient:
+        def stream(self, *args, **kwargs):
+            report.upstream_calls += 1
+            return ProbeStreamContext(report.upstream_calls, kwargs.get("json"))
+
+        async def post(self, *args, **kwargs):
+            report.upstream_calls += 1
+            return response_for_attempt(report.upstream_calls, kwargs.get("json"))
+
+    original_client = module._client
+    module._client = ProbeClient()
+
+    log_buffer = io.StringIO()
+    handler = logging.StreamHandler(log_buffer)
+    handler.setFormatter(
+        logging.Formatter(
+            "%(asctime)s %(levelname)s req_id=%(req_id)s phase=%(phase)s %(message)s"
+        )
+    )
+    handler.addFilter(module._RequestLogFilter())
+    original_handlers = list(module.log.handlers)
+    original_propagate = module.log.propagate
+    module.log.handlers = [handler]
+    module.log.propagate = False
+    module.log.setLevel(logging.INFO)
+
+    request_body = json.dumps(
+        {
+            "model": "gpt-fixture",
+            "max_tokens": 256,
+            "stream": stream,
+            "messages": messages,
+        },
+        separators=(",", ":"),
+    ).encode("utf-8")
+
+    async def exercise():
+        receive_queue: asyncio.Queue = asyncio.Queue()
+        receive_queue.put_nowait(
+            {"type": "http.request", "body": request_body, "more_body": False}
+        )
+
+        async def receive():
+            return await receive_queue.get()
+
+        sent: list[dict] = []
+
+        async def send(message):
+            sent.append(message)
+
+        scope = {"type": "http", "method": "POST", "path": "/v1/messages"}
+        try:
+            await asyncio.wait_for(module.app(scope, receive, send), timeout=5.0)
+        except Exception as error:  # noqa: BLE001 - recorded for assertions
+            report.raised = type(error).__name__
+
+    try:
+        asyncio.run(exercise())
+    finally:
+        module._client = ProbeClient() if original_client is None else original_client
+        module.log.handlers = original_handlers
+        module.log.propagate = original_propagate
+
+    report.logs = log_buffer.getvalue()
+    for line in parse_lifecycle_logs(report.logs):
+        if line.event == "terminal":
+            report.terminal = line.fields
+    return report
+
+
+def _get_health(module) -> dict:
+    """Drive a GET /health request through ``module.app`` and return the parsed JSON body."""
+
+    sent: list[dict] = []
+
+    async def send(message):
+        sent.append(message)
+
+    async def receive():
+        return {"type": "http.request", "body": b"", "more_body": False}
+
+    scope = {"type": "http", "method": "GET", "path": "/health"}
+    asyncio.run(asyncio.wait_for(module.app(scope, receive, send), timeout=5.0))
+    body = b"".join(
+        m.get("body", b"") for m in sent if m.get("type") == "http.response.body"
+    )
+    return json.loads(body)
+
+
+def _seed(test: unittest.TestCase, pairs, backend_mode="openai"):
+    """Seed a persisted reasoning-cache seam and load a fresh in-process shim pinned to it."""
+    seam = _seam_path()
+    seam.write_text(json.dumps(_seam_payload(pairs)), encoding="utf-8")
+    test.addCleanup(lambda: seam.unlink(missing_ok=True))
+    module = _load_probe_module(seam, backend_mode=backend_mode)
+    return module, seam
+
+
+# --- Item 8: known-events allowlist absorption ---
+
+class AllowlistAbsorptionTests(unittest.TestCase):
+    maxDiff = 8000
+
+    def test_keepalive_and_metadata_absorbed_unknown_events_zero(self) -> None:
+        # A clean streaming turn that ALSO interleaves a top-level `keepalive` frame and a
+        # `response.metadata` lifecycle frame. Both are now in the ignored group of
+        # _KNOWN_EVENT_TYPES, so the reducer catch-all skips them silently and the terminal
+        # record must report unknown_events=0 (the "0 when clean" invariant, extended).
+        module, _seam = _seed(self, [])
+        scenario = full_response_scenario()
+        events = list(scenario.stream_events)
+        # Insert the two absorbed types among the clean events (positions are arbitrary; the
+        # reducer keys off the event type, not order). keepalive is top-level like `error`.
+        events.insert(1, {"type": "keepalive"})
+        events.insert(
+            2, {"type": "response.metadata", "response": {"id": "resp_full"}}
+        )
+        report = _drive(
+            module,
+            messages=[{"role": "user", "content": "hello"}],
+            attempt_outcomes=[200],
+            stream=True,
+            success_stream_bytes=_sse_bytes_from_events(events, scenario.append_done),
+        )
+        self.assertEqual(report.upstream_calls, 1, report.logs)
+        self.assertEqual(report.terminal.get("outcome"), "success", report.logs)
+        self.assertEqual(report.terminal.get("unknown_events"), "0", report.logs)
+
+
+# --- Item 9: reasoning-cache HIT counter on the terminal record ---
+
+class HitCounterTerminalTests(unittest.TestCase):
+    maxDiff = 8000
+
+    def test_hit_only_request_reports_hit_one_miss_zero(self) -> None:
+        call_id, rs_id = "call_hit_only", "rs_hit_only"
+        module, _seam = _seed(self, [(call_id, _reasoning(rs_id))])
+        self.assertIn(call_id, module._REASONING_CACHE)
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[200],
+        )
+        self.assertEqual(report.upstream_calls, 1, report.logs)
+        self.assertEqual(report.terminal.get("outcome"), "success", report.logs)
+        self.assertEqual(report.terminal.get("reasoning_cache_hit"), "1", report.logs)
+        self.assertEqual(report.terminal.get("reasoning_cache_miss"), "0", report.logs)
+        # A clean request never strips — the field is present and 0.
+        self.assertEqual(
+            report.terminal.get("reasoning_cache_stripped"), "0", report.logs
+        )
+
+    def test_mixed_hit_and_miss_reports_both(self) -> None:
+        # One cached call_id (hit) and one absent call_id (miss) in the same replay message.
+        hit_id, rs_id = "call_mixed_hit", "rs_mixed_hit"
+        miss_id = "call_mixed_miss"
+        module, _seam = _seed(self, [(hit_id, _reasoning(rs_id))])
+        report = _drive(
+            module,
+            messages=_tool_use_replay_messages([hit_id, miss_id]),
+            attempt_outcomes=[200],
+        )
+        self.assertEqual(report.terminal.get("outcome"), "success", report.logs)
+        self.assertEqual(report.terminal.get("reasoning_cache_hit"), "1", report.logs)
+        self.assertEqual(report.terminal.get("reasoning_cache_miss"), "1", report.logs)
+
+
+# --- Item 11: /health restore-effectiveness (hits / restored_hits) ---
+
+class HealthRestoreEffectivenessTests(unittest.TestCase):
+    maxDiff = 8000
+
+    def test_health_nested_block_carries_hits_and_restored_hits(self) -> None:
+        call_id, rs_id = "call_health", "rs_health"
+        module, _seam = _seed(self, [(call_id, _reasoning(rs_id))])
+        # Baseline: fresh process, no hits yet.
+        baseline = _get_health(module)["reasoning_cache"]
+        self.assertEqual(baseline["hits"], 0)
+        self.assertEqual(baseline["restored_hits"], 0)
+        # A restored hit bumps BOTH cumulative counters.
+        _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[200],
+        )
+        after = _get_health(module)["reasoning_cache"]
+        self.assertEqual(after["hits"], 1)
+        self.assertEqual(after["restored_hits"], 1)
+        # Nesting invariant: the four count keys live INSIDE reasoning_cache, and hits/
+        # restored_hits are NOT promoted to top-level /health keys.
+        self.assertEqual(
+            set(after), {"entries", "restored", "hits", "restored_hits"}
+        )
+        health = _get_health(module)
+        self.assertNotIn("hits", health)
+        self.assertNotIn("restored_hits", health)
+
+    def test_live_populated_hit_bumps_hits_but_not_restored_hits(self) -> None:
+        # Seed one restored entry, exercise a restored hit (hits=1, restored_hits=1). Then
+        # convert that entry to LIVE via _cache_reasoning — the exact production write the
+        # live-population path uses, which discards the call_id from the restored set. A
+        # second hit on the now-live entry must bump hits (2) but NOT restored_hits (1).
+        call_id, rs_id = "call_live_vs_restored", "rs_live_vs_restored"
+        module, _seam = _seed(self, [(call_id, _reasoning(rs_id))])
+        _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[200],
+        )
+        first = _get_health(module)["reasoning_cache"]
+        self.assertEqual((first["hits"], first["restored_hits"]), (1, 1))
+        # Live re-population of the same call_id: real production function; drops it from the
+        # restored set (a live blob is no longer "restored").
+        self.assertIn(call_id, module._REASONING_CACHE_RESTORED_IDS)
+        module._cache_reasoning(call_id, module._REASONING_CACHE[call_id])
+        self.assertNotIn(call_id, module._REASONING_CACHE_RESTORED_IDS)
+        _drive(
+            module,
+            messages=_tool_use_replay_messages(call_id),
+            attempt_outcomes=[200],
+        )
+        second = _get_health(module)["reasoning_cache"]
+        self.assertEqual(second["hits"], 2, "the live hit must still count as a hit")
+        self.assertEqual(
+            second["restored_hits"], 1, "a live-populated hit must not bump restored_hits"
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/provider_shim/test_v136_prompt_cache_observability.py b/tests/provider_shim/test_v136_prompt_cache_observability.py
new file mode 100644
index 00000000..6ce81e01
--- /dev/null
+++ b/tests/provider_shim/test_v136_prompt_cache_observability.py
@@ -0,0 +1,324 @@
+"""Deterministic red/green contracts for provider-shim v1.3.6 prompt-cache observability.
+
+Covers the V6-R1/R2/R3/R4 client-visible + telemetry surface introduced in shim v1.3.6:
+
+* R1/R3 client mapping — OpenAI `usage.input_tokens` INCLUDES the cached prefix, so the
+  Anthropic-native usage block SUBTRACTS it (`input_tokens = total - cached`) and reports the
+  cached count as `cache_read_input_tokens`, preserving the sum invariant. `cache_creation_input_tokens`
+  is always 0 (OpenAI reports no cache-write count) and both cache fields are ALWAYS emitted.
+* R2 terminal record — the lane-agnostic terminal log line carries `cached_tokens` (the OpenAI
+  total's cached subset, or the `-` absent-convention). `state.input_tokens` stays the OpenAI TOTAL.
+* R4 /health — a new top-level `prompt_cache` block whose cumulative counters advance per terminal.
+
+Design test-plan items 2-8 (2026-07-22_v136_PromptCacheObservability_Design.md § Test plan).
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from ._loopback_harness import (
+    USAGE,
+    USAGE_WITH_CACHE,
+    MockResponsesServer,
+    RealShim,
+    lifecycle_for_response,
+    lifecycle_report,
+    parse_typed_sse,
+    terminal_contract_scenario,
+)
+
+
+# The prompt-cache detail resolves to input=19 (uncached remainder) + cache_read=12 on the wire,
+# while the terminal record and /health denominators keep the OpenAI total of 31.
+_TOTAL = USAGE_WITH_CACHE["input_tokens"]          # 31 (OpenAI total, includes cached prefix)
+_CACHED = USAGE_WITH_CACHE["input_tokens_details"]["cached_tokens"]  # 12
+_REMAINDER = _TOTAL - _CACHED                      # 19 (client-visible Anthropic input_tokens)
+_OUTPUT = USAGE_WITH_CACHE["output_tokens"]        # 17
+
+
+def _cache_hit_scenario(name: str):
+    """A clean, completed terminal whose usage carries a valid prompt-cache detail."""
+    return terminal_contract_scenario(
+        name,
+        "response.completed",
+        status="completed",
+        output=[],
+        usage=USAGE_WITH_CACHE,
+    )
+
+
+def _usage_scenario(name: str, usage):
+    """A clean, completed terminal carrying an arbitrary (possibly malformed) usage object."""
+    return terminal_contract_scenario(
+        name,
+        "response.completed",
+        status="completed",
+        output=[],
+        usage=usage,
+    )
+
+
+class ProviderShimPromptCacheObservabilityTests(unittest.TestCase):
+    maxDiff = 12000
+
+    # --- helpers -------------------------------------------------------------------------
+
+    def _terminal_fields(self, shim: RealShim, result) -> dict:
+        """Resolve the single terminal lifecycle record for one response."""
+        lines = lifecycle_for_response(shim, result)
+        terminal = next(line for line in lines if line.event == "terminal")
+        return terminal.fields
+
+    def _stream_client_usage(self, result) -> dict:
+        """Extract the client-visible message_delta usage block from a streaming response."""
+        frames = parse_typed_sse(result.body)
+        lifecycle_report(frames)
+        events = [frame.data for frame in frames if isinstance(frame.data, dict)]
+        delta = next(event for event in events if event.get("type") == "message_delta")
+        return delta["usage"]
+
+    def _health_prompt_cache(self, shim: RealShim) -> dict:
+        health = shim.get_health()
+        self.assertEqual(health.status, 200, health.text)
+        return health.json()
+
+    # --- item 2: streaming lane, cache-hit -----------------------------------------------
+
+    def test_streaming_cache_hit_maps_usage_and_records_terminal(self) -> None:
+        scenario = _cache_hit_scenario("prompt-cache-stream")
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                usage = self._stream_client_usage(result)
+                # Subtraction mapping: total(31) - cached(12) = 19; cache_read carries the 12.
+                self.assertEqual(
+                    usage,
+                    {
+                        "input_tokens": _REMAINDER,
+                        "output_tokens": _OUTPUT,
+                        "cache_read_input_tokens": _CACHED,
+                        "cache_creation_input_tokens": 0,
+                    },
+                )
+                # Terminal record keeps the OpenAI TOTAL input_tokens and the cached subset.
+                fields = self._terminal_fields(shim, result)
+                self.assertEqual(fields["cached_tokens"], str(_CACHED))
+                self.assertEqual(fields["input_tokens"], str(_TOTAL))
+                self.assertEqual(fields["usage"], "backend")
+                shim.assert_offline_contract()
+                backend.assert_request_counts(responses=1)
+
+    # --- item 3: both non-streaming lanes, cache-hit -------------------------------------
+
+    def test_nonstream_both_lanes_map_usage_and_record_terminal(self) -> None:
+        for mode in ("chatgpt", "openai"):
+            with self.subTest(mode=mode):
+                scenario = _cache_hit_scenario(f"prompt-cache-ns-{mode}")
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, mode) as shim:
+                        result = shim.post_messages(stream=False)
+                        self.assertEqual(result.status, 200, result.text)
+                        message = result.json()
+                        self.assertEqual(
+                            message.get("usage"),
+                            {
+                                "input_tokens": _REMAINDER,
+                                "output_tokens": _OUTPUT,
+                                "cache_read_input_tokens": _CACHED,
+                                "cache_creation_input_tokens": 0,
+                            },
+                        )
+                        # The private carry key never reaches the wire.
+                        self.assertNotIn("_cached_tokens", message.get("usage", {}))
+                        self.assertNotIn("_cached_tokens", message)
+                        fields = self._terminal_fields(shim, result)
+                        self.assertEqual(fields["cached_tokens"], str(_CACHED))
+                        self.assertEqual(fields["input_tokens"], str(_TOTAL))
+                        self.assertEqual(fields["usage"], "backend")
+                        shim.assert_offline_contract()
+                        backend.assert_request_counts(responses=1)
+
+    # --- item 4: absent detail (backward compatibility) ----------------------------------
+
+    def test_absent_detail_emits_zero_cache_fields_and_dash_terminal(self) -> None:
+        # The plain USAGE fixture carries no input_tokens_details — the pre-v1.3.6 world. The
+        # client sees the full OpenAI input as input_tokens (no subtraction) with both cache
+        # fields present as 0; the terminal renders the `-` absent-convention.
+        scenario = _usage_scenario("prompt-cache-absent", dict(USAGE))
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                stream_result = shim.post_messages(stream=True)
+                self.assertEqual(stream_result.status, 200, stream_result.text)
+                usage = self._stream_client_usage(stream_result)
+                self.assertEqual(
+                    usage,
+                    {
+                        "input_tokens": USAGE["input_tokens"],
+                        "output_tokens": USAGE["output_tokens"],
+                        "cache_read_input_tokens": 0,
+                        "cache_creation_input_tokens": 0,
+                    },
+                )
+                fields = self._terminal_fields(shim, stream_result)
+                self.assertEqual(fields["cached_tokens"], "-")
+                self.assertEqual(fields["input_tokens"], str(USAGE["input_tokens"]))
+                shim.assert_offline_contract()
+
+    # --- item 5: malformed detail battery ------------------------------------------------
+
+    def test_malformed_detail_is_treated_as_absent_without_error(self) -> None:
+        # string / negative / boolean / non-dict details all resolve to ABSENT: the response
+        # still succeeds, the client sees no cached tokens, and the terminal renders `-`.
+        malformed_details = (
+            ("string", "12"),
+            ("negative", -5),
+            ("boolean", True),
+            ("non-dict-details", None),  # input_tokens_details set to a non-dict below
+        )
+        for label, cached_value in malformed_details:
+            with self.subTest(case=label):
+                if label == "non-dict-details":
+                    usage = {
+                        "input_tokens": _TOTAL,
+                        "output_tokens": _OUTPUT,
+                        "input_tokens_details": "not-a-dict",
+                    }
+                else:
+                    usage = {
+                        "input_tokens": _TOTAL,
+                        "output_tokens": _OUTPUT,
+                        "input_tokens_details": {"cached_tokens": cached_value},
+                    }
+                scenario = _usage_scenario(f"prompt-cache-malformed-{label}", usage)
+                with MockResponsesServer(scenario) as backend:
+                    with RealShim(backend, "chatgpt") as shim:
+                        result = shim.post_messages(stream=False)
+                        self.assertEqual(result.status, 200, result.text)
+                        message = result.json()
+                        self.assertEqual(message.get("stop_reason"), "end_turn")
+                        self.assertEqual(
+                            message.get("usage"),
+                            {
+                                "input_tokens": _TOTAL,
+                                "output_tokens": _OUTPUT,
+                                "cache_read_input_tokens": 0,
+                                "cache_creation_input_tokens": 0,
+                            },
+                        )
+                        fields = self._terminal_fields(shim, result)
+                        self.assertEqual(fields["cached_tokens"], "-")
+                        self.assertEqual(fields["outcome"], "success")
+                        shim.assert_offline_contract()
+
+    # --- item 6: clamp guard (cached > input) --------------------------------------------
+
+    def test_cached_exceeding_input_total_is_treated_as_absent(self) -> None:
+        # A malformed upstream where cached_tokens > input_tokens must fail open to ABSENT,
+        # never a negative client-visible input_tokens.
+        usage = {
+            "input_tokens": _TOTAL,
+            "output_tokens": _OUTPUT,
+            "input_tokens_details": {"cached_tokens": _TOTAL + 5},
+        }
+        scenario = _usage_scenario("prompt-cache-clamp", usage)
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=False)
+                self.assertEqual(result.status, 200, result.text)
+                message = result.json()
+                self.assertEqual(
+                    message.get("usage"),
+                    {
+                        "input_tokens": _TOTAL,
+                        "output_tokens": _OUTPUT,
+                        "cache_read_input_tokens": 0,
+                        "cache_creation_input_tokens": 0,
+                    },
+                )
+                fields = self._terminal_fields(shim, result)
+                self.assertEqual(fields["cached_tokens"], "-")
+                self.assertEqual(fields["input_tokens"], str(_TOTAL))
+                shim.assert_offline_contract()
+
+    # --- item 7: /health prompt_cache block + counter advancement ------------------------
+
+    def test_health_prompt_cache_block_present_and_top_level(self) -> None:
+        scenario = _cache_hit_scenario("prompt-cache-health-shape")
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                health = self._health_prompt_cache(shim)
+                # ADDS a top-level key (distinct from the nested reasoning_cache block).
+                self.assertIn("prompt_cache", health)
+                block = health["prompt_cache"]
+                self.assertEqual(
+                    set(block),
+                    {
+                        "requests_with_usage",
+                        "requests_with_cached",
+                        "cached_tokens_total",
+                        "input_tokens_total",
+                    },
+                )
+                # The prompt-cache counters are NOT promoted to top-level /health keys.
+                for key in block:
+                    self.assertNotIn(key, {k for k in health if k != "prompt_cache"})
+
+    def test_health_counters_advance_on_a_cached_terminal(self) -> None:
+        scenario = _cache_hit_scenario("prompt-cache-health-cached")
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                before = self._health_prompt_cache(shim)["prompt_cache"]
+                # Fresh subprocess: no terminal has fired yet, so every counter starts at 0.
+                self.assertEqual(
+                    before,
+                    {
+                        "requests_with_usage": 0,
+                        "requests_with_cached": 0,
+                        "cached_tokens_total": 0,
+                        "input_tokens_total": 0,
+                    },
+                )
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_for_response(shim, result)  # ensure the terminal bump has landed
+                after = self._health_prompt_cache(shim)["prompt_cache"]
+                # One cached terminal: requests +1, cached-subset +1, totals advance by the
+                # cached count (12) and the OpenAI input TOTAL (31), respectively.
+                self.assertEqual(
+                    after,
+                    {
+                        "requests_with_usage": 1,
+                        "requests_with_cached": 1,
+                        "cached_tokens_total": _CACHED,
+                        "input_tokens_total": _TOTAL,
+                    },
+                )
+                shim.assert_offline_contract()
+
+    def test_health_present_but_absent_cached_counts_usage_only(self) -> None:
+        # A terminal with parsed backend usage but NO cached detail advances requests_with_usage
+        # and input_tokens_total, but leaves the cached-subset counters at 0 (adjudication 3:
+        # cached counters advance only when cached_tokens > 0).
+        scenario = _usage_scenario("prompt-cache-health-absent", dict(USAGE))
+        with MockResponsesServer(scenario) as backend:
+            with RealShim(backend, "chatgpt") as shim:
+                result = shim.post_messages(stream=True)
+                self.assertEqual(result.status, 200, result.text)
+                lifecycle_for_response(shim, result)
+                after = self._health_prompt_cache(shim)["prompt_cache"]
+                self.assertEqual(
+                    after,
+                    {
+                        "requests_with_usage": 1,
+                        "requests_with_cached": 0,
+                        "cached_tokens_total": 0,
+                        "input_tokens_total": USAGE["input_tokens"],
+                    },
+                )
+                shim.assert_offline_contract()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/python/test_deploy_smoke.py b/tests/python/test_deploy_smoke.py
index dec6fd2e..12aee96a 100644
--- a/tests/python/test_deploy_smoke.py
+++ b/tests/python/test_deploy_smoke.py
@@ -1,8 +1,9 @@
 """Provider-free regression tests for the DAAF deployment smoke harness.
 
 Standard-library unittest + unittest.mock ONLY — no third-party test deps, no
-network, no live provider calls. Every fixture lives under scripts/scratch/
-(NEVER /tmp) and is removed in tearDown.
+network, no live provider calls. Synthetic health fixtures are contract evidence
+only; they do not claim provider acceptance of any requested tier. Every fixture
+lives under scripts/scratch/ (NEVER /tmp) and is removed in tearDown.
 
