diff --git a/include/morph/core/bridge.hpp b/include/morph/core/bridge.hpp
index daff4afb8..460f76cde 100644
--- a/include/morph/core/bridge.hpp
+++ b/include/morph/core/bridge.hpp
@@ -1344,7 +1344,10 @@ class Bridge {
                                         if (rejectIfGone(sink, bound, settled)) {
                                             return;
                                         }
-                                        if (bound->primary != key || bound->currentId.load() == 0U) {
+                                        // An attach that left the binding on another key must not
+                                        // dispatch there. One that kept the key but bound no
+                                        // instance is rejected by `dispatchNow` itself.
+                                        if (bound->primary != key) {
                                             sink->settleException(bound->bindFailure ? bound->bindFailure
                                                                                      : notBound());
                                             return;
diff --git a/include/morph/core/remote.hpp b/include/morph/core/remote.hpp
index 85082ebc2..aa730fd85 100644
--- a/include/morph/core/remote.hpp
+++ b/include/morph/core/remote.hpp
@@ -1588,11 +1588,11 @@ class RemoteServer : public std::enable_shared_from_this<RemoteServer> {
     /// random key; guarded defensively rather than ever handed out.
     /// @return A freshly-generated, non-zero, opaque `ModelId`.
     [[nodiscard]] ::morph::exec::detail::ModelId nextOpaqueId() {
-        uint64_t id = 0;
-        do {
-            id = _idGen.permute(++_nextId);
-        } while (id == 0);
-        return ::morph::exec::detail::ModelId{id};
+        for (;;) {
+            if (uint64_t const opaque = _idGen.permute(++_nextId); opaque != 0) {
+                return ::morph::exec::detail::ModelId{opaque};
+            }
+        }
     }
 
     /// Everything one dispatched execute carries from `dispatchExecute` to its
diff --git a/include/morph/core/timeout_scheduler.hpp b/include/morph/core/timeout_scheduler.hpp
index a6507e7b8..39e3296cf 100644
--- a/include/morph/core/timeout_scheduler.hpp
+++ b/include/morph/core/timeout_scheduler.hpp
@@ -55,7 +55,8 @@ namespace morph::async::detail {
 /// thread, so it is known before the loop has armed anything.
 class TimeoutScheduler {
 public:
-    /// @brief Opaque identifier for one scheduled callback.
+    /// @brief Opaque identifier for one scheduled callback. Never `0`, so a
+    ///        holder may keep `0` for "nothing scheduled" and cancel it safely.
     using Handle = std::uint64_t;
 
     /// @brief Builds the scheduler on @p loop, whose thread runs every callback.
diff --git a/include/morph/core/wire.hpp b/include/morph/core/wire.hpp
index 71e14a530..977281012 100644
--- a/include/morph/core/wire.hpp
+++ b/include/morph/core/wire.hpp
@@ -571,8 +571,8 @@ inline constexpr std::array<std::string_view, 12> kOmittableEnvelopeKeys{
     while (idx < window.size() && (window[idx] == ' ' || window[idx] == '\t')) {
         ++idx;
     }
+    // No digits leaves `value` at 0, which is already the "no id" answer.
     std::uint64_t value = 0;
-    bool sawDigit = false;
     for (; idx < window.size(); ++idx) {
         // idx is bounded by the loop condition.
         // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-avoid-unchecked-container-access)
@@ -585,9 +585,8 @@ inline constexpr std::array<std::string_view, 12> kOmittableEnvelopeKeys{
             return 0;  // out of range — treat as unrecoverable rather than wrap
         }
         value = (value * 10U) + digit;
-        sawDigit = true;
     }
-    return sawDigit ? value : 0;
+    return value;
 }
 
 }  // namespace detail
diff --git a/scripts/branch_partial_allowlist.json b/scripts/branch_partial_allowlist.json
index 7f801172e..c255f19a3 100644
--- a/scripts/branch_partial_allowlist.json
+++ b/scripts/branch_partial_allowlist.json
@@ -109,7 +109,7 @@
     },
     {
       "file": "include/morph/core/bridge.hpp",
-      "line": 1773,
+      "line": 1776,
       "source": "if (_executeDeadline.count() <= 0 || !_timeoutScheduler) {",
       "reason": "The `!_timeoutScheduler` disjunct is unreachable by construction. `setExecuteDeadline` is the only writer of both `_executeDeadline` and `_timeoutScheduler`, and it creates `_timeoutScheduler` in the same call that makes `_executeDeadline` positive; nothing resets `_timeoutScheduler` to null afterwards (setting the deadline back to 0 only stops new calls from arming it, per that method's doc comment). So `_executeDeadline > 0 && !_timeoutScheduler` cannot hold once any positive deadline has been set."
     },
diff --git a/tests/test_async_delay.cpp b/tests/test_async_delay.cpp
index 238893f63..1437165e7 100644
--- a/tests/test_async_delay.cpp
+++ b/tests/test_async_delay.cpp
@@ -9,9 +9,11 @@
 #include <core/async/Cancellation.hpp>
 #include <core/async/StopToken.hpp>
 #include <core/async/Task.hpp>
+#include <cstddef>
 #include <memory>
 #include <morph/core/coroutine.hpp>
 #include <morph/core/executor.hpp>
+#include <morph/core/io_loop.hpp>
 #include <morph/core/timeout_scheduler.hpp>
 #include <thread>
 
@@ -148,3 +150,51 @@ TEST_CASE("a delay whose coroutine is destroyed while it waits withdraws its tim
     REQUIRE(morph::testing::waitUntil([&] { return past.load(); }));
     REQUIRE_FALSE(seen->finished.load());
 }
+
+namespace {
+
+// Timers armed on @p loop's event loop, read on the loop's own thread -- which
+// also means every schedule or cancel posted to it before has been applied.
+std::size_t armedTimers(morph::exec::IoLoop& loop) {
+    std::size_t count = 0;
+    loop.runAndWait([&loop, &count] { count = loop.loop().pendingTimerCount(); });
+    return count;
+}
+
+}  // namespace
+
+TEST_CASE("a stop that cancels a delay also retires its timer", "[coroutine][delay]") {
+    morph::exec::IoLoop loop;
+    morph::async::detail::TimeoutScheduler scheduler{loop};
+    morph::exec::MainThreadExecutor exec;
+    auto seen = std::make_shared<DelayObserved>();
+    auto const before = armedTimers(loop);
+
+    auto task = waitFor(&scheduler, 1h, seen);
+    // NOLINTNEXTLINE(misc-const-correctness): request_stop() is non-const in the standard.
+    core::async::StopSource stop;
+    task.handle().promise().setStopToken(stop.get_token());
+    morph::async::spawn(exec, std::move(task));
+    REQUIRE(pumpUntil(exec, [&] { return seen->reachedAwait.load(); }));
+    REQUIRE(armedTimers(loop) == before + 1);
+
+    stop.request_stop();
+    REQUIRE(pumpUntil(exec, [&] { return seen->finished.load(); }));
+    REQUIRE(seen->cancelled);
+    CHECK(armedTimers(loop) == before);
+}
+
+TEST_CASE("a delay whose coroutine is destroyed while it waits retires its timer", "[coroutine][delay]") {
+    morph::exec::IoLoop loop;
+    morph::async::detail::TimeoutScheduler scheduler{loop};
+    auto seen = std::make_shared<DelayObserved>();
+    auto const before = armedTimers(loop);
+    {
+        auto task = waitFor(&scheduler, 1h, seen);
+        task.handle().resume();
+        REQUIRE(seen->reachedAwait.load());
+        REQUIRE(armedTimers(loop) == before + 1);
+    }
+    CHECK(armedTimers(loop) == before);
+    CHECK_FALSE(seen->finished.load());
+}
diff --git a/tests/test_backend_extra.cpp b/tests/test_backend_extra.cpp
index 01c4f15f8..04144d1bb 100644
--- a/tests/test_backend_extra.cpp
+++ b/tests/test_backend_extra.cpp
@@ -14,6 +14,7 @@
 #include <mutex>
 #include <stdexcept>
 #include <thread>
+#include <utility>
 #include <vector>
 
 #include "test_support.hpp"
@@ -432,3 +433,148 @@ TEST_CASE("morph::backend::LocalBackend: amortised pending compaction bounds the
 
