diff --git a/.alfonso/release-notes/next/cross-repo-search-index-store.md b/.alfonso/release-notes/next/cross-repo-search-index-store.md
new file mode 100644
index 0000000000..91f13c28d6
--- /dev/null
+++ b/.alfonso/release-notes/next/cross-repo-search-index-store.md
@@ -0,0 +1 @@
+Cross-repository search keeps published index-store reads and the bounded unpublished-pattern fallback while removing unused unbounded trigram builds and comparisons of saved trigram indexes against files on disk.
diff --git a/.alfonso/release-notes/next/issue-1425.md b/.alfonso/release-notes/next/issue-1425.md
new file mode 100644
index 0000000000..f1805cf9de
--- /dev/null
+++ b/.alfonso/release-notes/next/issue-1425.md
@@ -0,0 +1 @@
+Rust diagnostics now handle literal `concat!` include paths and local fixture macros with literal arguments. Unresolved includes name their source file. Thanks @elmagow. (#1425)
diff --git a/.alfonso/release-notes/next/issue-1428.md b/.alfonso/release-notes/next/issue-1428.md
new file mode 100644
index 0000000000..77059db838
--- /dev/null
+++ b/.alfonso/release-notes/next/issue-1428.md
@@ -0,0 +1 @@
+Shared temporary folders no longer start project watchers, indexing, or language-server discovery, regardless of how they are mounted. Projects in their subfolders still work normally. Index builds now skip unreadable folders, report the coverage gap, and retry them on the next rescan instead of failing the whole build.
diff --git a/.alfonso/release-notes/next/linux-shell-oom-priority.md b/.alfonso/release-notes/next/linux-shell-oom-priority.md
new file mode 100644
index 0000000000..49b6f25298
--- /dev/null
+++ b/.alfonso/release-notes/next/linux-shell-oom-priority.md
@@ -0,0 +1 @@
+Linux agent shell commands now raise their OOM kill priority to protect AFT and desktop sessions during memory pressure (#750).
diff --git a/.alfonso/release-notes/next/live-secret-vault.md b/.alfonso/release-notes/next/live-secret-vault.md
new file mode 100644
index 0000000000..ee4b553e3d
--- /dev/null
+++ b/.alfonso/release-notes/next/live-secret-vault.md
@@ -0,0 +1 @@
+Shell `{{ck-secret:<label>}}` placeholders now use the live vault over AFT's authenticated daemon route. Each HTTPS request is checked against its real host and path; released keys are inserted only at the vault's designated location and are never reused to authorize another request. Requests needing phone approval share the same pending vault request's card, with one 10-minute deadline across all labels in each HTTP request. Cancelling the last waiter withdraws its card. URL fetches also ask per request and redirect, and never retry a credential-bearing send. Standalone use remains fail-closed, and keys stay out of command output, task logs and status replies.
diff --git a/.alfonso/release-notes/next/lsp-applicability-walks.md b/.alfonso/release-notes/next/lsp-applicability-walks.md
new file mode 100644
index 0000000000..bea14d8dc1
--- /dev/null
+++ b/.alfonso/release-notes/next/lsp-applicability-walks.md
@@ -0,0 +1 @@
+- Coalesce per-root language-server applicability walks with a short settle window and one follow-up for changes received during a walk.
diff --git a/.alfonso/release-notes/next/manifest-vault-sync.md b/.alfonso/release-notes/next/manifest-vault-sync.md
new file mode 100644
index 0000000000..fa9ad943a5
--- /dev/null
+++ b/.alfonso/release-notes/next/manifest-vault-sync.md
@@ -0,0 +1 @@
+AFT now synchronizes signed GitHub routing manifests from the vault and reports the gh shim's activation verdict in daemon health.
diff --git a/.alfonso/release-notes/next/pr-read-thread-state.md b/.alfonso/release-notes/next/pr-read-thread-state.md
new file mode 100644
index 0000000000..2cfafbf73d
--- /dev/null
+++ b/.alfonso/release-notes/next/pr-read-thread-state.md
@@ -0,0 +1 @@
+Pull-request reads now show review-thread IDs and open/resolved state, with explicit warnings when thread state is unavailable, incomplete, or cached.
diff --git a/.alfonso/release-notes/next/protected-folder-and-pty-exit-text.md b/.alfonso/release-notes/next/protected-folder-and-pty-exit-text.md
new file mode 100644
index 0000000000..0352fab25d
--- /dev/null
+++ b/.alfonso/release-notes/next/protected-folder-and-pty-exit-text.md
@@ -0,0 +1,2 @@
+- Protected CortexKit module data, module state, and AFT storage refusals explain why file tools cannot open them and which commands to use instead.
+- PTY tasks with lost exit status report exit status unknown without an exit code; real kills keep their status and reason.
diff --git a/.alfonso/release-notes/next/redact-inline-passwords.md b/.alfonso/release-notes/next/redact-inline-passwords.md
new file mode 100644
index 0000000000..76b9c5299d
--- /dev/null
+++ b/.alfonso/release-notes/next/redact-inline-passwords.md
@@ -0,0 +1 @@
+Shell command logs and issue reports now mask inline passwords named `PW` or `PASS` and secret-shaped assignment values.
diff --git a/.alfonso/release-notes/next/release-debug-symbols.md b/.alfonso/release-notes/next/release-debug-symbols.md
new file mode 100644
index 0000000000..fc1488914e
--- /dev/null
+++ b/.alfonso/release-notes/next/release-debug-symbols.md
@@ -0,0 +1 @@
+Release downloads now include matching Linux debug-symbol and Windows PDB archives for symbolizing production stack traces without enlarging installed packages.
diff --git a/.alfonso/release-notes/next/rerank-prepare.md b/.alfonso/release-notes/next/rerank-prepare.md
new file mode 100644
index 0000000000..abc921a597
--- /dev/null
+++ b/.alfonso/release-notes/next/rerank-prepare.md
@@ -0,0 +1 @@
+- Search prepares matching-line text only when needed, reducing concurrent rerank CPU without changing results.
diff --git a/.alfonso/release-notes/next/search-bounded-reads.md b/.alfonso/release-notes/next/search-bounded-reads.md
new file mode 100644
index 0000000000..60846554cb
--- /dev/null
+++ b/.alfonso/release-notes/next/search-bounded-reads.md
@@ -0,0 +1 @@
+Keep status and configuration responsive while grep searches large files.
diff --git a/.alfonso/release-notes/next/self-diagnosis-snapshot.md b/.alfonso/release-notes/next/self-diagnosis-snapshot.md
new file mode 100644
index 0000000000..ae8239f159
--- /dev/null
+++ b/.alfonso/release-notes/next/self-diagnosis-snapshot.md
@@ -0,0 +1 @@
+- AFT self-diagnosis now uses complete root evidence and each snapshot part's freshness window, so large heaps and size-trimmed health reports do not produce spurious unknown findings.
diff --git a/.alfonso/release-notes/next/status-push-cost.md b/.alfonso/release-notes/next/status-push-cost.md
new file mode 100644
index 0000000000..2ba69d6112
--- /dev/null
+++ b/.alfonso/release-notes/next/status-push-cost.md
@@ -0,0 +1 @@
+Status pushes avoid checkpoint mutation locks, meaning-store rebuilds and compression scans, and sample physical index-store size in the background.
diff --git a/.alfonso/release-notes/next/status-unknown-checkpoints.md b/.alfonso/release-notes/next/status-unknown-checkpoints.md
new file mode 100644
index 0000000000..0eed383684
--- /dev/null
+++ b/.alfonso/release-notes/next/status-unknown-checkpoints.md
@@ -0,0 +1 @@
+Show unknown checkpoint counts as — in status dialogs.
diff --git a/.alfonso/release-notes/next/task-metadata-writes.md b/.alfonso/release-notes/next/task-metadata-writes.md
new file mode 100644
index 0000000000..8c820fbfcb
--- /dev/null
+++ b/.alfonso/release-notes/next/task-metadata-writes.md
@@ -0,0 +1 @@
+Skip repeated background-task metadata writes and fsyncs when persisted fields and their durability requirements have not changed.
diff --git a/.alfonso/release-notes/next/test-gate-loops.md b/.alfonso/release-notes/next/test-gate-loops.md
new file mode 100644
index 0000000000..7f6594912e
--- /dev/null
+++ b/.alfonso/release-notes/next/test-gate-loops.md
@@ -0,0 +1 @@
+Test shell commands waiting for release files now stop when their parent directory disappears or their deadline expires, preventing orphaned polling processes.
diff --git a/.alfonso/release-notes/next/worker-pty-handback.md b/.alfonso/release-notes/next/worker-pty-handback.md
new file mode 100644
index 0000000000..4b723374de
--- /dev/null
+++ b/.alfonso/release-notes/next/worker-pty-handback.md
@@ -0,0 +1 @@
+A worker's interactive (pty) shell command answers with its task id at once instead of waiting until it ends.
diff --git a/.github/workflows/_unit-suite.yml b/.github/workflows/_unit-suite.yml
index c76a9b7b85..9c68ae6725 100644
--- a/.github/workflows/_unit-suite.yml
+++ b/.github/workflows/_unit-suite.yml
@@ -337,6 +337,32 @@ jobs:
           SUBC_CORE_BIN: ${{ steps.subc_core.outputs.path }}
           SUBC_CORE_WIRE_VERSION: "2"
 
+  unit-linux-real-daemon:
+    name: Real-daemon tool-provider tests (Linux)
+    if: ${{ github.event_name != 'pull_request' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 19
+    env:
+      SCCACHE_GHA_ENABLED: "true"
+      RUSTC_WRAPPER: sccache
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+        continue-on-error: true
+      - name: Start compiler cache (fall back to uncached)
+        shell: bash
+        run: bash scripts/ci-sccache-start.sh
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+        with:
+          shared-key: unit-linux-real-daemon
+          cache-on-failure: true
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: ./.github/actions/setup-nextest
+      - name: Run ignored real-daemon tool-provider tests
+        run: bash scripts/ci-real-daemon-tests.sh
+
   plugin-e2e-linux:
     name: Plugin e2e (${{ matrix.suite }}, Linux)
     if: ${{ github.event_name != 'pull_request' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1247255368..196731fa81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -441,7 +441,22 @@ jobs:
       # Use gnu target (not musl) so dlopen works for ONNX Runtime loading.
       # musl produces static binaries where dlopen is a stub that always fails.
       - name: Build
-        run: cross build --release --target aarch64-unknown-linux-gnu
+        # Keep line tables only until objcopy detaches them below; shipped code
+        # and optimization settings are unchanged.
+        run: cross build --release --target aarch64-unknown-linux-gnu --config 'profile.release.strip=false' --config 'profile.release.split-debuginfo="off"'
+
+      - name: Install ARM64 debug extraction tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y binutils-aarch64-linux-gnu
+      - name: Split and verify Linux debug symbols
+        run: python3 scripts/release-debug-symbols.py linux --binary target/aarch64-unknown-linux-gnu/release/aft --objcopy aarch64-linux-gnu-objcopy --archive release-debug/aft-linux-arm64-debug.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-arm64-debug
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-linux-arm64-debug.zip
+          if-no-files-found: error
 
       - uses: actions/upload-artifact@v4
         with:
@@ -484,7 +499,16 @@ jobs:
       # Use gnu target (not musl) so dlopen works for ONNX Runtime loading.
       # musl produces static binaries where dlopen is a stub that always fails.
       - name: Build
-        run: cross build --release --target x86_64-unknown-linux-gnu
+        run: cross build --release --target x86_64-unknown-linux-gnu --config 'profile.release.strip=false' --config 'profile.release.split-debuginfo="off"'
+
+      - name: Split and verify Linux debug symbols
+        run: python3 scripts/release-debug-symbols.py linux --binary target/x86_64-unknown-linux-gnu/release/aft --archive release-debug/aft-linux-x64-debug.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: linux-x64-debug
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-linux-x64-debug.zip
+          if-no-files-found: error
 