 This module is wired into Tier D as TD.0 (run BEFORE the broader batteries) so an
 official Tier D run first validates its own harness: environment sanitization,
@@ -13,6 +14,7 @@
   python3 -m unittest discover -s /daaf/tests/python -p 'test_deploy_smoke.py'
 """
 
+import json
 import os
 import subprocess
 import sys
@@ -21,6 +23,7 @@
 import uuid
 from pathlib import Path
 from unittest import mock
+from urllib.error import URLError
 
 # --- Import path guard: mirror run_deploy_smoke.py so route_detection /
 # smoke_probes / run_deploy_smoke and the benchmarks harness all import
@@ -48,6 +51,789 @@ def _scratch_dir(prefix):
     return d
 
 
+class _HealthResponse:
+    status = 200
+
+    def __init__(self, payload):
+        self.payload = payload
+        self.read_limit = None
+
+    def read(self, limit=None):
+        self.read_limit = limit
+        if isinstance(self.payload, bytes):
+            return self.payload[:limit] if limit is not None else self.payload
+        raw = json.dumps(self.payload).encode("utf-8")
+        return raw[:limit] if limit is not None else raw
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc, traceback):
+        return False
+
+
+class _HealthOpener:
+    def __init__(self, response):
+        self.response = response
+        self.request = None
+        self.timeout = None
+
+    def open(self, request, timeout):
+        self.request = request
+        self.timeout = timeout
+        return self.response
+
+
+class LocalHealthTransportTests(unittest.TestCase):
+    def test_fixed_loopback_no_proxy_no_redirect_and_bounded_valid_read(self):
+        response = _HealthResponse({"status": "ok"})
+        opener = _HealthOpener(response)
+        with mock.patch.object(smoke_probes, "build_opener", return_value=opener) as build:
+            payload = smoke_probes._read_local_health(timeout=3.5)
+        self.assertEqual(payload, {"status": "ok"})
+        self.assertEqual(opener.request.full_url, smoke_probes.SHIM_HEALTH_URL)
+        self.assertEqual(opener.timeout, 3.5)
+        self.assertEqual(response.read_limit, smoke_probes.HEALTH_BODY_LIMIT + 1)
+        handlers = build.call_args.args
+        self.assertTrue(any(isinstance(item, smoke_probes.ProxyHandler) and item.proxies == {} for item in handlers))
+        redirect_handler = next(item for item in handlers if isinstance(item, smoke_probes._RejectHealthRedirects))
+        self.assertIsNone(redirect_handler.redirect_request(None, None, 302, "Found", {}, "http://example.invalid"))
+
+    def test_oversized_health_is_rejected_before_json_decode(self):
+        body = b"{" + b"x" * smoke_probes.HEALTH_BODY_LIMIT
+        with self.assertRaisesRegex(ValueError, "16 KiB"):
+            smoke_probes._read_local_health(opener=_HealthOpener(_HealthResponse(body)))
+
+
+class RouteServiceTierCoherenceTests(unittest.TestCase):
+    def _env(self, backend):
+        env = {
+            "DAAF_PROVIDER_SHIM": "openai",
+            "SHIM_BACKEND_MODE": backend,
+            "ANTHROPIC_BASE_URL": "http://127.0.0.1:4141",
+            "ANTHROPIC_AUTH_TOKEN": "shim-local-token",
+            "CLAUDE_CODE_DISABLE_FAST_MODE": "1",
+        }
+        if backend == "chatgpt":
+            env["CODEX_HOME"] = "/bounded/codex-home"
+        else:
+            env["OPENAI_API_KEY"] = "secret-not-reported"
+        return env
+
+    def test_safe_fingerprint_includes_exact_native_disable_control(self):
+        exact = route_detection.env_fingerprint(
+            {"CLAUDE_CODE_DISABLE_FAST_MODE": "1"}
+        )
+        malformed = route_detection.env_fingerprint(
+            {"CLAUDE_CODE_DISABLE_FAST_MODE": " arbitrary\ntext "}
+        )
+        self.assertEqual(exact["CLAUDE_CODE_DISABLE_FAST_MODE"], "1")
+        self.assertEqual(
+            malformed["CLAUDE_CODE_DISABLE_FAST_MODE"],
+            "<invalid:not-exact-1>",
+        )
+        self.assertNotIn("arbitrary", json.dumps(malformed))
+
+    def test_both_exact_gpt_routes_require_exact_string_one(self):
+        invalid_values = (None, "", "0", "true", "TRUE", " 1", "1 ", "01")
+        for backend in ("openai", "chatgpt"):
+            for value in invalid_values:
+                with self.subTest(backend=backend, value=value):
+                    env = self._env(backend)
+                    if value is None:
+                        env.pop("CLAUDE_CODE_DISABLE_FAST_MODE")
+                    else:
+                        env["CLAUDE_CODE_DISABLE_FAST_MODE"] = value
+                    route = route_detection.build_route_info(env)
+                    result = route_detection.probe_env_coherence(route, env)
+                    self.assertEqual(result.verdict, Verdict.FAIL)
+                    self.assertIn("exact string '1'", result.detail)
+                    self.assertIn("gpt_fast.sh", result.detail)
+                    self.assertIn("environment_settings.txt", result.detail)
+                    self.assertIn("recreate the container", result.detail)
+                    self.assertIn("new Claude session", result.detail)
+
+    def test_both_exact_gpt_routes_accept_exact_string_one(self):
+        expected_routes = {
+            "openai": route_detection.ROUTE_OPENAI_API,
+            "chatgpt": route_detection.ROUTE_CHATGPT,
+        }
+        for backend, expected_route in expected_routes.items():
+            with self.subTest(backend=backend):
+                env = self._env(backend)
+                route = route_detection.build_route_info(env)
+                result = route_detection.probe_env_coherence(route, env)
+                self.assertEqual(route.detected_route, expected_route)
+                self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+
+    def test_route_detection_accepts_clean_routes_and_rejects_incomplete_shim_attempts(self):
+        cases = (
+            (
+                "empty native environment",
+                {},
+                route_detection.ROUTE_ANTHROPIC,
+                Verdict.PASS,
+                None,
+            ),
+            (
+                "explicit native model",
+                {"ANTHROPIC_MODEL": "claude-opus-4-8"},
+                route_detection.ROUTE_ANTHROPIC,
+                Verdict.PASS,
+                None,
+            ),
+            (
+                "coherent OpenRouter controls",
+                {
+                    "ANTHROPIC_BASE_URL": "https://openrouter.ai/api",
+                    "ANTHROPIC_AUTH_TOKEN": "openrouter-test-token",
+                    "ANTHROPIC_API_KEY": "",
+                },
+                route_detection.ROUTE_OPENROUTER,
+                Verdict.PASS,
+                None,
+            ),
+            (
+                "shim control only",
+                {"DAAF_PROVIDER_SHIM": "openai"},
+                route_detection.ROUTE_ANTHROPIC,
+                Verdict.FAIL,
+                "SHIM_BACKEND_MODE",
+            ),
+            (
+                "backend control only",
+                {"SHIM_BACKEND_MODE": "openai"},
+                route_detection.ROUTE_ANTHROPIC,
+                Verdict.FAIL,
+                "DAAF_PROVIDER_SHIM",
+            ),
+            (
+                "exact ChatGPT pair",
+                {
+                    "DAAF_PROVIDER_SHIM": "openai",
+                    "SHIM_BACKEND_MODE": "chatgpt",
+                },
+                route_detection.ROUTE_CHATGPT,
+                Verdict.PASS,
+                None,
+            ),
+            (
+                "exact OpenAI pair",
+                {
+                    "DAAF_PROVIDER_SHIM": "openai",
+                    "SHIM_BACKEND_MODE": "openai",
+                },
+                route_detection.ROUTE_OPENAI_API,
+                Verdict.PASS,
+                None,
+            ),
+        )
+        for label, env, expected_route, expected_verdict, diagnostic in cases:
+            with self.subTest(label=label):
+                route = route_detection.build_route_info(env)
+                result = route_detection.probe_route_detection(route)
+                self.assertEqual(route.detected_route, expected_route)
+                self.assertEqual(result.verdict, expected_verdict, result.detail)
+                if diagnostic is not None:
+                    self.assertIn(diagnostic, result.detail)
+
+    def test_route_control_diagnostics_are_bounded_and_do_not_reflect_values(self):
+        marker = "credential-shaped-private-marker-" + "x" * 200
+        env = {
+            "DAAF_PROVIDER_SHIM": marker,
+            "SHIM_BACKEND_MODE": marker,
+        }
+        route = route_detection.build_route_info(env)
+        result = route_detection.probe_route_detection(route)
+        reported = (
+            result.detail
+            + json.dumps(route.to_dict())
+            + json.dumps(route_detection.env_fingerprint(env))
+            + "".join(
+                evidence.output + evidence.note for evidence in result.evidence
+            )
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertNotIn(marker, reported)
+        self.assertIn("<invalid:unsupported>", reported)
+        self.assertLess(len(result.detail), 500)
+
+    def test_api_route_requires_explicit_exact_openai_backend_control(self):
+        for value in (None, "", "OpenAI", " OPENAI ", "openai ", "other"):
+            with self.subTest(value=value):
+                env = self._env("openai")
+                if value is None:
+                    env.pop("SHIM_BACKEND_MODE")
+                else:
+                    env["SHIM_BACKEND_MODE"] = value
+                route = route_detection.build_route_info(env)
+                result = route_detection.probe_route_detection(route)
+                self.assertNotEqual(route.detected_route, route_detection.ROUTE_OPENAI_API)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+                self.assertIn("SHIM_BACKEND_MODE", result.detail)
+
+    def test_clean_native_tier0_has_no_route_detection_failure(self):
+        env = {}
+        route = route_detection.build_route_info(env)
+        stub = route_detection.ProbeResult(
+            probe_id="stub",
+            name="provider-free stub",
+            tier="0",
+            verdict=Verdict.SKIP,
+        )
+        with mock.patch.object(smoke_probes, "probe_cli_available", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_hook_registration", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_statuslines", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_shim_health", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_auth_json", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_workspace_invariants", return_value=stub), \
+             mock.patch.object(smoke_probes, "probe_r_locale", return_value=stub):
+            results = smoke_probes.run_tier0(route, env, base_dir="/not-used")
+        route_results = [result for result in results if result.probe_id == "T0.1"]
+        self.assertEqual(len(route_results), 1)
+        self.assertEqual(route_results[0].verdict, Verdict.PASS, route_results[0].detail)
+
+    def test_non_gpt_route_behavior_is_unchanged_by_native_disable_absence(self):
+        cases = (
+            (
+                route_detection.ROUTE_ANTHROPIC,
+                {"ANTHROPIC_MODEL": "claude-opus-4-8"},
+            ),
+            (
+                route_detection.ROUTE_OPENROUTER,
+                {
+                    "ANTHROPIC_BASE_URL": "https://openrouter.ai/api",
+                    "ANTHROPIC_AUTH_TOKEN": "openrouter-token",
+                    "ANTHROPIC_API_KEY": "",
+                },
+            ),
+        )
+        for expected_route, env in cases:
+            with self.subTest(expected_route=expected_route):
+                route = route_detection.build_route_info(env)
+                result = route_detection.probe_env_coherence(route, env)
+                self.assertEqual(route.detected_route, expected_route)
+                self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+
+
+class ShimHealthProbeTests(unittest.TestCase):
+    def _payload(self, **overrides):
+        backend = overrides.get("backend_mode", "openai")
+        tier = "priority"
+        payload = {
+            "service": "daaf-anthropic-openai-shim",
+            "status": "ok",
+            "backend_mode": backend,
+            "version": "1.3.9",
+            "sanitize_tools": True,
+            "codex_home_present": True,
+            "gpt_service_tier": {
+                "backend_mode": backend,
+                "requested_tier_vocabulary": tier,
+                "policy": {
+                    "status": "ok",
+                    "backend_mode": backend,
+                    "enabled": False,
+                    "effective": False,
+                },
+                "native_fast_disabled": True,
+                "latest_terminal": None,
+            },
+        }
+        payload.update(overrides)
+        return payload
+
+    def _probe(self, route_name, payload):
+        route = route_detection.RouteInfo(route_name)
+        with mock.patch.object(
+            smoke_probes, "_read_local_health", return_value=payload
+        ):
+            return smoke_probes.probe_shim_health(route)
+
+    def _reported_text(self, result):
+        parts = [result.detail]
+        for evidence in result.evidence:
+            parts.extend((evidence.output or "", evidence.note or ""))
+        return "\n".join(parts)
+
+    def test_probe_uses_shared_safe_local_health_reader(self):
+        route = route_detection.RouteInfo(route_detection.ROUTE_OPENAI_API)
+        payload = self._payload()
+        with mock.patch.object(
+            smoke_probes, "_read_local_health", return_value=payload
+        ) as reader:
+            result = smoke_probes.probe_shim_health(route)
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+        reader.assert_called_once_with(timeout=10)
+
+    def test_exact_service_status_route_mode_and_safe_version_pass(self):
+        result = self._probe(
+            route_detection.ROUTE_OPENAI_API,
+            self._payload(version="1.2.12+build_7-x"),
+        )
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+        self.assertIn("version=1.2.12+build_7-x", result.detail)
+
+    def test_missing_version_fails_with_bounded_marker(self):
+        payload = self._payload()
+        payload.pop("version")
+        result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("version must match", result.detail)
+        self.assertIn("version=<invalid>", reported)
+
+    def test_empty_version_fails_with_bounded_marker(self):
+        result = self._probe(
+            route_detection.ROUTE_OPENAI_API,
+            self._payload(version=""),
+        )
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("version must match", result.detail)
+        self.assertIn("version=<invalid>", reported)
+
+    def test_unsafe_version_fails_without_reflecting_endpoint_text(self):
+        unsafe_version = "release/unsafe\nprivate-version-marker"
+        result = self._probe(
+            route_detection.ROUTE_OPENAI_API,
+            self._payload(version=unsafe_version),
+        )
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("version must match", result.detail)
+        self.assertIn("version=<invalid>", reported)
+        self.assertNotIn(unsafe_version, reported)
+        self.assertNotIn("private-version-marker", reported)
+
+    def test_overlong_version_fails_without_reflecting_endpoint_text(self):
+        overlong_version = "A" * 65
+        result = self._probe(
+            route_detection.ROUTE_OPENAI_API,
+            self._payload(version=overlong_version),
+        )
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("version must match", result.detail)
+        self.assertIn("version=<invalid>", reported)
+        self.assertNotIn(overlong_version, reported)
+
+    def test_nonstring_versions_fail_with_bounded_marker(self):
+        for version in (None, 12, True, ["1.2.12"]):
+            with self.subTest(version=version):
+                result = self._probe(
+                    route_detection.ROUTE_OPENAI_API,
+                    self._payload(version=version),
+                )
+                reported = self._reported_text(result)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+                self.assertIn("version must match", result.detail)
+                self.assertIn("version=<invalid>", reported)
+
+    def test_chatgpt_boolean_true_auth_presence_passes(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT,
+            self._payload(backend_mode="chatgpt", codex_home_present=True),
+        )
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+
+    def test_chatgpt_boolean_false_auth_presence_fails(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT,
+            self._payload(backend_mode="chatgpt", codex_home_present=False),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("codex_home_present must be boolean true", result.detail)
+
+    def test_chatgpt_missing_auth_presence_fails(self):
+        payload = self._payload(backend_mode="chatgpt")
+        payload.pop("codex_home_present")
+        result = self._probe(route_detection.ROUTE_CHATGPT, payload)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("codex_home_present must be boolean true", result.detail)
+
+    def test_chatgpt_string_auth_presence_fails_with_bounded_marker(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT,
+            self._payload(backend_mode="chatgpt", codex_home_present="true"),
+        )
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("codex_home_present must be boolean true", result.detail)
+        self.assertIn("codex_home_present=<invalid>", reported)
+
+    def test_chatgpt_truthy_nonboolean_auth_presence_fails(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT,
+            self._payload(backend_mode="chatgpt", codex_home_present=1),
+        )
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("codex_home_present must be boolean true", result.detail)
+        self.assertIn("codex_home_present=<invalid>", reported)
+
+    def test_unrelated_service_degraded_status_and_wrong_mode_fail(self):
+        cases = (
+            self._payload(service="unrelated-service"),
+            self._payload(status="degraded"),
+            self._payload(backend_mode="chatgpt"),
+        )
+        for payload in cases:
+            with self.subTest(payload=payload):
+                result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+
+    def test_nonobject_and_malformed_health_json_fail_cleanly(self):
+        for payload in (["not", "an", "object"], b"{not-json"):
+            with self.subTest(payload=payload):
+                result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+                self.assertIn("invalid", result.detail)
+
+    def test_both_lane_vocabularies_and_valid_off_on_policies_pass(self):
+        lanes = (
+            (route_detection.ROUTE_OPENAI_API, "openai", "priority"),
+            (route_detection.ROUTE_CHATGPT, "chatgpt", "priority"),
+        )
+        for route_name, backend, tier in lanes:
+            for enabled in (False, True):
+                with self.subTest(backend=backend, enabled=enabled):
+                    payload = self._payload(backend_mode=backend)
+                    payload["gpt_service_tier"]["policy"].update(
+                        enabled=enabled, effective=enabled
+                    )
+                    result = self._probe(route_name, payload)
+                    self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+                    self.assertIn(f"requested_policy={'ON' if enabled else 'OFF'}", result.detail)
+                    self.assertEqual(
+                        payload["gpt_service_tier"]["requested_tier_vocabulary"], tier
+                    )
+                    self.assertIn("not proof", result.detail)
+
+    def test_legacy_requested_fast_fails_closed_on_both_backends(self):
+        lanes = (
+            (route_detection.ROUTE_OPENAI_API, "openai"),
+            (route_detection.ROUTE_CHATGPT, "chatgpt"),
+        )
+        for route_name, backend in lanes:
+            with self.subTest(backend=backend):
+                payload = self._payload(backend_mode=backend)
+                payload["gpt_service_tier"]["requested_tier_vocabulary"] = "fast"
+                payload["gpt_service_tier"]["latest_terminal"] = {
+                    "model": "gpt-5.6-sol",
+                    "requested_service_tier": "fast",
+                    "requested_source": "shim_global",
+                    "served_service_tier": "default",
+                    "completed_at": "2026-07-25T20:00:00Z",
+                }
+                result = self._probe(route_name, payload)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+                self.assertIn("must equal 'priority'", result.detail)
+
+    def test_non_ok_policy_statuses_are_valid_fail_safe_off_not_on_claims(self):
+        for status in ("missing", "invalid", "unreadable", "unsafe"):
+            with self.subTest(status=status):
+                payload = self._payload()
+                payload["gpt_service_tier"]["policy"] = {
+                    "status": status,
+                    "backend_mode": None,
+                    "enabled": False,
+                    "effective": False,
+                }
+                result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+                self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+                self.assertIn("requested_policy=OFF", result.detail)
+                self.assertIn(f"status={status}", result.detail)
+                self.assertNotIn("requested_policy=ON", self._reported_text(result))
+
+    def test_service_tier_block_and_policy_reject_missing_extra_and_incoherence(self):
+        cases = []
+        missing_block_key = self._payload()
+        missing_block_key["gpt_service_tier"].pop("native_fast_disabled")
+        cases.append(missing_block_key)
+        extra_block_key = self._payload()
+        extra_block_key["gpt_service_tier"]["path"] = "/sensitive"
+        cases.append(extra_block_key)
+        wrong_vocabulary = self._payload()
+        wrong_vocabulary["gpt_service_tier"]["requested_tier_vocabulary"] = "fast"
+        cases.append(wrong_vocabulary)
+        nonboolean_native = self._payload()
+        nonboolean_native["gpt_service_tier"]["native_fast_disabled"] = 1
+        cases.append(nonboolean_native)
+        native_not_disabled = self._payload()
+        native_not_disabled["gpt_service_tier"]["native_fast_disabled"] = False
+        cases.append(native_not_disabled)
+        extra_policy_key = self._payload()
+        extra_policy_key["gpt_service_tier"]["policy"]["extra"] = False
+        cases.append(extra_policy_key)
+        incoherent_on = self._payload()
+        incoherent_on["gpt_service_tier"]["policy"].update(
+            enabled=True, effective=False
+        )
+        cases.append(incoherent_on)
+        corrupt_claims_on = self._payload()
+        corrupt_claims_on["gpt_service_tier"]["policy"] = {
+            "status": "invalid",
+            "backend_mode": "openai",
+            "enabled": True,
+            "effective": True,
+        }
+        cases.append(corrupt_claims_on)
+        unhashable_policy_values = self._payload()
+        unhashable_policy_values["gpt_service_tier"]["policy"].update(
+            status=["ok"], backend_mode={"lane": "openai"}
+        )
+        cases.append(unhashable_policy_values)
+        for payload in cases:
+            with self.subTest(payload=payload["gpt_service_tier"]):
+                result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+
+    def test_valid_latest_terminal_passes_for_both_lanes_and_separates_requested_from_served(self):
+        lanes = (
+            (route_detection.ROUTE_OPENAI_API, "openai", "priority"),
+            (route_detection.ROUTE_CHATGPT, "chatgpt", "priority"),
+        )
+        for route_name, backend, tier in lanes:
+            with self.subTest(backend=backend):
+                payload = self._payload(backend_mode=backend)
+                payload["gpt_service_tier"]["policy"].update(
+                    enabled=True, effective=True
+                )
+                payload["gpt_service_tier"]["latest_terminal"] = {
+                    "model": "openai/gpt-5.6-sol",
+                    "requested_service_tier": tier,
+                    "requested_source": "shim_global",
+                    "served_service_tier": "default",
+                    "completed_at": "2026-07-25T20:00:00Z",
+                }
+                result = self._probe(route_name, payload)
+                self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+                self.assertIn("requested_policy=ON", result.detail)
+                self.assertIn("latest terminal served tier=default", result.detail)
+                self.assertIn("not proof", result.detail)
+
+    def test_latest_terminal_rejects_extra_or_malformed_canonical_fields(self):
+        valid = {
+            "model": "gpt-5.6-sol",
+            "requested_service_tier": "priority",
+            "requested_source": "anthropic",
+            "served_service_tier": "priority",
+            "completed_at": "2026-07-25T20:00:00Z",
+        }
+        variants = []
+        extra = dict(valid, path="/sensitive")
+        variants.append(extra)
+        for key, value in (
+            ("model", "gpt bad\nmodel"),
+            ("model", "https://private.example.invalid/model"),
+            ("requested_service_tier", "fast"),
+            ("requested_service_tier", ["priority"]),
+            ("requested_source", "NONE"),
+            ("requested_source", ["none"]),
+            ("served_service_tier", "Priority"),
+            ("served_service_tier", {"tier": "priority"}),
+            ("completed_at", "2026-02-30T20:00:00Z"),
+        ):
+            malformed = dict(valid)
+            malformed[key] = value
+            variants.append(malformed)
+        incoherent = dict(valid)
+        incoherent["requested_service_tier"] = None
+        variants.append(incoherent)
+        for latest in variants:
+            with self.subTest(latest=latest):
+                payload = self._payload()
+                payload["gpt_service_tier"]["latest_terminal"] = latest
+                result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+                self.assertEqual(result.verdict, Verdict.FAIL)
+
+    def test_health_evidence_is_bounded_projection_not_broad_health_document(self):
+        payload = self._payload(
+            backend="https://private.example.invalid/v1",
+            auth={"token": "must-not-appear"},
+            unrelated={"path": "/private/path", "content": "arbitrary"},
+        )
+        result = self._probe(route_detection.ROUTE_OPENAI_API, payload)
+        reported = self._reported_text(result)
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+        for forbidden in (
+            "private.example.invalid", "must-not-appear", "/private/path", "arbitrary"
+        ):
+            self.assertNotIn(forbidden, reported)
+
+    def test_duplicate_health_keys_fail_before_schema_validation(self):
+        payload = json.dumps(self._payload(), separators=(",", ":")).encode("utf-8")
+        duplicate = payload.replace(
+            b'{"service":', b'{"service":"duplicate","service":', 1
+        )
+        route = route_detection.RouteInfo(route_detection.ROUTE_OPENAI_API)
+        with mock.patch.object(
+            smoke_probes,
+            "_read_local_health",
+            side_effect=smoke_probes._DuplicateHealthKeyError("duplicate health JSON key"),
+        ):
+            result = smoke_probes.probe_shim_health(route)
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("duplicate health JSON key", result.detail)
+
+
+class AuthJsonProbeTests(unittest.TestCase):
+    """T0.9 (probe_auth_json): the shim /health `auth` block is authoritative for
+    chatgpt-route auth validity (v1.3.0 / A1-R6b). FAIL on
+    expired|absent|unreadable, WARN on expiring, PASS on valid, route-appropriate
+    SKIP off shim routes."""
+
+    def setUp(self):
+        # Supplementary filesystem evidence target (presence/readability only,
+        # never blocking on its own) — a real scratch dir keeps os.access() honest
+        # without requiring an actual auth.json to exist.
+        self.codex_home = _scratch_dir("codex_home")
+
+    def tearDown(self):
+        import shutil
+        shutil.rmtree(self.codex_home, ignore_errors=True)
+
+    def _route(self, route_name):
+        return route_detection.RouteInfo(route_name)
+
+    def _env(self):
+        return {"CODEX_HOME": str(self.codex_home)}
+
+    def _health(self, **auth_overrides):
+        auth = {"state": "valid", "days_left": 30}
+        auth.update(auth_overrides)
+        return {"auth": auth}
+
+    def _probe(self, route_name, env, payload):
+        route = self._route(route_name)
+        with mock.patch.object(
+            smoke_probes, "_read_local_health", return_value=payload
+        ):
+            return smoke_probes.probe_auth_json(route, env)
+
+    def test_auth_probe_uses_shared_safe_local_health_reader(self):
+        route = self._route(route_detection.ROUTE_CHATGPT)
+        payload = self._health(state="valid", days_left=45)
+        with mock.patch.object(
+            smoke_probes, "_read_local_health", return_value=payload
+        ) as reader:
+            result = smoke_probes.probe_auth_json(route, self._env())
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+        reader.assert_called_once_with(timeout=10)
+
+    def test_non_chatgpt_route_skips_without_hitting_health(self):
+        # SKIP fires on route alone; env/health are never consulted.
+        result = smoke_probes.probe_auth_json(
+            self._route(route_detection.ROUTE_OPENAI_API), {}
+        )
+        self.assertEqual(result.verdict, Verdict.SKIP)
+        self.assertIn("Not the chatgpt-subscription route", result.detail)
+
+    def test_missing_codex_home_fails_before_any_health_call(self):
+        result = smoke_probes.probe_auth_json(
+            self._route(route_detection.ROUTE_CHATGPT), {}
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("CODEX_HOME", result.detail)
+
+    def test_valid_state_passes(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="valid", days_left=45),
+        )
+        self.assertEqual(result.verdict, Verdict.PASS, result.detail)
+        self.assertIn("days_left=45", result.detail)
+
+    def test_expiring_state_warns(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="expiring", days_left=2),
+        )
+        self.assertEqual(result.verdict, Verdict.WARN)
+        self.assertIn("expires soon", result.detail)
+        self.assertIn("days_left=2", result.detail)
+
+    def test_expired_state_fails(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="expired", days_left=None),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("auth is dead", result.detail)
+        self.assertIn("state=expired", result.detail)
+
+    def test_absent_state_fails(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="absent", days_left=None),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("auth is dead", result.detail)
+        self.assertIn("state=absent", result.detail)
+
+    def test_unreadable_state_fails(self):
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="unreadable", days_left=None),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("auth is dead", result.detail)
+        self.assertIn("state=unreadable", result.detail)
+
+    def test_missing_auth_block_fails_cleanly(self):
+        # Pre-v1.3.0 shim / broken build: no "auth" key at all in /health.
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            {"service": "daaf-anthropic-openai-shim", "status": "ok"},
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("no auth block", result.detail)
+
+    def test_auth_block_wrong_type_fails_cleanly(self):
+        # Malformed shape: "auth" present but not an object.
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            {"auth": "not-an-object"},
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("no auth block", result.detail)
+
+    def test_unrecognized_state_value_fails_without_crashing(self):
+        # Garbage state string outside the known vocabulary must not crash the
+        # probe and must be bounded (never reflected verbatim) in the detail.
+        garbage_state = "totally-bogus-state"
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state=garbage_state, days_left=None),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("unexpected auth state", result.detail)
+        self.assertIn("state=<invalid>", result.detail)
+        self.assertNotIn(garbage_state, result.detail)
+
+    def test_health_reported_na_state_on_chatgpt_route_fails(self):
+        # "n/a" is a KNOWN state string, but is unexpected specifically on the
+        # chatgpt route (it's the non-shim-route marker) — must still FAIL, not
+        # crash, and the known-but-wrong-here value is reflected verbatim.
+        result = self._probe(
+            route_detection.ROUTE_CHATGPT, self._env(),
+            self._health(state="n/a", days_left=None),
+        )
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("unexpected auth state", result.detail)
+        self.assertIn("state=n/a", result.detail)
+
+    def test_health_endpoint_unreachable_fails(self):
+        route = self._route(route_detection.ROUTE_CHATGPT)
+        with mock.patch.object(
+            smoke_probes, "_read_local_health", side_effect=URLError("refused")
+        ):
+            result = smoke_probes.probe_auth_json(route, self._env())
+        self.assertEqual(result.verdict, Verdict.FAIL)
+        self.assertIn("cannot assess auth", result.detail)
+
+
 class TierDEnvSanitizationTests(unittest.TestCase):
     def test_removes_exactly_the_two_contaminants_and_preserves_the_rest(self):
         with mock.patch.dict(os.environ, {
diff --git a/user_reference/01_installation_and_quickstart.md b/user_reference/01_installation_and_quickstart.md
index 210bb896..c9e511e7 100644
--- a/user_reference/01_installation_and_quickstart.md
+++ b/user_reference/01_installation_and_quickstart.md
@@ -49,7 +49,7 @@ Claude Code is the AI assistant platform that powers this project. It runs insid
 |--------|------|-------|--------------|
 | **Anthropic Max subscription** (recommended for heavy use) | $100-200/mo flat | Interactive login on first launch -- no config needed | Best value for heavy use. You can get by with much less (perhaps even the $20/mo Pro plan) if you're doing smaller, more discrete tasks with DAAF. [Get one here](https://claude.com/pricing/max) or [upgrade an existing plan](https://claude.ai/upgrade). Team/Enterprise subscriptions also work, but mileage may vary based on organizational settings/limits. |
 | **Anthropic API key** | Pay-per-use (can get expensive fast) | Interactive login on first launch -- no config needed | Unlimited use, but a full pipeline analysis can cost $50+ in API fees. I'd have paid roughly 10x more via API key than my Max subscription. [Get one here](https://console.anthropic.com/). |
-| **OpenRouter** | Pay-per-token via openrouter.ai with a 5.5% fee on credit purchases | Configure via `environment_settings.txt` ([instructions below](#configure-authentication-via-environment_settingstxt)) | No Anthropic subscription required. OpenRouter provides access to Anthropic's Claude models as well as high-performing open-weight alternatives. **GLM 5.2** in particular [benchmarks competitively with the Opus line](https://daaf.openaugments.org/bench/) at roughly 33% of the cost — an excellent option if you want strong performance without a monthly commitment. [Get a key here](https://openrouter.ai/). |
+| **OpenRouter** | Pay-per-token via openrouter.ai with a 5.5% fee on credit purchases | Configure via `environment_settings.txt` ([instructions below](#configure-authentication-via-environment_settingstxt)) | No Anthropic subscription required. OpenRouter provides access to Anthropic's Claude models as well as high-performing open-weight alternatives: [per DAAFBench](https://daaf.openaugments.org/bench/), **Kimi K3** reaches the top performance tier outright, **GLM 5.2** sits among the Opus-line models at ~22% of Opus 4.8's cost, and **DeepSeek V4 Flash** / **Gemma 4 31B** deliver credible budget performance at ~2-3% — strong options at every price point without a monthly commitment. [Get a key here](https://openrouter.ai/). |
 | **OpenAI** (API key or ChatGPT subscription) | OpenAI API pay-per-use, or your existing ChatGPT subscription | Configure via `environment_settings.txt` + one rebuild ([Option F instructions](#option-f-openai-api-directly-daaf-provider-shim)) | Run DAAF on GPT models with no Anthropic account. These are supported routes that benefit from wider community testing; the ChatGPT-subscription lane in particular has a smaller context ceiling, so it comes with practical [session-length guidance](#option-f-alternate-lane-chatgpt-subscription-codex-backend). |
 | **Cloud providers** (Bedrock, Vertex AI) | Per your organization's arrangement | Configure via `environment_settings.txt` ([instructions below](#configure-authentication-via-environment_settingstxt)) | Route through your org's existing cloud platform. DAAF provides configuration templates for these (see `environment_settings_example.txt` in `daaf-docker` for the required variables), aimed at organizations already running on Bedrock or Vertex. Note that DAAF's maintainers haven't been able to validate these two routes end-to-end ourselves — so treat them as a starting point you'll stand up and test in your own environment, and please share reports if you run them. |
 