     CHECK(cancelledCount == kRounds);
 }
+
+TEST_CASE("morph::backend::LocalBackend: trackedPendingCount counts every call still in flight",
+          "[backend][local][pending]") {
+    // Declared before the pool and the backend: the parked ops read it until
+    // the backend's teardown has drained them.
+    std::atomic<bool> release{false};
+    std::atomic<int> ran{0};
+    morph::exec::ThreadPoolExecutor pool{2};
+    SyncExecutor cbExec;
+    morph::backend::LocalBackend backend{pool};
+    auto mid = backend.registerModel("BE_CounterModel", morph::model::detail::ModelFactory::create<CounterModel>);
+    CHECK(backend.trackedPendingCount() == 0);
+
+    std::vector<morph::async::Completion<std::shared_ptr<void>>> live;
+    live.reserve(3);
+    for (int i = 0; i < 3; ++i) {
+        live.push_back(backend.execute(mid, pendingCall([&release, &ran] {
+                                           while (!release.load(std::memory_order_acquire)) {
+                                               std::this_thread::sleep_for(std::chrono::milliseconds(1));
+                                           }
+                                           ran.fetch_add(1);
+                                       }),
+                                       &cbExec));
+    }
+    CHECK(backend.trackedPendingCount() == 3);
+
+    release.store(true, std::memory_order_release);
+    REQUIRE(morph::testing::waitUntil([&] { return ran.load() == 3; }));
+}
+
+TEST_CASE("morph::backend::LocalBackend: executeLatencyMs covers the time the handler ran",
+          "[backend][local][observability]") {
+    morph::observe::ScopedObserveOverride const guard;
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::exec::MainThreadExecutor cbExec;
+    morph::backend::LocalBackend backend{pool};
+    auto mid = backend.registerModel("BE_CounterModel", morph::model::detail::ModelFactory::create<CounterModel>);
+
+    std::mutex sampleMtx;
+    std::vector<double> latencies;
+    morph::observe::setMetricSink([&](const morph::observe::MetricEvent& evt) {
+        if (evt.metric == morph::observe::Metric::executeLatencyMs) {
+            std::scoped_lock const lock{sampleMtx};
+            latencies.push_back(evt.value);
+        }
+    });
+
+    std::atomic<bool> done{false};
+    backend.execute(mid, pendingCall([] { std::this_thread::sleep_for(std::chrono::milliseconds(20)); }), &cbExec)
+        .then([&](const std::shared_ptr<void>&) { done = true; });
+    REQUIRE(morph::testing::pumpOwnerUntil(cbExec, [&] { return done.load(); }));
+
+    std::scoped_lock const lock{sampleMtx};
+    REQUIRE(latencies.size() == 1);
+    // A lower bound only: the handler slept 20 ms inside the measured span,
+    // and how much longer the span took depends on the machine.
+    CHECK(latencies.front() >= 20.0);
+}
+
+namespace {
+
+/// What a hand-built Task handler kept when it started: the token it was given
+/// and the callback that ends it.
+struct ParkedTaskHandler {
+    std::atomic<bool> started{false};
+    core::async::StopToken token;
+    morph::backend::detail::ActionCall::LocalDone done;
+
+    /// Ends the handler. The callback is taken out before it runs: it holds the
+    /// call, the call holds this handler, and leaving it stored keeps both alive.
+    void finish(std::exception_ptr error) { std::exchange(done, nullptr)(nullptr, std::move(error)); }
+};
+
+/// A Task-handler call that starts and then stays suspended: it records its
+/// token and its completion callback in the `ParkedTaskHandler` the call
+/// carries, and returns without finishing.
+morph::backend::detail::ActionCall parkedTaskCall(const std::shared_ptr<ParkedTaskHandler>& slot) {
+    morph::backend::detail::ActionCall call;
+    call.modelTypeId = "BE_CounterModel";
+    call.actionTypeId = "BE_CounterAction";
+    call.action = slot;
+    // NOLINTNEXTLINE(performance-unnecessary-value-param): ActionCall::localOpAsync fixes the by-value signature
+    call.localOpAsync = [](morph::model::detail::IModelHolder& /*holder*/, std::shared_ptr<void> action,
+                           const std::shared_ptr<morph::exec::detail::TaskResumer>& /*executor*/,
+                           core::async::StopToken token, morph::backend::detail::ActionCall::LocalDone done) {
+        auto* parked = static_cast<ParkedTaskHandler*>(action.get());
+        parked->token = std::move(token);
+        parked->done = std::move(done);
+        parked->started.store(true);
+    };
+    return call;
+}
+
+}  // namespace
+
+TEST_CASE("morph::backend::LocalBackend: destruction requests stop on a Task handler still running",
+          "[backend][local][lifetime]") {
+    auto slot = std::make_shared<ParkedTaskHandler>();
+    morph::exec::ThreadPoolExecutor pool{2};
+    SyncExecutor cbExec;
+    {
+        morph::backend::LocalBackend backend{pool};
+        auto mid = backend.registerModel("BE_CounterModel", morph::model::detail::ModelFactory::create<CounterModel>);
+        auto pending = backend.execute(mid, parkedTaskCall(slot), &cbExec);
+        REQUIRE(morph::testing::waitUntil([&] { return slot->started.load(); }));
+        CHECK_FALSE(slot->token.stop_requested());
+    }
+    // Nothing cancelled the call before the backend went: only its destructor
+    // could have asked the handler to stop.
+    CHECK(slot->token.stop_requested());
+
+    // The handler unwinds after its backend is gone, as a stopped one would.
+    slot->finish(std::make_exception_ptr(std::runtime_error{"stopped"}));
+}
+
+TEST_CASE("morph::backend::LocalBackend: a call cancelled while it waited behind a Task handler finishes as a failure",
+          "[backend][local][observability]") {
+    morph::observe::ScopedObserveOverride const guard;
+    std::atomic<int> errors{0};
+    morph::observe::setMetricSink([&errors](const morph::observe::MetricEvent& evt) {
+        if (evt.metric == morph::observe::Metric::executeErrors) {
+            errors.fetch_add(1);
+        }
+    });
+    auto slot = std::make_shared<ParkedTaskHandler>();
+    std::atomic<bool> queuedRan{false};
+    morph::exec::ThreadPoolExecutor pool{2};
+    SyncExecutor cbExec;
+    morph::backend::LocalBackend backend{pool};
+    auto mid = backend.registerModel("BE_CounterModel", morph::model::detail::ModelFactory::create<CounterModel>);
+
+    // The Task handler holds the instance's action gate; the ordinary call
+    // waits behind it, and is failed there by the cancellation.
+    auto task = backend.execute(mid, parkedTaskCall(slot), &cbExec);
+    REQUIRE(morph::testing::waitUntil([&] { return slot->started.load(); }));
+    auto queued = backend.execute(mid, pendingCall([&queuedRan] { queuedRan.store(true); }), &cbExec);
+    backend.cancelPending(std::make_exception_ptr(morph::backend::BackendChangedError{}));
+    REQUIRE(errors.load() == 0);
+
+    // The Task handler finishes successfully, handing the gate to the waiting
+    // call: it is recorded as the failure `cancelPending` made it, not run.
+    slot->finish(nullptr);
+    REQUIRE(morph::testing::waitUntil([&] { return errors.load() == 1; }));
+    CHECK_FALSE(queuedRan.load());
+}
diff --git a/tests/test_backend_registration_surface.cpp b/tests/test_backend_registration_surface.cpp
index 50754c374..9ea2b4583 100644
--- a/tests/test_backend_registration_surface.cpp
+++ b/tests/test_backend_registration_surface.cpp
@@ -25,6 +25,7 @@
 #include <condition_variable>
 #include <exception>
 #include <functional>
+#include <future>
 #include <memory>
 #include <morph/core/backend.hpp>
 #include <morph/core/bridge.hpp>
@@ -784,3 +785,48 @@ TEST_CASE(
     CHECK(errRan.load() == 2);
     CHECK(inner->cancels.load() == 1);
 }
+
+// ── A synchronous verb re-entered from the control strand ───────────────────
+
+namespace {
+
+/// @brief A wrapped backend whose `listInstances("outer")` calls back into the
+///        adapter's own synchronous `listInstances` — from inside the strand
+///        task the adapter is running it in.
+struct ReentrantBackend : RecordingBackend {
+    SynchronousBackendAdapter* adapter = nullptr;
+    std::vector<std::string> nested;
+
+    std::vector<std::string> listInstances(const std::string& typeId) override {
+        if (typeId == "outer" && adapter != nullptr) {
+            nested = adapter->listInstances("inner");
+        }
+        return {typeId};
+    }
+};
+
+}  // namespace
+
+TEST_CASE("morph::backend::SynchronousBackendAdapter: a synchronous verb called on its own strand runs inline",
+          "[backend][registration-surface][threading]") {
+    // Waiting for the strand from inside the strand would never return, so the
+    // outer call is made from a detached thread and waited for with a budget:
+    // a deadlock fails the case instead of hanging the suite. The adapter and
+    // its executor are leaked on that path, since both have a thread stuck in
+    // them that teardown would wait for.
+    auto pool = std::make_unique<morph::exec::ThreadPoolExecutor>(1);
+    auto inner = std::make_shared<ReentrantBackend>();
+    auto adapter = std::make_unique<SynchronousBackendAdapter>(inner, *pool);
+    inner->adapter = adapter.get();
+
+    auto outcome = std::make_shared<std::promise<std::vector<std::string>>>();
+    auto answer = outcome->get_future();
+    std::thread{[outer = adapter.get(), outcome] { outcome->set_value(outer->listInstances("outer")); }}.detach();
+    if (answer.wait_for(morph::testing::kDefaultWaitBudget) != std::future_status::ready) {
+        [[maybe_unused]] auto const* const leakedAdapter = adapter.release();
+        [[maybe_unused]] auto const* const leakedPool = pool.release();
+        FAIL("listInstances re-entered from the control strand never returned");
+    }
+    REQUIRE(answer.get() == std::vector<std::string>{"outer"});
+    REQUIRE(inner->nested == std::vector<std::string>{"inner"});
+}
diff --git a/tests/test_bridge_bind_paths.cpp b/tests/test_bridge_bind_paths.cpp
index 3453bb787..39bb0d155 100644
--- a/tests/test_bridge_bind_paths.cpp
+++ b/tests/test_bridge_bind_paths.cpp
@@ -6,6 +6,7 @@
 // follows. Every test drives a backend whose bind and promote replies the test
 // settles by hand, so each ordering is exact rather than a race.
 
+#include <algorithm>
 #include <atomic>
 #include <catch2/catch_test_macros.hpp>
 #include <chrono>
@@ -16,11 +17,15 @@
 #include <morph/core/backend.hpp>
 #include <morph/core/bridge.hpp>
 #include <morph/core/executor.hpp>
+#include <morph/core/logger.hpp>
 #include <morph/core/model_key.hpp>
 #include <morph/core/registry.hpp>
+#include <mutex>
 #include <optional>
 #include <stdexcept>
 #include <string>
+#include <string_view>
+#include <thread>
 #include <utility>
 #include <vector>
 
@@ -328,6 +333,9 @@ TEST_CASE("Bridge destruction rejects a call still waiting for its bind", "[brid
     recordFailure(bridge->executeVia<BbpModel, BbpPlain>(binding, BbpPlain{.value = 1}, &owner), failure);
     bridge.reset();
     REQUIRE(pumpOwnerUntil(owner, [&] { return failure.settled; }));
+    // The bridge's own error, not the one a destroyed handler gives: the
+    // binding is still alive, so the reason is that the bridge went away.
+    REQUIRE(failure.what == morph::backend::BridgeDestroyedError{}.what());
 }
 
 TEST_CASE("A bind reply landing after the bridge is gone releases its instance on a backend the caller kept",
@@ -529,7 +537,16 @@ TEST_CASE("A promote that lands after an attach already keyed the binding keeps
     REQUIRE(rig.bridge->bindingPrimary(handler.binding()) == "9");
 }
 
-TEST_CASE("A failed promote leaves the binding unkeyed", "[bridge][promote]") {
+TEST_CASE("A failed promote leaves the binding unkeyed and logs the backend's reason", "[bridge][promote]") {
+    std::mutex logMtx;
+    std::vector<std::string> logged;
+    morph::log::ScopedLoggerOverride const guard{
+        [&](morph::log::LogLevel, std::string_view msg) {
+            std::scoped_lock const lock{logMtx};
+            logged.emplace_back(msg);
+        },
+        morph::log::LogLevel::error,
+    };
     Rig rig;
     rig.gate->bindMode = Reply::Inline;
     BridgeHandler<BbpModel, AllowShared> handler{*rig.bridge, &rig.owner};
@@ -537,7 +554,12 @@ TEST_CASE("A failed promote leaves the binding unkeyed", "[bridge][promote]") {
     handler.execute(BbpMake{}).then([&](const BbpMade&) { done.store(true); });
     REQUIRE(pumpOwnerUntil(rig.owner, [&] { return done.load(); }));
     rig.gate->rejectPromote();
-    rig.owner.runFor(std::chrono::milliseconds{5});
+    REQUIRE(pumpOwnerUntil(rig.owner, [&] {
+        std::scoped_lock const lock{logMtx};
+        return std::ranges::any_of(logged, [](const std::string& line) {
+            return line.contains("promotion of 'BBP_Model' failed: promote refused");
+        });
+    }));
     REQUIRE(rig.bridge->bindingPrimary(handler.binding()).empty());
 }
 
@@ -562,6 +584,19 @@ TEST_CASE("A keyed call whose bind is refused is rejected with the bind's error"
     REQUIRE(failure.what == "attach refused");
 }
 
+TEST_CASE("A keyed call whose attach settles with no instance is rejected as not bound", "[bridge][bind]") {
+    Rig rig;
+    BridgeHandler<BbpModel, AllowShared> handler{*rig.bridge, &rig.owner};
+    Failure failure;
+    recordFailure(handler.execute(BbpLoad{.id = 3}), failure);
+    REQUIRE(rig.gate->heldBinds() == 1);
+
+    GateBackend::resolveFirst(*rig.gate->bindStash(), ModelId{});
+    REQUIRE(pumpOwnerUntil(rig.owner, [&] { return failure.settled; }));
+    REQUIRE(failure.what == "handler not bound");
+    REQUIRE(rig.bridge->pendingCalls() == 0);
+}
+
 // ── Binds that never produce an outcome, and the calls queued behind them ────
 
 TEST_CASE("A backend that returns an empty bind completion fails the bind", "[bridge][bind]") {
@@ -735,6 +770,58 @@ TEST_CASE("A handler registration posted to the owner is dropped when the bridge
     SUCCEED();
 }
 