       - name: Bundle shipped Linux binary
         id: bundle
@@ -601,7 +625,8 @@ jobs:
           }
 
       - name: Build
-        run: cargo build --release --target aarch64-pc-windows-msvc
+        # MSVC keeps debug info in a PDB, not in the shipped executable.
+        run: cargo build --release --target aarch64-pc-windows-msvc --config 'profile.release.strip=false'
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
 
@@ -616,6 +641,16 @@ jobs:
             throw "Staged release binary differs from the compiled bytes"
           }
 
+      - name: Verify and package Windows PDB
+        shell: pwsh
+        run: python scripts/release-debug-symbols.py windows --binary target/aarch64-pc-windows-msvc/release/aft.exe --pdb "$env:AFT_CI_TARGET_DIR/aarch64-pc-windows-msvc/release/aft.pdb" --archive release-debug/aft-windows-arm64-pdb.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-arm64-pdb
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-windows-arm64-pdb.zip
+          if-no-files-found: error
+
       - uses: actions/upload-artifact@v4
         with:
           name: win32-arm64
@@ -685,13 +720,13 @@ jobs:
         shell: pwsh
 
       - name: Release library codegen (shipped profile)
-        run: cargo build --release --lib --target x86_64-pc-windows-msvc -p agent-file-tools --timings
+        run: cargo build --release --lib --target x86_64-pc-windows-msvc -p agent-file-tools --timings --config 'profile.release.strip=false'
         shell: pwsh
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
 
       - name: Build
-        run: cargo build --release --bin aft --target x86_64-pc-windows-msvc -p agent-file-tools --timings
+        run: cargo build --release --bin aft --target x86_64-pc-windows-msvc -p agent-file-tools --timings --config 'profile.release.strip=false'
         shell: pwsh
         env:
           CARGO_TARGET_DIR: ${{ env.AFT_CI_TARGET_DIR }}
@@ -707,6 +742,16 @@ jobs:
             throw "Staged release binary differs from the compiled bytes"
           }
 
+      - name: Verify and package Windows PDB
+        shell: pwsh
+        run: python scripts/release-debug-symbols.py windows --binary target/x86_64-pc-windows-msvc/release/aft.exe --pdb "$env:AFT_CI_TARGET_DIR/x86_64-pc-windows-msvc/release/aft.pdb" --archive release-debug/aft-windows-x64-pdb.zip
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-x64-pdb
+          retention-days: ${{ github.event_name == 'schedule' && 2 || 90 }}
+          path: release-debug/aft-windows-x64-pdb.zip
+          if-no-files-found: error
+
       # Execute the exact bytes being published once on Windows.
       - name: Smoke-test binary
         run: target/x86_64-pc-windows-msvc/release/aft.exe --version
@@ -1393,6 +1438,18 @@ jobs:
         with:
           name: win32-arm64
           path: artifacts/win32-arm64
+      - name: Download Linux debug symbols
+        uses: actions/download-artifact@v4
+        with:
+          pattern: linux-*-debug
+          path: release-assets
+          merge-multiple: true
+      - name: Download Windows PDBs
+        uses: actions/download-artifact@v4
+        with:
+          pattern: windows-*-pdb
+          path: release-assets
+          merge-multiple: true
 
       - name: Verify tested macOS binary for release
         run: python3 scripts/native-release-artifact.py unpack-published --target aarch64-apple-darwin --archive "$RUNNER_TEMP/tested-darwin-arm64/release.tar" --binary release-assets/aft-darwin-arm64 --dsym release-assets/aft-darwin-arm64-dsym.zip
diff --git a/Cargo.lock b/Cargo.lock
index 47f166e155..ba850eac61 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -27,6 +27,8 @@ dependencies = [
  "content_inspector",
  "flate2",
  "ignore",
+ "libc",
+ "log",
  "rayon",
  "regex",
  "regex-syntax",
diff --git a/benchmarks/aft-search/slice-descriptors/alfonso-task-bg_bbb97ce9a9634cf6-aft-search-on-another-repository-uses-the-index-.json b/benchmarks/aft-search/slice-descriptors/alfonso-task-bg_bbb97ce9a9634cf6-aft-search-on-another-repository-uses-the-index-.json
new file mode 100644
index 0000000000..d72828fc42
--- /dev/null
+++ b/benchmarks/aft-search/slice-descriptors/alfonso-task-bg_bbb97ce9a9634cf6-aft-search-on-another-repository-uses-the-index-.json
@@ -0,0 +1,13 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/tests/integration/tool_call_parity_test.rs",
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/semantic_index.rs"
+  ],
+  "note": "Remove the unused unbounded legacy trigram builder, capped lexical-ranking API, memory accounting, saved-index reconciliation and its semantic recorded-stat accessor. Published external repositories already use ExternalSearch's index-store checkout at this base. Preserve unpublished external plain-query walks and the bounded explicit-pattern/query+pattern corpus; specialize its disk collector to the empty corpus its sole production caller supplies. Candidate selection, score formulas, source-first admission, deadlines and public coverage fields remain unchanged. Remove constant-None legacy snapshot branches from ranking and glob. The 300-query interleaved cross-repository replay uses a frozen second AFT checkout; ranked paths and counts must remain identical. No ranking or count difference is waived. Full legacy module deletion is deferred because changing the unpublished pattern fallback requires a separate design decision."
+}
diff --git a/benchmarks/aft-search/slice-descriptors/ci-speed-post064-batch-3.json b/benchmarks/aft-search/slice-descriptors/ci-speed-post064-batch-3.json
new file mode 100644
index 0000000000..3263155066
--- /dev/null
+++ b/benchmarks/aft-search/slice-descriptors/ci-speed-post064-batch-3.json
@@ -0,0 +1,114 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/src/commands/semantic_search/external_disk_check.rs",
+    "crates/aft/src/commands/semantic_search/external_pattern.rs",
+    "crates/aft/src/commands/semantic_search/mod.rs",
+    "crates/aft/src/commands/semantic_search/snippet_bounds.rs",
+    "crates/aft/src/lib.rs",
+    "crates/aft/src/search_index.rs",
+    "crates/aft/src/semantic_index.rs",
+    "crates/aft/tests/integration/tool_call_parity_test.rs"
+  ],
+  "slices": [
+    "rerank-line-prefilter",
+    "cross-repo-search-index-store",
+    "deferred-standalone-grep",
+    "status-push-cost"
+  ],
+  "note": "Combined post-0.64 batch 3 integration, based on batch 2's tip 398e5549aeaa (main 9b505ee5 has the same tree). Copied the engine_unwired descriptor class and the inherited reference pattern-count declarations from ci-speed-post064-batch-2.json. Ranking-fenced changes: semantic_search/mod.rs scans a phrase's first word in raw line bytes before normalizing a line during rerank (exact because normalization only collapses whitespace and ASCII-lowercases, proven on 400 random mixed-script sources); external_pattern.rs and external_disk_check.rs serve another repository's search from the index store instead of the deleted in-memory text index; search_index.rs and semantic_index.rs lose that in-memory index; telemetry.rs adds status-cost probes; lib.rs module declarations. No routing, candidate selection, score, range or ranked rendering change is intended. Evidence: the rerank change replayed all 6,897 recorded query lines with byte-identical rankings, scores, snippets and counts; the cross-repository change replayed 300 queries identically. The pattern_counts below remain only the pre-0.64 reference transitions already declared by batch 1 and batch 2; they grant no new difference.",
+  "pattern_counts": {
+    "followup-census:910002": {
+      "candidate_files": {
+        "before": 3,
+        "after": 6
+      },
+      "files_examined": {
+        "before": 3,
+        "after": 6
+      }
+    },
+    "followup-census:910003": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910004": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910005": {
+      "candidate_files": {
+        "before": 194,
+        "after": 141
+      },
+      "files_examined": {
+        "before": 194,
+        "after": 141
+      }
+    },
+    "followup-census:910010": {
+      "candidate_files": {
+        "before": 6,
+        "after": 19
+      },
+      "files_examined": {
+        "before": 6,
+        "after": 19
+      }
+    },
+    "followup-census:910011": {
+      "candidate_files": {
+        "before": 942,
+        "after": 729
+      },
+      "files_examined": {
+        "before": 942,
+        "after": 729
+      }
+    },
+    "followup-census:910012": {
+      "candidate_files": {
+        "before": 1031,
+        "after": 730
+      },
+      "files_examined": {
+        "before": 1031,
+        "after": 730
+      }
+    },
+    "followup-census:910013": {
+      "candidate_files": {
+        "before": 908,
+        "after": 45
+      },
+      "files_examined": {
+        "before": 908,
+        "after": 45
+      }
+    },
+    "followup-census:910014": {
+      "candidate_files": {
+        "before": 1011,
+        "after": 24
+      },
+      "files_examined": {
+        "before": 1011,
+        "after": 24
+      }
+    }
+  }
+}
diff --git a/benchmarks/aft-search/slice-descriptors/rerank-prepare.json b/benchmarks/aft-search/slice-descriptors/rerank-prepare.json
new file mode 100644
index 0000000000..f30cdd4187
--- /dev/null
+++ b/benchmarks/aft-search/slice-descriptors/rerank-prepare.json
@@ -0,0 +1,104 @@
+{
+  "slice_class": "engine_unwired",
+  "targeted_mechanism": "none",
+  "kind": "harness",
+  "fixtures": [
+    "crates/aft/src/commands/semantic_search/mod.rs"
+  ],
+  "slices": [
+    "rerank-prepare"
+  ],
+  "note": "Matching-line preparation only: use a byte prefilter to normalize phrase-candidate lines, defer compact-text preparation until phrase lookup misses, and compact ASCII lines without Unicode lowercasing. The fuzzy scorer, tie breaking, snippet anchors, routing, rankings, scores and counts are unchanged. Ranking-fenced paths are commands/semantic_search/mod.rs and telemetry.rs (opt-in phase/count instrumentation). Rows must stay byte-equal to the reference. The committed reference still predates 0.64, so the same nine pattern-lane candidate-count transitions declared for the index-store cutover (land-index-store-0.64.json) are inherited unchanged from ci-speed-landing-1.json; no new count waiver is introduced. Evidence: frozen base checkout, data mode, semantic disabled, eight concurrent requests, interleaved base/candidate ci-storm builds. All 6,897 recorded queries (6,700 distinct) preserved rankings, scores, snippets and counts; whole replies matched after process snapshot nonce/key-order and watcher-only normalization except two original timing-state rows (trigram readiness and duplicate-call elapsed time), both equal on settled replay. Search latency p50/p90 was 109.11/306.28 ms before and 102.08/299.23 ms after. On the 128-query paired slice, MatchingSource::new CPU fell 714.9 to 279.6 ms and matching_line_in_text CPU fell 2316.2 to 1694.0 ms; phrase lines normalized fell 1,777,424 to 15,468 (the base phrase scan inspected 2,247,698 cached lines). The ci-storm profile replaced fat-LTO release builds by explicit reviewer approval; optional backend reranking was off, while shared matching-line preparation ran on every query.",
+  "pattern_counts": {
+    "followup-census:910002": {
+      "candidate_files": {
+        "before": 3,
+        "after": 6
+      },
+      "files_examined": {
+        "before": 3,
+        "after": 6
+      }
+    },
+    "followup-census:910003": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910004": {
+      "candidate_files": {
+        "before": 972,
+        "after": 860
+      },
+      "files_examined": {
+        "before": 972,
+        "after": 860
+      }
+    },
+    "followup-census:910005": {
+      "candidate_files": {
+        "before": 194,
+        "after": 141
+      },
+      "files_examined": {
+        "before": 194,
+        "after": 141
+      }
+    },
+    "followup-census:910010": {
+      "candidate_files": {
+        "before": 6,
+        "after": 19
+      },
+      "files_examined": {
+        "before": 6,
+        "after": 19
+      }
+    },
+    "followup-census:910011": {
+      "candidate_files": {
+        "before": 942,
+        "after": 729
+      },
+      "files_examined": {
+        "before": 942,
+        "after": 729
+      }
+    },
+    "followup-census:910012": {
+      "candidate_files": {
+        "before": 1031,
+        "after": 730
+      },
+      "files_examined": {
+        "before": 1031,
+        "after": 730
+      }
+    },
+    "followup-census:910013": {
+      "candidate_files": {
+        "before": 908,
+        "after": 45
+      },
+      "files_examined": {
+        "before": 908,
+        "after": 45
+      }
+    },
+    "followup-census:910014": {
+      "candidate_files": {
+        "before": 1011,
+        "after": 24
+      },
+      "files_examined": {
+        "before": 1011,
+        "after": 24
+      }
+    }
+  }
+}
diff --git a/crates/aft-store/Cargo.toml b/crates/aft-store/Cargo.toml
index 020cbdeabc..8158b386ae 100644
--- a/crates/aft-store/Cargo.toml
+++ b/crates/aft-store/Cargo.toml
@@ -14,6 +14,10 @@ ignore = "0.4"
 regex-syntax = "0.8"
 thiserror = "2"
 