@@ -185,15 +185,9 @@ On first launch, Claude Code should prompt you to authenticate (API key or subsc
 
 ### Configure Claude Code (optional)
 
-Once you're in, there are a few settings you can adjust to your liking. You can check which Claude model is being used by checking the indicator below the chat line (Opus, Sonnet, Haiku). DAAF defaults to using **Opus 4.8** with 1 million token context -- no action needed on your part. You can change which Claude model is being used at any time by typing `/model`. Development and testing has spanned several Anthropic model generations, and [empirical benchmarking across available Anthropic and open-weight models](https://daaf.openaugments.org/bench/) has shown that several models perform excellently with DAAF's orchestration workflows. The table below reflects just a small quick reference:
+Once you're in, there are a few settings you can adjust to your liking. You can check which Claude model is being used by checking the indicator below the chat line (Opus, Sonnet, Haiku). DAAF defaults to using **Opus 4.8** with 1 million token context -- no action needed on your part. You can change which Claude model is being used at any time by typing `/model`. Development and testing has spanned several Anthropic model generations, and [empirical benchmarking across 29 Anthropic, OpenAI, Google, and open-weight models](https://daaf.openaugments.org/bench/) has shown that several models perform excellently with DAAF's orchestration workflows -- at very different price points.
 
-| Model | Benchmark Performance | Relative Cost | Best For |
-|-------|----------------------|---------------|----------|
-| **Opus 4.8** | Strong | 1.0x (baseline) | Maximum analytical reasoning depth; complex methodology |
-| **Sonnet 4.6** and **Sonnet 5** | Excellent — #2 and #3 overall | ~0.44x-0.56x | Best cost-performance ratio with an Anthropic subscription |
-| **GLM 5.2** (via OpenRouter) | Excellent — #4 overall, competitive with the Opus line | ~0.33x | Strong performance without an Anthropic subscription |
-
-The current shipped default is **Opus 4.8**, chosen for its analytical reasoning depth on complex tasks; the benchmarked results above show that the lower-cost Sonnet tier is a genuinely excellent alternative at a fraction of the cost, and GLM 5.2 via OpenRouter makes DAAF accessible without any Anthropic subscription at all. Because new model generations arrive faster than we can revise this guide, treat [daaf.openaugments.org/bench](https://daaf.openaugments.org/bench/) as the live, continuously updated results page -- it carries standings for newer model generations (including newer Opus and Sonnet releases) as we benchmark them, so check there rather than assuming the table above is current. It helps to be clear about what these scores can and can't decide for you. This testing (called DAAFBench, with full public results at [daaf.openaugments.org/bench](https://daaf.openaugments.org/bench/)) measures how reliably a model *follows DAAF's process* — classifying your request correctly, dispatching the right specialists, loading the right skills, and honoring the confirmation gates. That is exactly the question that matters when you're weighing a model against your budget: it tells you which models you can trust to drive the framework faithfully at a given price point. What it does **not** measure is which model produces *better research* — the depth of analytical reasoning and judgment on the hardest problems. Opus may still have an edge there, though the gap between the top models is smaller than once assumed. So use the scores to pick a model you can afford that stays on-protocol, and remember that your own review of the output is still what judges the quality of the analysis itself.
+The short version, as of the July 2026 corpus: **Fable 5** is the top performer if budget is not a constraint; **GPT-5.6 Sol** and **Sonnet 5** deliver top-tier performance at moderate cost; **GPT-5.6 Luna** covers most of that capability for a fraction of the spend; and on the open-weights side, **Kimi K3** reaches the top tier while **GLM 5.2**, **DeepSeek V4 Flash**, and **Gemma 4 31B** anchor the self-hosting and budget end. The canonical, regularly refreshed guidance table lives in the FAQ — see [**Which Claude model should I use?**](07_faq_technical.md#q-which-claude-model-should-i-use) — and because new model generations arrive faster than we can revise this guide, treat [daaf.openaugments.org/bench](https://daaf.openaugments.org/bench/) as the live results page rather than assuming any table in the docs is current. It helps to be clear about what these scores can and can't decide for you. This testing (called DAAFBench, with full public results at [daaf.openaugments.org/bench](https://daaf.openaugments.org/bench/)) measures how reliably a model *follows DAAF's process* — classifying your request correctly, dispatching the right specialists, loading the right skills, and honoring the confirmation gates. That is exactly the question that matters when you're weighing a model against your budget: it tells you which models you can trust to drive the framework faithfully at a given price point. What it does **not** measure is which model produces *better research* — the depth of analytical reasoning and judgment on the hardest problems. Opus may still have an edge there, though the gap between the top models is smaller than once assumed. So use the scores to pick a model you can afford that stays on-protocol, and remember that your own review of the output is still what judges the quality of the analysis itself.
 
 Current Claude models also let you select a "thinking level" by tapping the left-and-right arrow keys while the model is selected on the /model selector in Claude Code. All tests I've conducted to date use the "High" setting -- as this is a case where quality is far more important than quantity, I strongly recommend doing the same. This will have usage and API limit ramifications, though, so it is a reasonable thing to test out the tradeoffs for yourself. The [DAAFBench results](https://daaf.openaugments.org/bench/) are a great starting reference for understanding the quality-cost frontier across models. Please do report back with any findings so we can continue to refine this guidance!
 
@@ -371,9 +365,64 @@ You can also use the Docker Desktop GUI to explore the DAAF docker volume by nav
 - **Getting a large research folder out wholesale:** rather than zipping folder by folder, take a full **backup** — from the DAAF Control Panel choose **option 7, "Create Backup"** — which copies *everything* (all your research data) out to your host machine in one step. See [**Backing Up Your Work**](#backing-up-your-work) below.
 - **Bringing files in:** drag and drop them from your computer straight onto the editor's file explorer sidebar — this works for single files and whole folders (see *Getting files INTO the container* above).
 
+### Linking Host Folders into the Container (Bind Mounts)
+
+The drag-and-drop upload described above is the right tool for most files. But if you have a **large local dataset** — tens of gigabytes of parquet, a folder of survey extracts, a directory you refresh regularly from elsewhere — copying it through the browser editor is slow and duplicates the data into the Docker volume. For those cases you can **bind-mount** a folder on your computer straight into the container, so DAAF reads your files in place. Reach for this when the data is bulky or lives naturally on your host; stick with the [drag-and-drop upload](#viewing-and-editing-files) for the occasional single file or small dataset.
+
+DAAF ships this capability **off by default** as a commented-out block in `docker-compose.yml` that you opt into. The recommended pattern is a **read-only** mount of one host folder onto `/host_data` inside the container.
+
+**Set it up (edit in the container, then rebuild):**
+
+1. **Open the container's copy of `docker-compose.yml`.** Edit it *inside* the container — either ask Claude to edit `/daaf/docker-compose.yml`, or open it in the [browser-based code editor](#viewing-and-editing-files). This matters: `rebuild_daaf.sh` copies the container's compose file *out* to your host and rebuilds from it, so a host-side edit is silently overwritten on the next rebuild. Editing the container copy is the only change that survives.
+2. **Uncomment the bind-mount block** in the `daaf-docker` service's `volumes:` section and set `source:` to the folder on your computer you want to expose. Leave `read_only: true` in place:
+   ```yaml
+   # In the daaf-docker service, under volumes:
+   - type: bind
+     source: /Users/yourname/datasets   # <-- your host folder (Windows: C:\Users\yourname\datasets)
+     target: /host_data
+     read_only: true
+   ```
+3. **Rebuild so the host picks up the change:**
+
+   **macOS / Linux (Terminal):**
+   ```bash
+   cd daaf-docker
+   bash rebuild_daaf.sh
+   ```
+
+   **Windows (PowerShell):**
+   ```powershell
+   cd daaf-docker
+   .\rebuild_daaf.ps1
+   ```
+
+Your files now appear at `/host_data` inside the container, and DAAF can read them directly.
+
+**Why the long (`type: bind`) syntax?** DAAF uses the verbose form on purpose: if you mistype `source:`, Docker **fails loudly** with a clear error. The short one-line form (`./typo:/host_data`) instead **silently creates an empty directory** at the bad path — so a typo would leave DAAF staring at an empty `/host_data` with no hint why.
+
+**Permissions: will your files be readable?** The container runs as a non-root user, `appuser` (UID/GID **1000**), and — unlike the two managed Docker volumes — a bind mount is **not** ownership-corrected by DAAF's `daaf-init` step. Whether `appuser` can read your files therefore depends on your platform:
+
+| Your platform | Read-only mount | What's happening |
+|---------------|-----------------|------------------|
+| **macOS (Docker Desktop)** | Generally just works | Docker Desktop translates/fakes ownership, so your files appear owned by the container user regardless of your Mac UID (behavior is version-dependent; rare file-sharing bugs exist) |
+| **Windows — `/mnt/c/...` (WSL2)** or a path shared in Docker Desktop | Just works | Windows permissions are translated through the Docker Desktop file-sharing layer |
+| **Native Linux** | Works **if** UID 1000 can read the files | Real UID/GID pass-through — no translation layer. Only the numbers matter, not usernames |
+| **Windows — WSL filesystem path** (`/home/<you>` inside a distro) | Works **if** UID 1000 can read the files | Native Linux rules apply inside the distro — the same case as native Linux |
+
+On the two "if" rows, diagnose with `ls -ln` (the `-n` shows **numeric** owner IDs): if your files aren't owned by `1000` and aren't world-readable, `appuser` can't read them. The simplest fix for a read-only data folder is to make it group- or world-readable on the host.
+
+**Advanced: write-enabled mounts.** Keep `read_only: true` unless you have a specific reason to let the container write back to your host folder — a read-only mount is safer and keeps DAAF from ever modifying your source data. If you *do* need writes (drop `read_only: true`), permissions get stricter:
+
+- **Native Linux / WSL-filesystem paths:** the container writes files as UID 1000, so align ownership — either `chown` the host folder to UID 1000, or add yourself to a shared group and make the folder group-writable. **Don't reach for `chmod 777`** — it works, but it exposes the folder to every user on the machine; group alignment is the right tool.
+- **macOS and Windows `/mnt/c` paths:** writes "just work" through the Docker Desktop translation layer, with files landing under your host user on the other side.
+
+> **Reproducibility trade-off — a deliberate decision to make.** Bind-mounted files live **outside** DAAF's archive and hash boundary: they are not captured by `backup_daaf.sh` and not part of the project's audit trail. That means reproducing the analysis later depends on *you* guaranteeing the same files are present at the same mount point — DAAF can't freeze them for you. The recommended mitigation is to have your **fetch scripts copy** the inputs you actually use from `/host_data` into the project's own `data/raw/` directory (with the normal raw-data naming conventions). The bind mount then serves as a fast on-ramp, while the archived working copy inside the project keeps the audit trail complete.
+
+> **Boundary.** `/host_data` is *not* covered by `backup_daaf.sh`, so never treat it as a place to store DAAF outputs — write results into your project as usual. And never point a bind mount at the container's own system paths (`/daaf`, `/daaf/.claude`, and the like): mounting over DAAF's own files would shadow them and break the install.
+
 ### Backing Up Your Work
 
-Since your research files live inside the Docker volume, it'll be extremely important to regularly back up your work separately from the Docker volume. The easiest way is from the **DAAF Control Panel** — run `bash daaf.sh` (`.\daaf.ps1` on Windows) in your `daaf-docker` folder and choose **option 7, "Create Backup."** If you'd rather call the backup script directly, that works too:
+Since your research files live inside the Docker volume, it'll be extremely important to regularly back up your work separately from the Docker volume. The easiest way is from the **DAAF Control Panel** — run `bash daaf.sh` (`.\daaf.ps1` on Windows) in your `daaf-docker` folder and choose **option 7, "Create Backup."** (If you've set up a [shared research workspace](#sharing-one-research-workspace-across-two-installs-advanced) across two installs, note the caveat in that section: run backups from **one** install only.) If you'd rather call the backup script directly, that works too:
 
 **macOS / Linux (Terminal):**
 
@@ -391,7 +440,7 @@ cd daaf-docker
 
 The backup script creates a date-versioned folder (e.g., `2026-04-21_daaf_backup/`) in your `daaf-docker` directory. Multiple backups on the same day are automatically suffixed (`2026-04-21a_daaf_backup/`, `2026-04-21b_daaf_backup/`, etc.). Feel free to move or copy these folders to another location on your computer (or an external drive) for safekeeping.
 
-The backup script also checks itself as it goes: it verifies there's enough free disk space before it starts (and stops with a clear message if there isn't), and after copying it compares the backup against the original — checking both the number of files and their total size — so a truncated or incomplete backup gets flagged with a warning rather than passing silently.
+The backup script also checks itself as it goes: it verifies there's enough free disk space before it starts (and stops with a clear message if there isn't), and after copying it compares the backup against the original — checking both the number of files and their total size. How a shortfall is handled depends on how serious it is. If the copy step itself reports an error *and* fewer files landed than the volume scan expected, the backup is treated as genuinely incomplete: the script stops with an error and a nonzero exit code, and tells you to delete the partial backup folder and re-run once the problem is resolved (any tool that ran the backup for you — the updater or the migration tool — then halts too, rather than continuing on top of a bad backup). A milder discrepancy — the copy reported success but the file count or total size is still a little off — is flagged as a warning instead: the backup finishes, but its completion banner reads `Backup completed WITH WARNINGS -- verify before relying on it` rather than the plain `Backup complete!`, so a questionable backup never passes silently.
 
 The backup covers both DAAF volumes: your research data, plus Claude Code's own state (your login, session history, and plugins) in a hidden `.daaf-claude-config/` subfolder. **Because the backup includes your Claude Code login credentials, treat backup folders as sensitive** — store them somewhere private, and if you share a backup with a colleague for collaboration, delete the `.daaf-claude-config/` subfolder from the copy first. (The backup also contains one or two small hidden manifest files you can ignore — the restore consumes them automatically. `.daaf-permissions` records which files were executable, so the restore can put file permissions back correctly even when the backup was stored on a Windows drive, which does not preserve them. `.daaf-symlinks`, present only when your data contains symbolic links, records those links so the restore can recreate them — this is what lets backups complete cleanly on Windows, where the copy step would otherwise stop at the first symbolic link.)
 
@@ -585,8 +634,8 @@ You usually don't even have to add that line by hand: when you run an update wit
 
 If `DAAF_BRANCH` is set nowhere, the updater defaults to `main` (or `master` if `main` doesn't exist). Either way, the script validates that the branch exists on the remote before proceeding.
 
-> **Tags behave differently from branches for updates.** `DAAF_BRANCH` steers *ongoing* updates, and only a **branch** can be followed — a version tag like `v3.0.0` is a fixed snapshot with nowhere newer to move to. The updater handles a tag two ways depending on where it came from:
-> - **Set in your environment** (e.g. `DAAF_BRANCH=v3.0.0 bash update_daaf.sh`): the updater **declines**, explains why, makes no changes, and points you at the supported way to move onto a release — re-running the installer pinned to that tag (see ["Installing a specific version or branch"](#installing-a-specific-version-or-branch) below). A tag is never saved as your update branch, so ongoing updates keep tracking your persisted or default branch.
+> **Tags behave differently from branches for updates.** `DAAF_BRANCH` steers *ongoing* updates, and only a **branch** can be followed — a version tag like `v3.0.1` is a fixed snapshot with nowhere newer to move to. The updater handles a tag two ways depending on where it came from:
+> - **Set in your environment** (e.g. `DAAF_BRANCH=v3.0.1 bash update_daaf.sh`): the updater **declines**, explains why, makes no changes, and points you at the supported way to move onto a release — re-running the installer pinned to that tag (see ["Installing a specific version or branch"](#installing-a-specific-version-or-branch) below). A tag is never saved as your update branch, so ongoing updates keep tracking your persisted or default branch.
 > - **Left over in `environment_settings.txt`** (for example after a tagged install): the updater prints a warning naming the file and key, then falls back to the auto-detected default branch for that run so you are never locked out. Edit the file to set a real branch (or remove the line) to silence the warning.
 
 Your research files in `research/` are not tracked by git (they're local to your volume), so they are completely unaffected by updates.
@@ -609,7 +658,7 @@ Most updates don't change the Dockerfile, so usually `git pull` inside the conta
 ```bash
 # Inside the container
 git fetch --tags
-git checkout v3.0.0
+git checkout v3.0.1
 ```
 
 Check the [Releases page](https://github.com/DAAF-Contribution-Community/daaf/releases) to see what's changed in each version.
@@ -654,7 +703,7 @@ By default, the installer pulls the latest code from the `main` branch. To insta
 
 ```bash
 # Install a tagged release
-export DAAF_BRANCH=v3.0.0
+export DAAF_BRANCH=v3.0.1
 curl -fsSL "https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/${DAAF_BRANCH}/scripts/host/install.sh" | bash
 
 # Install from a development branch
@@ -666,7 +715,7 @@ curl -fsSL "https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/$
 
 ```powershell
 # Install a tagged release
-$env:DAAF_BRANCH="v3.0.0"; irm "https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/$env:DAAF_BRANCH/scripts/host/install.ps1" | iex
+$env:DAAF_BRANCH="v3.0.1"; irm "https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/$env:DAAF_BRANCH/scripts/host/install.ps1" | iex
 
 # Install from a development branch
 $env:DAAF_BRANCH="dev"; irm "https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/$env:DAAF_BRANCH/scripts/host/install.ps1" | iex
@@ -681,7 +730,7 @@ This fetches the installer itself from the specified branch or tag, and also con
 When the installer finishes, it sets up your `environment_settings.txt` so any DAAF options you chose at install time carry forward on their own:
 
 - **If you have no `environment_settings.txt` yet** (a typical fresh install), the installer copies the `environment_settings_example.txt` template into place as your new `environment_settings.txt`, then activates any of the six install-time `DAAF_*` options it finds in your environment — `DAAF_PROJECT_NAME`, `DAAF_PORT_MARIMO`, `DAAF_PORT_LOGVIEWER`, `DAAF_PORT_VSCODE`, `DAAF_DEV`, and `DAAF_BRANCH` — writing each one into the file in its proper place (in context, right where that setting is documented). So if you exported any of these before installing (for a specific branch, a second instance, or a developer build), you don't have to re-enter them: they're already saved for every future launch and update.
-- **`DAAF_BRANCH` is seeded only when it names a branch.** If you installed pinned to a version *tag* (e.g. `v3.0.0`), the installer does **not** write that tag into the file — a persisted tag would block future updates — and prints a short note saying so. Ongoing updates then track the default branch (see [Keeping DAAF Updated](#keeping-daaf-updated)).
+- **`DAAF_BRANCH` is seeded only when it names a branch.** If you installed pinned to a version *tag* (e.g. `v3.0.1`), the installer does **not** write that tag into the file — a persisted tag would block future updates — and prints a short note saying so. Ongoing updates then track the default branch (see [Keeping DAAF Updated](#keeping-daaf-updated)).
 - **Seeded settings take effect immediately — the installer restarts the container for you.** Because Docker injects `environment_settings.txt` into the container when the container is *created*, and a fresh install creates the container before the seeded file exists, the installer finishes by briefly recreating the container so your new settings file is in effect right away. This is automatic and takes only a few seconds; your files are safe in the Docker volume. You will *not* see the "environment_settings.txt has been modified since this container was started" note on your first launch after a fresh install. In the rare event this restart step fails, the installer prints instructions — just run `docker compose down` from your `daaf-docker` folder and launch normally, which applies the settings the same way.
 - **A reinstall never overwrites an existing `environment_settings.txt`.** If the file already exists, the installer leaves it completely untouched — your real API keys and settings are safe — and notes that any `DAAF_*` variables you set were used for that install run only. Because a reinstall reuses your existing file rather than re-reading your environment, install-time env vars must be set again on each reinstall to steer *that run*, and if you want to persist a *changed* value you edit the file yourself.
 - **The installer always prints an outcome note** at the end telling you exactly what happened — which values were seeded, that an existing file was preserved, or (in the rare event seeding can't complete) manual instructions for copying the template yourself. Seeding never blocks or fails the install.
@@ -736,7 +785,7 @@ If the installer detects a previous attempt that didn't complete successfully (e
 
 ### Running multiple DAAF instances
 
-Most people run a single DAAF installation and never need this section. But if you want **two (or more) independent DAAF installs on the same machine** — for example, one folder for work and another for personal projects, each with its own Docker volume and research history — you can, with a small amount of configuration.
+Most people run a single DAAF installation and never need this section. But if you want **two (or more) independent DAAF installs on the same machine** — for example, one folder for work and another for personal projects, each with its own Docker volume and research history — you can, with a small amount of configuration. (If instead you want two installs to **share** one research workspace — say, to work the same projects from both a Claude and a ChatGPT install — see [Sharing One Research Workspace Across Two Installs](#sharing-one-research-workspace-across-two-installs-advanced) below; that pattern is the deliberate exception to the per-instance volumes described here.)
 
 Two things must be unique per install so they don't collide:
 
@@ -781,6 +830,73 @@ The DAAF launcher and control-panel scripts (`run_daaf`, `daaf`, the `view_*` br
 
 > **Changing these on an existing install** requires the same `docker compose down` + relaunch: the project name and published ports are baked in at container-creation time, so a running container will not adopt new values until it is recreated. Your data volume moves with the project name — renaming `DAAF_PROJECT_NAME` on an existing install points it at a *different* (empty) volume, so choose the name once, up front.
 