+// A superseded reply must stay superseded however many binds follow it: the
+// count that marks it stale must never come back round to the value it carries.
+
+TEST_CASE("An attach superseded by a switch stays superseded once a newer attach is issued",
+          "[bridge][bind][switch]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::exec::MainThreadExecutor owner;
+    auto old = std::make_shared<GateBackend>(pool);
+    Bridge bridge{std::make_unique<GateBackend>(pool), owner};
+    bridge.switchBackend(std::static_pointer_cast<morph::backend::detail::IBackend>(old));
+    BridgeHandler<BbpModel, AllowShared> handler{bridge, &owner};
+    handler.attach(1);
+    REQUIRE(old->heldBinds() == 1);
+
+    auto next = std::make_unique<GateBackend>(pool);
+    auto* nextGate = next.get();
+    bridge.switchBackend(std::move(next));
+    handler.attach(2);
+    REQUIRE(nextGate->heldBinds() == 1);
+
+    // The first attach's reply lands last: it is released, and binds nothing.
+    old->resolveBind();
+    owner.runFor(std::chrono::milliseconds{5});
+    REQUIRE(*old->releasedCounter() == 1);
+    REQUIRE_FALSE(handler.isBound());
+    REQUIRE(bridge.bindingPrimary(handler.binding()).empty());
+}
+
+TEST_CASE("A bind superseded by a switch stays superseded once a reconnect issues another",
+          "[bridge][bind][switch][reconnect]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::exec::MainThreadExecutor owner;
+    auto old = std::make_shared<GateBackend>(pool);
+    Bridge bridge{std::make_unique<GateBackend>(pool), owner};
+    bridge.switchBackend(std::static_pointer_cast<morph::backend::detail::IBackend>(old));
+    BridgeHandler<BbpModel> const handler{bridge, &owner};
+    REQUIRE(old->heldBinds() == 1);
+
+    auto next = std::make_unique<GateBackend>(pool);
+    auto* nextGate = next.get();
+    bridge.switchBackend(std::move(next));
+    REQUIRE(nextGate->heldBinds() == 1);
+    nextGate->fireReconnect();
+    REQUIRE(pumpOwnerUntil(owner, [&] { return nextGate->heldBinds() == 2; }));
+
+    // The first bind's reply lands last: it is released, and binds nothing.
+    old->resolveBind();
+    owner.runFor(std::chrono::milliseconds{5});
+    REQUIRE(*old->releasedCounter() == 1);
+    REQUIRE_FALSE(handler.isBound());
+}
+
 TEST_CASE("A superseded bind that replies with no instance releases nothing", "[bridge][bind][switch]") {
     morph::exec::ThreadPoolExecutor pool{2};
     morph::exec::MainThreadExecutor owner;
@@ -752,3 +839,78 @@ TEST_CASE("A superseded bind that replies with no instance releases nothing", "[
     owner.runFor(std::chrono::milliseconds{5});
     REQUIRE(*old->releasedCounter() == 0);
 }
+
+// ── What a rejected or released operation leaves behind ──────────────────────
+
+TEST_CASE("An attach held behind a bind is dropped, not issued, when its handler is destroyed",
+          "[bridge][bind][teardown]") {
+    Rig rig;
+    // Outlives the handler: the keyed call is rejected with its destruction,
+    // and that failure is delivered on the owner afterwards.
+    Failure keyed;
+    {
+        BridgeHandler<BbpModel, AllowShared> handler{*rig.bridge, &rig.owner};
+        recordFailure(handler.execute(BbpLoad{.id = 1}), keyed);
+        REQUIRE(rig.gate->heldBinds() == 1);
+        handler.attach(2);  // waits behind the keyed call's bind
+    }
+    rig.owner.runFor(std::chrono::milliseconds{5});
+    // Only the keyed call's bind was ever issued: the attach was rejected with
+    // the handler's destruction rather than run against a deregistered binding.
+    REQUIRE(rig.gate->heldBinds() == 1);
+}
+
+TEST_CASE("Bridge::assignHandlerPrimary with an empty key promotes nothing", "[bridge][promote]") {
+    Rig rig;
+    rig.gate->bindMode = Reply::Inline;
+    auto binding = rig.bridge->registerHandler<BbpModel>();
+    REQUIRE(Bridge::isBound(binding));
+
+    rig.bridge->assignHandlerPrimary<BbpModel>(binding, "");
+    REQUIRE(rig.gate->heldPromotes() == 0);
+    REQUIRE(rig.bridge->bindingPrimary(binding).empty());
+}
+
+TEST_CASE("Destroying one handler leaves the bridge tracking the others", "[bridge][bind][switch]") {
+    Rig rig;
+    rig.gate->bindMode = Reply::Inline;
+    BridgeHandler<BbpModel> const survivor{*rig.bridge, &rig.owner};
+    {
+        BridgeHandler<BbpModel> const dropped{*rig.bridge, &rig.owner};
+    }
+
+    // A switch re-binds every handler the bridge still tracks: the survivor,
+    // and only the survivor.
+    auto next = std::make_unique<GateBackend>(rig.pool);
+    auto* nextGate = next.get();
+    rig.bridge->switchBackend(std::move(next));
+    REQUIRE(nextGate->heldBinds() == 1);
+}
+
+TEST_CASE("A call made on the owner before a posted handler registration runs is held, not refused",
+          "[bridge][bind]") {
+    Rig rig;
+    rig.gate->bindMode = Reply::Inline;
+
+    // Constructed off the owner, so its registration is posted there.
+    std::unique_ptr<BridgeHandler<BbpModel>> handler;
+    std::thread constructor{[&] { handler = std::make_unique<BridgeHandler<BbpModel>>(*rig.bridge, &rig.owner); }};
+    constructor.join();
+    REQUIRE_FALSE(handler->isBound());
+
+    std::atomic<int> result{-1};
+    Failure failure;
+    handler->execute(BbpPlain{.value = 3})
+        .then([&](const BbpValue& val) { result.store(val.value); })
+        .onError([&](const std::exception_ptr& err) {
+            try {
+                std::rethrow_exception(err);
+            } catch (const std::exception& exc) {
+                failure.what = exc.what();
+            }
+            failure.settled = true;
+        });
+    REQUIRE(pumpOwnerUntil(rig.owner, [&] { return result.load() != -1 || failure.settled; }));
+    REQUIRE(failure.what.empty());
+    REQUIRE(result.load() == 3);
+}
diff --git a/tests/test_bridge_owner.cpp b/tests/test_bridge_owner.cpp
index 5052fc93d..bf9971c0e 100644
--- a/tests/test_bridge_owner.cpp
+++ b/tests/test_bridge_owner.cpp
@@ -302,6 +302,23 @@ TEST_CASE("Bridge: the subscription fan-out of a result settled on a pool thread
     REQUIRE(recorder.allPosted("Bridge::publishResult"));
 }
 
+TEST_CASE("Bridge: a result the backend settles on the owner is published before execute returns",
+          "[bridge][owner][subscription]") {
+    // A backend whose strands run inline settles on the calling thread, which
+    // is the owner here: the bridge-side work runs there at once rather than
+    // as a later owner task. The owner is never pumped.
+    morph::testing::InlineExecutor inlinePool;
+    morph::testing::InlineExecutor gui;
+    morph::exec::MainThreadExecutor owner;
+    morph::bridge::Bridge bridge{std::make_unique<morph::backend::LocalBackend>(inlinePool), owner};
+    morph::bridge::BridgeHandler<PingModel> handler{bridge, &gui};
+
+    int seen = 0;
+    handler.subscribe<Pong>([&](Pong pong) { seen = pong.value; });
+    handler.execute(Ping{.value = 3});
+    REQUIRE(seen == 6);
+}
+
 // ── Owner-only verbs ─────────────────────────────────────────────────────────
 
 TEST_CASE("Bridge: owner-only verbs run inside the owner's task, and are caught off it", "[bridge][owner]") {
@@ -393,6 +410,29 @@ TEST_CASE("BridgeHandler: teardown runs on the owner, and a destruction off it i
     }
 }
 
+#ifndef NDEBUG
+TEST_CASE("BridgeHandler: a guiExec other than the owner is checked once, where it runs its tasks",
+          "[bridge][owner]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::exec::MainThreadExecutor owner;
+    morph::bridge::Bridge bridge{std::make_unique<morph::backend::LocalBackend>(pool), owner};
+    OwnerProbeRecorder const recorder{owner.coreExecutor()};
+
+    SECTION("the owner itself needs no check") {
+        morph::bridge::BridgeHandler<PingModel> const handler{bridge, &owner};
+        owner.runFor(std::chrono::milliseconds{5});
+        REQUIRE(recorder.count("BridgeHandler::guiExec") == 0);
+    }
+
+    SECTION("another executor is checked inside one of its own tasks") {
+        morph::exec::MainThreadExecutor gui;
+        morph::bridge::BridgeHandler<PingModel> const handler{bridge, &gui};
+        REQUIRE(pumpOwnerUntil(gui, [&] { return recorder.count("BridgeHandler::guiExec") == 1; }));
+        REQUIRE_FALSE(recorder.at("BridgeHandler::guiExec").front().onOwner);
+    }
+}
+#endif
+
 // ── Backends below the bridge ────────────────────────────────────────────────
 
 TEST_CASE("SynchronousBackendAdapter: a bind registered from inside an action is issued on the owner",
diff --git a/tests/test_bridge_remote.cpp b/tests/test_bridge_remote.cpp
index c9bdaa6a0..8a880da00 100644
--- a/tests/test_bridge_remote.cpp
+++ b/tests/test_bridge_remote.cpp
@@ -8,7 +8,9 @@
 #include <morph/core/registry.hpp>
 #include <morph/core/remote.hpp>
 #include <stdexcept>
+#include <string>
 #include <thread>
+#include <vector>
 
 #include "test_support.hpp"
 
@@ -96,3 +98,99 @@ TEST_CASE("morph::backend::SimulatedRemoteBackend: multiple actions on same hand
     REQUIRE(count.load() == numActions);
     REQUIRE(sum.load() == 15);  // 1+2+3+4+5
 }
+
+TEST_CASE("morph::backend::SimulatedRemoteBackend: assignPrimary files a live instance under its key",
+          "[bridge][remote]") {
+    morph::exec::ThreadPoolExecutor serverPool{2};
+    auto const server = std::make_shared<morph::backend::RemoteServer>(serverPool);
+    morph::backend::SimulatedRemoteBackend backend{*server};
+
+    auto const mid = backend.registerModel("TestR_EchoModel", {});
+    REQUIRE(mid.v != 0U);
+    REQUIRE(backend.listInstances("TestR_EchoModel").empty());
+
+    backend.assignPrimary(mid, "TestR_EchoModel", "filed-key");
+    CHECK(backend.listInstances("TestR_EchoModel") == std::vector<std::string>{"filed-key"});
+}
+
+TEST_CASE("morph::backend::SimulatedRemoteBackend: binding a private instance releases the one it replaces",
+          "[bridge][remote]") {
+    morph::exec::ThreadPoolExecutor serverPool{2};
+    auto const server = std::make_shared<morph::backend::RemoteServer>(serverPool);
+    morph::backend::SimulatedRemoteBackend backend{*server};
+    auto const liveModels = [&server] {
+        return morph::testing::awaitAnswer([&server](auto& owner) { return server->health(owner); }).liveModels;
+    };
+
+    auto const old = backend.registerModel("TestR_EchoModel", {});
+    REQUIRE(liveModels() == 1U);
+
+    morph::backend::detail::BindRequest request;
+    request.typeId = "TestR_EchoModel";
+    request.current = old;
+    morph::exec::MainThreadExecutor cbExec;
+    auto const bound = morph::testing::awaitValueOn(cbExec, backend.bindModel(std::move(request), cbExec));
+    CHECK(bound.v != old.v);
+    CHECK(liveModels() == 1U);
+}
+
+namespace {
+std::atomic<bool>& remoteBlockRelease() {
+    static std::atomic<bool> value{false};
+    return value;
+}
+std::atomic<int>& remoteBlockStarted() {
+    static std::atomic<int> value{0};
+    return value;
+}
+}  // namespace
+
+struct BlockAction {};
+struct BlockModel {
+    int execute(BlockAction /*action*/) {
+        remoteBlockStarted().fetch_add(1);
+        while (!remoteBlockRelease().load()) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        }
+        return 0;
+    }
+};
+
+BRIDGE_REGISTER_MODEL(BlockModel, "TestR_BlockModel")
+// The generated fromJson body declares a non-const local inside the macro.
+// NOLINTNEXTLINE(misc-const-correctness)
+BRIDGE_REGISTER_ACTION(BlockModel, BlockAction, "TestR_BlockAction")
+
+TEST_CASE("morph::backend::SimulatedRemoteBackend: cancelPending fails every call still in flight",
+          "[bridge][remote]") {
+    remoteBlockRelease().store(false);
+    remoteBlockStarted().store(0);
+    morph::exec::ThreadPoolExecutor serverPool{2};
+    auto const server = std::make_shared<morph::backend::RemoteServer>(serverPool);
+    morph::exec::MainThreadExecutor cbExec;
+    auto owned = std::make_unique<morph::backend::SimulatedRemoteBackend>(*server);
+    auto* const backend = owned.get();
+    morph::bridge::Bridge bridge{std::move(owned), cbExec};
+    morph::bridge::BridgeHandler<BlockModel> handler{bridge, &cbExec};
+
+    // Three calls on one instance: the first runs and blocks, the other two
+    // queue behind it, so all three are in flight together.
+    constexpr int kCalls = 3;
+    std::atomic<int> errors{0};
+    for (int idx = 0; idx < kCalls; ++idx) {
+        handler.execute(BlockAction{}).then([](int) {}).onError([&errors](const std::exception_ptr&) {
+            errors.fetch_add(1);
+        });
+    }
+    REQUIRE(morph::testing::waitUntil([] { return remoteBlockStarted().load() == 1; }));
+
+    backend->cancelPending(std::make_exception_ptr(std::runtime_error("cancelled")));
+    for (int idx = 0; idx < 100 && errors.load() < kCalls; ++idx) {
+        cbExec.runFor(std::chrono::milliseconds(10));
+    }
+    CHECK(errors.load() == kCalls);
+
+    remoteBlockRelease().store(true);
+    REQUIRE(morph::testing::awaitAnswer(
+        [&server](auto& owner) { return server->drainedWithin(std::chrono::milliseconds{5000}, owner); }));
+}
diff --git a/tests/test_client_execute_deadline.cpp b/tests/test_client_execute_deadline.cpp
index 0a4ee0b15..810833681 100644
--- a/tests/test_client_execute_deadline.cpp
+++ b/tests/test_client_execute_deadline.cpp
@@ -13,6 +13,9 @@
 