+[target.'cfg(target_os = "macos")'.dependencies]
+libc = "0.2"
+log = { version = "0.4", features = ["std"] }
+
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.61", features = [
     "Win32_Foundation",
diff --git a/crates/aft-store/src/checkout.rs b/crates/aft-store/src/checkout.rs
index faa605a30a..3ade44a323 100644
--- a/crates/aft-store/src/checkout.rs
+++ b/crates/aft-store/src/checkout.rs
@@ -112,6 +112,9 @@ pub struct PathRecord {
 /// Which content each path of a checkout held at one moment.
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub struct CheckoutState {
+    /// Relative folders the walk could not read, with their OS error text.
+    /// A rescan retries them rather than treating their absence as complete.
+    skipped_directories: Arc<std::collections::BTreeMap<Vec<u8>, String>>,
     /// The Git tree and index the state was built from, when the checkout
     /// is in Git. Opaque to the store; compared byte for byte.
     pub git: Vec<u8>,
@@ -170,6 +173,7 @@ impl CheckoutState {
             return Err(StateError::TooLong);
         }
         Ok(Self {
+            skipped_directories: Arc::default(),
             git,
             conversion,
             root: Vec::new(),
@@ -189,10 +193,27 @@ impl CheckoutState {
         self
     }
 
-    /// This state recording the root folder `from` records.
+    /// This state recording the root folder and walk gaps `from` records.
     #[must_use]
     pub fn with_root_of(mut self, from: &Self) -> Self {
         self.root.clone_from(&from.root);
+        self.skipped_directories = Arc::clone(&from.skipped_directories);
+        self
+    }
+
+    /// Folders the scan could not read, in relative path order.
+    #[must_use]
+    pub fn skipped_directories(&self) -> &std::collections::BTreeMap<Vec<u8>, String> {
+        &self.skipped_directories
+    }
+
+    /// Replaces the walk's coverage gaps after a full or partial scan.
+    #[must_use]
+    pub fn with_skipped_directories(
+        mut self,
+        skipped: std::collections::BTreeMap<Vec<u8>, String>,
+    ) -> Self {
+        self.skipped_directories = Arc::new(skipped);
         self
     }
 
@@ -381,6 +402,10 @@ impl CheckoutState {
             out.str(&record.language);
             previous = Some(record);
         }
+        let has_gaps = !self.skipped_directories.is_empty();
+        if has_gaps {
+            out.byte(3);
+        }
         // Flag 2 adds a producer stamp before the optional digests. Older
         // readers reject this flag as unusable and rebuild the checkout.
         out.byte(if self.graph_extractor.is_some() {
@@ -400,6 +425,13 @@ impl CheckoutState {
                 None => out.byte(0),
             }
         }
+        if has_gaps {
+            out.usize(self.skipped_directories.len());
+            for (path, reason) in self.skipped_directories.iter() {
+                out.blob(path);
+                out.str(reason);
+            }
+        }
         out.finish()
     }
 
@@ -416,6 +448,19 @@ impl CheckoutState {
     }
 
     fn decode_layout(payload: &[u8], stamped_graphs: bool) -> Result<Self, RecordError> {
+        Self::decode_sections(payload, stamped_graphs, true)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn decode_as_v064(payload: &[u8]) -> Result<Self, RecordError> {
+        Self::decode_sections(payload, true, false)
+    }
+
+    fn decode_sections(
+        payload: &[u8],
+        stamped_graphs: bool,
+        coverage_gaps: bool,
+    ) -> Result<Self, RecordError> {
         let invalid = |error: DecodeError| RecordError::Invalid(error.0);
         let mut input = Decoder::new(payload).map_err(invalid)?;
         let format = input.byte().map_err(invalid)?;
@@ -425,8 +470,8 @@ impl CheckoutState {
                 supported: u16::from(STATE_FORMAT),
             });
         }
-        // Format 2 is format 3 without the root folder.
-        if format != STATE_FORMAT && format != 2 {
+        // Format 2 has no root folder.
+        if !matches!(format, 2..=STATE_FORMAT) {
             return Err(RecordError::Invalid("unknown checkout state format"));
         }
         let git = input.blob().map_err(invalid)?.to_vec();
@@ -440,7 +485,7 @@ impl CheckoutState {
                 .try_into()
                 .map_err(|_| RecordError::Invalid("conversion digest length"))?,
         );
-        let root = if format == STATE_FORMAT {
+        let root = if format >= 3 {
             let root = input.blob().map_err(invalid)?.to_vec();
             if std::str::from_utf8(&root).is_err() {
                 return Err(RecordError::Invalid("root folder is not UTF-8"));
@@ -515,7 +560,12 @@ impl CheckoutState {
         }
         let mut fragments = Vec::new();
         let mut graph_extractor = None;
-        match input.byte().map_err(invalid)? {
+        let mut flag = input.byte().map_err(invalid)?;
+        let has_gaps = flag == 3 && coverage_gaps;
+        if has_gaps {
+            flag = input.byte().map_err(invalid)?;
+        }
+        match flag {
             0 => {}
             flag @ (1 | 2) if flag == 1 || stamped_graphs => {
                 if flag == 2 {
@@ -542,8 +592,18 @@ impl CheckoutState {
             }
             _ => return Err(RecordError::Invalid("fragment section flag")),
         }
+        let mut skipped_directories = std::collections::BTreeMap::new();
+        if has_gaps {
+            let count = input.count_of(2).map_err(invalid)?;
+            for _ in 0..count {
+                let path = input.blob().map_err(invalid)?.to_vec();
+                let reason = input.str().map_err(invalid)?.to_string();
+                skipped_directories.insert(path, reason);
+            }
+        }
         input.finish().map_err(invalid)?;
         Ok(Self {
+            skipped_directories: Arc::new(skipped_directories),
             git,
             conversion,
             root,
@@ -558,10 +618,15 @@ impl CheckoutState {
 /// the payload's string table. A reader refuses a payload naming a higher
 /// one, since a newer build wrote it. So every later layout must keep the
 /// string table's encoding and this byte where they are, and any other
-/// change to the layout must raise this number, except the stamped fragment
-/// flag 2: old readers deliberately treat that flag as unusable and rebuild,
-/// rather than refusing the whole family on rollback. The record envelope
-/// and the rest of the state layout are unchanged.
+/// change to the layout must raise this number, except rebuildable fragment
+/// sections. Fragment-section flag 2 adds a producer stamp: older readers
+/// treat an unknown section flag as unusable and rebuild the checkout rather
+/// than refusing the whole family on rollback. The record envelope and the
+/// rest of the state layout are unchanged.
+/// Fragment-section flag 3 uses the same mechanism: it wraps the existing
+/// fragment section and appends skipped-directory paths and errors. Readers
+/// that do not know this section flag rebuild only that checkout instead of
+/// refusing the family. Gap-free states keep their original bytes and flags.
 const STATE_FORMAT: u8 = 3;
 
 /// How much of a state record [`newer_state_format`] reads to find the
@@ -647,6 +712,7 @@ crate::heap_bytes_of_fields!(PathRecord {
     language,
 });
 crate::heap_bytes_of_fields!(CheckoutState {
+    skipped_directories,
     git,
     conversion,
     root,
@@ -659,6 +725,131 @@ crate::heap_bytes_of_fields!(CheckoutState {
 mod tests {
     use super::*;
 