+### Sharing One Research Workspace Across Two Installs (Advanced)
+
+The section above sets up **independent** instances — each with its own research volume and history. This one does the opposite: it points **two** DAAF installs at a **single, shared research workspace**, so both can work the same `research/` folder, projects, and audit trail.
+
+The motivating scenario is running **two different AI providers against one body of work** — for example, one install authenticated to your **Claude (Anthropic) subscription** and a second install on your **ChatGPT subscription** via the [provider shim](#option-f-alternate-lane-chatgpt-subscription-codex-backend). Each install keeps its **own** configuration and authentication volume (`<project>_daaf-claude-config`), so their logins never collide — only the *research data* volume is shared.
+
+DAAF supports this with a setting, **`DAAF_DATA_VOLUME_NAME`**, plus a second commented opt-in block in `docker-compose.yml`. `DAAF_DATA_VOLUME_NAME` overrides the full Docker volume name for the shared research data (leave it unset and each install gets its own default `<project>_daaf-data`, exactly as in the section above). Its value must match the `name:` in the compose file's external-volume block. The steps below convert two installs to share one volume.
+
+**Step 1 — Install the first instance normally.** Follow the standard [installation](#installing-daaf), let it run, and confirm your research data is where you expect. Its data volume is `<project1>_daaf-data` (where `<project1>` is its `DAAF_PROJECT_NAME`, default `daaf` — so the default volume is `daaf_daaf-data`).
+
+**Step 2 — Convert the first install to an external (shared) volume.** Edit the **container's** copy of `docker-compose.yml` (via Claude or the [browser editor](#viewing-and-editing-files) — remember `rebuild_daaf.sh` copies the container's copy out over the host one, so the container-side edit is the one that survives). Uncomment the external-volume block under the top-level `daaf-data:` key and set `name:` to the volume's **existing** full name:
+
+   ```yaml
+   volumes:
+     daaf-data:
+       external: true
+       name: daaf_daaf-data      # <-- your existing <project1>_daaf-data volume
+   ```
+
+   Then set the matching line in the **host** `environment_settings.txt`:
+
+   ```
+   DAAF_DATA_VOLUME_NAME=daaf_daaf-data
+   ```
+
+   Rebuild (`bash rebuild_daaf.sh` / `.\rebuild_daaf.ps1`). Nothing about this install's behavior changes — it still uses the same data — but the volume is now declared `external`, which has one important consequence: **`docker compose down -v` will no longer delete it.** Compose never removes external volumes, so your shared research data is now immune to an accidental `-v` wipe. (Deliberate deletion still works via `docker volume rm` — see the caveats.)
+
+**Step 3 — Install the second instance, pre-seeded to the shared volume.** Install into a **different folder**, giving it a distinct project name, distinct ports, **its own provider/auth settings** (e.g. the [ChatGPT-subscription shim lane](#option-f-alternate-lane-chatgpt-subscription-codex-backend)), and `DAAF_DATA_VOLUME_NAME` **exported at install time** so it lands in the new install's `environment_settings.txt` from the start (the value stays inert until Step 4 activates the shared volume):
+
+   **macOS / Linux (Terminal):**
+
+   ```bash
+   export DAAF_PROJECT_NAME=daaf-gpt
+   export DAAF_PORT_MARIMO=2818
+   export DAAF_PORT_LOGVIEWER=2819
+   export DAAF_PORT_VSCODE=2820
+   export DAAF_DATA_VOLUME_NAME=daaf_daaf-data     # same shared volume as install #1
+   curl -fsSL https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/main/scripts/host/install.sh | bash
+   ```
+
+   **Windows (PowerShell):**
+
+   ```powershell
+   $env:DAAF_PROJECT_NAME = "daaf-gpt"
+   $env:DAAF_PORT_MARIMO = "2818"
+   $env:DAAF_PORT_LOGVIEWER = "2819"
+   $env:DAAF_PORT_VSCODE = "2820"
+   $env:DAAF_DATA_VOLUME_NAME = "daaf_daaf-data"
+   irm https://raw.githubusercontent.com/DAAF-Contribution-Community/daaf/main/scripts/host/install.ps1 | iex
+   ```
+
+**Step 4 — Convert the second install identically.** The installer still had to create the container from a compose file referencing this instance's *own* `<project2>_daaf-data`, so a transitional volume (`daaf-gpt_daaf-data` in the example) now exists and holds only the fresh repo clone. Convert this install exactly as in Step 2 — uncomment the external block in its container compose, set `name: daaf_daaf-data`, confirm `DAAF_DATA_VOLUME_NAME=daaf_daaf-data` is in its `environment_settings.txt`, and rebuild. Once it comes up on the shared volume, delete the now-orphaned transitional volume:
+
+   ```bash
+   docker volume ls | grep daaf-gpt_daaf-data      # confirm it exists and is unused
+   docker volume rm daaf-gpt_daaf-data             # remove the orphaned transitional volume
+   ```
+
+**Step 5 — Steady state.** Both installs now mount the **same** `daaf_daaf-data` volume, which means they share **one** `/daaf` — including a single canonical `docker-compose.yml` and the whole framework tree. Because there is only one copy of those files, a rebuild of *either* install reads and writes the *same* compose file, so the two installs stay consistent by construction; you never maintain two diverging compose files. Each install still keeps its own separate `*_daaf-claude-config` volume, so its provider login and session history remain its own.
+
+> **Caveats — read before you rely on this.**
+> - **One active pipeline per research project at a time.** Docker provides *no* write coordination between two containers on one volume. Running two analysis pipelines against the same project simultaneously can corrupt files. Coordinate yourself: let one install work a given project at a time. (Working *different* projects in the shared workspace concurrently is fine.)
+> - **Back up from one install only.** Both installs see the same data, so a single `backup_daaf.sh` run from *either* one captures everything — running backups from both just duplicates work and can race.
+> - **Shim state splits across the two volumes.** Each container runs at most one provider-shim instance at a time. The shim's operational telemetry on the shared workspace (`scripts/provider_shim/logs/`) is therefore install-shared, while its reasoning-cache continuity file stays per-container on that install's own `*_daaf-claude-config` volume (`~/.claude/provider_shim/reasoning_cache.json`) — so the shim lane's reasoning continuity never crosses between the two installs.
+> - **Deleting the shared volume is deliberate.** Because it's external, `docker compose down -v` won't touch it. To actually delete it you must bring **both** installs down (no container may reference it) and run `docker volume rm daaf_daaf-data` explicitly.
+> - **The second install's initial clone is discarded.** The transitional `<project2>_daaf-data` volume created at Step 3 held only a fresh repo clone; converting to the shared volume in Step 4 abandons it (you delete it), and install #2 adopts install #1's existing `/daaf`. That's expected.
+
 ### Building with the developer test toolchain (DAAF_DEV)
 
 Most people never need this section — it is for **framework developers** who want to run DAAF's own shell and PowerShell test suites (`bats` and Pester) *inside* the container, so an in-container run reproduces what the project's CI does.
@@ -824,15 +940,13 @@ Including R (with the full package set and Quarto) accounts for roughly **2 GB**
 
 **To use R**, just tell DAAF "set execution language to R" at the start of a session — no configuration files to edit. See the [R and Language Support FAQ](07_faq_technical.md#r-and-language-support) for details on switching between languages.
 
-The smoke tests and their runner in `scripts/smoke_tests/` exercise each R library skill, plus a Python import smoke (`smoke_imports.py`) covering the pinned Python analysis stack; all run via `run_all_smoke_tests.sh` in any DAAF container.
-
 #### Coming from Stata or R? Get code comments in your language
 
 If your background is in **Stata** or **R** rather than Python, you don't have to read unfamiliar code cold. Just tell DAAF your background once — for example, "I'm coming from Stata" or "my background is in R" — and it will offer to save that as a preference. From then on, every piece of analysis code DAAF writes carries inline comments showing the equivalent command in your language: Stata users see the `reghdfe`, `xtreg`, `esttab`, and `svy:` equivalents next to the Python (or R) that runs, and R users see their familiar `tidyverse`/`fixest` equivalents. This is powered by DAAF's built-in translation skills, so it stays accurate to the actual code. The preference persists across sessions, and turning it on is entirely conversational — there are no configuration files to edit and nothing to set up in advance. (Under the hood this sets the cross-language annotation preference described in `CLAUDE.md` § User Preferences; you never have to touch that file yourself.)
 
 ### Configure authentication via environment_settings.txt
 
-By default, Claude Code prompts you to log in interactively the first time you launch it (browser-based OAuth or pasting an API key). This works great for Max subscription and direct API key setups. However, if you're using **OpenRouter**, a **cloud provider** (Bedrock/Vertex), or simply want your authentication to persist automatically without interactive login, you can configure it through the `environment_settings.txt` file in your `daaf-docker` folder.
+By default, Claude Code prompts you to log in interactively the first time you launch it (browser-based OAuth or pasting an API key). This works great for Max subscription and direct API key setups — and since your login now persists across rebuilds, signing in once is genuinely enough. However, if you're using **OpenRouter**, a **cloud provider** (Bedrock/Vertex), or simply want your authentication to persist automatically without interactive login, you can configure it through the `environment_settings.txt` file in your `daaf-docker` folder. (Subscription users who run *several* DAAF installs, or who want fully non-interactive startup, have one more option there: a one-time `claude setup-token` command mints a long-lived token you can paste into the file — see Option B in its authentication section. A normal single install doesn't need it.)
 
 Your `daaf-docker` folder includes an `environment_settings_example.txt` template. It opens with a table of contents and is organized into six numbered, lifecycle-tagged sections — **[1] Install & Update Settings**, **[2] Claude Code Authentication**, **[3] Model Routing**, **[4] Alternative Providers & Shim**, **[5] Data Source API Keys**, and **[6] Workspace & Developer Options** — so you can jump straight to the part you need. Authentication lives in **section [2]**, which covers the five direct authentication options (Options A-E) — plus interactive browser login, which needs no environment variables — and points to **section [4]** for the OpenAI/ChatGPT provider shim (Option F). To set it up:
 
@@ -929,9 +1043,12 @@ ANTHROPIC_BASE_URL=https://openrouter.ai/api
 ANTHROPIC_AUTH_TOKEN=your_openrouter_api_key_here
 ANTHROPIC_API_KEY=
 ANTHROPIC_MODEL=openai/gpt-5.6-sol
-ANTHROPIC_DEFAULT_OPUS_MODEL=openai/gpt-5.6-sol       # strong tier (Opus-analog)
-ANTHROPIC_DEFAULT_SONNET_MODEL=openai/gpt-5.6-terra   # fast tier (Sonnet-analog)
-CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000               # see "known limitations" below
+# Strong tier (Opus-analog):
+ANTHROPIC_DEFAULT_OPUS_MODEL=openai/gpt-5.6-sol
+# Fast tier (Sonnet-analog):
+ANTHROPIC_DEFAULT_SONNET_MODEL=openai/gpt-5.6-terra
+# Context window -- see "known limitations" below:
+CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000
 ```
 
 Recommended GPT slugs (context windows and roles verified against OpenRouter on 2026-07-09):
@@ -949,7 +1066,7 @@ The two-tier routing described above works identically: map `ANTHROPIC_DEFAULT_O
 
 > **GPT-5.6 tier naming:** the GPT-5.6 family uses OpenAI's tier-analog names — *Sol* (strong; Opus-analog), *Terra* (mid; Sonnet-analog), and *Luna* (economy; Haiku-analog) — all with 1,050,000-token windows. DAAF's recommended defaults are Sol and Terra, validated live through the full agentic stack (including subagent dispatch on the tier remaps) on 2026-07-09, the day of the OpenRouter release.
 >
-> **Avoid the `-pro` slugs via OpenRouter (Option C):** despite listing the same 1,050,000-token windows and identical pricing, `gpt-5.6-sol-pro` / `-terra-pro` / `-luna-pro` fail with hard "Prompt is too long" API errors once a session's real context reaches roughly 50k tokens — through the Anthropic-compatible endpoint their token accounting runs ~4x the non-pro count against an enforced ~200k ceiling, and the inflation also makes them bill ~2-4x more for identical work. Empirically verified across all three -pro variants in the 2026-07-10 DAAFBench smoke battery (see `benchmarks/README.md` § 1). The non-pro slugs are unaffected.
+> **Avoid the `-pro` slugs via OpenRouter (Option C) — they fail and cost more.** `gpt-5.6-sol-pro` / `-terra-pro` / `-luna-pro` error out with hard "Prompt is too long" failures once a session grows past roughly 50k tokens, and they bill ~2-4x more for identical work (their token accounting runs ~4x the non-pro count against an enforced ~200k ceiling). Empirically verified across all three -pro variants in the 2026-07-10 DAAFBench smoke battery (see `benchmarks/README.md` § 1); the non-pro slugs are unaffected.
 
 **Restart the container** (`docker compose down`, then `bash run_daaf.sh`) to pick up the changes. No rebuild is needed for OpenRouter — it is config-only.
 
@@ -957,26 +1074,32 @@ The two-tier routing described above works identically: map `ANTHROPIC_DEFAULT_O
 
 **Who this is for:** researchers who have an **OpenAI API key** (pay-per-use) and would rather talk to OpenAI directly, with no OpenRouter middle-hop.
 
-**What you'll end up with:** DAAF running on GPT models through a lightweight translation shim that ships built into DAAF. The shim presents an Anthropic-compatible endpoint on `localhost`, quietly forwards your requests to OpenAI, has **zero new dependencies**, and starts automatically inside the container — once it's set up, you won't think about it again. (Would you rather use a **ChatGPT subscription** than a pay-per-use API key? Skip ahead to the [ChatGPT subscription lane](#option-f-alternate-lane-chatgpt-subscription-codex-backend) below.)
+**What you'll end up with:** DAAF running on GPT models through a lightweight translation shim that ships built into DAAF. The shim presents an Anthropic-compatible endpoint on `localhost`, forwards your requests to OpenAI, and starts automatically inside the container — once it's set up, you normally won't think about it again. (Would you rather use a **ChatGPT subscription** than a pay-per-use API key? Skip ahead to the [ChatGPT subscription lane](#option-f-alternate-lane-chatgpt-subscription-codex-backend) below.)
 
 > **Billing prerequisite — API credits are separate from ChatGPT.** An OpenAI API key only works if its platform.openai.com project has **prepaid credits purchased**: adding a payment card alone is not enough (the $5+ credit purchase is a separate step), and new API accounts receive no free credits. A ChatGPT Plus/Pro subscription does **not** include API access — ChatGPT and the API are separate billing systems, and there is **no OpenAI-sanctioned** way to run a third-party tool like DAAF on a ChatGPT subscription (subscription usage is scoped to OpenAI's official apps; verified against OpenAI's terms and Codex documentation, 2026-07-11). An unfunded key fails with an instant `429 insufficient_quota` on every request — see the [technical FAQ entry on instant 429s](07_faq_technical.md#q-my-gpt-session-fails-instantly-with-429-errors-on-every-request-option-f). DAAF *does* ship a supported alternative that reuses your Codex (ChatGPT) OAuth login to route through your ChatGPT subscription — see the ["ChatGPT subscription lane"](#option-f-alternate-lane-chatgpt-subscription-codex-backend) below. It's a functional, carefully built route, but it works through a backend interface OpenAI doesn't officially offer for third-party tools, so it may change if OpenAI changes the backend, and you are responsible for compliance with OpenAI's terms. The API-key lane described here is the alternative if you'd rather stay on an officially offered interface.
 
 **Setup — four steps from an API key to a working GPT session.**
 
-**Step 1 — Add your settings to `environment_settings.txt`.** Open that file in your `daaf-docker` folder and add the block below, pasting your real OpenAI API key in place of the placeholder. The first two lines turn the shim on; the rest point Claude Code at it and choose your GPT models:
+**Step 1 — Add your settings to `environment_settings.txt`.** Open that file in your `daaf-docker` folder and add the block below, pasting your real OpenAI API key in place of the placeholder. The first settings activate the shim, bind the exact OpenAI route needed by its controller, and authenticate the API; the rest point Claude Code at it and choose your GPT models:
 
 ```bash
 # --- Option F: OpenAI API directly, via the DAAF provider shim ---
 DAAF_PROVIDER_SHIM=openai
+# Exact route value required by gpt_fast.sh:
+SHIM_BACKEND_MODE=openai
 OPENAI_API_KEY=sk-your_openai_api_key_here
 
 # Point Claude Code at the local shim (bare GPT slugs — no openai/ prefix here):
 ANTHROPIC_BASE_URL=http://127.0.0.1:4141
 ANTHROPIC_AUTH_TOKEN=daaf-shim-local
 ANTHROPIC_API_KEY=
-ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-5.6-sol[1m]         # strong tier (Opus-analog); [1m] = 1M window hint
-ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]     # fast tier (Sonnet-analog); [1m] = 1M window hint
-CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000               # see "Context window on GPT sessions" below
+# Hide the native /fast control; use gpt_fast.sh below instead:
+CLAUDE_CODE_DISABLE_FAST_MODE=1
+# Strong tier (Opus-analog) and fast tier (Sonnet-analog); [1m] = 1M window hint:
+ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-5.6-sol[1m]
+ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]
+# Context window -- see "Context window on GPT sessions" below:
+CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000
 ```
 
 **Step 2 — Rebuild the image.** Unlike Option C (which is config-only), this lane needs a one-time rebuild, because the shim's auto-launch is baked into the container entrypoint. From the DAAF Control Panel choose **option 10, "Rebuild Container,"** or run `bash rebuild_daaf.sh` (`.\rebuild_daaf.ps1` on Windows) directly — see the [rebuild instructions](#keeping-daaf-updated). On boot, the container starts the shim automatically and keeps it alive (restarting it if it ever exits), so you normally never have to touch it.
@@ -986,13 +1109,16 @@ CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000               # see "Context window on GP
 **Step 4 — Confirm it's working (optional).** If a GPT session ever misbehaves, a small manager script and a health endpoint let you check the shim at a glance:
 