 #include <catch2/catch_test_macros.hpp>
 #include <chrono>
+#include <cstddef>
+#include <exception>
+#include <filesystem>
 #include <memory>
 #include <morph/core/backend.hpp>
 #include <morph/core/bridge.hpp>
@@ -399,3 +402,52 @@ TEST_CASE(
     // deadline.
     CHECK(stateWatch.expired());
 }
+
+TEST_CASE("Bridge::setExecuteDeadline(0) after a positive deadline disarms it for calls made afterwards",
+          "[core][bridge][client-deadline]") {
+    // The scheduler a positive deadline created stays for the bridge's
+    // lifetime; disabling the deadline must still leave new calls unarmed
+    // rather than arming them with a zero-length one.
+    morph::exec::MainThreadExecutor exec;
+    morph::bridge::Bridge bridge{std::make_unique<NeverRepliesBackend>(), exec};
+    bridge.setExecuteDeadline(std::chrono::milliseconds{50});
+    bridge.setExecuteDeadline(std::chrono::milliseconds{0});
+    morph::bridge::BridgeHandler<DeadlineModel> handler{bridge, &exec};
+
+    bool resolved = false;
+    handler.execute(DeadlineCount{.x = 1})
+        .then([&resolved](int) { resolved = true; })
+        .onError([&resolved](const std::exception_ptr&) { resolved = true; });
+    exec.runFor(std::chrono::milliseconds{200});
+    CHECK_FALSE(resolved);
+}
+
+#ifdef __linux__
+namespace {
+
+/// Threads in this process, one directory entry each under /proc/self/task.
+std::size_t liveThreadCount() {
+    std::size_t count = 0;
+    for ([[maybe_unused]] auto const& entry : std::filesystem::directory_iterator{"/proc/self/task"}) {
+        ++count;
+    }
+    return count;
+}
+
+}  // namespace
+
+TEST_CASE("Bridge::setExecuteDeadline(0) starts no timer thread", "[core][bridge][client-deadline]") {
+    // The scheduler, and the one thread its loop owns, are created by the
+    // first call that enables a deadline -- never by one that leaves it off.
+    // `<=` rather than `==`: a thread from an earlier case still exiting can
+    // only lower the second count, never raise it.
+    morph::exec::MainThreadExecutor exec;
+    morph::bridge::Bridge bridge{std::make_unique<NeverRepliesBackend>(), exec};
+    auto const before = liveThreadCount();
+    bridge.setExecuteDeadline(std::chrono::milliseconds{0});
+    CHECK(liveThreadCount() <= before);
+
+    bridge.setExecuteDeadline(std::chrono::milliseconds{50});
+    CHECK(liveThreadCount() > before);
+}
+#endif  // __linux__
diff --git a/tests/test_completion_owner.cpp b/tests/test_completion_owner.cpp
index 27ba932f0..1bcc35cda 100644
--- a/tests/test_completion_owner.cpp
+++ b/tests/test_completion_owner.cpp
@@ -11,6 +11,7 @@
 #include <memory>
 #include <morph/core/completion.hpp>
 #include <morph/core/coroutine.hpp>
+#include <morph/core/detail/owned_state.hpp>
 #include <morph/core/executor.hpp>
 #include <morph/core/logger.hpp>
 #include <morph/core/owner_strand.hpp>
@@ -286,3 +287,21 @@ TEST_CASE("Completion: an owner that does not run one task at a time is refused
         CHECK(recorder.count("Completion: an owner that is not serial") == 0U);
     }
 }
+
+TEST_CASE("OwnedState::ask from off the owner posts its body to the owner", "[completion][owner]") {
+    morph::exec::MainThreadExecutor owner;
+    morph::exec::ThreadPoolExecutor pool{1};
+    morph::exec::detail::OwnedState<int> owned{owner, std::make_shared<int>(3)};
+
+    Completion<bool> answer;
+    onPool(pool, [&] {
+        answer = owned.ask<bool>("OwnedStateTest::ask", owner,
+                                 [&owner](int& state) { return state == 3 && morph::exec::runningOn(owner); });
+    });
+
+    std::optional<bool> ranOnOwner;
+    owner.post([&] { answer.then([&](bool value) { ranOnOwner = value; }); });
+    drainCounting(owner);
+    REQUIRE(ranOnOwner.has_value());
+    CHECK(*ranOnOwner);
+}
diff --git a/tests/test_coroutine_client.cpp b/tests/test_coroutine_client.cpp
index d31695242..f1967114f 100644
--- a/tests/test_coroutine_client.cpp
+++ b/tests/test_coroutine_client.cpp
@@ -7,6 +7,7 @@
 #include <catch2/catch_test_macros.hpp>
 #include <chrono>
 #include <core/async/Cancellation.hpp>
+#include <core/async/ExecutorContext.hpp>
 #include <core/async/StopToken.hpp>
 #include <core/async/Task.hpp>
 #include <functional>
@@ -389,3 +390,54 @@ TEST_CASE("co_await whose handler cannot be attached rethrows at the co_await an
     REQUIRE_FALSE(seen->value.has_value());
     REQUIRE_FALSE(seen->cancelled);
 }
+
+namespace {
+
+/// Runs every task inline, then -- once armed -- reports the outermost post as
+/// failed anyway, after the task has run: a queue that accepted the work and
+/// then threw on its way out.
+class RunsThenThrowsExecutor : public morph::exec::IExecutor {
+public:
+    void armThrowAfterRunning() { _throwAfterRunning = true; }
+
+    void post(std::function<void()> task) override {
+        ++_depth;
+        {
+            // The task runs as one of this executor's, as a real queue's would.
+            ::core::async::ExecutorScope const scope{coreExecutor()};
+            task();
+        }
+        --_depth;
+        if (_throwAfterRunning && _depth == 0) {
+            throw std::runtime_error{"post failed after running the task"};
+        }
+    }
+
+private:
+    bool _throwAfterRunning = false;
+    int _depth = 0;
+};
+
+}  // namespace
+
+TEST_CASE("co_await whose attach settles the await before its post fails resumes with the value, once",
+          "[coroutine][client]") {
+    // The attach is posted to the completion's executor, which runs it inline:
+    // the completion is already settled, so the attached handler settles the
+    // await and queues the resumption on `exec` -- and only then does the post
+    // throw. The await is already answered, so the throw must not reach the
+    // coroutine as well.
+    RunsThenThrowsExecutor executor;
+    auto [completion, promise] = Completion<int>::makeSettleable(&executor);
+    promise.resolve(5);
+    executor.armThrowAfterRunning();
+    morph::exec::MainThreadExecutor exec;
+    auto seen = std::make_shared<Observed>();
+
+    morph::async::spawn(exec, awaitInto(std::move(completion), seen));
+
+    REQUIRE(pumpUntil(exec, [&] { return seen->finished.load(); }));
+    CHECK(seen->value == 5);
+    CHECK(seen->error.empty());
+    CHECK_FALSE(seen->cancelled);
+}
diff --git a/tests/test_executor_extra.cpp b/tests/test_executor_extra.cpp
index c778d0418..cad49bf14 100644
--- a/tests/test_executor_extra.cpp
+++ b/tests/test_executor_extra.cpp
@@ -31,9 +31,10 @@ TEST_CASE("morph::exec::MainThreadExecutor: tasks posted before runFor are all d
     REQUIRE(count.load() == numTasks);
 }
 
-TEST_CASE("morph::exec::ThreadPoolExecutor: stop with queued tasks does not deadlock", "[executor]") {
-    // Post many tasks and immediately destroy the pool — destructor must join cleanly.
-    // Some tasks may not run; the important invariant is no deadlock/crash.
+TEST_CASE("morph::exec::ThreadPoolExecutor: destruction runs every task queued before it, then joins", "[executor]") {
+    // Post many tasks and immediately destroy the pool: the workers drain the
+    // queue before they exit, so the join neither deadlocks nor drops a task
+    // that was queued in time.
     std::atomic<int> ran{0};
     {
         morph::exec::ThreadPoolExecutor pool{1};
@@ -43,10 +44,8 @@ TEST_CASE("morph::exec::ThreadPoolExecutor: stop with queued tasks does not dead
                 ran.fetch_add(1);
             });
         }
-        // pool destructor joins here — workers drain remaining tasks before exit
     }
-    // After join, whatever ran is fine; the test verifies it did not hang.
-    REQUIRE(ran.load() >= 0);
+    REQUIRE(ran.load() == 100);
 }
 
 TEST_CASE("morph::exec::ThreadPoolExecutor: exception in one task does not kill worker", "[executor]") {
diff --git a/tests/test_file_io_ops.cpp b/tests/test_file_io_ops.cpp
index f01c12c7f..0b7d7b7cc 100644
--- a/tests/test_file_io_ops.cpp
+++ b/tests/test_file_io_ops.cpp
@@ -13,13 +13,27 @@
 #include <cstdio>
 #include <filesystem>
 #include <fstream>
+#include <iterator>
 #include <memory>
 #include <morph/core/file_io_ops.hpp>
+#include <morph/core/logger.hpp>
 #include <string>
+#include <string_view>
 #include <system_error>
+#include <vector>
 
 namespace {
 
+std::string readAll(const std::filesystem::path& path) {
+    std::ifstream in{path, std::ios::binary};
+    return {std::istreambuf_iterator<char>{in}, std::istreambuf_iterator<char>{}};
+}
+
+void writeAll(const std::filesystem::path& path, std::string_view bytes) {
+    std::ofstream out{path, std::ios::binary};
+    out << bytes;
+}
+
 std::filesystem::path tempIoPath(const std::string& tag) {
     static int counter = 0;
     return std::filesystem::temp_directory_path() /
@@ -342,3 +356,107 @@ TEST_CASE("morph::core::repairTornTail: a read error leaves the file untouched",
     std::filesystem::remove_all(dir);
 }
 #endif
+
+TEST_CASE("morph::core::rollBackShortWrite: a short first write into an empty file is trimmed to nothing",
+          "[file_io_ops]") {
+    // Offset zero is a real offset -- the start of an empty file -- not the
+    // "could not query" sentinel, which is negative.
+    auto const path = tempIoPath("offset_zero");
+    writeAll(path, "");
+
+    morph::core::FileIoOps ioOps;
+    {
+        auto const file = openForAppend(path);
+        REQUIRE(file != nullptr);
+        morph::core::positionAtEnd(file.get());
+        long long const offsetBeforeWrite = morph::core::wideFtell(file.get());
+        REQUIRE(offsetBeforeWrite == 0);
+        REQUIRE(std::fwrite("{\"tw", 1, 4, file.get()) == 4);
+
+        CHECK(morph::core::rollBackShortWrite(ioOps, file.get(), path, offsetBeforeWrite) ==
+              morph::core::RollBack::clean);
+    }
+
+    CHECK(std::filesystem::file_size(path) == 0);
+    std::filesystem::remove(path);
+}
+
+TEST_CASE("morph::core::rollBackShortWrite: a second short write on the same handle rolls back too", "[file_io_ops]") {
+    // The caller takes each rollback's offset from `wideFtell` just before the
+    // write, so after one rollback the handle's position has to describe the
+    // shortened file. A stale position would hand the second rollback an
+    // offset past the second partial record, and leave it on disk.
+    auto const path = tempIoPath("second_rollback");
+    writeAll(path, "{\"one\":1}\n");
+
+    morph::core::FileIoOps ioOps;
+    {
+        auto const file = openForAppend(path);
+        REQUIRE(file != nullptr);
+        morph::core::positionAtEnd(file.get());
+        for (int attempt = 0; attempt < 2; ++attempt) {
+            long long const offsetBeforeWrite = morph::core::wideFtell(file.get());
+            CHECK(offsetBeforeWrite == 10);
+            REQUIRE(std::fwrite("{\"tw", 1, 4, file.get()) == 4);
+            CHECK(morph::core::rollBackShortWrite(ioOps, file.get(), path, offsetBeforeWrite) ==
+                  morph::core::RollBack::clean);
+        }
+    }
+
+    CHECK(readAll(path) == "{\"one\":1}\n");
+    std::filesystem::remove(path);
+}
+
+// ── repairTornTail ──────────────────────────────────────────────────────────
+
+namespace {
+
+struct WarningCapture {
+    std::vector<std::string> warnings;
+    morph::log::ScopedLoggerOverride guard{[this](morph::log::LogLevel level, std::string_view msg) {
+        if (level == morph::log::LogLevel::warn) {
+            warnings.emplace_back(msg);
+        }
+    }};
+};
+
+}  // namespace
+
+TEST_CASE("morph::core::repairTornTail: a file holding only a torn record is emptied", "[file_io_ops]") {
+    // No newline anywhere: there is no complete record, so everything goes.
+    auto const path = tempIoPath("only_torn");
+    writeAll(path, "{\"tw");
+
+    morph::core::FileIoOps ioOps;
+    morph::core::repairTornTail(ioOps, path, "TestComponent");
+
+    CHECK(std::filesystem::file_size(path) == 0);
+    std::filesystem::remove(path);
+}
+
+TEST_CASE("morph::core::repairTornTail: an intact file is left alone and reported as nothing", "[file_io_ops]") {
+    auto const path = tempIoPath("intact");
+    writeAll(path, "{\"one\":1}\n{\"two\":2}\n");
+
+    WarningCapture const capture;
+    morph::core::FileIoOps ioOps;
+    morph::core::repairTornTail(ioOps, path, "TestComponent");
+
+    CHECK(readAll(path) == "{\"one\":1}\n{\"two\":2}\n");
+    CHECK(capture.warnings.empty());
+    std::filesystem::remove(path);
+}
+
+TEST_CASE("morph::core::repairTornTail: a trimmed tail is reported with the bytes it discarded", "[file_io_ops]") {
+    auto const path = tempIoPath("trim_reported");
+    writeAll(path, "{\"one\":1}\n{\"tw");
+
+    WarningCapture capture;
+    morph::core::FileIoOps ioOps;
+    morph::core::repairTornTail(ioOps, path, "TestComponent");
+
+    CHECK(readAll(path) == "{\"one\":1}\n");
+    REQUIRE(capture.warnings.size() == 1);
+    CHECK(capture.warnings[0].starts_with("TestComponent: discarded 4 byte(s) of a torn trailing record in "));
+    std::filesystem::remove(path);
+}
diff --git a/tests/test_graceful_shutdown.cpp b/tests/test_graceful_shutdown.cpp
index 084fb2988..b82990588 100644
--- a/tests/test_graceful_shutdown.cpp
+++ b/tests/test_graceful_shutdown.cpp
@@ -238,6 +238,52 @@ TEST_CASE("RemoteServer::drainedWithin with no time to wait answers false while
     REQUIRE(execReply.await(2s));
 }
 