+    // Frozen from v0.64.0's encode_layout, with its format fixed at 3.
+    // This oracle must not delegate to the current writer: gap-free bytes
+    // must remain compatible even as new optional sections are introduced.
+    fn encode_v064(state: &CheckoutState) -> Vec<u8> {
+        let mut out = Encoder::default();
+        out.byte(3);
+        out.blob(&state.git);
+        out.blob(state.conversion.as_bytes());
+        out.blob(&state.root);
+        out.usize(state.paths.len());
+        let mut previous: Option<&PathRecord> = None;
+        for record in state.paths.iter() {
+            let shared = previous.map_or(0, |previous| {
+                previous
+                    .path
+                    .iter()
+                    .zip(&record.path)
+                    .take_while(|(a, b)| a == b)
+                    .count()
+            });
+            out.usize(shared);
+            out.blob(&record.path[shared..]);
+            out.u32(record.mode);
+            out.byte(record.kind.code());
+            out.blob(record.content.digest().as_bytes());
+            out.blob(&record.link);
+            let stat = &record.stat;
+            let before = previous.map(|previous| &previous.stat);
+            out.u64(stat.size);
+            out.u64(zigzag(stat.mtime_ns));
+            out.u64(zigzag(stat.ctime_ns.wrapping_sub(stat.mtime_ns)));
+            put_optional(
+                &mut out,
+                stat.birth_ns
+                    .map(|birth| zigzag(birth.wrapping_sub(stat.mtime_ns))),
+            );
+            out.u64(stat.file_id);
+            out.u64(zigzag(
+                stat.device
+                    .wrapping_sub(before.map_or(0, |before| before.device))
+                    .cast_signed(),
+            ));
+            put_optional(&mut out, stat.usn);
+            put_optional(&mut out, stat.journal);
+            out.u64(zigzag(
+                stat.observed_ns
+                    .wrapping_sub(before.map_or(0, |before| before.observed_ns)),
+            ));
+            out.str(&record.language);
+            previous = Some(record);
+        }
+        out.byte(if state.graph_extractor.is_some() {
+            2
+        } else {
+            u8::from(!state.fragments.is_empty())
+        });
+        if let Some(extractor) = &state.graph_extractor {
+            out.blob(extractor.as_bytes());
+        }
+        for fragment in state.fragments.iter() {
+            match fragment {
+                Some(digest) => {
+                    out.byte(1);
+                    out.blob(digest.as_bytes());
+                }
+                None => out.byte(0),
+            }
+        }
+        out.finish()
+    }
+
+    #[test]
+    fn gap_free_states_keep_v064_bytes_for_every_fragment_section() {
+        for paths in [
+            Vec::new(),
+            vec![record("src/a.rs", "a"), record("src/b.rs", "b")],
+        ] {
+            let state = CheckoutState::new(b"git".to_vec(), Digest128::of(b"attrs"), paths)
+                .unwrap()
+                .with_root(Path::new("/work"));
+            let fragments = vec![Some(Digest128::of(b"fragment")); state.paths().len()];
+            let states = [
+                state.clone(),
+                state.clone().with_fragments(fragments.clone()).unwrap(),
+                state.with_fragments_for(fragments, "current").unwrap(),
+            ];
+            for state in states {
+                assert_eq!(state.encode(), encode_v064(&state));
+                assert_eq!(
+                    CheckoutState::decode_as_v064(&state.encode()).unwrap(),
+                    state
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn gap_sections_round_trip_with_each_fragment_section_and_v064_rejects_them() {
+        for paths in [Vec::new(), vec![record("a.rs", "a")]] {
+            let state = CheckoutState::new(Vec::new(), Digest128::of(b""), paths).unwrap();
+            let fragments = vec![Some(Digest128::of(b"fragment")); state.paths().len()];
+            let states = [
+                state.clone(),
+                state.clone().with_fragments(fragments.clone()).unwrap(),
+                state.with_fragments_for(fragments, "current").unwrap(),
+            ];
+            for state in states {
+                let state = state.with_skipped_directories(
+                    [(
+                        b"locked".to_vec(),
+                        "permission denied (os error 13)".to_string(),
+                    )]
+                    .into(),
+                );
+                let payload = state.encode();
+                assert_eq!(Decoder::new(&payload).unwrap().byte().unwrap(), 3);
+                assert_eq!(CheckoutState::decode(&payload).unwrap(), state);
+                assert!(matches!(
+                    CheckoutState::decode_as_v064(&payload),
+                    Err(RecordError::Invalid("fragment section flag"))
+                ));
+            }
+        }
+    }
+
     fn record(path: &str, content: &str) -> PathRecord {
         PathRecord {
             path: path.as_bytes().to_vec(),
@@ -732,6 +923,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn skipped_folders_survive_encoding_and_rebuilding() {
+        let state = CheckoutState::new(Vec::new(), Digest128::of(b""), vec![record("a", "a")])
+            .unwrap()
+            .with_root(Path::new("/work"))
+            .with_skipped_directories(
+                [(
+                    b"locked".to_vec(),
+                    "permission denied (os error 13)".to_string(),
+                )]
+                .into(),
+            );
+        let decoded = CheckoutState::decode(&state.encode()).unwrap();
+        assert_eq!(decoded, state);
+        let rebuilt = CheckoutState::new(Vec::new(), state.conversion, Vec::new())
+            .unwrap()
+            .with_root_of(&state);
+        assert_eq!(rebuilt.skipped_directories(), state.skipped_directories());
+        assert_eq!(Decoder::new(&state.encode()).unwrap().byte().unwrap(), 3);
+        assert!(matches!(
+            CheckoutState::decode_sections(&state.encode(), true, false),
+            Err(RecordError::Invalid("fragment section flag"))
+        ));
+    }
+
     #[test]
     fn round_trips_sorted_and_refuses_duplicates() {
         let state = CheckoutState::new(
diff --git a/crates/aft-store/src/family/tests.rs b/crates/aft-store/src/family/tests.rs
index 3edc78b415..6163d2b414 100644
--- a/crates/aft-store/src/family/tests.rs
+++ b/crates/aft-store/src/family/tests.rs
@@ -906,3 +906,64 @@ fn a_checkout_state_payload_an_older_build_wrote_stays_unusable() {
         "a writer still starts"
     );
 }
+
+#[test]
+fn a_checkout_state_with_gaps_is_unusable_to_v064_without_refusing_its_family() {
+    use crate::checkout::CheckoutState;
+    let dir = tempfile::tempdir().unwrap();
+    let family = open(dir.path());
+    let gap_free = CheckoutState::new(Vec::new(), Digest128::of(b""), Vec::new()).unwrap();
+    let gapped = gap_free.clone().with_skipped_directories(
+        [(
+            b"locked".to_vec(),
+            "permission denied (os error 13)".to_string(),
+        )]
+        .into(),
+    );
+    let mut writer = family.try_write().unwrap().unwrap();
+    let main = writer
+        .write_checkout_state(checkout("main"), &gapped)
+        .unwrap();
+    let sibling = writer
+        .write_checkout_state(checkout("sibling"), &gap_free)
+        .unwrap();
+    writer
+        .publish(&Publication {
+            add_segments: Vec::new(),
+            remove_segments: Vec::new(),
+            states: vec![main, sibling],
+            retire_checkouts: Vec::new(),
+        })
+        .unwrap();
+    drop(writer);
+    let snapshot = family.snapshot().unwrap();
+    assert_eq!(
+        snapshot.checkout_state(checkout("main")).unwrap().unwrap(),
+        gapped
+    );
+    let payload = snapshot.read_state(checkout("main")).unwrap().unwrap();
+    let error = CheckoutState::decode_as_v064(&payload).unwrap_err();
+    assert!(matches!(
+        error,
+        RecordError::Invalid("fragment section flag")
+    ));
+    let path = family.layout.state(
+        checkout("main"),
+        snapshot
+            .manifest()
+            .checkout(checkout("main"))
+            .unwrap()
+            .number,
+    );
+    let error = FamilyError::record(&path, error);
+    assert!(error.is_unusable_file(), "{error}");
+    assert_eq!(error.newer_format(), None);
+    let sibling = snapshot.read_state(checkout("sibling")).unwrap().unwrap();
+    assert_eq!(CheckoutState::decode_as_v064(&sibling).unwrap(), gap_free);
+    drop(snapshot);
+    family.check_formats().unwrap();
+    assert!(
+        family.try_write().unwrap().is_some(),
+        "an unusable checkout must not block its family writer"
+    );
+}
diff --git a/crates/aft-store/src/fs.rs b/crates/aft-store/src/fs.rs
index f1661d5f74..e3ba6744c0 100644
--- a/crates/aft-store/src/fs.rs
+++ b/crates/aft-store/src/fs.rs
@@ -53,7 +53,7 @@ pub(crate) fn write_new_durable(path: &Path, bytes: &[u8]) -> io::Result<()> {
     fault::point("write")?;
     file.write_all(bytes)?;
     fault::point("sync")?;
-    file.sync_all()?;
+    crate::sync::sync_all(&file, path)?;
     drop(file);
     sync_parent(path)
 }
@@ -113,7 +113,7 @@ pub(crate) fn sync_dir(path: &Path) -> io::Result<()> {
     fault::point("sync_dir")?;
     #[cfg(unix)]
     {
-        File::open(path)?.sync_all()
+        crate::sync::sync_all(&File::open(path)?, path)
     }
     #[cfg(not(unix))]
     {
diff --git a/crates/aft-store/src/lib.rs b/crates/aft-store/src/lib.rs
index 8c1bac877c..0065eb22f6 100644
--- a/crates/aft-store/src/lib.rs
+++ b/crates/aft-store/src/lib.rs
@@ -20,6 +20,7 @@ pub mod postings;
 pub mod scan;
 pub mod segment;
 pub mod stat;
+pub mod sync;
 pub mod table;
 pub mod text;
 pub mod vector;
diff --git a/crates/aft-store/src/scan.rs b/crates/aft-store/src/scan.rs
index 0b8ef9ab66..484a86df95 100644
--- a/crates/aft-store/src/scan.rs
+++ b/crates/aft-store/src/scan.rs
@@ -181,9 +181,11 @@ pub fn scan(
     previous: Option<&CheckoutState>,
     sink: &dyn ContentSink,
 ) -> Result<Scan, ScanError> {
-    let (records, mut counters) = walk_records(root, policy, previous, None, sink)?;
+    let (records, skipped, mut counters) = walk_records(root, policy, previous, None, sink)?;
     counters.files = records.len();
-    let state = CheckoutState::new(Vec::new(), Digest128::of(b""), records)?.with_root(root);
+    let state = CheckoutState::new(Vec::new(), Digest128::of(b""), records)?
+        .with_root(root)
+        .with_skipped_directories(skipped);
     Ok(Scan { state, counters })
 }
 
@@ -201,6 +203,7 @@ pub struct PathScan {
 /// Brings `previous` up to date for `paths` (relative, such as a watcher or
 /// an edit reports them): each path, and everything under it when it is a
 /// folder, is walked again under exactly the rules a full [`scan`] applies.
+/// An empty relative path names the root and rescans the whole checkout.
 /// A path that is gone, ignored, or inside a skipped folder leaves the
 /// state; a folder that appeared is walked whole. Every other record is kept
 /// as it is. Files are read only when their stat no longer proves the
@@ -217,13 +220,18 @@ pub fn scan_paths(
     sink: &dyn ContentSink,
 ) -> Result<PathScan, ScanError> {
     let restrict = Arc::new(Restrict::new(paths));
-    let (walked, mut counters) = walk_records(
+    let (walked, mut skipped, mut counters) = walk_records(
         root,
         policy,
         Some(previous),
         Some(Arc::clone(&restrict)),
         sink,
     )?;
+    for (path, reason) in previous.skipped_directories() {
+        if !restrict.covers(path) {
+            skipped.insert(path.clone(), reason.clone());
+        }
+    }
     let mut records = previous
         .paths()
         .iter()
@@ -255,8 +263,9 @@ pub fn scan_paths(
     drop(walked_by_path);
     records.extend(walked);
     counters.files = records.len();
-    let state =
-        CheckoutState::new(previous.git.clone(), previous.conversion, records)?.with_root(root);
+    let state = CheckoutState::new(previous.git.clone(), previous.conversion, records)?
+        .with_root(root)
+        .with_skipped_directories(skipped);
     Ok(PathScan {
         state,
         changed: changed.into_iter().collect(),
@@ -291,14 +300,13 @@ impl Restrict {
                     }
                     path
                 })
-                .filter(|path| !path.is_empty())
                 .collect(),
         }
     }
 
     /// Whether `path` is one of the paths or under one of them.
     fn covers(&self, path: &[u8]) -> bool {
-        if self.paths.contains(path) {
+        if self.paths.contains(b"".as_slice()) || self.paths.contains(path) {
             return true;
         }
         path.iter()
@@ -322,6 +330,12 @@ impl Restrict {
     }
 }
 
+type WalkRecords = (
+    Vec<PathRecord>,
+    std::collections::BTreeMap<Vec<u8>, String>,
+    ScanCounters,
+);
+
 /// Walks `root` under the scan's rules, limited to `restrict` when given,
 /// and records every member it reaches.
 fn walk_records(
@@ -330,7 +344,20 @@ fn walk_records(
     previous: Option<&CheckoutState>,
     restrict: Option<Arc<Restrict>>,
     sink: &dyn ContentSink,
-) -> Result<(Vec<PathRecord>, ScanCounters), ScanError> {
+) -> Result<WalkRecords, ScanError> {
+    if let Err(source) = std::fs::read_dir(root) {
+        if source.kind() == io::ErrorKind::PermissionDenied {
+            return Ok((
+                Vec::new(),
+                [(Vec::new(), source.to_string().to_lowercase())].into(),
+                ScanCounters::default(),
+            ));
+        }
+        return Err(ScanError::Walk {
+            path: root.to_path_buf(),
+            source,
+        });
+    }
     let common_dir = git_common_dir(root);
     let mut builder = WalkBuilder::new(root);
     builder
@@ -382,6 +409,7 @@ fn walk_records(
     });
 
     let records = Mutex::new(Vec::new());
+    let skipped = Mutex::new(std::collections::BTreeMap::new());
     let walk_error = Mutex::new(None);
     let counters = Counters::default();
     builder.build_parallel().run(|| {
@@ -389,13 +417,22 @@ fn walk_records(
             let entry = match entry {
                 Ok(entry) => entry,
                 Err(error) => {
-                    // A directory that cannot be listed is a hole in the
-                    // state, so the whole scan fails rather than silently
-                    // dropping its files.
-                    if let Some(io) = error.io_error()
-                        && io.kind() != io::ErrorKind::NotFound
-                    {
+                    // Permission-denied folders are explicit coverage gaps.
+                    // Other walk errors still fail the scan.
+                    if let Some(io) = error.io_error() {
                         let path = error_path(&error).unwrap_or_else(|| root.to_path_buf());
+                        if io.kind() == io::ErrorKind::NotFound && path != root {
+                            return WalkState::Continue;
+                        }
+                        if io.kind() == io::ErrorKind::PermissionDenied
+                            && let Ok(relative) = relative_bytes(root, &path)
+                        {
+                            skipped
+                                .lock()
+                                .expect("no panics while holding it")
+                                .insert(relative, io.to_string().to_lowercase());
+                            return WalkState::Continue;
+                        }
                         let mut slot = walk_error.lock().expect("no panics while holding it");
                         slot.get_or_insert(ScanError::Walk {
                             path,
@@ -440,7 +477,11 @@ fn walk_records(
         return Err(error);
     }
     let records = records.into_inner().expect("no panics while holding it");
-    Ok((records, counters.finish()))
+    Ok((
+        records,
+        skipped.into_inner().expect("no panics while holding it"),
+        counters.finish(),
+    ))
 }
 