 ```bash
-bash /daaf/scripts/provider_shim/start_shim.sh --status   # is it running?
-curl -s http://127.0.0.1:4141/health                       # health check
+bash /daaf/scripts/provider_shim/start_shim.sh --status    # is it running?
+bash /daaf/scripts/provider_shim/start_shim.sh --restart # replace it atomically
+curl -s http://127.0.0.1:4141/health                      # health check
 ```
 
-That's the whole setup. The paragraphs that follow are optional tuning you can safely skip at first, and deeper mechanics and diagnostics live in **Under the hood / troubleshooting reference** at the very end of this lane.
+In short: `--status` tells you whether the shim is healthy, and `--restart` safely replaces it in one step (it stops the old shim, waits, launches a fresh one, and confirms it's ready). Reach for `--restart` whenever you change shim settings or a session misbehaves. **One important caution: if the active Claude Code session itself routes through this shim, never ask it to run `--stop` and then `--start` in separate turns**—the stop severs your own session's route before the later turn can run. Always use `--restart`, which does both under a single lock.
+
+That's the whole setup. The paragraphs that follow are optional reading you can come back to when you need it — and deeper mechanics and diagnostics live in **Under the hood / troubleshooting reference** at the very end of this lane.
 
-**Optional tuning (safe to skip at first).**
+**Optional tuning.**
 
 **Reasoning effort.** The shim always sets the OpenAI request's reasoning effort, resolved by a four-tier precedence chain — first present wins: (1) a per-request signal from Claude Code, (2) a `#<effort>` suffix you append to a model slug (e.g. `ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]#medium`; it works alongside the `[1m]` window hint and is stripped before the request reaches OpenAI), (3) the `SHIM_REASONING_EFFORT` env var, and (4) the default `high` (parity with DAAF Claude sessions). Valid values are `none`, `low`, `medium`, `high`, `xhigh`, and `max` (`max` is gpt-5.6-only). Leave everything unset to get `high` everywhere; set the env var or a slug suffix only if you want a different level.
 
@@ -1002,23 +1128,58 @@ See the [technical FAQ entry on controlling GPT reasoning effort](07_faq_technic
 
 **Response verbosity.** Separately from reasoning effort, the shim sends OpenAI's `text.verbosity` control on every request, defaulting to `high` for parity with DAAF's warm, educational posture (`high` adds warmth and volume; `low` is terse); set `SHIM_TEXT_VERBOSITY=low` or `medium` in `environment_settings.txt` if GPT responses feel too long, and see the [technical FAQ entry on terse GPT responses](07_faq_technical.md#q-gpt-responses-feel-terse-compared-to-claude-option-f) if they feel too brief.
 
-**Context window on GPT sessions.** Claude Code enforces its context-window budget *locally*, and for a model slug it does not recognize it assumes a small (~200K) window — far below the 1,050,000-token physical window of the gpt-5.6 family on API/OpenRouter routes. On the direct OpenAI-API shim route, **append `[1m]` to your bare GPT slugs** in the model variables (e.g. `ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-5.6-sol[1m]`, as shown above) and declare `CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000`: Claude Code reads `[1m]` as a 1M-window hint and strips the suffix before sending, while the explicit declaration aligns Claude Code and DAAF's accounting denominator. On OpenRouter, keep the provider-prefixed **bare** slug (e.g. `ANTHROPIC_MODEL=openai/gpt-5.6-sol`) and declare `CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000` explicitly; `[1m]` is not established for those provider-prefixed slugs and must not be generalized across routes. DAAF does **not** use `CLAUDE_CODE_AUTO_COMPACT_WINDOW` as an alternative — automatic compaction remains disabled because it can disrupt orchestration. Separately, **the shim calibrates its token-count estimates against the real backend counts**: it learns the true tokens-per-byte ratio from each backend response and estimates slightly *under* the real count, so if a limit is ever reached the failure mode is a loud, recoverable backend error rather than a silent client-side stop ("Prompt is too long") well below the real window. If a GPT session still reports "Context limit reached" / "Prompt is too long" at low utilization, see the [technical FAQ entry on low-utilization context errors](07_faq_technical.md#q-my-gpt-session-says-context-limit-reached--prompt-is-too-long-at-low-utilization). **The [ChatGPT-subscription (Codex) lane below](#option-f-alternate-lane-chatgpt-subscription-codex-backend) is different:** its backend enforces a much lower effective input ceiling — measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16) — that no client hint can raise. On that lane, set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` so Claude Code and DAAF account against the measured backend ceiling. DAAF uses that denominator for utilization, statusline rendering, severity, and behavioral stop/restart guidance; it does not enable automatic compaction or implement a transport-level request blocker, and the backend remains the ultimate hard ceiling.
+##### GPT Fast Mode on the provider-shim routes
+
+Mirroring OpenAI Codex's "Fast mode" and API "Priority mode", you can turn on an equivalent with the GPT shim in DAAF. This basically turns on a speed-up from the model side of things, resulting in faster generation at the cost of greater subscription usage rates or higher API fees. To activate this in your session:
+
+**First, disable the native Claude Code `/fast` control.** The Claude Code mode itself doesn't work with the GPT models and can get confusing with settings, so we need to turn it off first. Set this exact line in your host `environment_settings.txt` file:
+
+```bash
+CLAUDE_CODE_DISABLE_FAST_MODE=1
+```
+
+Then rebuild the container (`bash daaf.sh` / `.\daaf.ps1` and select the Rebuild option), and start a **new Claude Code session** afterwards.
+
+**Then run the appropriate fast command for the shim** to check the current state, turn the boost on, or turn it off:
+
+```bash
+bash /daaf/scripts/provider_shim/gpt_fast.sh status
+bash /daaf/scripts/provider_shim/gpt_fast.sh on
+bash /daaf/scripts/provider_shim/gpt_fast.sh off
+```
+
+From the Claude Code prompt window, you can prefix the same command with `!`, for example `!bash /daaf/scripts/provider_shim/gpt_fast.sh on` to run it directly in the chat. The boost is **off by default**, and turning it `on` requires the `CLAUDE_CODE_DISABLE_FAST_MODE=1` line above; `off` and `status` always work. Which product you get depends on your route:
+
+| Your Option F route | What "on" gives you | Product name |
+|----------------|---------------------|--------------|
+| ChatGPT subscription (`SHIM_BACKEND_MODE=chatgpt`) | Faster responses, drawn from your ChatGPT subscription credits | **GPT Fast** |
+| OpenAI API key (`SHIM_BACKEND_MODE=openai`) | Priority processing, billed through your OpenAI API account | **GPT Priority** |
+
+**A word on cost.** **GPT Priority can cost more** than ordinary API processing and depends on your provider, model, project/account, and usage-tier eligibility — the controller warns you before it enables it. GPT Fast draws on your ChatGPT subscription's own credit and eligibility rules; current Codex documentation describes roughly **1.5×** speed and says GPT-5.6 and GPT-5.5 use **2.5× Standard ChatGPT credits**. Either way, requesting the boost doesn't guarantee you were served it on any given request.
+
+**Optional reading — under the hood.** The setting is persistent and shim-wide, and it's bound to the active route: switching routes resets it off, and switching back doesn't restore the old state — run `on` again on the new route. Requesting the faster tier is not the same as being served it; only the provider's actual response settles what served a given request, and the controller's `status` shows the latest such result the running shim has seen (qualified by model and completion time), not a promise about your current turn. One early ChatGPT-subscription probe requested priority and was served the standard tier — a dated, single-shape result, kept scoped to that old request rather than read as a standing entitlement test. The full policy semantics, wire-contract details, and version history live in the shim code, its tests, and git history.
+
+**Context window on GPT sessions.** Two small settings tell Claude Code how big your GPT model's context window really is — without them it assumes a small (~200K) window for slugs it doesn't recognize, far below the 1,050,000-token window of the gpt-5.6 family.
+
+- **On the direct OpenAI-API shim route,** append `[1m]` to your bare GPT slugs (e.g. `ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-5.6-sol[1m]`, as shown above) and set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000`. Claude Code reads `[1m]` as a 1M-window hint and strips it before sending.
+- **On OpenRouter,** keep the provider-prefixed bare slug (e.g. `ANTHROPIC_MODEL=openai/gpt-5.6-sol`) and set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=1050000`. Don't add `[1m]` to provider-prefixed slugs — it isn't established for that form.
+- **On the [ChatGPT-subscription (Codex) lane below](#option-f-alternate-lane-chatgpt-subscription-codex-backend),** set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` instead — that backend caps input around 370,000 tokens (measured for `gpt-5.6-sol`, 2026-07-16), and no client hint can raise it.
+
+*Why it matters:* the declaration keeps Claude Code and DAAF measuring utilization against the same real window. DAAF does **not** use `CLAUDE_CODE_AUTO_COMPACT_WINDOW` — automatic compaction stays off because it can disrupt orchestration. If a GPT session reports "Context limit reached" / "Prompt is too long" at low utilization, see the [technical FAQ entry on low-utilization context errors](07_faq_technical.md#q-my-gpt-session-says-context-limit-reached--prompt-is-too-long-at-low-utilization).
 
 **Optional 64K Claude Code output budget.** Claude Code defaults `CLAUDE_CODE_MAX_OUTPUT_TOKENS` to `32000` and supports a maximum of `64000`. If unusually long specialist work is being cut off, you may opt in by adding the plain decimal `CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000` (the form supported by the pinned Claude Code 2.1.202) to the **host** `daaf-docker/environment_settings.txt` before Claude Code/the container starts, then recreate the container through the normal host flow. This is not free context: thinking tokens count toward the output budget, and raising the reservation leaves less context for conversation history and tool results, which can cause DAAF's context-pressure stop/restart guidance to fire earlier. Your provider or selected model may enforce a lower limit regardless. Keep specialist final returns bounded even with 64K enabled; prefer the default `32000` unless you have a concrete truncation problem. See the [technical FAQ entry](07_faq_technical.md#q-how-do-i-opt-in-to-a-64k-claude-code-output-budget) for the tradeoff summary.
 
 ##### Under the hood / troubleshooting reference (Option F)
 
-*You can safely skip this subsection — it's here for when you want to look under the hood or diagnose a problem. These mechanics are shared by both shim lanes (this one and the ChatGPT lane below).*
+**Optional reading.** Here for when you want to look under the hood or diagnose a problem. These mechanics are shared by both shim lanes (this one and the ChatGPT lane below).
 
-**Shim controls, logs, and tuning variables.** The manager script (`start_shim.sh`, shown in Step 4) also accepts `--start`, `--stop`, and `--auto`. The shim's log lives at `/daaf/scripts/provider_shim/logs/shim.log`. Backend failures are logged as structural metadata — status, exact structured type/code, mapped Anthropic type, retry/attempt information, phase, and safe allowlisted headers/request IDs. Free-form backend response bodies and messages are not retained, because provider prose can reflect request content; downstream client errors use bounded, classification-derived text instead. The [technical FAQ](07_faq_technical.md#q-my-gpt-session-fails-instantly-with-429-errors-on-every-request-option-f) walks through status/type/code triage such as `insufficient_quota` (billing) versus a true rate limit. Defaults are fine for almost everyone; the tuning variables (`SHIM_PORT`, `SHIM_BACKEND_BASE_URL`, `SHIM_BACKEND_API_KEY`, `SHIM_STRIP_MODEL_PREFIX`, `SHIM_SANITIZE_TOOLS`, `SHIM_REASONING_EFFORT`, `SHIM_TEXT_VERBOSITY`) are documented in `environment_settings_example.txt`.
+**Logs and diagnostics.** The shim keeps its own diagnostic log at `/daaf/scripts/provider_shim/logs/shim.log`. It records only technical metadata — timings, status codes, error types, retry counts, and request-correlation IDs — and **never** your prompts or text, tool inputs, image bytes or URLs, credentials, raw response streams, or full request/response bodies. If a GPT session misbehaves, run `--restart` and check that log; the [technical FAQ](07_faq_technical.md#q-my-gpt-session-fails-instantly-with-429-errors-on-every-request-option-f) walks through common status/type/code triage such as `insufficient_quota` (billing) versus a true rate limit. The shim is a persistent daemon: changing its Python source does not update the already-running process. After any source update, run `bash /daaf/scripts/provider_shim/start_shim.sh --restart`, then confirm that `curl -s http://127.0.0.1:4141/health` reports `"version": "1.3.9"` before testing the new behavior.
 
-**Tool-call sanitization.** This is **on by default** (`SHIM_SANITIZE_TOOLS`): the shim silently strips known GPT tool-call quirks (empty `pages` parameters, `isolation` fills on subagent dispatches, redundant sandbox flags) that would otherwise each cost a wasted error round-trip; every strip is recorded in the shim log. Set `SHIM_SANITIZE_TOOLS=0` (and restart the shim — the flag is read at startup) when running DAAFBench against shim-routed models, which must observe raw model behavior; confirm via the `/health` endpoint's `sanitize_tools` field.
+**Session continuity across rebuilds.** On a shim lane, the shim keeps a small reasoning-cache file (`~/.claude/provider_shim/reasoning_cache.json`) that carries GPT reasoning continuity from one turn to the next. It lives on your per-install `daaf-claude-config` volume, so it survives container restarts and image rebuilds — you don't have to do anything to preserve it. Only an explicit `docker compose down -v` or `docker volume rm` erases it.
 
-**Correlated request diagnostics.** Every JSON or SSE response from `POST /v1/messages` carries an `x-daaf-request-id` response header containing an internally generated 32-character hexadecimal ID. The same value appears as `req_id=<32-hex-id>` on that request's shim and HTTP-client log records, so saving the header lets you reconstruct one request without matching unrelated concurrent traffic. The stable lifecycle event names are `request_start`, `request_parsed`, `upstream_attempt`, `upstream_retry`, `upstream_headers`, `upstream_first_event`, `downstream_first_content`, `backend_error`, `disconnect`, `terminal`, and `cleanup`; retry events can repeat and some milestones apply only to streaming or failure paths, but every `/v1/messages` lifecycle has exactly one `event=terminal` summary and one `event=cleanup` record. These records expose diagnostic metadata rather than content (`phase`, monotonic `elapsed_ms`/`dur_ms`, attempt and retry counts, allowlisted upstream request-ID metadata such as `upstream_req_id_header` and `upstream_req_id`, normalized `http_version`, failure phase and structured error type/code, disconnect state, `terminal_frame_send`, `body_close_send`, and cleanup status/error); prompts, request message bodies, translated payloads, tool schemas and inputs, raw SSE content, free-form backend response bodies/messages, credentials, and arbitrary headers are never logged, and upstream IDs never replace the local `x-daaf-request-id` correlation value. For a safe request-ID grep workflow and a field-by-field mid-response diagnostic, see [How do I diagnose a provider-shim server error mid-response?](07_faq_technical.md#q-how-do-i-diagnose-a-provider-shim-server-error-mid-response).
+**Images.** The shim accepts images in your messages and tool results and forwards them to OpenAI without inspecting or logging the bytes; the [image troubleshooting entry](07_faq_technical.md#q-what-image-inputs-does-the-provider-shim-support) lists exactly what's accepted. Image support was verified with a dated privacy-safe probe (a 2026-07-18 Base64-PNG request) — that's evidence the shape worked on that date, not an official OpenAI guarantee.
 
-**Reading the evidence carefully.** The terminal send fields are deliberately narrow evidence. `send_completed` means only that the awaited ASGI `send` call returned; it does **not** prove that the client received or acknowledged the bytes. Likewise, `event=disconnect` records that the shim observed an ASGI `http.disconnect` event at `observed_phase`; it is not proof of what the user received or displayed, does not establish that the disconnect caused an upstream operation to be cancelled, and does not imply that an upstream operation existed. Generic ASGI task cancellation is not itself recorded as client-disconnect evidence. Read the correlated events in order before drawing a causal conclusion: for example, a structured backend `server_error` followed by `disconnect` is evidence that the shim observed the backend-declared error first, not proof that the later disconnect caused it or that the terminal error reached the client.
-
-**Structured-error normalization.** The shim's structured-error normalizer gives a real non-2xx backend HTTP status first precedence. When there is no such status, it checks backend `code` before backend `type`: `context_length_exceeded` maps to Anthropic `invalid_request_error`, `server_error` maps to `api_error`, and unknown structured failures remain `api_error`. Users receive bounded, classification-derived messages selected from status/type/code families and a fixed unknown fallback; arbitrary provider prose is neither retained nor reflected. Only observability and error presentation are shaped this way — retry policy, timeout values, backoff, connection pooling, and heartbeat behavior are independent of it.
+**Advanced tuning.** Tool-call sanitization is on by default (`SHIM_SANITIZE_TOOLS`); the shim quietly strips known GPT tool-call quirks that would otherwise waste an error round-trip. Turn it off (`SHIM_SANITIZE_TOOLS=0`, then restart) only when running DAAFBench, which must observe raw model behavior. The remaining tuning variables are documented in `environment_settings_example.txt`.
 
 #### Option F, alternate lane: ChatGPT subscription (Codex backend)
 
@@ -1026,7 +1187,7 @@ See the [technical FAQ entry on controlling GPT reasoning effort](07_faq_technic
 
 **What you'll end up with:** the same DAAF provider shim as Option F above, but pointed at your ChatGPT subscription's Codex backend. You authenticate once with your ChatGPT login (an OAuth token from your `codex` login) instead of an API key, and from there everything works the same. Request translation, tools, and the content-block lifecycle are shared across both lanes; only the authentication and endpoint differ. (The lane's deeper wire-level behavior — how it handles streaming, tolerates the optional fields the undocumented Codex backend may omit, and formats reasoning summaries — is documented in the [technical FAQ](07_faq_technical.md#q-can-i-use-my-chatgpt-subscription-instead-of-an-openai-api-key-option-f).)
 
-> **A supported route we've built carefully — and DAAF's newest, so help us test it.** This lane routes Claude Code through your ChatGPT subscription, and we've done the engineering to make it a smooth, productive experience — it's exercised by DAAF's own benchmark runs. One thing to know up front, said plainly: it works through a backend interface that OpenAI doesn't officially offer for third-party tools like DAAF (OpenAI scopes subscription usage to its own official apps), so OpenAI could change that backend and disrupt the lane at any time, and **you are responsible for compliance with OpenAI's terms of service.** Because it's the newest route, please treat it as the one most likely to have rough edges and tell us about anything you hit. If you'd prefer to stay on an interface OpenAI officially offers, the API-key lane above (`SHIM_BACKEND_MODE` unset → `openai`) is the alternative.
+> **A supported route we've built carefully — and DAAF's newest, so help us test it.** This lane routes Claude Code through your ChatGPT subscription, and we've done the engineering to make it a smooth, productive experience — it's exercised by DAAF's own benchmark runs. One thing to know up front, said plainly: it works through a backend interface that OpenAI doesn't officially offer for third-party tools like DAAF (OpenAI scopes subscription usage to its own official apps), so OpenAI could change that backend and disrupt the lane at any time, and **you are responsible for compliance with OpenAI's terms of service.** Because it's the newest route, please treat it as the one most likely to have rough edges and tell us about anything you hit. If you'd prefer to stay on an interface OpenAI officially offers, the API-key lane above (exact `SHIM_BACKEND_MODE=openai`) is the alternative.
 
 **Prerequisite — confirm the standard-image Codex CLI.** The pinned **Codex CLI ships in every DAAF image**. Its presence is optional infrastructure only: it does not change DAAF's default provider, authenticate you, or activate the shim. Confirm Codex installed successfully inside the container before going further:
 
@@ -1052,11 +1213,12 @@ If that reports `codex: command not found`, your image predates the universal in
    ANTHROPIC_BASE_URL=http://127.0.0.1:4141
    ANTHROPIC_AUTH_TOKEN=daaf-shim-local
    ANTHROPIC_API_KEY=
+   CLAUDE_CODE_DISABLE_FAST_MODE=1   # hide native /fast; use gpt_fast.sh below
    ANTHROPIC_DEFAULT_OPUS_MODEL=gpt-5.6-sol[1m]
    ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]
    CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000   # Codex lane: backend-capped ~370k (measured), NOT 1,050,000 — see below
    ```
-   In this mode `OPENAI_API_KEY` / `SHIM_BACKEND_API_KEY` are **ignored** — the OAuth token is the credential. Codex availability alone does not select this lane; both `DAAF_PROVIDER_SHIM=openai` and `SHIM_BACKEND_MODE=chatgpt` are explicit opt-ins. **Note the `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000`** above: unlike the API-key lane's full `1050000`, the ChatGPT/Codex backend enforces a much lower effective *input* ceiling (~370,000 tokens, measured for `gpt-5.6-sol` on 2026-07-16 — accepted at 369,941, rejected at 372,905), independent of the model's true 1M window on the API route. Declaring `370000` aligns Claude Code and DAAF's physical-window accounting with that ceiling. DAAF uses it for utilization, statusline rendering, severity, and behavioral stop/restart guidance. DAAF keeps automatic compaction disabled and does not implement a transport-level request blocker; the Codex backend remains the ultimate hard ceiling. Keeping `[1m]` on the configured slugs does not raise that ceiling because DAAF's matched runtime consumers apply `min(resolved_window, 370000)` as a final accounting constraint. A breach surfaces as a clean `invalid_request_error` (`context_length_exceeded`) rather than a retryable-looking 502. Re-measure with `scripts/provider_shim/probe_context_ceiling.py` if OpenAI changes the backend.
+   In this mode `OPENAI_API_KEY` / `SHIM_BACKEND_API_KEY` are **ignored** — the OAuth token is the credential. Codex availability alone does not select this lane; both `DAAF_PROVIDER_SHIM=openai` and `SHIM_BACKEND_MODE=chatgpt` are explicit opt-ins. **Note the `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000`** above: unlike the API-key lane's full `1050000`, the ChatGPT/Codex backend caps input around 370,000 tokens (measured for `gpt-5.6-sol`, 2026-07-16), independent of the model's true 1M window on the API route — and no `[1m]` hint or client setting can raise it. Declaring `370000` keeps Claude Code and DAAF's utilization accounting aligned with that ceiling; a breach surfaces as a clean `invalid_request_error` (`context_length_exceeded`). Re-measure with `scripts/provider_shim/probe_context_ceiling.py` if OpenAI changes the backend.
 5. **Recreate the container** to apply (`docker compose down`, then `bash run_daaf.sh` / `.\run_daaf.ps1`). The shim reads `SHIM_BACKEND_MODE` at startup.
 
 **Confirm it's working.** After the container comes back up, check the shim log:
@@ -1077,17 +1239,46 @@ A healthy ChatGPT lane logs `backend_mode=chatgpt` at startup and then healthy `
 | `codex: command not found` | The image predates the universal Codex installation or was built from a stale Dockerfile. Update DAAF and rebuild (`rebuild_daaf.sh` / `rebuild_daaf.ps1`) so the current Dockerfile is used; `DAAF_DEV=1` is not required. |
 | Shim log tells you to re-login | The OAuth token refresh failed permanently — run `codex login --device-auth` again inside the container. |
 
-**Running more than one container.** Each DAAF container does its **own** `codex login`, which creates an **independent refresh-token grant** — there is no credential collision between containers. They share only your ChatGPT **usage pool** (the 5-hour and weekly caps), so running two in parallel simply draws that pool down faster. This is the clean way to run parallel DAAF instances. (The subtler case is running several codex-based tools — the `codex` CLI, `codex-plugin-cc`, the shim — inside a *single* container off the *same* login: that can rarely trigger a refresh-token-rotation race. To isolate them, give each its own `codex login` under a separate `CODEX_HOME`; `CODEX_HOME` and the `SHIM_OAUTH_TOKEN_URL` / `SHIM_OAUTH_CLIENT_ID` override variables in `environment_settings_example.txt` are the hooks for that. None of this is needed for a normal single-tool setup.)
+**Running more than one container.** Each DAAF container does its **own** `codex login`, which creates an **independent refresh-token grant** — there is no credential collision between containers. They share only your ChatGPT **usage pool** (the 5-hour and weekly caps), so running two in parallel simply draws that pool down faster. This is the clean way to run parallel DAAF instances. (The subtler case is running several codex-based tools — the `codex` CLI, the [Codex plugin](#using-the-codex-plugin-for-claude-code), the shim — inside a *single* container off the *same* login. As of shim v1.3.0 the shim is a pure *reader* of `auth.json`: it never rewrites the store, delegating every token refresh to the `codex` CLI — the single writer per `CODEX_HOME` — so the old shim-versus-other-tool rotation race is structurally eliminated. What stays unverified is *codex-versus-codex*: two independent codex invocations against one `CODEX_HOME` (for instance the plugin and the shim's delegated refresh firing at nearly the same moment). The safe posture is therefore still to give each codex-based tool its own `codex login` under a separate `CODEX_HOME`. None of this is needed for a normal single-tool setup.)
 
 See the [technical FAQ entry on the ChatGPT subscription lane](07_faq_technical.md#q-can-i-use-my-chatgpt-subscription-instead-of-an-openai-api-key-option-f).
 
+#### Using the Codex Plugin for Claude Code
+
+Separate from the provider-shim lanes above, OpenAI ships an official plugin — **`codex-plugin-cc`** — that lets a Claude Code session **delegate a task to Codex** for a second opinion: a code review, an adversarial review, a rescue attempt. It adds slash commands like `/codex:review` and `/codex:adversarial-review`. Think of it as a way to get an *independent* model's eyes on a piece of work, complementary to DAAF's own review agents — not a provider route for running DAAF itself.
+
+**What's already in the image.** The plugin shells out to the local `codex` CLI, and DAAF bakes that in (a pinned static binary — the same one the ChatGPT lane uses). Node.js is present and version-sufficient too, guaranteed by the Dockerfile. `npm` isn't included, but nothing here needs it — Codex is already installed, so if a plugin step ever mentions a missing `npm`, that's the harmless reason and you can ignore it.
+
+**Install and authenticate (inside a Claude Code session):**
+
+```
+/plugin marketplace add openai/codex-plugin-cc
+/plugin install codex@openai-codex
+/reload-plugins
+/codex:setup
+```
+
+Then authenticate Codex with the same headless device-code flow the ChatGPT lane uses:
+
+```bash
+codex login --device-auth
+```
+
+As with the shim's ChatGPT lane, this requires **device-code login enabled in your ChatGPT security settings** (off by default — enable it first, or the login fails immediately).
+
+**Which setups are safe.** There are two race-free ways to use the plugin:
+
+1. **Two containers (the natural pairing with the ChatGPT lane).** Run the plugin in a container on the **Anthropic route** (Claude subscription/API), and keep the ChatGPT-subscription **shim lane** in a *separate* container. Because each container has its own config volume, each has its own Codex login — the plugin and the shim never touch the same token. This pairs naturally with the [shared-workspace setup above](#sharing-one-research-workspace-across-two-installs-advanced).
+2. **One Anthropic-route container plus the plugin.** If the container is *not* running the ChatGPT shim lane, nothing else is consuming the Codex login, so the plugin is the sole consumer and there is no contention.
+
+> **Do not add the Codex plugin to a container that is already using the ChatGPT-subscription shim lane.** In that lane the shim is *itself* a consumer of your Codex login: it reads the OAuth token from `auth.json` and (as of shim v1.3.0) triggers refreshes by invoking the `codex` CLI against its `CODEX_HOME` rather than rewriting the file itself. Adding a second consumer of the same login — the plugin, or for that matter running the `codex` CLI by hand — is exactly the unverified *codex-versus-codex* case described above: two codex invocations can still rotate the refresh token at nearly the same moment, and a lost rotation **permanently invalidates the login** (a `refresh_token_reused` lockout that forces a fresh `codex login`). If you genuinely must run both in one container, give each tool its own **separate `CODEX_HOME`** with its own **separate `codex login --device-auth`**, so they never share a token file. Either way, remember that all logins on one ChatGPT account draw from the **same usage pool** (the 5-hour and weekly caps), so adding a second Codex consumer spends that pool faster.
+
 #### Known limitations of GPT sessions (both lanes)
 
 GPT support is a **supported capability we've engineered carefully** — actively tested, including through DAAF's own benchmark runs, and still gathering wider community experience across different setups. A few specifics are worth knowing:
 
 - **Context utilization is estimated, not exact.** OpenRouter's Anthropic-compatible endpoint does not implement token counting, so Claude Code falls back to estimation on GPT sessions (the shim does the same). The context bar and utilization warnings are close approximations, not precise counts.
-- **Set `CLAUDE_CODE_MAX_CONTEXT_TOKENS` to the route's real physical accounting window.** Claude Code assumes a 200k window for models it doesn't recognize, which is wrong for the 400k and 1,050,000-token GPT models. Setting this variable (as shown in the blocks above) aligns Claude Code and DAAF's utilization denominator. **The two shim lanes differ here:** the API-key lane (and OpenRouter) serve the model's full window (`1050000`), but the ChatGPT-subscription (Codex) lane's backend enforces a much lower effective *input* ceiling — measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16) — so on that lane declare `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` instead. This is a backend-enforced limit on the Codex route, independent of the model's true 1M window on the API route; no `[1m]` hint or client setting can raise it. DAAF's three runtime consumers use the exact `DAAF_PROVIDER_SHIM=openai` + `SHIM_BACKEND_MODE=chatgpt` gate and apply `min(resolved_window, 370000)` to the mapped GPT 5.4/5.5/5.6 flagship family, including stale-cache and same-model paths. DAAF uses the result for utilization, statusline rendering, severity, and behavioral stop/restart guidance; it keeps automatic compaction disabled and does not implement a transport-level request blocker. The backend remains the ultimate hard ceiling. Re-measure with `scripts/provider_shim/probe_context_ceiling.py` if OpenAI changes it. Sol keeps its exact-Sol quality-threshold profile on both lanes — physical-window mapping and quality-threshold profile selection are separate lookups.
-- **Exact GPT 5.6 Sol is the validated exception; other GPT variants stay conservative.** The terminal model slug must be exactly `gpt-5.6-sol` or `gpt-5.6-sol[1m]`; the identifier may be bare or may contain one or more provider path prefixes ending in `/`. These exact terminal GPT 5.6 Sol model slugs use the standard percentage gates — ELEVATED at 40%, HIGH at 60%, and CRITICAL at 75% — while retaining Sol's higher validated absolute gates of 300,000, 400,000, and 500,000 tokens, respectively; each status fires when either its percentage or absolute gate is reached. Claude Fable/Mythos remains on 30%/40%/50% with the same 300,000/400,000/500,000 absolute gates. On the ChatGPT-subscription lane's 370,000-token physical window, Sol's percentage gates correspond to 148,000, 222,000, and 277,500 tokens, so they fire before the retained absolute gates. Malformed left-boundary strings such as `xgpt-5.6-sol`, `foo-gpt-5.6-sol`, and `vendor/notgpt-5.6-sol` remain conservative, as do Terra, Luna, Pro, mini, chat, date snapshots, future variants, and right-side suffix or trailing variants. Those use the conservative-default gates (40%/150,000, 60%/200,000, 75%/250,000) unless separately validated and registered. Threshold-profile selection is version-specific and independent of physical context-window mapping: the wider GPT 5.6 family can still map to a 1,050,000-token window even when a particular variant uses conservative quality thresholds. GPT is not part of the Claude Fable/Mythos model family; exact Sol now shares the standard 40%/60%/75% percentages but retains the higher validated Sol absolute gates.
+- **Set `CLAUDE_CODE_MAX_CONTEXT_TOKENS` to match your route.** Claude Code assumes a small (~200k) window for models it doesn't recognize, which is wrong for the large GPT windows. Set it to `1050000` on the API-key and OpenRouter routes, or to `370000` on the ChatGPT-subscription (Codex) lane, whose backend caps input around 370k tokens regardless of the model's true 1M window. DAAF detects your model and applies the matching quality thresholds automatically. Re-measure the Codex ceiling with `scripts/provider_shim/probe_context_ceiling.py` if OpenAI changes it.
 - **OpenRouter's Anthropic endpoint is officially scoped to Anthropic models.** GPT works through it (proven live), but OpenRouter documents this endpoint for Claude models — it is effectively unsupported territory the vendor could change at any time.
 - **Anthropic does not officially support routing Claude Code to non-Claude models** through any gateway. DAAF offers and tests these lanes as a supported capability, not something either vendor guarantees.
 
diff --git a/user_reference/02_understanding_daaf.md b/user_reference/02_understanding_daaf.md
index 70778df9..c7b326e2 100644
--- a/user_reference/02_understanding_daaf.md
+++ b/user_reference/02_understanding_daaf.md
@@ -241,8 +241,8 @@ Four things to keep in mind as you use DAAF:
 
 1. In addition to the context engineering DAAF orchestrates behind the scenes, **what you ask Claude to do and how you ask it to do it** is an immensely important element of getting better quality output from DAAF/Claude. So a lot of what we'll talk about here (and in [**03. Best Practices**](03_best_practices.md)) is how to do this thoughtfully and well to maximize your chances of getting something useful from DAAF.
 2. The system is **designed to intelligently select and inject the right context to Claude before your query/question/chat**, based on what you provide in your query/question/chat. But this is **NOT** foolproof, and simply cannot account for every possibility. Feel free to go off the beaten path at will, but just be aware that it's going to necessarily be less supported and structured from there; you may ultimately find it's not working very well for what you want, because I wasn't able to design for that style of work. Trying to write your query in a different way can help, or you can help us improve DAAF by [opening an issue](https://github.com/DAAF-Contribution-Community/daaf/issues) and telling us about it!
-3. Because thoughtfully shaping the context is our way of shaping Claude's thinking, DAAF is built for **frontier models** and works them hard, taking advantage of their full context windows wherever possible. That does make DAAF genuinely compute-intensive -- pushing capable models to their limits is inherently so. But cost is a **dial you control**, not a fixed barrier: [empirical benchmarking](https://daaf.openaugments.org/bench/) shows that several models drive DAAF's workflows excellently at very different price points -- including cheaper Anthropic tiers and high-performing open-weight alternatives (like GLM 5.2) via OpenRouter. The quality-cost tradeoff is yours to tune through your choice of model and provider route, and the [DAAFBench results](https://daaf.openaugments.org/bench/) are the best starting reference for making that call.
-4. While DAAF's reference files, skills, and workflow instructions are all carefully designed to be loaded at specific moments, Claude may occasionally fail to load them, skip a step, or deviate from its instructions in subtle ways. When this happens, you get an agent working without the specialized knowledge it was supposed to have, which means it falls back on its general training -- its fuzzy long-term memory -- and that's when hallucinations, fabricated variable names, and plausible-sounding-but-wrong details creep in. This is why **Verbose output** in Claude Code's `/config` settings is particularly useful: it lets you see what DAAF's agents are actually thinking behind the scenes, including what motivates which files they're reading and which skills they're loading (or what shortcuts they're deciding on, if they are).
+3. Because thoughtfully shaping the context is our way of shaping Claude's thinking, DAAF is built for **frontier models** and works them hard, taking advantage of their full context windows wherever possible. That does make DAAF genuinely compute-intensive -- pushing capable models to their limits is inherently so. But cost is a **dial you control**, not a fixed barrier: [empirical benchmarking](https://daaf.openaugments.org/bench/) shows that several models drive DAAF's workflows excellently at very different price points -- cheaper Anthropic tiers, OpenAI's GPT-5.6 line (including on a flat-monthly ChatGPT subscription), and high-performing open-weight alternatives (Kimi K3, GLM 5.2, DeepSeek, Gemma) via OpenRouter. The quality-cost tradeoff is yours to tune through your choice of model and provider route, and the [DAAFBench results](https://daaf.openaugments.org/bench/) plus the [model-selection FAQ](07_faq_technical.md#q-which-claude-model-should-i-use) are the best starting references for making that call.
+4. While DAAF's reference files, skills, and workflow instructions are all carefully designed to be loaded at specific moments, Claude may occasionally fail to load them, skip a step, or deviate from its instructions in subtle ways. When this happens, you get an agent working without the specialized knowledge it was supposed to have, which means it falls back on its general training -- its fuzzy long-term memory -- and that's when hallucinations, fabricated variable names, and plausible-sounding-but-wrong details creep in. This is why **Verbose output** -- which DAAF turns on by default (you can confirm it in Claude Code's `/config` settings) -- is particularly useful: it lets you see what DAAF's agents are actually thinking behind the scenes, including what motivates which files they're reading and which skills they're loading (or what shortcuts they're deciding on, if they are).
 
 ---
 
@@ -388,9 +388,9 @@ And here's what each of them do in more detail, and how the workflow works so yo
 
 **What it is:** You have an existing completed DAAF analysis and want an independent mechanical check from its delivered audit notebook. Intake requires one unambiguous original Report and one unambiguous DAAF Stage 9 archive: Marimo `.py` for Python or canonical Quarto `.qmd` for R. Generic Marimo apps and arbitrary Quarto projects are not supported. If there are multiple candidates or both formats, DAAF stops and asks you to choose. Reproduction always uses a new folder and a new extraction root; it never merges into or overwrites an earlier attempt.
 
-After extraction, DAAF normalizes the project root and runs a mandatory containment audit before execution. A passing audit gives bounded assurance: the known original-root string is absent and each supported script has one correct static `PROJECT_DIR` assignment. It does not prove every dynamically constructed path safe. A script with a nonpassing audit cannot run in RV-2 unless it is corrected and re-audited or you approve that exact script as an exclusion before RV-2.
+Before re-running anything, DAAF checks each script to make sure it's safe to re-run — that it points at the new reproduction folder and won't reach back into the original project's files. A script that fails this check isn't run until it's either corrected or you explicitly approve running it as-is. This is a safety check on where scripts read and write, not a guarantee that every possible path in the code is safe.
 
-Evidence is graded rather than guessed. Log comparison covers only metrics actually printed in both logs. Supported Parquet artifacts receive direct schema/content comparison; selected files can receive exact-byte comparison, which proves byte identity only. Figures are reviewed side by side, and saved tables/models are compared only when an inspectable representation exists. Anything missing, unsupported, or unproven is labeled **NOT DIRECTLY VERIFIED**, never silently treated as a match.
+Evidence is graded rather than guessed. Log comparison covers only metrics actually printed in both logs. Supported Parquet data files get a direct schema and content comparison; selected files can also be compared byte-for-byte, which proves they are identical. Figures are reviewed side by side, and saved tables/models are compared only when an inspectable representation exists. Anything missing, unsupported, or unproven is labeled **NOT DIRECTLY VERIFIED**, never silently treated as a match.
 
 **What a "reproduced" verdict does and doesn't promise.** When DAAF reports an analysis as reproduced, it means DAAF re-ran the work and the results matched the original within reasonable tolerances -- not that every number came out bit-for-bit identical. Small, legitimate differences can arise: data that was re-downloaded may have been updated at the source since the original run, the software environment may have moved on, and some statistical methods involve a degree of randomness. DAAF's comparison uses purpose-built checks for the different kinds of evidence -- data files, figures, execution logs, and the quantitative claims in the report -- and those checks are built to account for reasonable tolerances rather than to demand exact equality. The goal is a trustworthy, well-documented answer to "does this hold up when someone re-runs it?", not a guarantee of identical digits.
 
@@ -403,7 +403,7 @@ Evidence is graded rather than guessed. Log comparison covers only metrics actua
 - **Whether to re-fetch data** (default: yes). Re-fetch mode executes Stage 5 and tests current acquisition behavior. Frozen-input mode copies and hashes the original raw files, does **not** run Stage 5, starts with downstream scripts, and verifies those raw hashes remain unchanged. In frozen mode, acquisition reproducibility and mirrors are explicitly out of scope.
 - **Methodological review depth** (default: light). Light review focuses on mechanical reproduction and notable concerns; full review also scrutinizes methodology, assumptions, and interpretation.
 
-Exact exclusions only leave the verdict denominator when you approve them before re-execution begins. A script skipped later remains an in-scope gap. Environment comparison is language-aware: Python inventories Python, Marimo, and imported packages; R inventories R, Quarto, repository/snapshot metadata, and installed imported packages. Unpinned original versions remain UNKNOWN / NOT DIRECTLY VERIFIED rather than being inferred. When DAAF needs a diagnostic script for that inventory, it keeps the script and its execution record under the reproduction project's `scripts/repro_checks/` folder; it never installs packages into the running environment.
+Something only drops out of the reproduction verdict if you approve excluding it up front — a script you skip partway through still counts as an in-scope gap. DAAF also compares the software environments the two runs used (which language, notebook, and package versions), labeling anything it can't pin down as UNKNOWN / NOT DIRECTLY VERIFIED rather than guessing. Any helper scripts it writes for that comparison are kept with the rest of the reproduction project's files, and it never installs packages into the running environment.
 
 **Expected time investment:** Depends on the complexity of the original analysis. A straightforward single-source analysis might take 15-30 minutes; a multi-source analysis with extensive transformations could take longer. You'll review the Reproduction Report at the end.
 
@@ -720,7 +720,7 @@ marimo run 'research/YYYY-MM-DD_Title/YYYY-MM-DD_Notebook.py' --host 0.0.0.0 --p
 ```
 You can also open the `.py` file in any text editor -- marimo notebooks are just Python.
 