+TEST_CASE(
+    "RemoteServer::drainedWithin with no time to wait answers from the count its request finds, "
+    "not from a later one",
+    "[shutdown][graceful][drain]") {
+    gGSSlowStarted.store(0, std::memory_order_relaxed);
+    morph::exec::ThreadPoolExecutor pool{4};
+    auto const server = std::make_shared<morph::backend::RemoteServer>(pool);
+
+    morph::testing::WaitReply regReply;
+    server->handle(morph::wire::encode(morph::wire::makeRegister("GS_SlowModel")), std::ref(regReply));
+    REQUIRE(regReply.await());
+
+    morph::wire::Envelope req;
+    req.kind = "execute";
+    req.callId = 1;
+    req.modelId = regReply.env.modelId;
+    req.modelType = "GS_SlowModel";
+    req.actionType = "GS_SlowAction";
+    req.body = R"({"ms":50})";
+    morph::testing::WaitReply execReply;
+    server->handle(morph::wire::encode(req), std::ref(execReply));
+    REQUIRE(morph::testing::waitUntil([] { return gGSSlowStarted.load(std::memory_order_relaxed) >= 1; }));
+
+    // Hold the server strand, so the drain request and the execute's
+    // completion queue on it in that order: the request is answered while the
+    // execute is still counted, and the completion right behind it must not
+    // turn that answer into `true`.
+    std::atomic<bool> release{false};
+    std::atomic<bool> holding{false};
+    server->strand().post([&release, &holding] {
+        holding.store(true);
+        while (!release.load()) {
+            std::this_thread::sleep_for(1ms);
+        }
+    });
+    REQUIRE(morph::testing::waitUntil([&holding] { return holding.load(); }));
+
+    morph::exec::MainThreadExecutor owner;
+    auto drained = server->drainedWithin(0ms, owner);
+    REQUIRE(execReply.await(2s));
+    release.store(true);
+
+    bool const answer = morph::testing::awaitValueOn(owner, std::move(drained));
+    CHECK_FALSE(answer);
+}
+
 TEST_CASE("RemoteServer::drainedWithin times out while a slower-than-deadline execute is still running",
           "[shutdown][graceful][drain]") {
     gGSSlowStarted.store(0, std::memory_order_relaxed);
diff --git a/tests/test_journal_payload_evolution.cpp b/tests/test_journal_payload_evolution.cpp
index 852a58af3..3069dae17 100644
--- a/tests/test_journal_payload_evolution.cpp
+++ b/tests/test_journal_payload_evolution.cpp
@@ -285,6 +285,68 @@ TEST_CASE("payloadShapeString: the deepest level that still renders is kPayloadS
     REQUIRE(payloadFingerprint<PEDepthAtLimit>() != payloadFingerprint<PEDepthPastLimit>());
 }
 
+// Every other nesting form costs one level per wrapper too, so nine of any of
+// them put the leaf past the limit.
+
+/// One reflected member wrapped around @p T.
+template <typename T>
+struct PEBox {
+    T v;
+};
+
+/// A custom-codec wrapper around @p T that declares its inner shape.
+template <typename T>
+struct PEWrap {
+    T inner;
+};
+
+template <typename T>
+struct morph::model::PayloadShapeTag<PEWrap<T>> {
+    using Inner = T;
+    static constexpr std::string_view name() { return "w"; }
+};
+
+/// @p Wrap applied @p N times around `std::int32_t`.
+template <template <typename> class Wrap, int N>
+struct PENest {
+    using type = Wrap<typename PENest<Wrap, N - 1>::type>;
+};
+
+template <template <typename> class Wrap>
+struct PENest<Wrap, 0> {
+    using type = std::int32_t;
+};
+
+template <typename T>
+using PEOptionalOf = std::optional<T>;
+template <typename T>
+using PEMapTo = std::map<std::int32_t, T>;
+template <typename T>
+using PEMapFrom = std::map<T, std::int32_t>;
+
+TEST_CASE("payloadShapeString: every nesting form stops at kPayloadShapeMaxDepth",
+          "[journal][payload_evolution][issue174]") {
+    STATIC_REQUIRE(morph::model::detail::kPayloadShapeMaxDepth == 8);
+
+    CHECK(payloadShapeString<PENest<PEOptionalOf, 9>::type>() == "?????????x");
+    // A map renders its key and its value one level down, so the innermost
+    // map's key is past the limit too.
+    CHECK(payloadShapeString<PENest<PEMapTo, 9>::type>() == "{i4>{i4>{i4>{i4>{i4>{i4>{i4>{i4>{x>x}}}}}}}}}");
+    CHECK(payloadShapeString<PENest<PEMapFrom, 9>::type>() == "{{{{{{{{{x>x}>i4}>i4}>i4}>i4}>i4}>i4}>i4}>i4}");
+    CHECK(payloadShapeString<PENest<PEBox, 9>::type>() == "(v:(v:(v:(v:(v:(v:(v:(v:(v:x)))))))))");
+    CHECK(payloadShapeString<PENest<PEWrap, 9>::type>() == "x{w:x{w:x{w:x{w:x{w:x{w:x{w:x{w:x{w:x}}}}}}}}}");
+}
+
+TEST_CASE("payloadFingerprint: the digest is 64-bit FNV-1a, so it matches across builds and versions",
+          "[journal][payload_evolution][issue174]") {
+    // Published FNV-1a test vectors. A fingerprint stamped into a journal is
+    // compared against one computed by a later build, so the function itself
+    // must never drift.
+    CHECK(morph::model::detail::fnv1a64("") == 0xcbf29ce484222325ULL);
+    CHECK(morph::model::detail::fnv1a64("a") == 0xaf63dc4c8601ec8cULL);
+    CHECK(morph::model::detail::fnv1a64("foobar") == 0x85944171f73967e8ULL);
+}
+
 TEST_CASE("payloadFingerprint: renders nested shape and carries the scheme prefix",
           "[journal][payload_evolution][issue174]") {
     REQUIRE(payloadShapeString<PEShapeNested>() == "(inner:(count:i4,state:s),lookup:{s>i4},note:?s,xs:[i4])");
diff --git a/tests/test_limit_policy.cpp b/tests/test_limit_policy.cpp
index 512f39db7..1d99817c3 100644
--- a/tests/test_limit_policy.cpp
+++ b/tests/test_limit_policy.cpp
@@ -7,6 +7,7 @@
 #include <atomic>
 #include <catch2/catch_test_macros.hpp>
 #include <chrono>
+#include <memory>
 #include <morph/core/backend.hpp>
 #include <morph/core/bridge.hpp>
 #include <morph/core/executor.hpp>
@@ -250,6 +251,38 @@ TEST_CASE("LimitPolicy: an executeTimeout longer than the action lets the action
     REQUIRE(execReply.env.kind == "ok");
 }
 
+TEST_CASE("LimitPolicy: an execute that answers before its executeTimeout retires its deadline",
+          "[limits][limit-policy]") {
+    // The armed deadline holds the server, so one left armed after the reply
+    // would keep the server alive until it fires -- here, for an hour.
+    gLPSlowStarted.store(0, std::memory_order_relaxed);
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::backend::ServerConfig serverConfig;
+    serverConfig.limits.executeTimeout = std::chrono::hours{1};
+    auto server = std::make_shared<morph::backend::RemoteServer>(pool, serverConfig);
+
+    morph::testing::WaitReply regReply;
+    server->handle(morph::wire::encode(morph::wire::makeRegister("LP_SlowModel")), std::ref(regReply));
+    REQUIRE(regReply.await());
+
+    morph::wire::Envelope req;
+    req.kind = "execute";
+    req.callId = 1;
+    req.modelId = regReply.env.modelId;
+    req.modelType = "LP_SlowModel";
+    req.actionType = "LP_SlowAction";
+    req.body = R"({"ms":0})";
+
+    morph::testing::WaitReply execReply;
+    server->handle(morph::wire::encode(req), std::ref(execReply));
+    REQUIRE(execReply.await());
+    REQUIRE(execReply.env.kind == "ok");
+
+    std::weak_ptr<morph::backend::RemoteServer> const weak = server;
+    server.reset();
+    CHECK(morph::testing::waitUntil([&weak] { return weak.expired(); }));
+}
+
 TEST_CASE("LimitPolicy: default executeTimeout (0) never times out a slow action (regression)",
           "[limits][limit-policy]") {
     gLPSlowStarted.store(0, std::memory_order_relaxed);
diff --git a/tests/test_observability.cpp b/tests/test_observability.cpp
index 9d0a1c6da..7e6bf3d8b 100644
--- a/tests/test_observability.cpp
+++ b/tests/test_observability.cpp
@@ -5,6 +5,7 @@
 #include <catch2/catch_test_macros.hpp>
 #include <memory>
 #include <morph/core/observability.hpp>
+#include <mutex>
 #include <stdexcept>
 #include <string>
 #include <string_view>
@@ -192,6 +193,35 @@ TEST_CASE("morph::observe::ScopedObserveOverride: restores previous sinks on sco
     REQUIRE(morph::observe::detail::beginSpan("r", "m", "a") == 0);
 }
 
+TEST_CASE("morph::observe::ScopedObserveOverride: works in a process that never installed a sink", "[observability]") {
+    // Until the first setMetricSink/setTraceSink the state holds no sink
+    // object at all, not an empty one -- the state a test run filtered down to
+    // one case starts in. Reset to it here, since earlier cases installed some.
+    auto& state = morph::observe::detail::observeState();
+    {
+        std::scoped_lock const lock{state.metricMtx};
+        state.metricSink.reset();
+        state.metricsOn = false;
+    }
+    {
+        std::scoped_lock const lock{state.traceMtx};
+        state.traceSink.reset();
+        state.traceOn = false;
+    }
+    {
+        ObserveGuard const guard;
+        morph::observe::setMetricSink([](const morph::observe::MetricEvent&) {});
+        morph::observe::setTraceSink(morph::observe::TraceSink{
+            .beginSpan = [](std::string_view, std::string_view,
+                            std::string_view) { return morph::observe::SpanId{1}; },
+            .endSpan = [](morph::observe::SpanId, bool) {},
+        });
+        REQUIRE(morph::observe::metricsEnabled());
+    }
+    CHECK_FALSE(morph::observe::metricsEnabled());
+    CHECK(morph::observe::detail::beginSpan("r", "m", "a") == 0);
+}
+
 // ── Thread safety ─────────────────────────────────────────────────────────────
 
 TEST_CASE("concurrent metric emission is thread-safe", "[observability]") {
diff --git a/tests/test_opaque_model_ids.cpp b/tests/test_opaque_model_ids.cpp
index 2b7c7059c..f8d74ecdf 100644
--- a/tests/test_opaque_model_ids.cpp
+++ b/tests/test_opaque_model_ids.cpp
@@ -8,6 +8,7 @@
 // bijection) but are not sequential or predictable from a previously
 // observed id. See docs/spec/core/backend.md and docs/spec/security.md.
 