 #[derive(Default)]
@@ -840,6 +881,110 @@ mod tests {
     /// watcher would report, and the paths whose record must change.
     type Step<'a> = (Box<dyn Fn() + 'a>, Vec<&'a str>, Vec<&'a str>);
 
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn walk_skips_unreadable_folders_and_retries_them() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let locked = root.join("locked");
+        std::fs::create_dir(&locked).unwrap();
+        std::fs::write(locked.join("hidden.txt"), "needle hidden\n").unwrap();
+        std::fs::write(root.join("open.txt"), "needle open\n").unwrap();
+        struct Restore(PathBuf);
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+            }
+        }
+        let restore = Restore(locked.clone());
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0)).unwrap();
+        assert_eq!(
+            std::fs::read_dir(&locked)
+                .err()
+                .expect("run without DAC override privileges")
+                .kind(),
+            io::ErrorKind::PermissionDenied
+        );
+        let sink = Collect::default();
+        let policy = ScanPolicy::default();
+        let first = scan(root, &policy, None, &sink).unwrap().state;
+        assert_eq!(paths(&first), vec!["open.txt"]);
+        assert_eq!(first.skipped_directories().len(), 1);
+        assert_eq!(
+            first.skipped_directories()[b"locked".as_slice()],
+            "permission denied (os error 13)"
+        );
+        let partial = scan_paths(root, &policy, &first, &[b"open.txt".to_vec()], &sink)
+            .unwrap()
+            .state;
+        assert_eq!(partial.skipped_directories(), first.skipped_directories());
+        let retried = scan_paths(root, &policy, &partial, &[b"locked".to_vec()], &sink)
+            .unwrap()
+            .state;
+        assert_eq!(retried.skipped_directories(), first.skipped_directories());
+        drop(restore);
+        let recovered = scan_paths(root, &policy, &retried, &[b"locked".to_vec()], &sink)
+            .unwrap()
+            .state;
+        assert!(recovered.skipped_directories().is_empty());
+        assert_eq!(paths(&recovered), vec!["locked/hidden.txt", "open.txt"]);
+        assert!(
+            scan(root, &policy, Some(&first), &sink)
+                .unwrap()
+                .state
+                .skipped_directories()
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn walk_a_vanished_root_still_fails() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("gone");
+        assert!(
+            matches!(scan(&missing, &ScanPolicy::default(), None, &Collect::default()), Err(ScanError::Walk { source, .. }) if source.kind() == io::ErrorKind::NotFound)
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn walk_an_unreadable_root_is_a_gap_and_is_retried_after_access_returns() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::write(root.join("readable-later.txt"), "needle\n").unwrap();
+        struct Restore(PathBuf);
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+            }
+        }
+        let restore = Restore(root.to_path_buf());
+        std::fs::set_permissions(root, std::fs::Permissions::from_mode(0)).unwrap();
+        assert_eq!(
+            std::fs::read_dir(root)
+                .err()
+                .expect("run without DAC override privileges")
+                .kind(),
+            io::ErrorKind::PermissionDenied
+        );
+        let sink = Collect::default();
+        let policy = ScanPolicy::default();
+        let first = scan(root, &policy, None, &sink).unwrap().state;
+        assert!(first.paths().is_empty());
+        assert_eq!(
+            first.skipped_directories()[b"".as_slice()],
+            "permission denied (os error 13)"
+        );
+        drop(restore);
+        let recovered = scan_paths(root, &policy, &first, &[Vec::new()], &sink)
+            .unwrap()
+            .state;
+        assert!(recovered.skipped_directories().is_empty());
+        assert_eq!(paths(&recovered), vec!["readable-later.txt"]);
+    }
+
     /// The members of `state` with what identifies each, for comparing a
     /// path scan with a full scan.
     fn members(state: &CheckoutState) -> Vec<Member> {
diff --git a/crates/aft-store/src/segment/writer.rs b/crates/aft-store/src/segment/writer.rs
index 803cc88b57..26368d5b70 100644
--- a/crates/aft-store/src/segment/writer.rs
+++ b/crates/aft-store/src/segment/writer.rs
@@ -261,7 +261,7 @@ impl SegmentWriter {
             .map_err(|error| io(&path, error.into_error()))?;
         file.seek(SeekFrom::Start(0))
             .and_then(|_| file.write_all(&header.encode()))
-            .and_then(|()| file.sync_all())
+            .and_then(|()| crate::sync::sync_all(&file, &path))
             .map_err(|error| io(&path, error))?;
         Ok(SegmentSummary {
             path,
diff --git a/crates/aft-store/src/sync.rs b/crates/aft-store/src/sync.rs
new file mode 100644
index 0000000000..a13ece9330
--- /dev/null
+++ b/crates/aft-store/src/sync.rs
@@ -0,0 +1,355 @@
+//! Durable flushes shared by the index store and AFT's other file writers.
+//!
+//! macOS mounts without F_FULLFSYNC support still receive fsync. Other errors
+//! remain fatal; a failed device flush must not be mistaken for unsupported I/O.
+
+use std::fs::File;
+use std::io;
+use std::path::Path;
+
+/// Flush file contents and metadata, using the strongest sync the mount supports.
+pub fn sync_all(file: &File, path: &Path) -> io::Result<()> {
+    #[cfg(target_os = "macos")]
+    {
+        macos::sync_all(file, path)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = path;
+        file.sync_all()
+    }
+}
+
+/// Flush from a panic hook without entering the logger or its warning-set lock.
+/// Unsupported full syncs are still counted and fall back to fsync, but do not
+/// warn or mark the device as warned by an ordinary caller.
+pub fn sync_all_in_panic(file: &File, path: &Path) -> io::Result<()> {
+    #[cfg(target_os = "macos")]
+    {
+        macos::sync_all_inner(file, path, false)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = path;
+        file.sync_all()
+    }
+}
+
+/// Flush file contents, retaining the platform's existing sync_data semantics.
+pub fn sync_data(file: &File, path: &Path) -> io::Result<()> {
+    #[cfg(target_os = "macos")]
+    {
+        // Rust uses F_FULLFSYNC for both sync_all and sync_data on macOS.
+        macos::sync_all(file, path)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = path;
+        file.sync_data()
+    }
+}
+
+/// Number of unsupported full-sync calls that attempted the fsync fallback.
+pub fn full_sync_fallbacks() -> u64 {
+    #[cfg(target_os = "macos")]
+    {
+        macos::DIAGNOSTICS
+            .fallbacks
+            .load(std::sync::atomic::Ordering::Relaxed)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        0
+    }
+}
+
+#[cfg(target_os = "macos")]
+mod macos {
+    use super::*;
+    use std::collections::HashSet;
+    use std::os::fd::AsRawFd;
+    use std::os::unix::fs::MetadataExt;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::sync::{LazyLock, Mutex};
+
+    #[derive(Default)]
+    pub(super) struct Diagnostics {
+        pub(super) fallbacks: AtomicU64,
+        warned_devices: LazyLock<Mutex<HashSet<u64>>>,
+    }
+
+    pub(super) static DIAGNOSTICS: Diagnostics = Diagnostics {
+        fallbacks: AtomicU64::new(0),
+        warned_devices: LazyLock::new(Mutex::default),
+    };
+
+    pub(super) fn sync_all(file: &File, path: &Path) -> io::Result<()> {
+        sync_all_inner(file, path, true)
+    }
+
+    pub(super) fn sync_all_inner(file: &File, path: &Path, warn: bool) -> io::Result<()> {
+        sync_all_with(
+            file,
+            path,
+            &DIAGNOSTICS,
+            || {
+                // SAFETY: the borrowed File keeps its descriptor open.
+                retry(|| unsafe { libc::fcntl(file.as_raw_fd(), libc::F_FULLFSYNC) })
+            },
+            || fsync(file),
+            warn,
+        )
+    }
+
+    fn fsync(file: &File) -> io::Result<()> {
+        // SAFETY: the borrowed File keeps its descriptor open.
+        retry(|| unsafe { libc::fsync(file.as_raw_fd()) })
+    }
+
+    fn retry(mut syscall: impl FnMut() -> libc::c_int) -> io::Result<()> {
+        loop {
+            if syscall() == 0 {
+                return Ok(());
+            }
+            let error = io::Error::last_os_error();
+            if error.kind() != io::ErrorKind::Interrupted {
+                return Err(error);
+            }
+        }
+    }
+
+    // Inject only the syscalls: tests exercise the same errno selection,
+    // accounting, device identity and warning suppression as production.
+    fn sync_all_with(
+        file: &File,
+        path: &Path,
+        diagnostics: &Diagnostics,
+        full_sync: impl FnOnce() -> io::Result<()>,
+        fallback: impl FnOnce() -> io::Result<()>,
+        warn: bool,
+    ) -> io::Result<()> {
+        match full_sync() {
+            Ok(()) => Ok(()),
+            Err(error)
+                if error.raw_os_error().is_some_and(|errno| {
+                    [libc::ENOTTY, libc::ENOTSUP, libc::EINVAL].contains(&errno)
+                }) =>
+            {
+                diagnostics.fallbacks.fetch_add(1, Ordering::Relaxed);
+                // Device lookup is diagnostic only; it must not prevent fsync.
+                if warn && let Ok(metadata) = file.metadata() {
+                    let device = metadata.dev();
+                    let first = diagnostics
+                        .warned_devices
+                        .lock()
+                        .unwrap_or_else(|error| error.into_inner())
+                        .insert(device);
+                    if first {
+                        log::warn!(
+                            "F_FULLFSYNC unsupported; falling back to fsync: path={} errno={} device={device}",
+                            path.display(),
+                            error.raw_os_error().expect("matched an errno"),
+                        );
+                    }
+                }
+                fallback()
+            }
+            Err(error) => Err(error),
+        }
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+        use std::cell::{Cell, RefCell};
+        use std::sync::Once;
+
+        struct TestLogger;
+        static LOGGER: TestLogger = TestLogger;
+        static INIT: Once = Once::new();
+        thread_local! {
+            static WARNINGS: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+        }
+
+        impl log::Log for TestLogger {
+            fn enabled(&self, metadata: &log::Metadata<'_>) -> bool {
+                metadata.level() == log::Level::Warn
+            }
+
+            fn log(&self, record: &log::Record<'_>) {
+                if self.enabled(record.metadata()) {
+                    WARNINGS.with(|warnings| warnings.borrow_mut().push(record.args().to_string()));
+                }
+            }
+
+            fn flush(&self) {}
+        }
+
+        fn diagnostics() -> Diagnostics {
+            INIT.call_once(|| {
+                log::set_logger(&LOGGER).expect("install test logger");
+                log::set_max_level(log::LevelFilter::Warn);
+            });
+            WARNINGS.with(|warnings| warnings.borrow_mut().clear());
+            Diagnostics::default()
+        }
+
+        fn injected(
+            file: &File,
+            path: &Path,
+            diagnostics: &Diagnostics,
+            errno: i32,
+            fsyncs: &Cell<usize>,
+        ) -> io::Result<()> {
+            sync_all_with(
+                file,
+                path,
+                diagnostics,
+                || Err(io::Error::from_raw_os_error(errno)),
+                || {
+                    fsyncs.set(fsyncs.get() + 1);
+                    fsync(file)
+                },
+                true,
+            )
+        }
+
+        #[test]
+        fn full_sync_enotty_falls_back_and_counts() {
+            let diagnostics = diagnostics();
+            let file = tempfile::NamedTempFile::new().unwrap();
+            let fsyncs = Cell::new(0);
+            injected(
+                file.as_file(),
+                file.path(),
+                &diagnostics,
+                libc::ENOTTY,
+                &fsyncs,
+            )
+            .unwrap();
+            assert_eq!(fsyncs.get(), 1);
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 1);
+            WARNINGS.with(|warnings| {
+                let warnings = warnings.borrow();
+                assert_eq!(warnings.len(), 1);
+                assert!(warnings[0].contains(&file.path().display().to_string()));
+                assert!(warnings[0].contains(&format!("errno={}", libc::ENOTTY)));
+            });
+        }
+
+        #[test]
+        fn full_sync_enotsup_and_einval_fall_back_for_directories() {
+            let diagnostics = diagnostics();
+            let dir = tempfile::tempdir().unwrap();
+            let file = File::open(dir.path()).unwrap();
+            let fsyncs = Cell::new(0);
+            for errno in [libc::ENOTSUP, libc::EINVAL] {
+                injected(&file, dir.path(), &diagnostics, errno, &fsyncs).unwrap();
+            }
+            assert_eq!(fsyncs.get(), 2);
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 2);
+        }
+
+        #[test]
+        fn full_sync_eio_still_fails_without_fallback() {
+            let diagnostics = diagnostics();
+            let file = tempfile::NamedTempFile::new().unwrap();
+            let fsyncs = Cell::new(0);
+            let error = injected(
+                file.as_file(),
+                file.path(),
+                &diagnostics,
+                libc::EIO,
+                &fsyncs,
+            )
+            .unwrap_err();
+            assert_eq!(error.raw_os_error(), Some(libc::EIO));
+            assert_eq!(fsyncs.get(), 0);
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 0);
+            WARNINGS.with(|warnings| assert!(warnings.borrow().is_empty()));
+        }
+
+        #[test]
+        fn full_sync_second_fallback_on_same_device_warns_once() {
+            let diagnostics = diagnostics();
+            let first = tempfile::NamedTempFile::new().unwrap();
+            let second = tempfile::NamedTempFile::new().unwrap();
+            assert_eq!(
+                first.as_file().metadata().unwrap().dev(),
+                second.as_file().metadata().unwrap().dev()
+            );
+            let fsyncs = Cell::new(0);
+            for file in [&first, &second] {
+                injected(
+                    file.as_file(),
+                    file.path(),
+                    &diagnostics,
+                    libc::ENOTTY,
+                    &fsyncs,
+                )
+                .unwrap();
+            }
+            assert_eq!(fsyncs.get(), 2);
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 2);
+            WARNINGS.with(|warnings| assert_eq!(warnings.borrow().len(), 1));
+        }
+
+        #[test]
+        fn full_sync_fallback_failure_is_propagated() {
+            let diagnostics = diagnostics();
+            let file = tempfile::NamedTempFile::new().unwrap();
+            let error = sync_all_with(
+                file.as_file(),
+                file.path(),
+                &diagnostics,
+                || Err(io::Error::from_raw_os_error(libc::ENOTTY)),
+                || Err(io::Error::from_raw_os_error(libc::EIO)),
+                true,
+            )
+            .unwrap_err();
+            assert_eq!(error.raw_os_error(), Some(libc::EIO));
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 1);
+        }
+
+        #[test]
+        fn full_sync_success_does_not_fall_back() {
+            let diagnostics = diagnostics();
+            let file = tempfile::NamedTempFile::new().unwrap();
+            sync_all_with(
+                file.as_file(),
+                file.path(),
+                &diagnostics,
+                || Ok(()),
+                || panic!("successful full sync must not fall back"),
+                true,
+            )
+            .unwrap();
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 0);
+            WARNINGS.with(|warnings| assert!(warnings.borrow().is_empty()));
+        }
+
+        #[test]
+        fn full_sync_panic_fallback_skips_warning_lock() {
+            let diagnostics = diagnostics();
+            let file = tempfile::NamedTempFile::new().unwrap();
+            let fsyncs = Cell::new(0);
+            let warned = diagnostics.warned_devices.lock().unwrap();
+            sync_all_with(
+                file.as_file(),
+                file.path(),
+                &diagnostics,
+                || Err(io::Error::from_raw_os_error(libc::ENOTTY)),
+                || {
+                    fsyncs.set(fsyncs.get() + 1);
+                    fsync(file.as_file())
+                },
+                false,
+            )
+            .unwrap();
+            assert_eq!(fsyncs.get(), 1);
+            assert_eq!(diagnostics.fallbacks.load(Ordering::Relaxed), 1);
+            assert!(warned.is_empty());
+            WARNINGS.with(|warnings| assert!(warnings.borrow().is_empty()));
+        }
+    }
+}
diff --git a/crates/aft/examples/alloc_trace_probe.rs b/crates/aft/examples/alloc_trace_probe.rs
index 503b8693b0..32612e97c6 100644
--- a/crates/aft/examples/alloc_trace_probe.rs
+++ b/crates/aft/examples/alloc_trace_probe.rs
@@ -12,6 +12,8 @@
 //!     restart <repo> <dir> [threads]
 //! cargo run --profile ci-storm -p agent-file-tools --example alloc_trace_probe -- \
 //!     replay <pack.jsonl.gz> [publish_every|daemon] [threads]
+//! cargo run --profile ci-storm -p agent-file-tools --example alloc_trace_probe -- \
+//!     transition <base-root> <target-root> [threads] [sibling|refresh|cold]
 //! ```
 //!
 //! `overhead` runs two workloads in one process and prints one JSON line
@@ -53,14 +55,20 @@
 //! refreshes print the block reads they made through the layer's cache.
 //! With `PROBE_TRIM=1`, `refresh` hands the allocator's free memory back
 //! before the restart's refresh.
+//!
+//! `transition` compares two exported source trees. `PROBE_STAGES=1` counts
+//! the live Rust heap at each stage; `PROBE_STAGE_TIMING=1` reports stage
+//! wall/CPU times without those counting atomics. Both require `test-hooks`.
+//! `PROBE_SKIP_HANDOFF=1` disables pending-record reuse for a timing control;
+//! `PROBE_COMPARE=1` compares every resulting engine record with a cold build.
 