-**How to view Quarto notebooks (R):** The easiest way is the **DAAF Control Panel** (`bash daaf.sh` / `.\daaf.ps1` from your `daaf-docker` folder → **5) View Quarto Notebooks (R)**), which runs `view_quarto.sh` for you. (You can also run `bash view_quarto.sh` / `.\view_quarto.ps1` directly.) With no argument, the viewer recursively finds every `.qmd` anywhere below `research/`, presents a sorted numbered picker, and renders the notebook you select; `0`, blank input, `q`/`Q`, or end-of-file cancels without rendering. You can bypass the picker with a direct `.qmd` path, or pass a project folder when that project contains exactly one recursive match (multiple matches are printed rather than guessed). The selected notebook is rendered to a single self-contained HTML file inside the container, copied to a `quarto_html/` folder on your host, and opened in your browser (the R-notebook counterpart to `view_notebooks.sh` for Python). The host filename is the flat notebook basename, so equal basenames overwrite; set `QUARTO_HTML_DIR` differently when both outputs must be retained. In a Full Pipeline Stage 9 notebook, rendering evaluates only explicitly enabled preview chunks; archived analysis-script chunks remain disabled, so render success validates the audit document rather than reproducing the full analysis. Alternatively, from inside the container you can render by hand with `quarto render 'research/YYYY-MM-DD_Title/YYYY-MM-DD_Notebook.qmd'`, then view the resulting HTML file in the browser-based code editor. You can also open the `.qmd` file directly in any text editor -- Quarto notebooks are plain text with YAML frontmatter and code chunks.
+**How to view Quarto notebooks (R):** The easiest way is the **DAAF Control Panel** (`bash daaf.sh` / `.\daaf.ps1` from your `daaf-docker` folder → **5) View Quarto Notebooks (R)**), which runs `view_quarto.sh` for you — it lists every `.qmd` under `research/`, lets you pick one, renders it to a self-contained HTML file, and opens it in your browser. (You can also run `bash view_quarto.sh` / `.\view_quarto.ps1` directly, or pass it a specific `.qmd` path.) Alternatively, from inside the container you can render by hand with `quarto render 'research/YYYY-MM-DD_Title/YYYY-MM-DD_Notebook.qmd'`, then view the resulting HTML file in the browser-based code editor. You can also open the `.qmd` file directly in any text editor -- Quarto notebooks are plain text with YAML frontmatter and code chunks.
 
 ### The Report
 
@@ -856,17 +856,9 @@ Real research analyses take time -- often more time than a single Claude Code se
 
 Claude Code operates within a context window that can be up to 1M tokens. However, quality can degrade well before the window is full, so DAAF enforces dual thresholds — both percentage-based and absolute token counts, whichever fires first. As DAAF works through a Full Pipeline analysis, delegating tasks to agents, receiving results, and coordinating the workflow, it gradually fills up this context. When it gets too full, Claude's performance degrades, and it becomes increasingly susceptible to erratic behavior due to **context rot**.
 
-The exact points at which DAAF acts depend on the **context-quality threshold profile** assigned to the model you are running. DAAF detects the exact model identifier automatically and applies the right profile — you do not need to configure anything. Claude Fable/Mythos models retain the validated extended-horizon profile. Exact GPT 5.6 Sol identifiers use the standard percentage gates but retain Sol's higher validated absolute gates. Opus, Sonnet, unknown model IDs, every other GPT variant, GLM models, and all other alternative-provider models use the conservative-default profile unless that exact model has been separately validated and registered.
+DAAF watches context usage for every agent it runs and applies model-appropriate thresholds automatically — you configure nothing. It detects which model you're running and picks the right profile: models DAAF has specifically validated (Claude Fable/Mythos, and exact GPT 5.6 Sol) get more generous thresholds, while everything else uses conservative defaults. The important part isn't the exact numbers — it's that quality can start to degrade before a window is technically full, which is why DAAF acts early rather than waiting for it to fill.
 
-Threshold-profile selection is version-specific and separate from the model's physical context-window size. For GPT 5.6 Sol, the terminal model slug must be exactly `gpt-5.6-sol` or `gpt-5.6-sol[1m]`; the identifier may be bare or may contain one or more provider path prefixes ending in `/`. Malformed left-boundary strings such as `xgpt-5.6-sol`, `foo-gpt-5.6-sol`, and `vendor/notgpt-5.6-sol` remain conservative, as do right-side suffix or trailing variants. GPT is not part of Claude's Fable/Mythos family: exact Sol now shares the standard 40%/60%/75% percentages but retains the higher validated Sol absolute gates of 300k/400k/500k. Terra, Luna, Pro, mini, chat, date snapshots, future variants, and trailing modifiers remain conservative unless separately validated. This means a wider GPT 5.6 variant can still have a 1,050,000-token physical window while DAAF applies the conservative quality thresholds. That physical window is itself route-conditional: the 1,050,000 figure holds on the API-key and OpenRouter routes, while the ChatGPT-subscription (Codex) shim lane is backend-capped near ~370,000 tokens (measured for Sol, 2026-07-16), which DAAF's hooks and statuslines lane-gate automatically. On that 370k physical window, exact Sol's percentage boundaries are 148k, 222k, and 277.5k tokens, before its retained 300k, 400k, and 500k absolute gates.
-
-To prevent context rot, DAAF monitors its own context utilization continuously and manages this proactively. The thresholds below trigger the same set of protective actions for every model — only the trigger points differ by threshold profile (percentage OR token count, whichever comes first):
-
-| Threshold Profile | Membership | ELEVATED at | HIGH at | CRITICAL at |
-|-------------------|------------|-------------|---------|-------------|
-| **Validated extended-horizon** | Claude Fable/Mythos models | ≥ 30% or ≥ 300k tokens | ≥ 40% or ≥ 400k tokens | ≥ 50% or ≥ 500k tokens |
-| **Exact GPT 5.6 Sol** | Exact terminal model slugs, bare or provider-prefixed: `gpt-5.6-sol` or `gpt-5.6-sol[1m]` | ≥ 40% or ≥ 300k tokens | ≥ 60% or ≥ 400k tokens | ≥ 75% or ≥ 500k tokens |
-| **Conservative-default** | Opus, Sonnet, unknown model IDs, every other GPT variant, GLM models, and all other alternative-provider models unless individually validated and registered | ≥ 40% or ≥ 150k tokens | ≥ 60% or ≥ 200k tokens | ≥ 75% or ≥ 250k tokens |
+DAAF monitors its own context utilization continuously and takes escalating protective action as it climbs. The four levels below, and what DAAF does at each, are the same for every model — only the exact trigger points differ:
 
 | Status | What DAAF Does |
 |--------|----------------|
@@ -938,13 +930,15 @@ You don't need to know what's in most of these directories -- the two that matte
 
 **Key insight for new users:** Everything you need to review, share, or reproduce is inside the project folder. You can copy the entire folder to a colleague and they'd have everything needed to understand and verify the analysis. That's the whole point of reproducibility.
 
+**Where does this all physically live?** The whole repository sits inside a Docker-managed storage volume on your machine — not in a regular folder you can browse directly. That's why the viewing tools below exist, and it's also why backups matter. If you want to go deeper — how the volumes work, how to link a folder from your computer into the container for data access, or how to share one research workspace between two DAAF installs — the [Installation Guide's file-management section](01_installation_and_quickstart.md#how-to-manage-daaf-project-files-and-output) covers all of it.
+
 ### Browsing and Viewing Your Work
 
 DAAF includes convenience scripts for viewing your files, notebooks, and session logs outside of the terminal. The simplest way to reach all of them is the **DAAF Control Panel** — run `bash daaf.sh` (macOS/Linux) or `.\daaf.ps1` (Windows) from your `daaf-docker` folder and pick the matching menu option (**2)** Browse Files, **4)** View Marimo Notebooks, **5)** View Quarto Notebooks, **3)** View Session Logs). Each convenience script below also runs directly from your `daaf-docker` folder on the host (i.e., outside the container):
 
 - **Browse and edit project files:** `bash run_vscode.sh` (macOS/Linux) or `.\run_vscode.ps1` (Windows) -- opens a browser-based VS Code editor. You can preview Markdown reports and plans with `Shift+Ctrl+V`, read Python and R scripts with syntax highlighting, and inspect the Git history to see what changed and when. See [**03. Best Practices — Using the Browser-Based Code Editor**](03_best_practices.md#using-the-browser-based-code-editor) for more.
 - **View interactive notebooks (Python):** `bash view_notebooks.sh` (macOS/Linux) or `.\view_notebooks.ps1` (Windows) -- opens marimo's notebook browser at [http://localhost:2718](http://localhost:2718), where you can browse and open any project notebook.
-- **View Quarto documents (R):** `bash view_quarto.sh` (macOS/Linux) or `.\view_quarto.ps1` (Windows) -- recursively discovers every `.qmd` below `research/` and presents a sorted numbered picker, then renders the selection to self-contained HTML, copies it to `quarto_html/` on your host, and opens it in your browser. Cancel with `0`, blank, `q`/`Q`, or end-of-file; pass a direct `.qmd` path to bypass selection, or pass a project folder only when it has one recursive notebook match. Equal basenames share the same flat output path and overwrite; set `QUARTO_HTML_DIR` differently to retain both.
+- **View Quarto documents (R):** `bash view_quarto.sh` (macOS/Linux) or `.\view_quarto.ps1` (Windows) -- finds every `.qmd` below `research/`, lets you pick one from a numbered list, renders it to a self-contained HTML file on your host, and opens it in your browser. Pass a direct `.qmd` path to skip the picker.
 - **View session logs:** `bash view_logs.sh` (macOS/Linux) or `.\view_logs.ps1` (Windows) -- opens the **DAAF Log Explorer**, an interactive timeline that shows orchestrator actions, subagent dispatches, and tool calls in your browser at [http://localhost:2719](http://localhost:2719). See the [Installation Guide — Viewing Session Logs](01_installation_and_quickstart.md#viewing-session-logs-in-your-browser) for details.
 
 ---
diff --git a/user_reference/03_best_practices.md b/user_reference/03_best_practices.md
index 87ea0696..1cdd9269 100644
--- a/user_reference/03_best_practices.md
+++ b/user_reference/03_best_practices.md
@@ -245,7 +245,14 @@ The report follows a standard structure (Executive Summary, Key Findings, Data &
 
 ### Reading DAAF's Claims: Observed Facts vs. Inference
 
-One habit worth building as you read any DAAF output is to notice how it grades its own claims by evidence. When DAAF reports that something *ran* -- a fetch returned so many rows, a validation passed -- the actual command and its output are on record, quoted in the script's execution log for you to check; statements without that kind of record are inferences, and DAAF is instructed to phrase them so they read that way rather than as established fact. Pay especially close attention when DAAF says something is *impossible* or *unavailable* -- that a source doesn't offer a variable, or that an operation can't be done -- because a wrong "no" fails silently and can quietly harden into accepted fact, so those negative claims deserve the same "show me the check" scrutiny you'd give any surprising result. And when DAAF tells you how much it did -- files changed, outcomes addressed -- that accounting should trace back to actual tool output, not to memory. Reading with this lens tells you which parts of a report you can take at face value and which warrant a second look.
+One habit worth building as you read any DAAF output is to notice how it grades its own claims by evidence. A quick lens to read with:
+
+- **Ran-and-quoted means observed fact.** When DAAF reports that something *ran* -- a fetch returned so many rows, a validation passed -- the actual command and its output are on record in the script's execution log for you to check.
+- **Everything else is inference.** Statements without that kind of record are inferences, and DAAF is instructed to phrase them so they read that way rather than as established fact.
+- **Watch negative claims most closely.** When DAAF says something is *impossible* or *unavailable* -- that a source doesn't offer a variable, or that an operation can't be done -- give it extra scrutiny. A wrong "no" fails silently and can quietly harden into accepted fact, so those claims deserve the same "show me the check" treatment you'd give any surprising result.
+- **Completion counts should trace to output.** When DAAF tells you how much it did -- files changed, outcomes addressed -- that accounting should trace back to actual tool output, not to memory.
+
+Reading with this lens tells you which parts of a report you can take at face value and which warrant a second look.
 
 ### Reading the Notebook
 
@@ -347,7 +354,7 @@ There's one oversight responsibility that's easy to overlook because it's about
 
 LLMs are non-deterministic, and DAAF's reference loading is orchestrated by an LLM. This means that occasionally -- not often, but not never -- an agent will proceed without loading a skill it was instructed to load, or the orchestrator will skip a reference file it was supposed to read. When this happens, the agent falls back on its general training, which produces output that looks correct but is built on plausible inference rather than curated knowledge.
 
-**Verbose output is your primary monitoring tool.** When you set Verbose output to True in `/config` (which you should -- it's a [required configuration setting](01_installation_and_quickstart.md#configure-claude-code-required)), you can see the internal thought process informing the file reads that DAAF's agents make. Here's what to watch for:
+**Verbose output is your primary monitoring tool.** DAAF ships with Verbose output turned on by default (you can confirm it anytime in `/config`), so you can see the internal thought process informing the file reads that DAAF's agents make. Here's what to watch for:
 
 **Signs that something may not have loaded:**
 - An agent explicitly mentions wanting to load something but then never doing it
@@ -503,6 +510,8 @@ The browser editor comes pre-loaded with extensions for Python and R syntax high
 - **Git integration:** The Source Control panel (left sidebar) shows uncommitted changes and lets you view diffs -- the most direct way to review exactly what DAAF produced during a session -- and, if you've enabled the optional "Git commit management" preference, browse commit history too.
 - **Search across files:** `Ctrl+Shift+F` (or `Cmd+Shift+F` on Mac) searches across all files in the project -- great for finding specific variables, scripts, or content.
 
+> **Working with a bulk local dataset?** Uploading tens of gigabytes through the browser is slow. For large or frequently-refreshed local data, bind-mount the folder into the container read-only instead — see [Linking Host Folders into the Container (Bind Mounts)](01_installation_and_quickstart.md#linking-host-folders-into-the-container-bind-mounts) in the installation guide.
+
 ### Alternative: Desktop VSCode with Dev Containers
 
 If you already have [VSCode](https://code.visualstudio.com) installed on your computer and prefer a native desktop experience, you can connect it directly to the DAAF container. Install the [Dev Containers extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) and use the "Attach to Running Container" command to open the DAAF container's filesystem directly in VSCode. This gives you a full file browser, integrated terminal, and your own preferred extensions and settings.
diff --git a/user_reference/04_extending_daaf.md b/user_reference/04_extending_daaf.md
index e263b54e..6387bfa4 100644
--- a/user_reference/04_extending_daaf.md
+++ b/user_reference/04_extending_daaf.md
@@ -388,6 +388,8 @@ The two files start out identical, but they can drift apart as soon as either si
 
 **The fix is simple but easy to forget:** after DAAF edits the in-container Dockerfile (or docker-compose.yml), you need to copy that updated file back to the host build directory *before* running the container rebuild. The step-by-step process below walks through this carefully, and you should follow it exactly the first time.
 
+**A second host/container boundary to know about:** *bind mounts* — linking a folder on your computer directly into the container — are the other place where the host and container filesystems meet. If you want DAAF to read a large local dataset in place rather than copying it into the Docker volume, see [Linking Host Folders into the Container (Bind Mounts)](01_installation_and_quickstart.md#linking-host-folders-into-the-container-bind-mounts) in the installation guide.
+
 > **One structural note before you edit:** DAAF's image defines a custom `ENTRYPOINT` (`daaf-entrypoint.sh`, written inline by a heredoc block near the end of the Dockerfile — there is no separate source file). It runs optional startup tasks -- such as auto-launching the OpenAI provider shim when `DAAF_PROVIDER_SHIM` is configured (see the [installation guide's Option F](01_installation_and_quickstart.md#option-f-openai-api-directly-daaf-provider-shim)) -- and then hands control to the normal `CMD ["bash"]`. Adding packages or changing `CMD` is safe, but adding a second `ENTRYPOINT` line would silently replace this wrapper and disable those startup behaviors. The heredoc's comment block explains exactly what it does.
 
 #### Step-by-Step Process
diff --git a/user_reference/07_faq_technical.md b/user_reference/07_faq_technical.md
index 3258a357..65a88803 100644
--- a/user_reference/07_faq_technical.md
+++ b/user_reference/07_faq_technical.md
@@ -66,9 +66,21 @@ Another application is using one of DAAF's ports. Either close the conflicting a
 
 This usually happens when Docker Desktop's file sharing permissions haven't been configured. Open Docker Desktop → Settings → Resources → File Sharing, and ensure the relevant directories are shared.
 
+### Bind-mounted host folder problems (empty, unreadable, or lost after rebuild)
+
+If you've linked a host folder into the container as a [bind mount](01_installation_and_quickstart.md#linking-host-folders-into-the-container-bind-mounts) and something isn't right, it's almost always one of these three:
+
+| Symptom | Cause and fix |
+|---------|---------------|
+| `/host_data` is **empty** inside the container | The `source:` path is mistyped, or (on Docker Desktop) the folder isn't shared. Check the path, and on macOS/Windows confirm the folder sits under a directory shared in Docker Desktop → Settings → Resources → File Sharing. |
+| **Permission denied** reading the files | UID mismatch on native Linux or a WSL-filesystem path — the container user is UID 1000 and `daaf-init` does **not** fix bind-mount ownership. Run `ls -ln` on the host folder; if it isn't owned by `1000` or world-readable, make it group- or world-readable. |
+| Your compose edit is **lost after a rebuild** | You edited the *host* copy of `docker-compose.yml`. `rebuild_daaf.sh` copies the container's copy out over the host one, so edit `/daaf/docker-compose.yml` *inside* the container (via Claude or the browser editor), then rebuild. |
+
+See [Linking Host Folders into the Container (Bind Mounts)](01_installation_and_quickstart.md#linking-host-folders-into-the-container-bind-mounts) for the full setup.
+
 ### Claude Code asks me to log in again
 
-This should be uncommon. Claude Code's login, session history, and plugins live in a dedicated Docker volume (`daaf-claude-config`), so they persist across container restarts, `docker compose down`, and even image rebuilds -- a routine restart or update should not sign you out. If you *do* get prompted after a normal restart, just run `/login` once for an Anthropic Max/Pro subscription (or paste your API key); it will persist from then on. Note that `docker compose down -v` (with the `-v` flag) or manually deleting the volume erases this state, so avoid `-v` unless you mean to wipe everything. If you'd rather never log in interactively, set your credentials in the `environment_settings.txt` file in the `daaf-docker/` folder -- it is read on every container start.
+This should be uncommon. Claude Code's login, session history, plugins, and (on shim-lane installs) the provider shim's reasoning-cache continuity file (`~/.claude/provider_shim/reasoning_cache.json`) live in a dedicated Docker volume (`daaf-claude-config`), so they persist across container restarts, `docker compose down`, and even image rebuilds -- a routine restart or update should not sign you out. If you *do* get prompted after a normal restart, just run `/login` once for an Anthropic Max/Pro subscription (or paste your API key); it will persist from then on. Note that `docker compose down -v` (with the `-v` flag) or manually deleting the volume erases this state, so avoid `-v` unless you mean to wipe everything. If you'd rather never log in interactively, set your credentials in the `environment_settings.txt` file in the `daaf-docker/` folder -- it is read on every container start.
 
 ### OpenRouter: "model not found" or authentication errors
 
@@ -125,9 +137,9 @@ DAAF always confirms the mode with you before proceeding, so you can adjust if i
 
 These are Claude Code slash commands you can type anytime during a session:
 
-- `/config` — Opens the Claude Code settings menu. Key settings to check:
-  - **Auto-compact:** Set to `false` (DAAF manages its own context)
-  - **Verbose output:** Set to `true` (lets you see what agents are thinking)
+- `/config` — Opens the Claude Code settings menu. DAAF pre-configures the key settings for you (no action needed — you can verify them here if you like):
+  - **Auto-compact:** Off by default (DAAF manages its own context)
+  - **Verbose output:** On by default (lets you see what agents are thinking)
 - `/model` — Switch the active model (use arrow keys to select)
 - `/clear` — Clear conversation history and start fresh (used when resuming from STATE.md)
 - `/exit` — Exit Claude Code (first step in ending a session)
@@ -166,25 +178,36 @@ I strongly recommend the **Max subscription** ($100/mo or $200/mo). DAAF is extr
 | **Rate limiting** | Minimal | May hit rate limits during very heavy sessions |
 | **Best for** | Light/occasional use, or organizational API budgets | Regular DAAF usage (recommended) |
 
-**Third option: OpenRouter.** Pay-per-token access via [OpenRouter](https://openrouter.ai/) with no monthly commitment (5.5% fee on credit purchases). OpenRouter provides access to Anthropic's Claude models and also to high-performing open-weight models like GLM 5.2, which [benchmarks competitively with the Opus line](https://daaf.openaugments.org/bench/) at roughly 33% of the cost. Good for testing DAAF or for cost-conscious sustained use. See [**01. Installation -- Configure authentication via environment_settings.txt**](01_installation_and_quickstart.md#configure-authentication-via-environment_settingstxt) for setup.
+**Third option: OpenRouter.** Pay-per-token access via [OpenRouter](https://openrouter.ai/) with no monthly commitment (5.5% fee on credit purchases). OpenRouter provides access to Anthropic's Claude models and also to high-performing open-weight models like GLM 5.2, which [sits among the Opus-line models on DAAF's benchmarks](https://daaf.openaugments.org/bench/) at roughly 22% of Opus 4.8's cost. Good for testing DAAF or for cost-conscious sustained use. See [**01. Installation -- Configure authentication via environment_settings.txt**](01_installation_and_quickstart.md#configure-authentication-via-environment_settingstxt) for setup.
 