+#include <algorithm>
 #include <catch2/catch_test_macros.hpp>
 #include <cstddef>
 #include <cstdint>
@@ -19,6 +20,7 @@
 #include <string>
 #include <string_view>
 #include <unordered_set>
+#include <vector>
 
 #include "test_support.hpp"
 
@@ -126,6 +128,27 @@ TEST_CASE("OpaqueIdGenerator is a bijection over counters that exercise the high
     REQUIRE(gen.permute(0U) != gen.permute(1ULL << 32U));
 }
 
+// A permutation that drops either half's contribution, or folds its 64-bit
+// state into a 32-bit result, still maps the two samples above to distinct
+// ids: each varies only one half, and a 32-bit round function is itself a
+// bijection on that half. Counters spread across both halves at once expose
+// it: 2^19 of them into a 32-bit image collide ~32 times on average, so a
+// sample this size passes a lossy permutation with probability ~e^-32.
+TEST_CASE("OpaqueIdGenerator is a bijection over counters that vary both halves at once", "[opaque_id][unit]") {
+    morph::backend::detail::OpaqueIdGenerator const gen;
+    constexpr std::size_t n = std::size_t{1} << 19U;
+    // An odd multiplier is a bijection modulo 2^64, so these counters are
+    // distinct, and each one differs from the next in both words.
+    constexpr uint64_t kSpread = 0x9e3779b97f4a7c15ULL;
+    std::vector<uint64_t> ids;
+    ids.reserve(n);
+    for (uint64_t i = 1; i <= n; ++i) {
+        ids.push_back(gen.permute(i * kSpread));
+    }
+    std::ranges::sort(ids);
+    REQUIRE(std::ranges::adjacent_find(ids) == ids.end());
+}
+
 TEST_CASE("OpaqueIdGenerator output is not sequential", "[opaque_id][unit]") {
     morph::backend::detail::OpaqueIdGenerator gen;
     const uint64_t first = gen.permute(1);
diff --git a/tests/test_protocol_version.cpp b/tests/test_protocol_version.cpp
index 410cfe6d2..e2ef8467e 100644
--- a/tests/test_protocol_version.cpp
+++ b/tests/test_protocol_version.cpp
@@ -14,6 +14,7 @@
 #include <morph/core/registry.hpp>
 #include <morph/core/remote.hpp>
 #include <morph/core/wire.hpp>
+#include <stdexcept>
 #include <string>
 
 #include "test_support.hpp"
@@ -103,6 +104,20 @@ TEST_CASE("interpretHelloReply: any other err throws instead of proceeding", "[w
     REQUIRE_THROWS_AS(interpretHelloReply(reply), std::runtime_error);
 }
 
+TEST_CASE("interpretHelloReply: the refusal carries the peer's own message", "[wire][protocol]") {
+    auto messageOf = [](const morph::wire::Envelope& reply) {
+        try {
+            (void)interpretHelloReply(reply);
+        } catch (const std::runtime_error& exc) {
+            return std::string{exc.what()};
+        }
+        return std::string{};
+    };
+    CHECK(messageOf(makeErr("protocol version unsupported")) ==
+          "protocol negotiation failed: protocol version unsupported");
+    CHECK(messageOf(makeErr("")) == "protocol negotiation failed: malformed reply");
+}
+
 TEST_CASE("interpretHelloReply: an empty-message err still throws (does not misclassify)", "[wire][protocol]") {
     auto reply = makeErr("");
     REQUIRE_THROWS_AS(interpretHelloReply(reply), std::runtime_error);
diff --git a/tests/test_registration_phase.cpp b/tests/test_registration_phase.cpp
index e735c546d..1dc96f3b0 100644
--- a/tests/test_registration_phase.cpp
+++ b/tests/test_registration_phase.cpp
@@ -24,6 +24,7 @@
 // wired to a condition that is always true -- would look identical.
 
 #include <catch2/catch_test_macros.hpp>
+#include <exception>
 #include <morph/core/bridge.hpp>
 #include <morph/core/registry.hpp>
 #include <stdexcept>
@@ -123,6 +124,70 @@ TEST_CASE("morph::model: reading a process-level registry closes the latch by it
 
     morph::model::detail::reopenRegistrationPhaseForTesting();
 }
+
+TEST_CASE("morph::model: ActionExecuteRegistry closes the latch on the process registry only",
+          "[registry][registration-phase]") {
+    using morph::bridge::ActionExecuteRegistry;
+    using morph::bridge::NoSharing;
+
+    // `contains` and `execute` are both reads of the executor map; an unknown
+    // action still reads it.
+    morph::model::detail::reopenRegistrationPhaseForTesting();
+    CHECK_FALSE(ActionExecuteRegistry::instance().contains<NoSharing>("RegPhase_Model", "RegPhase_NoSuchAction"));
+    CHECK(morph::model::registrationPhaseClosed());
+
+    morph::model::detail::reopenRegistrationPhaseForTesting();
+    REQUIRE_THROWS_AS(
+        ActionExecuteRegistry::instance().execute<NoSharing>("RegPhase_Model", "RegPhase_NoSuchAction", nullptr, "{}"),
+        std::runtime_error);
+    CHECK(morph::model::registrationPhaseClosed());
+
+    morph::model::detail::reopenRegistrationPhaseForTesting();
+    ActionExecuteRegistry const local;
+    CHECK_FALSE(local.contains<NoSharing>("RegPhase_Model", "RegPhase_NoSuchAction"));
+    REQUIRE_THROWS_AS(local.execute<NoSharing>("RegPhase_Model", "RegPhase_NoSuchAction", nullptr, "{}"),
+                      std::runtime_error);
+    CHECK_FALSE(morph::model::registrationPhaseClosed());
+
+    morph::model::detail::reopenRegistrationPhaseForTesting();
+}
+
+TEST_CASE("morph::model: dispatching through the process dispatcher closes the latch; a local one does not",
+          "[registry][registration-phase]") {
+    auto holder = morph::model::detail::ModelFactory::create<RegPhaseModel>();
+    auto& processDispatcher = morph::model::detail::ActionDispatcher::instance();
+    morph::model::detail::ActionDispatcher localDispatcher;
+    // An unknown action: each call throws or reports through `done` before it
+    // runs anything -- what matters is that the map was read.
+    auto dispatchAsync = [&holder](morph::model::detail::ActionDispatcher& dispatcher) {
+        bool reported = false;
+        dispatcher.dispatchAsync(
+            "RegPhase_Model", "RegPhase_NoSuchAction", *holder, "{}", nullptr, core::async::StopToken{},
+            [&reported](const std::string&, const std::exception_ptr& error) { reported = error != nullptr; });
+        return reported;
+    };
+
+    SECTION("dispatch") {
+        morph::model::detail::reopenRegistrationPhaseForTesting();
+        REQUIRE_THROWS_AS(localDispatcher.dispatch("RegPhase_Model", "RegPhase_NoSuchAction", *holder, "{}"),
+                          std::runtime_error);
+        CHECK_FALSE(morph::model::registrationPhaseClosed());
+
+        REQUIRE_THROWS_AS(processDispatcher.dispatch("RegPhase_Model", "RegPhase_NoSuchAction", *holder, "{}"),
+                          std::runtime_error);
+        CHECK(morph::model::registrationPhaseClosed());
+    }
+    SECTION("dispatchAsync") {
+        morph::model::detail::reopenRegistrationPhaseForTesting();
+        REQUIRE(dispatchAsync(localDispatcher));
+        CHECK_FALSE(morph::model::registrationPhaseClosed());
+
+        REQUIRE(dispatchAsync(processDispatcher));
+        CHECK(morph::model::registrationPhaseClosed());
+    }
+
+    morph::model::detail::reopenRegistrationPhaseForTesting();
+}
 #endif  // !NDEBUG
 
 // ── The violating case ───────────────────────────────────────────────────────
diff --git a/tests/test_remote_connection_scope.cpp b/tests/test_remote_connection_scope.cpp
index c7ac75ac7..3fc721a04 100644
--- a/tests/test_remote_connection_scope.cpp
+++ b/tests/test_remote_connection_scope.cpp
@@ -13,6 +13,7 @@
 #include <string>
 #include <string_view>
 #include <thread>
+#include <utility>
 
 #include "bind_support.hpp"
 #include "test_support.hpp"
@@ -195,6 +196,21 @@ struct morph::model::ModelTraits<CsReentrantAttachModel> {
     static constexpr std::string_view typeId() { return "CS_ReentrantAttachModel"; }
 };
 
+// A model whose factory counts its constructions and, while `server` is set,
+// first registers one plain CS_SquareModel through `handleInline` -- host code
+// that fills a live-model slot during this model's own construction.
+struct CsCountedModel {
+    static inline std::atomic<int> constructions{0};
+    static inline morph::backend::RemoteServer* server = nullptr;
+
+    int execute(const CsSquareAction& act) { return act.x * act.x; }
+};
+
+template <>
+struct morph::model::ModelTraits<CsCountedModel> {
+    static constexpr std::string_view typeId() { return "CS_CountedModel"; }
+};
+
 static CsEnv& csEnv() {
     static CsEnv env = [] {
         CsEnv env2;
@@ -221,6 +237,15 @@ static CsEnv& csEnv() {
             });
         env2.dispatcher.registerAction<CsReentrantAttachModel, CsSquareAction>("CS_ReentrantAttachModel",
                                                                                "CS_SquareAction");
+        env2.registry.registerModel<CsCountedModel>(
+            "CS_CountedModel", [] -> std::unique_ptr<::morph::model::detail::IModelHolder> {
+                CsCountedModel::constructions.fetch_add(1);
+                if (auto* server = std::exchange(CsCountedModel::server, nullptr)) {
+                    (void)server->handleInline(::morph::wire::encode(::morph::wire::makeRegister("CS_SquareModel")));
+                }
+                return std::make_unique<morph::model::detail::ModelHolder<CsCountedModel>>();
+            });
+        env2.dispatcher.registerAction<CsCountedModel, CsSquareAction>("CS_CountedModel", "CS_SquareAction");
         return env2;
     }();
     return env;
@@ -912,6 +937,94 @@ TEST_CASE(
             1U);  // only key 2's instance remains
 }
 