 #![allow(clippy::unwrap_used, clippy::print_stdout, clippy::print_stderr)]
 
 use std::alloc::{GlobalAlloc, Layout, System};
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicIsize, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};
 
 use aft::alloc_trace::TracingAllocator;
@@ -73,25 +81,46 @@ use aft_store::ids::{Digest128, FamilyId};
 struct Switch;
 
 static TRACE: AtomicBool = AtomicBool::new(false);
+static COUNTING: AtomicBool = AtomicBool::new(false);
+static STAGE_TIMING: AtomicBool = AtomicBool::new(false);
+static LIVE: AtomicIsize = AtomicIsize::new(0);
+static PEAK: AtomicIsize = AtomicIsize::new(0);
+static STAGE_RSS: AtomicU64 = AtomicU64::new(0);
+
+fn count(bytes: isize) {
+    if COUNTING.load(Ordering::Relaxed) {
+        let live = LIVE.fetch_add(bytes, Ordering::Relaxed) + bytes;
+        PEAK.fetch_max(live, Ordering::Relaxed);
+    }
+}
 
 unsafe impl GlobalAlloc for Switch {
     unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
-        if TRACE.load(Ordering::Relaxed) {
+        let ptr = if TRACE.load(Ordering::Relaxed) {
             unsafe { TracingAllocator.alloc(layout) }
         } else {
             unsafe { System.alloc(layout) }
+        };
+        if !ptr.is_null() {
+            count(layout.size() as isize);
         }
+        ptr
     }
 
     unsafe fn alloc_zeroed(&self, layout: Layout) -> *mut u8 {
-        if TRACE.load(Ordering::Relaxed) {
+        let ptr = if TRACE.load(Ordering::Relaxed) {
             unsafe { TracingAllocator.alloc_zeroed(layout) }
         } else {
             unsafe { System.alloc_zeroed(layout) }
+        };
+        if !ptr.is_null() {
+            count(layout.size() as isize);
         }
+        ptr
     }
 
     unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        count(-(layout.size() as isize));
         if TRACE.load(Ordering::Relaxed) {
             unsafe { TracingAllocator.dealloc(ptr, layout) }
         } else {
@@ -100,11 +129,15 @@ unsafe impl GlobalAlloc for Switch {
     }
 
     unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
-        if TRACE.load(Ordering::Relaxed) {
+        let next = if TRACE.load(Ordering::Relaxed) {
             unsafe { TracingAllocator.realloc(ptr, layout, new_size) }
         } else {
             unsafe { System.realloc(ptr, layout, new_size) }
+        };
+        if !next.is_null() {
+            count(new_size as isize - layout.size() as isize);
         }
+        next
     }
 }
 
@@ -324,6 +357,7 @@ fn start_resident_sampler() {
     std::thread::spawn(|| loop {
         if let Some(bytes) = resident_bytes() {
             RESIDENT_PEAK.fetch_max(bytes, Ordering::Relaxed);
+            STAGE_RSS.fetch_max(bytes, Ordering::Relaxed);
         }
         std::thread::sleep(Duration::from_millis(250));
     });
@@ -389,6 +423,53 @@ fn start_tracing() {
     start_resident_sampler();
 }
 
+struct Stage {
+    name: &'static str,
+    started: Instant,
+    cpu: (f64, f64, u64),
+    live: isize,
+}
+
+static STAGE: Mutex<Option<Stage>> = Mutex::new(None);
+
+/// Stage peaks count the whole Rust heap, including allocations made by a
+/// previous stage. Counting is opt-in because atomics on every allocation
+/// perturb CPU timings. C-library memory is visible only in the RSS samples.
+fn stage(name: &'static str) {
+    if !STAGE_TIMING.load(Ordering::Relaxed) {
+        return;
+    }
+    let mut current = STAGE.lock().unwrap();
+    let live = LIVE.load(Ordering::Relaxed);
+    let peak = PEAK.swap(live, Ordering::Relaxed);
+    let rss = resident_bytes().unwrap_or(0);
+    let rss_peak = STAGE_RSS.swap(rss, Ordering::Relaxed).max(rss);
+    let cpu = usage();
+    if let Some(previous) = current.take() {
+        println!(
+            "{}",
+            serde_json::json!({
+                "refresh_stage": previous.name,
+                "wall_s": previous.started.elapsed().as_secs_f64(),
+                "cpu_s": cpu.0 + cpu.1 - previous.cpu.0 - previous.cpu.1,
+            "live_bytes_at_start": COUNTING.load(Ordering::Relaxed).then_some(previous.live),
+            "peak_live_bytes": COUNTING.load(Ordering::Relaxed).then_some(peak),
+            "live_bytes_at_end": COUNTING.load(Ordering::Relaxed).then_some(live),
+                "resident_peak_bytes": rss_peak,
+                "malloc_at_end": malloc_figures(),
+            })
+        );
+    }
+    if name != "end" {
+        *current = Some(Stage {
+            name,
+            started: Instant::now(),
+            cpu: usage(),
+            live,
+        });
+    }
+}
+
 /// The probe's edit: a function appended to AFT's crate root, which most of
 /// the crate reads.
 const EDITED: &str = "crates/aft/src/lib.rs";
@@ -651,6 +732,7 @@ fn replay(mut args: impl Iterator<Item = String>) {
     let mut reused = (0usize, 0.0f64, 0.0f64);
     let mut walls = Vec::new();
     let mut publications = 0usize;
+    let mut cold_builds = 0usize;
     phase("replay", || {
         let mut since = 0usize;
         for (index, edit) in edits.iter().enumerate() {
@@ -661,6 +743,7 @@ fn replay(mut args: impl Iterator<Item = String>) {
             let cpu = cpu_seconds();
             let wall = Instant::now();
             let stats = checkout.refresh_callgraph().unwrap();
+            cold_builds += usize::from(stats.as_ref().is_some_and(|stats| stats.cold_build));
             let wall = wall.elapsed().as_secs_f64();
             let cpu = cpu_seconds() - cpu;
             if stats.is_some() {
@@ -693,7 +776,7 @@ fn replay(mut args: impl Iterator<Item = String>) {
                 .unwrap_or(0.0)
         };
         format!(
-            "{} edits, {publications} publications; refreshes that started an engine: {} \
+            "{} edits, {publications} publications, {cold_builds} cold switches; refreshes that started an engine: {} \
              ({:.1} s wall, {:.1} s CPU); that reused one: {} ({:.1} s wall, {:.1} s CPU); \
              all: {:.1} s wall, {:.1} s CPU, per refresh p50 {:.0} ms, p90 {:.0} ms, max {:.0} ms",
             edits.len(),
@@ -744,6 +827,7 @@ fn restart(mut args: impl Iterator<Item = String>) {
 }
 