 For the full comparison of all authentication options, see [**01. Installation -- AI Provider Account & Authentication**](01_installation_and_quickstart.md#1-ai-provider-account--authentication).
 
 One thing to note: the Max plan does have usage limits per time window. If you're running several DAAF analyses in parallel (which you absolutely can do!), you may occasionally hit a rate limit and need to wait a bit. The API key doesn't have that issue, but your wallet will feel it instead.
 
+**The same lever exists on the OpenAI side.** [DAAFBench's](https://daaf.openaugments.org/bench/) GPT-5.6 results carry API-equivalent price tags, but every one of those runs actually executed on a flat-monthly **ChatGPT subscription** through DAAF's provider shim — no per-token API billing at all. If you're weighing providers on cost, compare *subscriptions to subscriptions*: a Max plan on the Anthropic side, or a ChatGPT plan on the OpenAI side ([Option F in the install guide](01_installation_and_quickstart.md#option-f-alternate-lane-chatgpt-subscription-codex-backend)), will generally beat API metering by a wide margin for DAAF's usage volumes on either provider.
+
 ### Q: Which Claude model should I use?
 
-DAAF ships with **Opus 4.8** as its default, and staying on the default is a strong choice — but it's far from the only good one. [Empirical benchmarking across 20 models](https://daaf.openaugments.org/bench/) (DAAFBench) has produced clear, data-backed guidance. The table below reflects the models benchmarked to date (which won't always be the very newest releases — the linked results page is updated continuously as newer generations are run):
+This is the canonical model-selection guidance for DAAF, kept in sync with [DAAFBench](https://daaf.openaugments.org/bench/) (currently **4,437 runs across 29 models**, July 2026 corpus). The results page is updated continuously as newer generations are run, so treat it as the live source of truth; the guidance below reflects the corpus as of this writing.
+
+DAAF ships with **Opus 4.8** as its default, and staying on the default remains a solid choice — but the July 2026 corpus reshuffled the top of the leaderboard, and the strongest picks now span several providers:
 
 | Recommendation | Model | Why |
 |---------------|-------|-----|
-| **Deepest reasoning** | **Opus 4.8** | Strong orchestration performance with the deepest analytical reasoning of the benchmarked set. Best for complex methodology and nuanced judgment calls. |
-| **Best value** | **Sonnet 4.6** or **Sonnet 5** | Ranked #2 and #3 overall on orchestration benchmarks — outperforms every Opus model on protocol conformance at ~50% of the cost. An excellent choice for most DAAF work. |
-| **Best without Anthropic subscription** | **GLM 5.2** (via OpenRouter) | Ranked #4 overall, roughly on par with the Opus line on orchestration at ~33% of the cost. Makes DAAF accessible without any Anthropic subscription. |
-| **Budget-friendly** | **DeepSeek V4 Flash** (via OpenRouter) | Solid mid-tier performance at ~3% of flagship cost. Worth exploring for less complex tasks. |
-| **Not recommended** | **Haiku 4.5** | Adequate on basic tasks but struggles with DAAF's multi-step protocols and skill routing. |
+| **Top performer** | **Fable 5** | Leads the scoreboard outright. Opus 5 lands right behind it but costs meaningfully more to run for a hair lower score, so if budget permits the very top, Fable 5 is the pick. |
+| **Strong performance at moderate cost** | **GPT-5.6 Sol** or **Sonnet 5** | Both sit in the top tier at roughly half to two-thirds of Opus 4.8's benchmark battery cost — the sweet spot for most sustained DAAF work. |
+| **Most capability per dollar** | **GPT-5.6 Luna** | Delivers most of the top tier's conformance for roughly an eighth of Opus 4.8's battery cost. |
+| **Top open-weights capability** | **Kimi K3** (via OpenRouter) | The first open-weights model to reach the top tier, when price and model size are not the binding constraint. |
+| **Self-hosting / full control** | **GLM 5.2** (via OpenRouter or your own hardware) | Sits in the thick of the Opus-line pack (above Opus 4.5-4.7, just under Opus 4.8) at ~22% of Opus 4.8's cost. |
+| **Budget open-weights** | **DeepSeek V4 Flash** or **Gemma 4 31B** (via OpenRouter) | The two cheapest non-dominated points on the entire cost-performance chart (~2-3% of Opus 4.8's cost). Gemma 4 31B can even run on sufficiently powerful home computers. |
+| **Use with caution** | **Haiku 4.5** and other small/lite models | Adequate on basic tasks but noticeably weaker on DAAF's multi-step protocols — and budget models also *wobble* more (less run-to-run consistency), which compounds across chained agentic steps. |
+
+Two cross-cutting findings worth knowing:
+
+- **The efficiency frontier spans four providers.** The models that are never simply outclassed by something cheaper — Gemma 4 31B, DeepSeek V4 Flash, GPT-5.6 Luna, Sonnet 5, GPT-5.6 Sol, and Fable 5 — come from four different vendors. No single provider owns price-performance; the right pick depends on which budget point you're shopping at.
+- **Flat-rate subscriptions are the biggest cost lever.** The GPT-5.6 cost figures on the results page are API-equivalent prices, but every GPT run in the corpus actually executed on a flat-monthly ChatGPT subscription — the same lever as Anthropic's Max plan. See [Should I use an API key or a Max subscription?](#q-should-i-use-an-api-key-or-a-max-subscription)
 
-**Important context:** These benchmarks test *orchestration behavioral conformance* — can the model follow DAAF's protocols, dispatch agents correctly, and load the right skills? They do not directly measure analytical reasoning depth or code quality. Opus may still have an edge on the hardest analytical work, but the gap between the top models is much smaller than previously assumed. See the [full DAAFBench results](https://daaf.openaugments.org/bench/) for detailed per-phase breakdowns.
+**Important context:** These benchmarks test *orchestration behavioral conformance* — can the model follow DAAF's protocols, dispatch agents correctly, and load the right skills? They do not directly measure analytical reasoning depth or code quality, and with up to three reps per case, small score gaps are within sample noise — read exact rankings a little loosely. See the [full DAAFBench results](https://daaf.openaugments.org/bench/) for detailed per-phase breakdowns, tier bands, and the cost-performance chart.
 
 Current Claude models also support configurable "thinking levels" (toggle in the `/model` selector with left/right arrow keys). I recommend the **"High"** setting — quality matters more than speed for research work. Higher thinking levels do consume more of your usage allocation, so there's a legitimate tradeoff to explore. The DAAFBench results are a useful starting point for understanding where different models sit on the quality-cost frontier.
 
@@ -210,7 +233,7 @@ Yes -- partially. There are two different things this question might mean, so le
 
 **Using different models through OpenRouter (supported):** [OpenRouter](https://openrouter.ai/) is a model gateway that lets you route Claude Code through a single API key with pay-per-token billing. It's already configured as an authentication option in DAAF's `environment_settings_example.txt` template (Option C). Through OpenRouter, you can access Anthropic's Claude models without a Max subscription — and also access non-Anthropic models that perform well with DAAF. This route is supported and functional — its one-key setup is stated consistently across DAAF's install guide and FAQ — and we're still gathering wider community experience with it across different environments, so reports are always welcome. See [**01. Installation & Quick Start -- Configure authentication via environment_settings.txt**](01_installation_and_quickstart.md#configure-authentication-via-environment_settingstxt) for setup instructions (remember to run `/logout` first if you previously authenticated with Anthropic directly).
 
-**Non-Anthropic models — what works:** [DAAFBench](https://daaf.openaugments.org/bench/) has tested multiple non-Anthropic models across 2,799 runs. The standout is **GLM 5.2**, which ranks #4 overall and performs roughly on par with the Opus line on orchestration benchmarks at ~33% of the cost. **DeepSeek V4 Flash** performs appreciably worse but at substantially lower price points (~3% of costs for Opus). Note that extended thinking (which DAAF uses extensively with Anthropic models) does not work with non-Anthropic models through OpenRouter — these models rely on their native reasoning capabilities instead. See the [full benchmark results](https://daaf.openaugments.org/bench/) for per-model breakdowns.
+**Non-Anthropic models — what works:** [DAAFBench](https://daaf.openaugments.org/bench/) has tested non-Anthropic models extensively (the July 2026 corpus spans **4,437 runs across 29 models**), and the headline is that Anthropic no longer has a monopoly on the top tier: **GPT-5.6 Sol** (OpenAI) and the open-weights **Kimi K3** both reach Tier 1 alongside Fable 5, Opus 5, and Sonnet 5, and **GPT-5.6 Luna** delivers most of that capability for roughly an eighth of Opus 4.8's benchmark cost. Among open-weights, **Kimi K3** now tops the pack on raw capability, **GLM 5.2** remains the natural self-hosting pick (in the thick of the Opus-line pack at ~22% of Opus 4.8's cost), and **DeepSeek V4 Flash** and **Gemma 4 31B** hold the budget end of the efficiency frontier at ~2-3% of flagship cost. See [Which Claude model should I use?](#q-which-claude-model-should-i-use) for the consolidated guidance table. Note that extended thinking (which DAAF uses extensively with Anthropic models) does not work with non-Anthropic models through OpenRouter — these models rely on their native reasoning capabilities instead. See the [full benchmark results](https://daaf.openaugments.org/bench/) for per-model breakdowns.
 
 **Porting DAAF to a different CLI tool entirely:** This is also possible but requires more effort. DAAF is built on Claude Code, which is Anthropic's CLI agent tool. The vast majority of what DAAF actually *is* -- the agent protocols, skill documents, workflow definitions, validation checkpoints -- is just structured text in Markdown files. None of that is Anthropic-specific. What *is* specific to Claude Code are the hooks system (the safety guardrails that block dangerous commands, scan outputs for secrets, etc.) and some of the tool invocation patterns.
 
@@ -232,7 +255,7 @@ I would honestly be thrilled if someone forked DAAF and adapted it for another p
 Yes, and it's been validated live (2026-07-09). There are two ways in, both documented step-by-step in [**01. Installation & Quick Start**](01_installation_and_quickstart.md#gpt-openai-models-via-openrouter-option-c-extended):
 
 - **Via OpenRouter (config-only, no rebuild):** point the existing "Option C" OpenRouter setup at GPT slugs like `openai/gpt-5.6-sol` (strong tier) and `openai/gpt-5.6-terra` (fast tier). GPT runs the full agentic stack — multi-tool loops, subagent dispatch, two-tier routing — with just environment variables.
-- **Via the DAAF provider shim (direct OpenAI API):** set `DAAF_PROVIDER_SHIM=openai` and `OPENAI_API_KEY`, then point Claude Code at the local shim (`http://127.0.0.1:4141`). This one requires an image rebuild because the shim auto-starts from the container entrypoint.
+- **Via the DAAF provider shim (direct OpenAI API):** set `DAAF_PROVIDER_SHIM=openai`, exact `SHIM_BACKEND_MODE=openai`, `OPENAI_API_KEY`, and exact `CLAUDE_CODE_DISABLE_FAST_MODE=1`, then point Claude Code at the local shim (`http://127.0.0.1:4141`). The initial shim setup requires an image rebuild because it auto-starts from the container entrypoint; later settings-only changes need only a container recreate and new Claude Code session.
 
 GPT support is a capability DAAF has engineered carefully and tested — the specifics and honest caveats are in the limitation entries below. Anthropic does not officially support routing Claude Code to non-Claude models, and OpenRouter's Anthropic-compatible endpoint is officially scoped to Claude models — GPT works through it in practice, but that is territory a vendor could change.
 
@@ -251,13 +274,13 @@ This is expected, not a bug: DAAF ships with Claude as the default model, so a G
 
 Not exactly — treat it as a close estimate. OpenRouter's Anthropic-compatible endpoint (and the provider shim) do not implement precise token counting, so Claude Code falls back to *estimating* context usage on GPT sessions. The context bar and the ELEVATED/HIGH/CRITICAL utilization warnings still work and are a good guide, but the percentages are approximations rather than exact counts.
 
-**Under the hood (safe to skip).** DAAF's quality thresholds depend on the exact model identifier, not on whether the provider is GPT in general. Claude Fable/Mythos models retain the validated extended-horizon thresholds of 30%/300k, 40%/400k, and 50%/500k. For GPT 5.6 Sol, the terminal model slug must be exactly `gpt-5.6-sol` or `gpt-5.6-sol[1m]`; the identifier may be bare or may contain one or more provider path prefixes ending in `/`. These exact terminal GPT 5.6 Sol model slugs use the standard percentage gates while retaining Sol's higher validated absolute gates: 40% or 300k for ELEVATED, 60% or 400k for HIGH, and 75% or 500k for CRITICAL, whichever trigger fires first. Malformed left-boundary strings such as `xgpt-5.6-sol`, `foo-gpt-5.6-sol`, and `vendor/notgpt-5.6-sol` remain conservative, as do Terra, Luna, Pro, mini, chat, date snapshots, future GPT variants, and right-side suffix or trailing variants. Those use the conservative-default thresholds of 40%/150k, 60%/200k, and 75%/250k unless separately validated and registered. Threshold-profile selection is independent of physical context-window mapping: another GPT 5.6 variant can still map to a 1,050,000-token window while using conservative quality thresholds. GPT is not part of the Claude Fable/Mythos model family; exact Sol now shares the standard percentages but retains the higher validated Sol absolute gates. Separately, on the ChatGPT-subscription shim lane the physical window itself is backend-capped at ~370k; there, exact Sol's percentage boundaries are 148k, 222k, and 277.5k tokens, before the retained 300k, 400k, and 500k absolute gates (see the next entry).
+**Optional reading — under the hood.** DAAF's quality thresholds key off the exact model identifier, not just "is this GPT." Models DAAF has specifically validated (Claude Fable/Mythos, and exact GPT 5.6 Sol) get extended thresholds; every other model falls back to conservative defaults until it's validated too. Selection is automatic from the model ID — you don't configure it. One subtlety: which threshold profile a model gets is a separate question from how big its context window is, so a model can have a large window but still use conservative thresholds. And on the ChatGPT-subscription lane the window itself is capped lower, which is why thresholds fire sooner there (see the next entry).
 
 ### Q: The statusline shows the wrong context window on a GPT session (e.g. 200k when my model has more)
 
 Nothing is broken here — the bar is just showing a wrong guess, and it's a one-line fix. Claude Code assumes a 200k context window for any model it doesn't recognize, which is wrong for the 400k `gpt-5.2` / `gpt-5.4-mini` and the 1,050,000-token `gpt-5.4` / `gpt-5.5` / `gpt-5.6` family (Sol/Terra/Luna) on API/OpenRouter routes. Fix it by setting `CLAUDE_CODE_MAX_CONTEXT_TOKENS` in `environment_settings.txt` to the route's real physical accounting window (for example, `1050000` for `gpt-5.6-sol` over OpenRouter or the OpenAI API), then recreate the container and restart the Claude Code session.
 
-The **ChatGPT-subscription (Codex) shim lane** is different: its backend enforces a much lower effective *input* ceiling, measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16), independent of the model's true 1M window on the API route. On that lane set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000`. This aligns Claude Code and DAAF's accounting with the backend ceiling. DAAF's statusline, context reporter, and subagent statusline all apply `min(resolved_window, 370000)` as a final constraint for the matched GPT 5.4/5.5/5.6 flagship family when both exact lane signals are present, so stale caches, incoming `[1m]` windows, and higher explicit declarations cannot preserve an unsafe denominator. DAAF uses the result for utilization, statusline rendering, severity, and behavioral stop/restart guidance. It keeps automatic compaction disabled and does not implement a transport-level request blocker; the backend remains the ultimate hard ceiling.
+The **ChatGPT-subscription (Codex) lane** is different: its backend caps the usable input window much lower — measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16), regardless of the model's true 1M window on the API route. On that lane, set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` instead, so Claude Code and DAAF measure usage against the real ceiling. DAAF applies this automatically wherever it can, and keeps automatic compaction off; the backend itself remains the ultimate hard limit.
 
 ### Q: How do I opt in to a 64K Claude Code output budget?
 
@@ -283,17 +306,28 @@ Restart the container after editing `environment_settings.txt`.
 The shim auto-starts from the container entrypoint and is kept alive by a supervisor, so it should already be running. To diagnose:
 
 ```bash
-bash /daaf/scripts/provider_shim/start_shim.sh --status   # is it running?
-curl -s http://127.0.0.1:4141/health                       # health check
+bash /daaf/scripts/provider_shim/start_shim.sh --status    # is it running?
+bash /daaf/scripts/provider_shim/start_shim.sh --restart # atomic repair/reload
+curl -s http://127.0.0.1:4141/health                      # health check
 ```
 
-Its log is at `/daaf/scripts/provider_shim/logs/shim.log` — check there first. The manager script also accepts `--start`, `--stop`, and `--auto`. Remember that Option F requires the image to have been **rebuilt** after you set `DAAF_PROVIDER_SHIM=openai` (the auto-launch is baked into the entrypoint), so if nothing is running, confirm you rebuilt. If the shim *is* running but every request fails instantly with a 429, see the next entry.
+Its log is at `/daaf/scripts/provider_shim/logs/shim.log` — check there first. `--status` tells you whether the shim is cleanly running (or cleanly stopped); anything else means it isn't healthy, and the log will usually say why.
+
+For an in-place repair or reload, use `--restart` — it stops and relaunches the shim in a single step. This matters when the active Claude Code session is itself running through the shim: do **not** split `--stop` and `--start` across separate assistant turns, because once the shim is stopped your session no longer has a working provider route to issue the `--start` with. `--restart` avoids that trap by never leaving the route down between turns.
+
+Remember that Option F requires the image to have been **rebuilt** after you set `DAAF_PROVIDER_SHIM=openai` (the auto-launch is baked into the entrypoint), so if nothing is running, confirm you rebuilt. If the shim *is* running but every request fails instantly with a 429, see the relevant entry below.
+
+### Q: What image inputs does the provider shim support?
+
+For the direct OpenAI API lane, the shim supports images in **user messages** and in **tool results**. You can supply an image two ways: as Base64 data paired with one of `image/jpeg`, `image/png`, `image/gif`, or `image/webp`, or as a plain `http://`/`https://` URL with no credentials embedded in it. A malformed or unsupported image fails right away with a local error, before anything is sent to the backend. One limitation: the shim doesn't decode image contents, so it can't detect animated GIFs.
+
+This was verified with a privacy-safe probe on 2026-07-18 (a synthetic one-pixel PNG round-tripped successfully) — that's evidence that shape worked on that date, not an official OpenAI guarantee, and the URL variants weren't part of that test.
 
 ### Q: How do I diagnose a provider-shim server error mid-response?
 
-**You almost certainly don't need this entry.** It's a deep-dive for the rare case where a GPT request fails partway through a response and you want to file a precise bug report or trace exactly what the shim did. If that's not you, it's completely safe to skip — the shim keeps its own logs and the earlier troubleshooting entries cover the common failures. If you *do* want to trace a specific failed request, here's how.
+**Optional reading — you almost certainly don't need this entry.** It's a deep-dive for the rare case where a GPT request fails partway through a response and you want to file a precise bug report or trace exactly what the shim did. If that's not you, feel free to skip it — the shim keeps its own logs, and the earlier troubleshooting entries cover the common failures. If you *do* want to trace a specific failed request, here's how.
 
-The provider shim gives each `POST /v1/messages` request an internal 32-character hexadecimal correlation ID. The shim returns it as the `x-daaf-request-id` response header on both JSON and SSE responses and writes the same value as `req_id=<32-hex-id>` on correlated records in `/daaf/scripts/provider_shim/logs/shim.log`. If the failing client or its network diagnostics expose response headers, copy that header value immediately. If they do not, use the failure timestamp to find the nearest `event=terminal` record and copy its `req_id`; treat a timestamp match as a lead to verify against the full lifecycle, not proof that it is the same request.
+Every request through the shim gets a unique 32-character ID. The shim returns it as the `x-daaf-request-id` response header and writes the same value as `req_id=<id>` on that request's records in `/daaf/scripts/provider_shim/logs/shim.log`. If your client can show you response headers, copy that value; otherwise, find the log record nearest the failure time and copy its `req_id`.
 
 Use a safe placeholder rather than pasting prompts, credentials, or response content into a command. Replace the example ID with the 32-hex value you captured:
 