+TEST_CASE("morph::backend::RemoteServer: attach re-pointing onto a key that is already live releases the old instance",
+          "[remote][connection-scope][shared-instances]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    auto& env = csEnv();
+    auto server = std::make_shared<morph::backend::RemoteServer>(pool, env.dispatcher, env.registry);
+    auto const cidA = server->openConnection();
+    auto const cidB = server->openConnection();
+
+    WaitReply regA;
+    server->handle(morph::wire::encode(morph::wire::makeRegisterShared("CS_SquareModel", "old")), std::ref(regA),
+                   cidA);
+    REQUIRE(regA.await());
+    REQUIRE(regA.env.kind == "ok");
+    WaitReply regB;
+    server->handle(morph::wire::encode(morph::wire::makeRegisterShared("CS_SquareModel", "target")), std::ref(regB),
+                   cidB);
+    REQUIRE(regB.await());
+    REQUIRE(regB.env.kind == "ok");
+    REQUIRE(morph::testing::awaitAnswer([&](auto& owner) { return server->health(owner); }).liveModels == 2U);
+
+    // cidA was the sole holder of "old"; moving it onto the live "target"
+    // attaches to that instance and leaves nothing holding "old".
+    WaitReply moved;
+    server->handle(morph::wire::encode(morph::wire::makeAttach("CS_SquareModel", "target", regA.env.modelId)),
+                   std::ref(moved), cidA);
+    REQUIRE(moved.await());
+    REQUIRE(moved.env.kind == "ok");
+    REQUIRE(moved.env.modelId == regB.env.modelId);
+    REQUIRE(morph::testing::awaitAnswer([&](auto& owner) { return server->health(owner); }).liveModels == 1U);
+
+    morph::wire::Envelope execOld;
+    execOld.kind = "execute";
+    execOld.modelId = regA.env.modelId;
+    execOld.modelType = "CS_SquareModel";
+    execOld.actionType = "CS_SquareAction";
+    execOld.body = R"({"x":2})";
+    WaitReply gone;
+    server->handle(morph::wire::encode(execOld), std::ref(gone), cidA);
+    REQUIRE(gone.await());
+    REQUIRE(gone.env.kind == "err");
+    REQUIRE(gone.env.message == "model not found");
+}
+
+TEST_CASE(
+    "morph::backend::RemoteServer: a connection that has released its one reference cannot release another "
+    "connection's",
+    "[remote][connection-scope][shared-instances]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    auto& env = csEnv();
+    auto server = std::make_shared<morph::backend::RemoteServer>(pool, env.dispatcher, env.registry);
+    auto const cidA = server->openConnection();
+    auto const cidB = server->openConnection();
+
+    WaitReply regA;
+    server->handle(morph::wire::encode(morph::wire::makeRegisterShared("CS_SquareModel", "held")), std::ref(regA),
+                   cidA);
+    REQUIRE(regA.await());
+    REQUIRE(regA.env.kind == "ok");
+    WaitReply regB;
+    server->handle(morph::wire::encode(morph::wire::makeRegisterShared("CS_SquareModel", "held")), std::ref(regB),
+                   cidB);
+    REQUIRE(regB.await());
+    REQUIRE(regB.env.modelId == regA.env.modelId);
+
+    // cidA held one reference. Its second deregister, and its close, find
+    // nothing of its own left to release, so cidB's reference stands.
+    for (int round = 0; round < 2; ++round) {
+        WaitReply dereg;
+        server->handle(morph::wire::encode(morph::wire::makeDeregister(regA.env.modelId)), std::ref(dereg), cidA);
+        REQUIRE(dereg.await());
+        REQUIRE(dereg.env.kind == "ok");
+    }
+    server->closeConnection(cidA);
+    REQUIRE(morph::testing::awaitAnswer([&](auto& owner) { return server->health(owner); }).liveModels == 1U);
+
+    morph::wire::Envelope execReq;
+    execReq.kind = "execute";
+    execReq.modelId = regB.env.modelId;
+    execReq.modelType = "CS_SquareModel";
+    execReq.actionType = "CS_SquareAction";
+    execReq.body = R"({"x":3})";
+    WaitReply exec;
+    server->handle(morph::wire::encode(execReq), std::ref(exec), cidB);
+    REQUIRE(exec.await());
+    REQUIRE(exec.env.kind == "ok");
+    REQUIRE(exec.env.body == "9");
+}
+
 TEST_CASE("morph::backend::RemoteServer: assign files a live instance under a key",
           "[remote][connection-scope][shared-instances]") {
     morph::exec::ThreadPoolExecutor pool{2};
@@ -1702,3 +1815,45 @@ TEST_CASE("morph::backend::RemoteServer: an unscoped deregister still releases t
     CHECK(dereg.env.kind == "ok");
     REQUIRE(csLiveModels(*server) == 0U);
 }
+
+// ── maxLiveModels around a register's own construction ─────────────────────
+
+TEST_CASE("morph::backend::RemoteServer: a register at the live-model cap is refused before constructing a model",
+          "[remote][limits]") {
+    auto& env = csEnv();
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::backend::ServerConfig serverConfig;
+    serverConfig.limits.maxLiveModels = 1;
+    auto const server =
+        std::make_shared<morph::backend::RemoteServer>(pool, serverConfig, env.dispatcher, env.registry);
+
+    auto first =
+        morph::wire::decode(server->handleInline(morph::wire::encode(morph::wire::makeRegister("CS_SquareModel"))));
+    REQUIRE(first.kind == "ok");
+
+    CsCountedModel::constructions.store(0);
+    auto refused =
+        morph::wire::decode(server->handleInline(morph::wire::encode(morph::wire::makeRegister("CS_CountedModel"))));
+    REQUIRE(refused.kind == "err");
+    REQUIRE(refused.message == "too many models");
+    CHECK(CsCountedModel::constructions.load() == 0);
+}
+
+TEST_CASE("morph::backend::RemoteServer: a register whose construction fills the last slot is refused",
+          "[remote][limits]") {
+    auto& env = csEnv();
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::backend::ServerConfig serverConfig;
+    serverConfig.limits.maxLiveModels = 1;
+    auto server = std::make_shared<morph::backend::RemoteServer>(pool, serverConfig, env.dispatcher, env.registry);
+
+    // The slot is free when the register is admitted; the model's own
+    // construction takes it by registering another model inline.
+    CsCountedModel::server = server.get();
+    auto outer =
+        morph::wire::decode(server->handleInline(morph::wire::encode(morph::wire::makeRegister("CS_CountedModel"))));
+    CsCountedModel::server = nullptr;
+    REQUIRE(outer.kind == "err");
+    REQUIRE(outer.message == "too many models");
+    CHECK(morph::testing::awaitAnswer([&](auto& owner) { return server->health(owner); }).liveModels == 1U);
+}
diff --git a/tests/test_remote_extra.cpp b/tests/test_remote_extra.cpp
index 98e1f476e..5b6ffe701 100644
--- a/tests/test_remote_extra.cpp
+++ b/tests/test_remote_extra.cpp
@@ -5,6 +5,7 @@
 #include <chrono>
 #include <morph/core/bridge.hpp>
 #include <morph/core/executor.hpp>
+#include <morph/core/logger.hpp>
 #include <morph/core/observability.hpp>
 #include <morph/core/registry.hpp>
 #include <morph/core/remote.hpp>
@@ -13,6 +14,8 @@
 #include <morph/session/session_auth.hpp>
 #include <mutex>
 #include <stdexcept>
+#include <string>
+#include <string_view>
 #include <thread>
 #include <vector>
 
@@ -28,9 +31,16 @@ struct SquareAction {
     int x = 0;
 };
 struct SquareFail {};
+struct SquareSlow {
+    int ms = 0;
+};
 struct SquareModel {
     int execute(const SquareAction& act) { return act.x * act.x; }
     int execute(const SquareFail&) { throw std::runtime_error("square failed"); }
+    int execute(const SquareSlow& act) {
+        std::this_thread::sleep_for(std::chrono::milliseconds{act.ms});
+        return act.ms;
+    }
 };
 
 template <>
@@ -72,12 +82,39 @@ struct morph::model::ActionTraits<SquareFail> {
     static int resultFromJson(std::string_view) { return 0; }
 };
 
+template <>
+struct morph::model::ActionTraits<SquareSlow> {
+    using Result = int;
+    static constexpr std::string_view typeId() { return "RX_SquareSlow"; }
+    static std::string toJson(const SquareSlow& act) {
+        std::string out;
+        (void)glz::write_json(act, out);
+        return out;
+    }
+    static SquareSlow fromJson(std::string_view json) {
+        SquareSlow action{};
+        (void)glz::read_json(action, json);
+        return action;
+    }
+    static std::string resultToJson(const int& res) {
+        std::string out;
+        (void)glz::write_json(res, out);
+        return out;
+    }
+    static int resultFromJson(std::string_view json) {
+        int result{};
+        (void)glz::read_json(result, json);
+        return result;
+    }
+};
+
 static Env& sharedEnv() {
     static Env env = [] {
         Env env2;
         env2.registry.registerModel<SquareModel>("RX_SquareModel");
         env2.dispatcher.registerAction<SquareModel, SquareAction>("RX_SquareModel", "RX_SquareAction");
         env2.dispatcher.registerAction<SquareModel, SquareFail>("RX_SquareModel", "RX_SquareFail");
+        env2.dispatcher.registerAction<SquareModel, SquareSlow>("RX_SquareModel", "RX_SquareSlow");
         return env2;
     }();
     return env;
@@ -297,6 +334,87 @@ TEST_CASE(
     REQUIRE(reply.kind == "err");
 }
 
+namespace {
+/// Collects every log line whose text contains @p marker, from any thread.
+struct LogLines {
+    std::mutex mtx;
+    std::vector<std::string> lines;
+
+    std::vector<std::string> matching(std::string_view marker) {
+        std::scoped_lock const lock{mtx};
+        std::vector<std::string> out;
+        for (const auto& line : lines) {
+            if (line.contains(marker)) {
+                out.push_back(line);
+            }
+        }
+        return out;
+    }
+};
+
+/// The one "undecodable envelope" error line @p server logs for @p raw.
+std::string undecodableLogLine(morph::backend::RemoteServer& server, const std::string& raw) {
+    LogLines captured;
+    morph::log::ScopedLoggerOverride const guard{[&captured](morph::log::LogLevel, std::string_view msg) {
+        std::scoped_lock const lock{captured.mtx};
+        captured.lines.emplace_back(msg);
+    }};
+    auto reply = morph::wire::decode(server.handleInline(raw));
+    REQUIRE(reply.kind == "err");
+    auto lines = captured.matching("undecodable envelope");
+    REQUIRE(lines.size() == 1);
+    return lines.front();
+}
+}  // namespace
+
+TEST_CASE("morph::backend::RemoteServer: the undecodable-envelope log line reports the full size and a capped prefix",
+          "[remote][handleInline][log]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    auto& env = sharedEnv();
+    auto const server = std::make_shared<morph::backend::RemoteServer>(pool, env.dispatcher, env.registry);
+
+    SECTION("a short message is logged whole, with no ellipsis") {
+        const std::string line = undecodableLogLine(*server, "not json");
+        CHECK(line.contains("(8 bytes, payload prefix: not json)"));
+    }
+    SECTION("a message of exactly the preview cap is logged whole, with no ellipsis") {
+        const std::string exact(256, 'x');
+        const std::string line = undecodableLogLine(*server, exact);
+        CHECK(line.contains("(256 bytes, payload prefix: " + exact + ")"));
+    }
+    SECTION("a message over the cap is logged as its first 256 bytes and an ellipsis") {
+        const std::string line = undecodableLogLine(*server, std::string(300, 'x'));
+        CHECK(line.contains("(300 bytes, payload prefix: " + std::string(256, 'x') + "...)"));
+        CHECK_FALSE(line.contains(std::string(257, 'x')));
+    }
+}
+
+TEST_CASE("morph::backend::RemoteServer: the per-request debug log line reports the body's size", "[remote][log]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    auto& env = sharedEnv();
+    auto const server = std::make_shared<morph::backend::RemoteServer>(pool, env.dispatcher, env.registry);
+
+    LogLines captured;
+    morph::log::ScopedLoggerOverride const guard{[&captured](morph::log::LogLevel, std::string_view msg) {
+        std::scoped_lock const lock{captured.mtx};
+        captured.lines.emplace_back(msg);
+    }};
+    morph::wire::Envelope req;
+    req.kind = "execute";
+    req.callId = 7;
+    req.modelId = 9999;
+    req.modelType = "RX_SquareModel";
+    req.actionType = "RX_SquareAction";
+    req.body = R"({"x":5})";
+    WaitReply waiter;
+    server->handle(morph::wire::encode(req), std::ref(waiter));
+    REQUIRE(waiter.await());
+
+    auto lines = captured.matching("kind=execute callId=7");
+    REQUIRE(lines.size() == 1);
+    CHECK(lines.front().contains("bodyBytes=7"));
+}
+
 TEST_CASE(
     "morph::backend::RemoteServer::handleImpl: a well-formed execute naming modelId 0 reports \"model not found\"",
     "[remote][handleImpl]") {
@@ -432,6 +550,47 @@ TEST_CASE("morph::backend::RemoteServer: execute emits executeLatencyMs and togg
     REQUIRE(inFlightSamples[1] == 0.0);
 }
 