 fn main() {
+    let _ = env_logger::try_init();
     let mut args = std::env::args().skip(1);
     match args.next().as_deref() {
         Some("overhead") => overhead(args),
@@ -751,6 +835,119 @@ fn main() {
         Some("refresh") => refresh(args),
         Some("restart") => restart(args),
         Some("replay") => replay(args),
-        _ => panic!("usage: alloc_trace_probe overhead|burst|refresh|restart|replay ..."),
+        Some("transition") => transition(args),
+        _ => {
+            panic!("usage: alloc_trace_probe overhead|burst|refresh|restart|replay|transition ...")
+        }
+    }
+}
+
+/// Measures a revision transition using sibling admission, a refresh of an
+/// already published checkout, or a cold rebuild reusing its stored records.
+/// Roots must be exported source trees, not repositories with private files.
+/// Their contents stay intact; the mutable checkout and store are private.
+fn transition(mut args: impl Iterator<Item = String>) {
+    let base = std::fs::canonicalize(args.next().unwrap()).unwrap();
+    let target = std::fs::canonicalize(args.next().unwrap()).unwrap();
+    let threads = args.next().map_or(8, |threads| threads.parse().unwrap());
+    let strategy = args.next().unwrap_or_else(|| "sibling".to_string());
+    assert!(["sibling", "refresh", "cold"].contains(&strategy.as_str()));
+    let profiling = std::env::var_os("PROBE_STAGES").is_some();
+    let stage_timing = profiling || std::env::var_os("PROBE_STAGE_TIMING").is_some();
+    COUNTING.store(profiling, Ordering::Relaxed);
+    STAGE_TIMING.store(stage_timing, Ordering::Relaxed);
+    #[cfg(feature = "test-hooks")]
+    if stage_timing {
+        aft::data_layer::refresh_probe::set_observer(stage);
+    }
+    #[cfg(not(feature = "test-hooks"))]
+    assert!(
+        !stage_timing,
+        "stage measurement requires --features test-hooks"
+    );
+    start_tracing();
+    let scratch = tempfile::tempdir().unwrap();
+    let store = scratch.path().join("store");
+    let family = FamilyId::from_digest(Digest128::of(b"alloc trace transition"));
+    let layer = Arc::new(DataLayer::new(256 << 20, threads));
+    let root = scratch.path().join("checkout");
+    copy_tree(&base, &root);
+    let sibling = Checkout::bind(Arc::clone(&layer), &store, family, &root).unwrap();
+    stage("base_start");
+    phase("base_build", || {
+        let report = sibling.build().unwrap();
+        stage("end");
+        format!("{report:?}")
+    });
+    let next = if strategy == "sibling" {
+        let next = scratch.path().join("sibling");
+        copy_tree(&target, &next);
+        next
+    } else {
+        std::fs::remove_dir_all(&root).unwrap();
+        copy_tree(&target, &root);
+        root
+    };
+    stage("bind");
+    let worktree = Checkout::bind(Arc::clone(&layer), &store, family, &next).unwrap();
+    phase("target_build", || {
+        with_cache_counts(&layer, || {
+            let detail = if strategy == "refresh" {
+                let stats = worktree.refresh_callgraph().unwrap().unwrap();
+                let detail = format!(
+                    "changed {}, rebound {}, resolved {}, replayed {}, dispatch replayed {}, recomputed {}, sites {}, touched {}; update {} ms (facts {}, bind {}, resolve {}, dispatch {}, sites {})",
+                    stats.changed_paths, stats.rebound, stats.resolved, stats.replayed,
+                    stats.dispatch_replayed, stats.dispatch_recomputed, stats.sites_resolved,
+                    stats.touched.len(), stats.total_ms, stats.facts_ms, stats.bind_ms,
+                    stats.resolve_ms, stats.dispatch_ms, stats.sites_ms,
+                );
+                stage("publication");
+                worktree.publish_changes().unwrap();
+                detail
+            } else {
+                format!("{:?}", worktree.build().unwrap())
+            };
+            stage("end");
+            detail
+        })
+    });
+    println!("engine parts {:?}", worktree.engine_memory_parts());
+    #[cfg(feature = "test-hooks")]
+    if std::env::var_os("PROBE_COMPARE").is_some() {
+        let cold = Checkout::bind(
+            Arc::clone(&layer),
+            &scratch.path().join("cold-store"),
+            family,
+            &next,
+        )
+        .unwrap();
+        cold.build().unwrap();
+        let compared = aft::data_layer::checkout_gate::compare_engines(&worktree, &cold).unwrap();
+        println!(
+            "forced-switch comparison {}",
+            serde_json::to_string(&compared).unwrap()
+        );
     }
 }
+
+/// Copies an archive's source tree without following links or copying Git's
+/// metadata. The empty marker makes ignore rules behave as in a repository.
+fn copy_tree(source: &Path, destination: &Path) {
+    std::fs::create_dir_all(destination).unwrap();
+    let mut archive = Command::new("tar")
+        .args(["-c", "--exclude=.git", "-C"])
+        .arg(source)
+        .arg(".")
+        .stdout(Stdio::piped())
+        .spawn()
+        .unwrap();
+    let status = Command::new("tar")
+        .arg("-x")
+        .arg("-C")
+        .arg(destination)
+        .stdin(archive.stdout.take().unwrap())
+        .status()
+        .unwrap();
+    assert!(status.success() && archive.wait().unwrap().success());
+    std::fs::create_dir_all(destination.join(".git")).unwrap();
+}
diff --git a/crates/aft/examples/edit_latency_probe.rs b/crates/aft/examples/edit_latency_probe.rs
index 8a577f0fd6..9fd368405b 100644
--- a/crates/aft/examples/edit_latency_probe.rs
+++ b/crates/aft/examples/edit_latency_probe.rs
@@ -209,7 +209,7 @@ fn spawn_io_load(
                 }
                 written.fetch_add(chunk.len() as u64, Ordering::Relaxed);
             }
-            let _ = file.sync_data();
+            let _ = aft_store::sync::sync_data(&file, &path);
         }
         let _ = std::fs::remove_file(&path);
     })
diff --git a/crates/aft/examples/rust_fingerprint_probe.rs b/crates/aft/examples/rust_fingerprint_probe.rs
new file mode 100644
index 0000000000..86cef81897
--- /dev/null
+++ b/crates/aft/examples/rust_fingerprint_probe.rs
@@ -0,0 +1,56 @@
+//! Release-only wall/thread-CPU probe for the real Rust input fingerprint.
+//! Run with `cargo run --release -p agent-file-tools --example rust_fingerprint_probe --features test-hooks -- <corpus>`.
+
+#[cfg(all(feature = "test-hooks", target_os = "linux"))]
+fn main() {
+    use std::time::{Duration, Instant};
+
+    use aft::lsp::FingerprintProbe;
+
+    fn cpu() -> Duration {
+        let mut time = libc::timespec {
+            tv_sec: 0,
+            tv_nsec: 0,
+        };
+        // The pointer refers to writable storage with the layout clock_gettime expects.
+        assert_eq!(
+            unsafe { libc::clock_gettime(libc::CLOCK_THREAD_CPUTIME_ID, &mut time) },
+            0
+        );
+        Duration::new(time.tv_sec as u64, time.tv_nsec as u32)
+    }
+
+    let root =
+        std::fs::canonicalize(std::env::args_os().nth(1).expect("corpus path required")).unwrap();
+    let start_cpu = cpu();
+    let start = Instant::now();
+    let cold = FingerprintProbe::capture(&root, None);
+    let cold_wall_ms = start.elapsed().as_secs_f64() * 1000.0;
+    let cold_cpu_ms = (cpu() - start_cpu).as_secs_f64() * 1000.0;
+    let Some(cold) = cold else {
+        println!(
+            "{}",
+            serde_json::json!({"complete": false, "cold_wall_ms": cold_wall_ms, "cold_cpu_ms": cold_cpu_ms})
+        );
+        return;
+    };
+    let start_cpu = cpu();
+    let start = Instant::now();
+    let warm =
+        FingerprintProbe::capture(&root, Some(&cold)).expect("warm fingerprint must complete");
+    let warm_wall_ms = start.elapsed().as_secs_f64() * 1000.0;
+    let warm_cpu_ms = (cpu() - start_cpu).as_secs_f64() * 1000.0;
+    assert!(cold.same_digest(&warm));
+    let (examined, inputs, rust_files, rust_bytes, cold_hashed) = cold.stats();
+    let (_, _, _, _, warm_hashed) = warm.stats();
+    println!(
+        "{}",
+        serde_json::json!({"complete": true, "cold_wall_ms": cold_wall_ms, "cold_cpu_ms": cold_cpu_ms, "warm_wall_ms": warm_wall_ms, "warm_cpu_ms": warm_cpu_ms, "examined": examined, "inputs": inputs, "rust_files": rust_files, "rust_bytes": rust_bytes, "cold_hashed": cold_hashed, "warm_hashed": warm_hashed})
+    );
+}
+
+#[cfg(not(all(feature = "test-hooks", target_os = "linux")))]
+fn main() {
+    eprintln!("rust_fingerprint_probe requires Linux and --features test-hooks");
+    std::process::exit(1);
+}
diff --git a/crates/aft/src/access_policy.rs b/crates/aft/src/access_policy.rs
index 25395f038f..2270ab3206 100644
--- a/crates/aft/src/access_policy.rs
+++ b/crates/aft/src/access_policy.rs
@@ -612,6 +612,10 @@ pub(crate) struct PolicyFloor {
     pub(crate) rule: FloorRule,
 }
 
+pub(crate) fn aft_storage_denial_message(path: impl std::fmt::Display) -> String {
+    format!("path '{path}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.")
+}
+
 #[derive(Debug, Clone)]
 pub struct AccessPolicy {
     pub roots: Vec<PathBuf>,
@@ -965,6 +969,49 @@ impl AccessPolicy {
             })
     }
 