@@ -303,16 +337,9 @@ grep -F "req_id=${REQUEST_ID} " /daaf/scripts/provider_shim/logs/shim.log
 grep -E "req_id=${REQUEST_ID} .*event=(backend_error|disconnect|terminal|cleanup)" /daaf/scripts/provider_shim/logs/shim.log
 ```
 
-The first grep reconstructs the complete correlated lifecycle. Stable event names are `request_start`, `request_parsed`, `upstream_attempt`, `upstream_retry`, `upstream_headers`, `upstream_first_event`, `downstream_first_content`, `backend_error`, `disconnect`, `terminal`, and `cleanup`. Some milestones are conditional and attempts/retries may repeat, but the shim emits `event=terminal` exactly once and `event=cleanup` exactly once for each `/v1/messages` request. Read the focused records in causal order:
-
-1. **Inspect `event=backend_error`.** `backend_type`, `backend_code`, `anthropic_type`, and `failure_phase` identify the structured or transport failure the shim recorded. Error mapping follows an explicit precedence: a real non-2xx backend HTTP status maps first and takes precedence; otherwise backend `code` is checked before backend `type`. At either structured field, `context_length_exceeded` maps to Anthropic `invalid_request_error`, `server_error` maps to `api_error`, and an unknown value remains `api_error`. Free-form backend response bodies/messages are not retained or reflected because provider prose can contain request-derived material; the user-facing message is bounded, classification-derived text selected from status/type/code families or a fixed unknown fallback. Do not infer that every failure is backend-originated merely because the user saw an `api_error`: local translation, send, disconnect, and cleanup failures have distinct evidence.
-2. **Inspect `event=disconnect`, if present.** This event is narrow evidence that the shim observed an ASGI `http.disconnect`; `observed_phase` records where it was observed. It does not prove what the user received or displayed, that the observation caused an upstream operation to be cancelled, or even that an upstream operation existed. Generic ASGI task cancellation is not itself evidence of client disconnect and does not create this event. If a backend-declared error appears earlier, a later disconnect is a subsequent observed condition, not evidence that the disconnect caused the backend error. If no backend failure was known first, the terminal outcome can instead be `disconnect`.
-3. **Inspect the one `event=terminal` summary.** Check `outcome`, `attempts`, `retries`, `failure_phase`, `terminal_frame_send`, `body_close_send`, `disconnect`, and `disconnect_phase`. The send states are `not_attempted`, `attempted`, `send_completed`, `skipped_disconnect`, or `write_failed`. Critically, `send_completed` means only that the awaited ASGI send returned; it does **not** establish client receipt, acknowledgment, or guaranteed delivery. A `write_failed` state is direct evidence of a downstream send failure; other conclusions about what the client displayed remain inference.
-4. **Inspect the one `event=cleanup` record.** `status=completed` records clean shim-owned resource cleanup; `status=failed` plus the bounded `error` type records a cleanup failure. Cleanup evidence does not overwrite an earlier success, backend error, or disconnect outcome.
-
-Additional safe fields can help locate the failing phase without revealing request content: `phase`, monotonic `elapsed_ms`/`dur_ms`, attempts/retries, the allowlisted upstream request-ID fields `upstream_req_id_header` and `upstream_req_id`, normalized `http_version`, disconnect state, terminal semantic-frame state, body-close state, and cleanup status. The local `req_id` remains authoritative for joining shim records; an upstream request ID is separate metadata and never replaces it.
+These two commands pull out the full record of what the shim did for that one request, in order: when it started, what the backend returned, and how it ended. That sequence is usually enough to see where a request went wrong.
 
-The lifecycle and diagnostic logs intentionally omit prompts, message bodies, translated payloads, tool schemas and inputs, raw SSE content, free-form backend response bodies/messages, credentials, and arbitrary headers. Do not add those values to bug-report grep commands. Retry policy, timeouts, backoff, connection pooling, and heartbeat behavior are independent of this logging, so a new correlated failure should be diagnosed from the recorded sequence before proposing transport-policy changes.
+Importantly, the log records only this lifecycle metadata — it **never** contains your prompts, the model's text, tool inputs, image bytes or URLs, file names, or credentials. That's what makes a `req_id` record safe to paste into a bug report.
 
 ### Q: My GPT session fails instantly with 429 errors on every request (Option F)
 
@@ -326,25 +353,31 @@ An immediate, deterministic 429 on *every* request — including the very first
 
 Yes — through a supported route we've built carefully; because it's a newer route, it especially benefits from wider community testing. In plain terms: instead of paying per token for OpenAI API access, you reuse the ChatGPT subscription you already have. The same provider shim (Option F) has an alternate backend mode, `SHIM_BACKEND_MODE=chatgpt`, that routes Claude Code through your **ChatGPT subscription's Codex backend** using your `codex` OAuth login instead of a pay-per-token `api.openai.com` API key.
 
-**One thing to know up front.** This lane works through a backend interface that OpenAI doesn't officially offer for third-party tools like DAAF — OpenAI scopes subscription usage to its own official apps — so OpenAI could change that backend and disrupt the lane, and **you are responsible for compliance with OpenAI's terms of service.** We've engineered the lane to be smooth and reliable, and it's exercised by DAAF's own benchmark runs; but because it's the newest route, please treat it as the one most likely to have rough edges and report anything you hit. If you'd rather stay on an interface OpenAI officially offers, the API-key lane (`SHIM_BACKEND_MODE` unset → `openai`) is the alternative, covered by the [instant-429 entry above](#q-my-gpt-session-fails-instantly-with-429-errors-on-every-request-option-f).
+**One thing to know up front.** This lane works through a backend interface that OpenAI doesn't officially offer for third-party tools like DAAF — OpenAI scopes subscription usage to its own official apps — so OpenAI could change that backend and disrupt the lane, and **you are responsible for compliance with OpenAI's terms of service.** We've engineered the lane to be smooth and reliable, and it's exercised by DAAF's own benchmark runs; but because it's the newest route, please treat it as the one most likely to have rough edges and report anything you hit. If you'd rather stay on an interface OpenAI officially offers, the API-key lane (exact `SHIM_BACKEND_MODE=openai`) is the alternative, covered by the [instant-429 entry above](#q-my-gpt-session-fails-instantly-with-429-errors-on-every-request-option-f).
 
 **Setup, in brief** (full step-by-step in the [installation guide](01_installation_and_quickstart.md#option-f-alternate-lane-chatgpt-subscription-codex-backend)):
 
 - The pinned **Codex CLI ships in every DAAF image**; confirm with `codex --version` inside the container (expect `0.144.1`). Its presence does not change the default provider or activate this lane. `DAAF_DEV=1` is only for contributor/testing tools and is not required merely to obtain Codex or log in.
 - **Enable device-code login in your ChatGPT security settings first.** This toggle is **off by default** and is the most common thing to miss — the login fails immediately without it.
 - Log in with `codex login --device-auth` inside the container — that exact flag (`codex auth` does not exist, and bare `codex login` uses a browser loopback that cannot complete headless). It prints a URL + one-time code you approve on any device (laptop/phone); no in-container browser or port forwarding. `CODEX_HOME` is preset by Compose to the persisted, backed-up `codex-daaf` store, so the login survives rebuilds — you do it once.
-- Explicitly set both `DAAF_PROVIDER_SHIM=openai` and `SHIM_BACKEND_MODE=chatgpt` in `environment_settings.txt` (alongside the usual Option F `ANTHROPIC_BASE_URL`/model lines), then restart the container. In this mode `OPENAI_API_KEY` is ignored — the OAuth token is the credential. Confirm the lane is live in the shim log (`/daaf/scripts/provider_shim/logs/shim.log`): it shows `backend_mode=chatgpt` and healthy `200`s.
+- Explicitly set `DAAF_PROVIDER_SHIM=openai`, `SHIM_BACKEND_MODE=chatgpt`, and exact `CLAUDE_CODE_DISABLE_FAST_MODE=1` in `environment_settings.txt` (alongside the usual Option F `ANTHROPIC_BASE_URL`/model lines), then recreate the container and start a new Claude Code session. In this mode `OPENAI_API_KEY` is ignored — the OAuth token is the credential. Confirm the lane is live in the shim log (`/daaf/scripts/provider_shim/logs/shim.log`): it shows `backend_mode=chatgpt` and healthy `200`s.
 
 The shim reads the OAuth token from `auth.json` and **refreshes it automatically** (the token lasts ~10 days and is never logged); if a refresh fails permanently, the shim log tells you to re-run `codex login --device-auth`.
 
-**Context ceiling on this lane.** The Codex subscription backend enforces a much lower effective *input* ceiling than the model's true 1M window — measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16: accepted at 369,941, rejected at 372,905). This is a backend-enforced limit on the Codex route, not a client setting: no `[1m]` hint or local declaration can raise it. Set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` on this lane (not the API-key lane's `1050000`) to align Claude Code and DAAF's physical-window accounting with the measured backend ceiling. DAAF uses this denominator for utilization, statusline rendering, severity, and behavioral stop/restart guidance. It keeps automatic compaction disabled and does not implement a transport-level request blocker; the backend remains the ultimate hard ceiling. The matched runtime consumers defensively cap stale or higher resolved values at 370,000 while preserving lower positive declarations. A breach surfaces as a clean `invalid_request_error` (`context_length_exceeded`) rather than a retryable-looking 502. Re-measure with `scripts/provider_shim/probe_context_ceiling.py` if OpenAI changes the backend.
+**Context ceiling on this lane.** The Codex subscription backend caps the usable input window much lower than the model's true 1M window — measured at ~370,000 tokens for `gpt-5.6-sol` (2026-07-16). This is a hard backend limit on the Codex route, not a client setting: no `[1m]` hint or local declaration can raise it. Set `CLAUDE_CODE_MAX_CONTEXT_TOKENS=370000` on this lane (not the API-key lane's `1050000`), so Claude Code and DAAF measure usage against the real ceiling. DAAF applies this automatically and keeps automatic compaction off; the backend itself remains the ultimate hard limit. If you exceed it, you'll get a clean "context length exceeded" error rather than a confusing retry loop.
 
-**Parallel use.** Running more than one container is the clean way to parallelize: each container does its own `codex login` (an independent token grant — no collision), and they share only your ChatGPT usage pool, so running them in parallel just draws that pool down faster. For several codex tools inside a *single* container, give each its own login under a separate `CODEX_HOME` to avoid a rare token-rotation race.
+**Parallel use.** Running more than one container is the clean way to parallelize: each container does its own `codex login` (an independent token grant — no collision), and they share only your ChatGPT usage pool, so running them in parallel just draws that pool down faster. For several codex-based tools inside a *single* container, the shim itself is no longer a factor — as of v1.3.0 it never writes `auth.json`, delegating every refresh to the `codex` CLI (the single writer) — but two independent *codex* invocations sharing one `CODEX_HOME` stay unverified, so give each tool its own login under a separate `CODEX_HOME` to stay safe.
 
-**Under the hood (safe to skip).** Request translation, tools, and the content-block lifecycle are shared across both lanes; only authentication and endpoint differ. On this lane the shim always requests upstream SSE — including for inbound non-stream calls, whose terminal response is accumulated into JSON — and malformed/missing terminals or invalid block ordering fail explicitly. Tool-call events missing optional identity fields (which the undocumented Codex backend may omit) degrade gracefully with grep-stable `wire-divergence:` warnings in the shim log instead of failing the turn, and an invalid usage token counter is dropped rather than discarding a completed response. One response-formatting rule is ChatGPT-only: reliably identified reasoning-summary part boundaries are preserved as blank lines (`\n\n`), while OpenAI/API-key mode retains exact concatenation and its real upstream non-stream JSON path.
+**Optional reading — under the hood.** Both lanes handle tools and message content the same way; only the login method and endpoint differ. If the backend ever sends something malformed or out of order, the shim fails loudly rather than quietly passing along corrupted output. A few small formatting and logging details differ between the two lanes, but nothing you need to configure or worry about.
 
 See the full walkthrough in [**01. Installation & Quick Start — Option F, alternate lane: ChatGPT subscription**](01_installation_and_quickstart.md#option-f-alternate-lane-chatgpt-subscription-codex-backend).
 
+### Q: Can I run Claude and ChatGPT DAAF installs at the same time, on the same research workspace?
+
+Yes. You can run **two DAAF installs in parallel** — one on your Claude (Anthropic) subscription and one on your ChatGPT subscription via the provider shim — and point them at a **single shared research workspace** so both work the same projects and audit trail. Each install keeps its own separate configuration/authentication volume, so the two logins never collide; only the research-data volume is shared. The full step-by-step is in [**01. Installation — Sharing One Research Workspace Across Two Installs**](01_installation_and_quickstart.md#sharing-one-research-workspace-across-two-installs-advanced).
+
+**One concurrency caveat:** Docker gives you no write coordination between the two containers, so don't run analysis pipelines against the *same research project* from both installs at once — let one install work a given project at a time. (Working different projects in the shared workspace concurrently is fine.)
+
 ### Q: A scripted `claude -p` call on a GPT model returned an empty result
 
 Occasionally a GPT turn ends with a reasoning-only block and no visible text, which can surface as an empty `result` field in scripted (non-interactive) `claude -p` usage. This is a GPT quirk, not a DAAF fault, and is only relevant to automated/batch tooling — interactive sessions are unaffected. If you hit it in a script, re-issue the call or add a follow-up turn that requests the answer explicitly.
@@ -353,14 +386,30 @@ Occasionally a GPT turn ends with a reasoning-only block and no visible text, wh
 
 **Short answer: you probably don't need to touch this.** By default GPT already runs at the highest reasoning effort (`high`), matching how DAAF runs Claude — so for most people, leaving everything unset is exactly right. Reach for the controls below only if you want to dial effort *down* (for speed or cost) or pin it explicitly. One gotcha to know first: the reasoning-effort selector in the Claude Code `/model` menu does **not** work for GPT — use the environment-variable methods below instead.
 
-Here's how it works under the hood. On the direct-OpenAI shim lane, every request to OpenAI carries a `reasoning.effort` value, and the shim resolves it from a **four-tier precedence chain** — the first tier present wins:
+You have two ways to set it, both in `environment_settings.txt`:
+
+1. **A `#<effort>` suffix on the model slug** — e.g. `ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]#medium`. This works alongside the `[1m]` window hint, and the shim strips the suffix before the request reaches OpenAI (the backend only ever sees the bare `gpt-5.6-terra`).
+2. **The `SHIM_REASONING_EFFORT` env var** — a single default applied to the whole shim.
+
+Valid values are `none`, `low`, `medium`, `high`, `xhigh`, and `max` (`max` is gpt-5.6-only; `none` disables reasoning). An explicit setting always wins over the built-in `high` default, and a per-slug suffix wins over the shim-wide env var; the shim logs which source it used on each request line in `/daaf/scripts/provider_shim/logs/shim.log` (as `effort=<value>:<source>`). Most people set nothing and get `high` everywhere. Changes to `environment_settings.txt` take effect after the usual container recreate. See also the Option F [reasoning-effort paragraph](01_installation_and_quickstart.md#option-f-openai-api-directly-daaf-provider-shim) in the installation guide. If GPT replies also feel *shorter* or *terser* than you expect, that is a separate knob — see [GPT responses feel terse compared to Claude](#q-gpt-responses-feel-terse-compared-to-claude-option-f) below.
+
+### Q: How do I control GPT Fast or GPT Priority through the provider shim? (Option F)
+
+On a GPT route the shim offers an optional speed boost — **GPT Fast** on the ChatGPT-subscription route, **GPT Priority** on the OpenAI API-key route. Three things get you going:
 
-1. **Per-request signal from Claude Code** — when Claude Code specifies an effort for a turn, that takes precedence over the tiers below. **Important caveat:** the `/model` reasoning-effort selector in the Claude Code UI does **not** work for GPT slugs. Claude Code gates that selector by model-ID pattern and, for an unrecognized (GPT) slug, pins the per-request signal to `high` on *every* request regardless of what you select — so the selector is inert. To keep it from masking your real preference, the shim treats an inbound `high` as that pin (i.e. as unset) and falls through to the tiers below; any *other* inbound value (`low`, `medium`, etc.) is still honored. The practical consequence: **steer GPT effort with tier 2 or tier 3 below, not the `/model` selector.**
-2. **A `#<effort>` suffix on the model slug** — append it in `environment_settings.txt`, e.g. `ANTHROPIC_DEFAULT_SONNET_MODEL=gpt-5.6-terra[1m]#medium`. This works *alongside* the `[1m]` window hint (Claude Code consumes `[1m]` locally and passes `#medium` through), and the shim strips the suffix before the request reaches OpenAI — the backend only ever sees the bare `gpt-5.6-terra`.
-3. **The `SHIM_REASONING_EFFORT` env var** — a single default for the whole shim, applied when there is no usable per-request signal and no slug suffix.
-4. **The built-in default, `high`** — used when none of the above is set, for posture parity with DAAF's Claude sessions.
+1. **Step Claude Code's own `/fast` aside.** Add exact `CLAUDE_CODE_DISABLE_FAST_MODE=1` to your private host `daaf-docker/environment_settings.txt`, then recreate the container and start a new Claude Code session. (This keeps native `/fast` from showing a misleading ON state for a GPT model that can't honor it. Make the host edit yourself — in-container code can't touch the private file. No image rebuild needed.)
 
-Valid values are `none`, `low`, `medium`, `high`, `xhigh`, and `max` (`max` is gpt-5.6-only; `none` disables reasoning). An unrecognized value at any tier is ignored with a log warning and the next tier applies. You can confirm what the shim resolved by checking the shim log (`/daaf/scripts/provider_shim/logs/shim.log`): each request line ends with `effort=<value>:<source>`, where source is one of `inbound`, `slug`, `env`, or `default`. (Because of that demotion, an inbound `high` with no slug/env override logs `effort=high:default`, not `effort=high:inbound`.) Most users need to set nothing — leaving everything unset gives `high` everywhere. Both the env var and slug suffixes are read at shim startup / request time; changes to `environment_settings.txt` require the usual container recreate. See also the Option F [reasoning-effort paragraph](01_installation_and_quickstart.md#option-f-openai-api-directly-daaf-provider-shim) in the installation guide. If GPT replies also feel *shorter* or *terser* than you expect, that is a separate knob — see [GPT responses feel terse compared to Claude](#q-gpt-responses-feel-terse-compared-to-claude-option-f) below.
+2. **Flip the boost with one command** (it starts **off**):
+
+   ```bash
+   bash /daaf/scripts/provider_shim/gpt_fast.sh {on|off|status}
+   ```
+
+   Inside a Claude Code prompt, prefix it with `!`, for example `!bash /daaf/scripts/provider_shim/gpt_fast.sh status`. Turning it `on` requires the `CLAUDE_CODE_DISABLE_FAST_MODE=1` line above; `off` and `status` always work.
+
+3. **Mind the cost.** OpenAI API **GPT Priority may cost extra** and depends on your provider, model, project/account, and usage-tier eligibility — the controller warns before enabling it. ChatGPT **GPT Fast** follows your subscription's own credit and eligibility rules; current Codex documentation describes roughly **1.5×** speed and says GPT-5.6 and GPT-5.5 use **2.5× Standard ChatGPT credits**. And requesting the boost doesn't guarantee it was served on any given request.
+
+For the route-to-product mapping, the full setup steps, and the policy details under the hood, see [GPT Fast and GPT Priority on the provider-shim routes](01_installation_and_quickstart.md#gpt-fast-and-gpt-priority-on-the-provider-shim-routes) in the installation guide.
 
 ### Q: GPT responses feel terse compared to Claude (Option F)
 
@@ -457,13 +506,13 @@ After changing, rebuild the container — see [Keeping DAAF Updated](01_installa
 
 Not in a practical sense for full-pipeline analyses, unfortunately. The free and Pro tiers of Claude simply don't provide enough usage for the volume of work DAAF demands. You might be able to do some lightweight Data Discovery Mode queries (asking what data is available, looking up variable definitions), but a full analysis pipeline will exhaust a lower-tier plan very quickly.
 
-**More flexible and affordable billing via OpenRouter:** [OpenRouter](https://openrouter.ai/) offers pay-per-token access with no monthly subscription commitment (5.5% fee on credit purchases). Critically, OpenRouter also provides access to high-performing open-weight models at a fraction of Anthropic's pricing. **GLM 5.2** [benchmarks competitively with the Opus line](https://daaf.openaugments.org/bench/) at roughly 33% of the cost, and **DeepSeek V4 Flash** offers passable mid-tier performance at roughly 3% of flagship cost. This makes DAAF substantially more accessible than it was even a few months ago — a full pipeline analysis that might cost $50+ with Opus via API could cost under $15 with GLM 5.2 through OpenRouter, or less than $1 with DeepSeek V4 Flash. See the [Installation Guide](01_installation_and_quickstart.md#configure-authentication-via-environment_settingstxt) for setup instructions.
+**More flexible and affordable billing via OpenRouter:** [OpenRouter](https://openrouter.ai/) offers pay-per-token access with no monthly subscription commitment (5.5% fee on credit purchases). Critically, OpenRouter also provides access to high-performing open-weight models at a fraction of Anthropic's pricing. Per the [July 2026 DAAFBench corpus](https://daaf.openaugments.org/bench/), **DeepSeek V4 Flash** and **Gemma 4 31B** hold the budget end of the efficiency frontier at roughly 2-3% of Opus 4.8's benchmark cost, **GLM 5.2** sits in the thick of the Opus-line pack at ~22%, and **Kimi K3** reaches the top tier outright when budget allows. This makes DAAF substantially more accessible than it was even a few months ago — a full pipeline analysis that might cost $50+ with Opus via API could cost under $15 with GLM 5.2 through OpenRouter, or on the order of $1 with DeepSeek V4 Flash or Gemma 4 31B (which can even run on sufficiently powerful home computers). See [Which Claude model should I use?](#q-which-claude-model-should-i-use) for the consolidated guidance and the [Installation Guide](01_installation_and_quickstart.md#configure-authentication-via-environment_settingstxt) for setup instructions.
 
 Cost remains a meaningful barrier to entry for DAAF, but it's shrinking. As open-weight models continue to improve and inference costs continue to fall, accessibility will only get better. If you're running DAAF with non-default models, please share your experiences — community feedback on the quality-cost frontier directly informs the guidance here and in the [DAAFBench results](https://daaf.openaugments.org/bench/).
 
 ### Q: How much disk space does DAAF use?
 
-The Docker image is roughly **8.6 GB** after building (the exact size varies with your Docker version and platform). It includes an Ubuntu 24.04 (Noble) base image, Python 3.12, 46 pinned Python packages (data science, geospatial, econometrics, visualization, ML), geospatial system libraries (GDAL/GEOS/PROJ), Claude Code, R, 60+ pinned R packages (tidyverse, fixest, survey, sf, and more), and the Quarto CLI. The R runtime, packages, and Quarto account for roughly **2 GB** of that total (approximately 8.6 GB with R versus 6.4 GB without). Docker also keeps build cache layers, so total Docker disk usage may be somewhat higher.
+The Docker image is roughly **8.6 GB** after building (the exact size varies with your Docker version and platform). It includes an Ubuntu 24.04 (Noble) base image, Python 3.12, **~52 pinned Python packages** covering data science, geospatial, econometrics, visualization, ML, and shim infrastructure; geospatial system libraries (GDAL/GEOS/PROJ); Claude Code; R; 60+ pinned R packages (tidyverse, fixest, survey, sf, and more); and the Quarto CLI. The R runtime, packages, and Quarto account for roughly **2 GB** of that total (approximately 8.6 GB with R versus 6.4 GB without). Docker also keeps build cache layers, so total Docker disk usage may be somewhat higher.
 
 Beyond the image, your Docker volume will grow as you create research projects. Each project accumulates scripts, parquet data files, session logs, and notebooks. A typical full-pipeline project might add 50-500 MB depending on how many datasets you fetch and how large they are.
 
@@ -685,7 +734,7 @@ A virtual environment (venv, conda, etc.) handles one thing well: Python package
 
 **Complete reproducibility.** Docker pins *everything*: the OS (Ubuntu 24.04), Python version (3.12), system packages, Python libraries, and Claude Code itself. When I say DAAF works, I mean it works in that exact environment. Virtualenvs only manage Python packages, not system-level dependencies, OS differences, or tool versions.
 
-**Clean recovery.** If something goes wrong -- a corrupted package, a broken state, whatever -- you can tear down the container and rebuild from scratch in minutes. Your research data persists in its Docker volume, and Claude Code's own login and session history persist in a second dedicated volume (`daaf-claude-config`), so both are completely unaffected by a rebuild. (Only an explicit `docker compose down -v` or `docker volume rm` deletes those volumes.) Try doing that with a corrupted virtualenv.
+**Clean recovery.** If something goes wrong -- a corrupted package, a broken state, whatever -- you can tear down the container and rebuild from scratch in minutes. Your research data persists in its Docker volume, and Claude Code's own login and session history -- plus, on shim-lane installs, the provider shim's reasoning-cache continuity file (`~/.claude/provider_shim/reasoning_cache.json`) -- persist in a second dedicated volume (`daaf-claude-config`), so both are completely unaffected by a rebuild. That reasoning-cache file holds backend-encrypted reasoning-continuity blobs and lives on the per-container config volume deliberately, outside the shareable, VCS-trackable repo tree. (Only an explicit `docker compose down -v` or `docker volume rm` deletes those volumes.) Try doing that with a corrupted virtualenv.
 
 **Cross-platform consistency.** Docker runs the same way on Mac, Windows, and Linux. No more "it works on my machine" problems.
 
@@ -887,7 +936,7 @@ bash view_quarto.sh research/2026-01-24_Your_Project/output/analysis/notebook.qm
 .\view_quarto.ps1 research/2026-01-24_Your_Project/output/analysis/notebook.qmd
 ```
 
-The script renders the selected notebook to a single self-contained HTML file inside the container, copies it out to a `quarto_html/` folder next to your `docker-compose.yml`, and opens it in your browser -- handling container startup automatically. For a Full Pipeline Stage 9 notebook, this render validates the document and explicitly enabled previews; archived Stage 5-8 script chunks remain disabled, so render success is not a full analysis reproduction. Output uses the notebook's flat basename, so rendering two notebooks named `report.qmd` targets the same `quarto_html/report.html` and the later render overwrites the earlier one. Set `QUARTO_HTML_DIR` to a different host directory when both must be retained.
+The script renders the selected notebook to a single self-contained HTML file, copies it out to a `quarto_html/` folder next to your `docker-compose.yml`, and opens it in your browser -- starting the container automatically if it isn't already running.
 
 If you'd rather do it by hand, render from inside the container and copy the result out yourself:
 
@@ -906,7 +955,7 @@ You can also read the `.qmd` source directly in the browser-based VS Code editor
 
 Two at-a-glance displays that Claude Code renders for you, both customized by DAAF.
 
-**The status bar** runs along the bottom of your session. Reading across, it shows the active model (with its reasoning-effort level), the current working directory, the Git branch you're on, a context-usage meter for the session, and -- if you're on a Claude subscription -- your rate-limit windows (how much of your rolling 5-hour and 7-day usage allowance you've used up). That rate-limit readout is specific to Claude subscription plans for now; on API-key or other-provider sessions those segments simply don't appear.
+**The status bar** runs along the bottom of your session. Reading across, it shows the active model (with its reasoning-effort level), the current working directory, the Git branch you're on, a context-usage meter for the session, and -- if you're on a Claude subscription -- your rate-limit windows (how much of your rolling 5-hour and 7-day usage allowance you've used up). That readout also appears on ChatGPT-subscription (provider-shim) sessions, where it shows your Codex plan windows instead (e.g. the 7-day window with its used-percent and reset countdown, sourced from the shim's cached quota snapshot). On API-key and other provider sessions, that segment simply doesn't appear.
 
 **The agent panel** shows up whenever DAAF has dispatched specialists to work in the background. It gives you one row per running specialist, and each row reports that specialist's type (what kind of agent it is), its model, its current status, its token count, and its own context meter -- so you can watch several agents make progress at once.
 
@@ -918,9 +967,7 @@ This isn't an error -- it's DAAF being responsible about Claude's working memory
 
 Claude has a finite context window. As a session progresses and Claude processes more information, that window fills up. Even with large context windows (up to 1M tokens), quality can degrade well before the window is full, so DAAF enforces both percentage-based and absolute token thresholds — whichever fires first.
 
-The exact trigger points depend on the model's **context-quality threshold profile**. DAAF detects the exact model identifier automatically — nothing to configure. Claude Fable/Mythos models retain the validated extended-horizon profile. Exact terminal GPT 5.6 Sol model slugs, bare or provider-prefixed, use the standard percentage gates while retaining Sol's higher validated absolute gates. Opus, Sonnet, unknown model IDs, every other GPT variant, GLM models, and all other alternative-provider models use the conservative-default profile unless individually validated and registered.
-
-For GPT 5.6 Sol, the terminal model slug must be exactly `gpt-5.6-sol` or `gpt-5.6-sol[1m]`; the identifier may be bare or may contain one or more provider path prefixes ending in `/`. Malformed left-boundary strings such as `xgpt-5.6-sol`, `foo-gpt-5.6-sol`, and `vendor/notgpt-5.6-sol` remain conservative, as do right-side suffix or trailing variants. Threshold-profile selection is version-specific and independent of physical context-window mapping. Terra, Luna, Pro, mini, chat, date snapshots, future variants, and trailing modifiers remain conservative unless separately validated, even when a wider GPT 5.6 variant maps to a 1,050,000-token physical window. That 1,050,000-token physical window is itself route-conditional: it holds on the OpenAI-API-key and OpenRouter routes, while the ChatGPT-subscription (Codex) shim lane is backend-capped near ~370,000 tokens (measured for Sol, 2026-07-16), which DAAF's hooks and statuslines lane-gate automatically. On that 370k physical window, exact Sol's standard percentage boundaries are 148k, 222k, and 277.5k tokens, before its retained 300k, 400k, and 500k absolute gates. Physical-window mapping and quality-threshold profile selection remain separate. GPT is not part of Claude's Fable/Mythos family: exact Sol now shares standard percentages but retains the higher validated Sol absolute gates. The four status levels and what DAAF does at each are the same for every model; only the trigger points differ:
+The exact trigger points vary by model — DAAF detects which model you're running automatically and applies the matching profile, so there's nothing to configure. Broadly, models DAAF has specifically validated (Claude Fable/Mythos, and exact GPT 5.6 Sol) get more generous thresholds, while everything else — Opus, Sonnet, other GPT variants, GLM, and any unrecognized model — uses conservative defaults. One wrinkle worth knowing: on the ChatGPT-subscription (Codex) lane the usable context window itself is capped lower (~370k tokens), so the thresholds there fire earlier than on the full-window API route. The four status levels and what DAAF does at each are the same for every model; only the trigger points differ:
 
 | Threshold Profile | Membership | ELEVATED at | HIGH at | CRITICAL at |
 |-------------------|------------|-------------|---------|-------------|
@@ -966,7 +1013,7 @@ This is one of the most common -- and most important -- symptoms to recognize. I
 DAAF has extensive curated knowledge about its supported data sources, stored in skill files. When these skills load correctly, agents have access to exact variable names, precise endpoint paths, correct coded values, and known caveats. When a skill *doesn't* load -- which can happen due to the non-deterministic nature of LLMs -- the agent falls back on its general training data and fills in the gaps with plausible-sounding but potentially incorrect details.
 
 **What to do:**
-1. Make sure **Verbose output** is set to **True** in `/config`. This is your primary tool for monitoring how agents are deciding to load or not to load certain reference files.
+1. Use **Verbose output** (on by default in DAAF — you can confirm it in `/config`) to monitor how agents are deciding to load or not to load certain reference files. This is your primary tool for spotting a skipped skill or reference.
 2. Ask DAAF to verify: "Can you double-check that variable name against the actual skill documentation?" or "Did the agent load the CCD data source skill before writing that script?"
 3. If the issue persists, try restarting the session with `/clear` -- a fresh context often resolves loading issues. For Full Pipeline mode, DAAF's session recovery system will pick up where you left off.
 4. Report persistent loading failures by [opening an issue](https://github.com/DAAF-Contribution-Community/daaf/issues) -- patterns of failure help us improve DAAF's loading reliability.