+TEST_CASE("morph::backend::RemoteServer: executeLatencyMs measures the handler's run time",
+          "[remote][observability]") {
+    morph::observe::ScopedObserveOverride const guard;
+    morph::exec::ThreadPoolExecutor pool{2};
+    auto& env = sharedEnv();
+    auto const server = std::make_shared<morph::backend::RemoteServer>(pool, env.dispatcher, env.registry);
+
+    WaitReply reg;
+    server->handle(morph::wire::encode(morph::wire::makeRegister("RX_SquareModel")), std::ref(reg));
+    REQUIRE(reg.await());
+    REQUIRE(reg.env.kind == "ok");
+
+    std::mutex sampleMtx;
+    std::vector<double> latencies;
+    morph::observe::setMetricSink([&](const morph::observe::MetricEvent& evt) {
+        if (evt.metric == morph::observe::Metric::executeLatencyMs) {
+            std::scoped_lock const lock{sampleMtx};
+            latencies.push_back(evt.value);
+        }
+    });
+
+    constexpr int kHandlerMs = 60;
+    morph::wire::Envelope req;
+    req.kind = "execute";
+    req.callId = 1;
+    req.modelId = reg.env.modelId;
+    req.modelType = "RX_SquareModel";
+    req.actionType = "RX_SquareSlow";
+    req.body = R"({"ms":60})";
+    WaitReply waiter;
+    server->handle(morph::wire::encode(req), std::ref(waiter));
+    REQUIRE(waiter.await());
+    REQUIRE(waiter.env.kind == "ok");
+
+    std::scoped_lock const lock{sampleMtx};
+    REQUIRE(latencies.size() == 1);
+    // A lower bound only: the measurement spans the handler, which sleeps at
+    // least this long. No upper bound, so a loaded machine cannot fail it.
+    CHECK(latencies.front() >= static_cast<double>(kHandlerMs));
+}
+
 TEST_CASE("morph::backend::RemoteServer: an erroring execute emits executeErrors", "[remote][observability]") {
     morph::observe::ScopedObserveOverride guard;
     morph::exec::ThreadPoolExecutor pool{2};
diff --git a/tests/test_shared_instances.cpp b/tests/test_shared_instances.cpp
index d007ec2a7..733823f4d 100644
--- a/tests/test_shared_instances.cpp
+++ b/tests/test_shared_instances.cpp
@@ -23,6 +23,7 @@
 #include <morph/core/registry.hpp>
 #include <morph/core/remote.hpp>
 #include <string>
+#include <string_view>
 #include <thread>
 #include <vector>
 
@@ -608,6 +609,14 @@ TEST_CASE("primary keys round-trip through their canonical encoding", "[shared-i
     REQUIRE_THROWS(morph::model::keyFromString<std::int64_t>(""));
 }
 
+TEST_CASE("a numeric key decodes only the characters its view spans", "[shared-instances]") {
+    // A decoded wire field is a view into a larger buffer; the digits that
+    // follow it there are not part of the key.
+    std::string_view const buffer = "12345";
+    CHECK(morph::model::keyFromString<std::int64_t>(buffer.substr(0, 2)) == 12);
+    CHECK(morph::model::keyFromString<std::uint32_t>(buffer.substr(1, 3)) == 234U);
+}
+
 TEST_CASE("keyed models and keyed actions are detected structurally", "[shared-instances]") {
     STATIC_REQUIRE(morph::model::KeyedModel<ShiCounterModel>);
     STATIC_REQUIRE_FALSE(morph::model::KeyedModel<ShiAddTo>);
@@ -686,6 +695,11 @@ TEST_CASE("assignPrimary promotes an anonymous instance and ignores unusable inp
         std::string{});
     REQUIRE(backend.listInstances("SHI_CounterModel").empty());
 
+    // An empty key names nothing, so the instance stays anonymous and is still
+    // free to take a real one below.
+    backend.assignPrimary(mid, "SHI_CounterModel", "");
+    REQUIRE(backend.listInstances("SHI_CounterModel").empty());
+
     backend.assignPrimary(mid, "SHI_CounterModel", "new");
     REQUIRE(backend.listInstances("SHI_CounterModel") == std::vector<std::string>{"new"});
 
@@ -700,6 +714,22 @@ TEST_CASE("assignPrimary promotes an anonymous instance and ignores unusable inp
     REQUIRE(backend.listInstances("SHI_CounterModel") == std::vector<std::string>{"new"});
 }
 
+TEST_CASE("a promoted instance is held by its one handler and dies with it", "[shared-instances][backend]") {
+    morph::exec::ThreadPoolExecutor pool{2};
+    morph::backend::LocalBackend backend{pool};
+
+    auto mid = morph::testing::bindShared(
+        backend, "SHI_CounterModel", [] { return morph::model::detail::ModelFactory::create<ShiCounterModel>(); },
+        std::string{});
+    backend.assignPrimary(mid, "SHI_CounterModel", "promoted");
+    REQUIRE(backend.listInstances("SHI_CounterModel") == std::vector<std::string>{"promoted"});
+
+    // The handler that created it is its only attachment, so releasing that
+    // handler destroys it and frees the key.
+    backend.deregisterModel(mid);
+    CHECK(backend.listInstances("SHI_CounterModel").empty());
+}
+
 // `listInstances` had never been driven with two distinct registered types in
 // the directory at once -- every prior call in this suite populated it with one
 // type, so nothing ever had to discriminate. The mechanism it discriminates
@@ -971,6 +1001,23 @@ TEST_CASE("a change-aware model is tracked when registered shared", "[shared-ins
     REQUIRE(settle(exec, handler.execute(ShiAwareRead{.id = 900})).value == 1);
 }
 
+TEST_CASE("a change-aware instance stays notified after one of its two handlers releases it", "[shared-instances]") {
+    morph::testing::InlineExecutor exec;
+    auto backend = std::make_unique<morph::backend::LocalBackend>(exec);
+    auto* local = backend.get();
+    Bridge bridge{std::move(backend), exec};
+
+    BridgeHandler<ShiAwareModel, AllowShared> survivor{bridge, &exec};
+    settle(survivor.execute(ShiAwareRead{.id = 901}));
+    {
+        BridgeHandler<ShiAwareModel, AllowShared> transient{bridge, &exec};
+        settle(transient.execute(ShiAwareRead{.id = 901}));
+    }  // one attachment released; the instance lives on for `survivor`
+
+    local->notifyBackendChanged();
+    REQUIRE(settle(survivor.execute(ShiAwareRead{.id = 901})).value == 1);
+}
+
 TEST_CASE("the server refuses to re-file an already-keyed instance onto a different key", "[shared-instances]") {
     morph::exec::ThreadPoolExecutor pool{2};
     auto server = std::make_shared<morph::backend::RemoteServer>(pool);
diff --git a/tests/test_strand.cpp b/tests/test_strand.cpp
index 5761a4681..576efca0c 100644
--- a/tests/test_strand.cpp
+++ b/tests/test_strand.cpp
@@ -549,6 +549,27 @@ TEST_CASE("ModelStrands teardown: a handler's end arriving after the seal never
     CHECK(ActionGate::overlapsObserved() == overlapsBefore);
 }
 
+TEST_CASE("ActionGate: an action started by a leave() and still running starts the next one when it leaves",
+          "[strand][gate]") {
+    // B is started by A's leave() and does not finish inside it, as a Task
+    // handler that suspends does not. Its own later leave() is what starts C.
+    morph::model::detail::ActionGate gate;
+    std::vector<std::string> started;
+    REQUIRE(gate.tryEnter());  // A
+    gate.enter([&] { started.emplace_back("B"); });
+    gate.enter([&] {
+        started.emplace_back("C");
+        gate.leave();
+    });
+
+    gate.leave();  // A finishes
+    REQUIRE(started == std::vector<std::string>{"B"});
+
+    gate.leave();  // B finishes
+    CHECK(started == std::vector<std::string>{"B", "C"});
+    CHECK(gate.tryEnter());
+}
+
 // Regression test for ThreadPoolExecutor(0): a zero-worker pool used to accept
 // tasks that could never run, hanging every post() forever. The constructor now
 // clamps the worker count to at least 1, so a pool built with 0 is still usable.
diff --git a/tests/test_timeout_scheduler.cpp b/tests/test_timeout_scheduler.cpp
index 593e092e9..614380698 100644
--- a/tests/test_timeout_scheduler.cpp
+++ b/tests/test_timeout_scheduler.cpp
@@ -14,6 +14,7 @@
 #include <atomic>
 #include <catch2/catch_test_macros.hpp>
 #include <chrono>
+#include <cstddef>
 #include <memory>
 #include <morph/core/executor.hpp>
 #include <morph/core/io_loop.hpp>
@@ -309,3 +310,50 @@ TEST_CASE("TimeoutScheduler: destroyed with a timer still armed, it retires the
     }
     REQUIRE_FALSE(ran.load());
 }
+
+namespace {
+
+// Timers armed on @p loop's event loop, read on the loop's own thread.
+std::size_t armedTimers(morph::exec::IoLoop& loop) {
+    std::size_t count = 0;
+    loop.runAndWait([&loop, &count] { count = loop.loop().pendingTimerCount(); });
+    return count;
+}
+
+}  // namespace
+
+TEST_CASE("TimeoutScheduler: cancel() retires the loop's timer, not only the callback", "[timeout_scheduler]") {
+    morph::exec::IoLoop loop;
+    TimeoutScheduler scheduler{loop};
+    auto const before = armedTimers(loop);
+
+    auto const handle = scheduler.schedule(1h, [] {});
+    REQUIRE(armedTimers(loop) == before + 1);
+
+    scheduler.cancel(handle);
+    CHECK(armedTimers(loop) == before);
+}
+
+TEST_CASE("TimeoutScheduler: destruction retires every loop timer it armed", "[timeout_scheduler]") {
+    morph::exec::IoLoop loop;
+    auto const before = armedTimers(loop);
+    {
+        TimeoutScheduler scheduler{loop};
+        static_cast<void>(scheduler.schedule(1h, [] {}));
+        static_cast<void>(scheduler.schedule(2h, [] {}));
+        REQUIRE(armedTimers(loop) == before + 2);
+    }
+    CHECK(armedTimers(loop) == before);
+}
+
+TEST_CASE("TimeoutScheduler: 0 is never a handle, so cancel(0) cancels nothing", "[timeout_scheduler]") {
+    // `delay()` cancels its handle on a stop without knowing whether its timer
+    // was armed yet, and 0 is the value it holds until then.
+    TimeoutScheduler scheduler;
+    std::atomic<int> fired{0};
+    for (int i = 0; i < 3; ++i) {
+        CHECK(scheduler.schedule(1ms, [&fired] { fired.fetch_add(1); }) != 0);
+    }
+    scheduler.cancel(0);
+    REQUIRE(waitFor([&] { return fired.load() == 3; }));
+}
diff --git a/tests/test_wire_hardening.cpp b/tests/test_wire_hardening.cpp
index ebf7d0740..708f95e78 100644
--- a/tests/test_wire_hardening.cpp
+++ b/tests/test_wire_hardening.cpp
@@ -60,10 +60,13 @@
 
 #include <catch2/catch_test_macros.hpp>
 #include <cstddef>
+#include <cstdint>
 #include <cstring>
+#include <limits>
 #include <memory>
 #include <morph/core/bridge.hpp>
 #include <morph/core/wire.hpp>
+#include <stdexcept>
 #include <string>
 #include <string_view>
 
@@ -123,6 +126,17 @@ TEST_CASE("decode's size cap is exact at kMaxEnvelopeBytes", "[wire][hardening]"
     REQUIRE_THROWS_AS(decode(oneOver), std::runtime_error);
 }
 
+TEST_CASE("decode's size refusal names the size it refused", "[wire][hardening]") {
+    const std::string oversized(kMaxEnvelopeBytes + 7, ' ');
+    std::string message;
+    try {
+        (void)decode(oversized);
+    } catch (const std::runtime_error& exc) {
+        message = exc.what();
+    }
+    CHECK(message.contains("(" + std::to_string(kMaxEnvelopeBytes + 7) + " > " + std::to_string(kMaxEnvelopeBytes)));
+}
+
 TEST_CASE("decode rejects an oversized envelope before parsing", "[wire][hardening]") {
     // An envelope whose serialized length exceeds the cap must be rejected by
     // decode() regardless of whether the JSON itself is otherwise well-formed.
@@ -350,6 +364,15 @@ TEST_CASE("wire::detail::peekCallId degrades to 0 rather than guessing", "[wire]
     CHECK(morph::wire::detail::peekCallId(R"({"callId":99999999999999999999999})") == 0U);
 }
 
+TEST_CASE("wire::detail::peekCallId reads zero digits and the full uint64 range", "[wire][hardening]") {
+    CHECK(morph::wire::detail::peekCallId(R"({"callId":10})") == 10U);
+    CHECK(morph::wire::detail::peekCallId(R"({"callId":1000000007})") == 1000000007U);
+    // The largest id still fits: only a value that would wrap is refused.
+    CHECK(morph::wire::detail::peekCallId(R"({"callId":18446744073709551615})") ==
+          std::numeric_limits<std::uint64_t>::max());
+    CHECK(morph::wire::detail::peekCallId(R"({"callId":18446744073709551616})") == 0U);
+}
+
 TEST_CASE("wire::detail::peekCallId cannot be spoofed from an earlier string field", "[wire][hardening]") {
     // `kind` is written before `callId`, so a hostile value there is scanned
     // first. encode() escapes its quotes, yielding bytes that do not match.