+    pub(crate) fn floor_denial_message(
+        &self,
+        operation: AccessOperation,
+        identity: &Path,
+        original: &Path,
+        owned_artifact: bool,
+    ) -> String {
+        if let Some(mut floor) = self.floor_for_path(operation, identity, owned_artifact) {
+            // A connection credential can sit below the broader module-data floor.
+            if matches!(
+                floor.rule,
+                FloorRule::CortexkitModuleData | FloorRule::CortexkitModuleState
+            ) && self.floor_rules.iter().any(|candidate| {
+                matches!(candidate.rule, FloorRule::SubcConnection)
+                    && floor_contains(identity, &candidate.path)
+            }) {
+                floor.rule = FloorRule::SubcConnection;
+            }
+            match floor.rule {
+                FloorRule::AftStorage => return aft_storage_denial_message(original.display()),
+                FloorRule::CortexkitModuleData | FloorRule::CortexkitModuleState => {
+                    // The resolved identity names the target module even through an alias.
+                    // Shared CortexKit roots have no module name and keep the generic refusal.
+                    if let Some(std::path::Component::Normal(module)) =
+                        identity.components().nth(floor.path.components().count())
+                    {
+                        let module = module.to_string_lossy();
+                        let path = original.display();
+                        return match floor.rule {
+                            FloorRule::CortexkitModuleData => format!("path '{path}' is in the {module} module's data folder. AFT's file tools never open it, because it can hold live databases. Use the {module} module's own commands, or ask the agent that owns it."),
+                            _ => format!("path '{path}' is in the {module} module's state folder. AFT's file tools never open it. Use the {module} module's own commands, or ask the agent that owns it."),
+                        };
+                    }
+                }
+                _ => {}
+            }
+        }
+        format!(
+            "path '{}' is denied by the access policy floor",
+            original.display()
+        )
+    }
+
     #[cfg(unix)]
     pub(crate) fn add_session_store_floor(&mut self, path: PathBuf) {
         self.floor_rules.push(PolicyFloor {
@@ -1506,6 +1553,40 @@ fn resolve_policy_path(path: &Path) -> PathBuf {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn protected_folder_refusal_words_match_approved_table() {
+        use super::*;
+        let dir = tempfile::tempdir().unwrap();
+        let home = policy_path(dir.path());
+        let storage = home.join(".local/share/cortexkit/aft");
+        let mut config = Config::default();
+        config.sandbox.read_deny.push(home.join("denied"));
+        let policy = AccessPolicy::from_config(&config, &storage, vec![], &home);
+        for (relative, expected) in [
+            (".local/share/cortexkit/synapse/memory.db", "path '<path>' is in the synapse module's data folder. AFT's file tools never open it, because it can hold live databases. Use the synapse module's own commands, or ask the agent that owns it."),
+            (".local/state/cortexkit/alfonso/state.json", "path '<path>' is in the alfonso module's state folder. AFT's file tools never open it. Use the alfonso module's own commands, or ask the agent that owns it."),
+            (".local/share/cortexkit/aft/aft.db", "path '<path>' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status."),
+            ("denied", "path '<path>' is denied by the access policy floor"),
+            (".ssh/id_ed25519", "path '<path>' is denied by the access policy floor"),
+            (".local/share/cortexkit/run/subc-connection.json", "path '<path>' is denied by the access policy floor"),
+            (".local/share/cortexkit", "path '<path>' is denied by the access policy floor"),
+            (".local/state/cortexkit", "path '<path>' is denied by the access policy floor"),
+        ] {
+            let identity = home.join(relative);
+            for operation in [AccessOperation::Read, AccessOperation::Write] {
+                assert_eq!(policy.decide(operation, &identity, false), AccessDecision::Deny(AccessDenial::Floor));
+                assert_eq!(policy.floor_denial_message(operation, &identity, &identity, false), expected.replace("<path>", &identity.display().to_string()));
+            }
+        }
+        let storage_path = storage.join("aft.db");
+        let error = crate::error::AftError::DeniedFloor {
+            path: storage_path.display().to_string(),
+        }
+        .to_error_json();
+        assert_eq!(error["code"], "denied_floor");
+        assert_eq!(error["message"], format!("path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.", storage_path.display()));
+    }
+
     #[test]
     fn carrier_scope_grants_guard_is_nested_thread_local_and_unwind_safe() {
         use super::{scope_grants_denial, scope_grants_guard, ScopeGrantsDenial};
diff --git a/crates/aft/src/access_policy_task_tests.rs b/crates/aft/src/access_policy_task_tests.rs
index be590937c6..2292ec785e 100644
--- a/crates/aft/src/access_policy_task_tests.rs
+++ b/crates/aft/src/access_policy_task_tests.rs
@@ -133,6 +133,18 @@ fn read_as(ctx: &AppContext, session: &str, path: &Path) -> crate::protocol::Res
 }
 
 fn assert_floor(response: crate::protocol::Response, path: &Path) {
+    assert!(!response.success, "{:?}", response.data);
+    assert_eq!(response.data["code"], "denied_floor", "{:?}", response.data);
+    assert_eq!(
+        response.data["message"],
+        format!(
+            "path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.",
+            path.display()
+        )
+    );
+}
+
+fn assert_credential_floor(response: crate::protocol::Response, path: &Path) {
     assert!(!response.success, "{:?}", response.data);
     assert_eq!(response.data["code"], "denied_floor", "{:?}", response.data);
     assert_eq!(
@@ -281,7 +293,7 @@ fn access_policy_worker_cannot_read_sibling_or_head_task_records() {
 fn access_policy_head_cannot_read_task_environment() {
     let f = fixture();
     crate::access_policy::with_scope(Some(f.head.clone()), || {
-        assert_floor(
+        assert_credential_floor(
             read_as(&f.ctx, "head-session", &f.worker.environment),
             &f.worker.environment,
         )
@@ -291,13 +303,13 @@ fn access_policy_head_cannot_read_task_environment() {
 #[test]
 fn access_policy_session_cannot_read_task_environment() {
     let f = fixture();
-    assert_floor(
+    assert_credential_floor(
         read_as(&f.ctx, "worker-session", &f.worker.environment),
         &f.worker.environment,
     );
     f.ctx
         .update_config(|config| config.project_root = Some(f.worker.dir.clone()));
-    assert_floor(
+    assert_credential_floor(
         read_as(&f.ctx, "worker-session", &f.worker.environment),
         &f.worker.environment,
     );
diff --git a/crates/aft/src/access_policy_tests.rs b/crates/aft/src/access_policy_tests.rs
index 2de0a2234f..de3e7c5dc6 100644
--- a/crates/aft/src/access_policy_tests.rs
+++ b/crates/aft/src/access_policy_tests.rs
@@ -486,7 +486,7 @@ pub(crate) fn assert_artifact_read_policy(
         assert_eq!(
             denied.data["message"],
             format!(
-                "path '{}' is denied by the access policy floor",
+                "path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.",
                 path.display()
             )
         );
@@ -884,7 +884,7 @@ fn artifact_read_search_does_not_authorize_containing_git_store() {
     assert_eq!(
         response.data["message"],
         format!(
-            "path '{}' is denied by the access policy floor",
+            "path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.",
             std::fs::canonicalize(storage).unwrap().display()
         )
     );
diff --git a/crates/aft/src/agent_child_env.rs b/crates/aft/src/agent_child_env.rs
index 4504ccf749..36fd91cbc9 100644
--- a/crates/aft/src/agent_child_env.rs
+++ b/crates/aft/src/agent_child_env.rs
@@ -4148,9 +4148,10 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn dispatcher_cancels_a_timer_that_ignores_term() {
-        let mut fixture = DispatcherProcessFixture::new(
-            "#!/bin/sh\nwhile [ ! -f \"$AFT_TEST_REPO/timer-ready\" ]; do /bin/sleep 0.01; done\n",
-        );
+        let mut fixture = DispatcherProcessFixture::new(&format!(
+            "#!/bin/sh\n{}\n",
+            crate::test_gate::gate("\"$AFT_TEST_REPO/timer-ready\"", "/bin/sleep 0.01")
+        ));
         // TERM sent between fork and exec can be consumed by the timer child's
         // inherited shell trap. Model an equally unresponsive timer explicitly,
         // and let the probe finish only after that timer is known to be running.
@@ -4168,9 +4169,10 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn dispatcher_timer_exec_leaves_no_intermediate_shell_child() {
-        let mut fixture = DispatcherProcessFixture::new(
-            "#!/bin/sh\nwhile [ ! -f \"$AFT_TEST_REPO/timer-ready\" ]; do /bin/sleep 0.01; done\n",
-        );
+        let mut fixture = DispatcherProcessFixture::new(&format!(
+            "#!/bin/sh\n{}\n",
+            crate::test_gate::gate("\"$AFT_TEST_REPO/timer-ready\"", "/bin/sleep 0.01")
+        ));
         write_executable(
             &fixture.temp.path().join("sleep"),
             "#!/bin/sh\n: > \"$AFT_TEST_REPO/timer-ready\"\nexec /bin/sleep \"$@\"\n",
@@ -4194,9 +4196,10 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn dispatcher_waits_for_timer_pid_before_cancelling() {
-        let mut fixture = DispatcherProcessFixture::new(
-            "#!/bin/sh\nwhile [ ! -f \"$AFT_TEST_REPO/timer-ready\" ]; do /bin/sleep 0.01; done\n",
-        );
+        let mut fixture = DispatcherProcessFixture::new(&format!(
+            "#!/bin/sh\n{}\n",
+            crate::test_gate::gate("\"$AFT_TEST_REPO/timer-ready\"", "/bin/sleep 0.01")
+        ));
         write_executable(
             &fixture.temp.path().join("sleep"),
             "#!/bin/sh\n: > \"$AFT_TEST_REPO/timer-ready\"\nexec /bin/sleep \"$@\"\n",
@@ -4221,9 +4224,10 @@ mod tests {
     #[cfg(unix)]
     #[test]
     fn dispatcher_cancellation_survives_term_suppressed_during_timer_fork() {
-        let mut fixture = DispatcherProcessFixture::new(
-            "#!/bin/sh\nwhile [ ! -f \"$AFT_TEST_REPO/timer-ready\" ]; do /bin/sleep 0.01; done\n",
-        );
+        let mut fixture = DispatcherProcessFixture::new(&format!(
+            "#!/bin/sh\n{}\n",
+            crate::test_gate::gate("\"$AFT_TEST_REPO/timer-ready\"", "/bin/sleep 0.01")
+        ));
         write_executable(
             &fixture.temp.path().join("sleep"),
             "#!/bin/sh\n: > \"$AFT_TEST_REPO/timer-ready\"\nexec /bin/sleep \"$@\"\n",
diff --git a/crates/aft/src/backup.rs b/crates/aft/src/backup.rs
index 4a0dca16a6..484f8cca10 100644
--- a/crates/aft/src/backup.rs
+++ b/crates/aft/src/backup.rs
@@ -20,6 +20,11 @@ mod ordinary_format_tests;
 #[path = "agent_data/backup.rs"]
 mod portable;
 pub mod purge;
+mod status_inventory;
+#[cfg(test)]
+mod status_inventory_tests;
+
+pub(crate) use status_inventory::StatusInventory;
 
 pub const DEFAULT_MAX_UNDO_DEPTH: usize = 20;
 /// Default upper bound for one automatic undo snapshot (64 MiB).
@@ -1093,9 +1098,12 @@ pub struct BackupStore {
     #[cfg(test)]
     discovery_entry_limit: usize,
     #[cfg(test)]
-    discovery_entries_examined: AtomicU64,
+    discovery_entries_examined: Arc<AtomicU64>,
     #[cfg(test)]
     discovery_deadline_override: Option<Instant>,
+    /// Parsed `meta.json` fields kept between status pushes; see
+    /// `status_inventory`.
+    status_meta_caches: Arc<status_inventory::StatusMetaCaches>,
     #[cfg(test)]
     discard_outcome_for_tests: Option<Result<(), String>>,
     /// When the last operation discard's cleanup allowance began, so tests can
@@ -1192,9 +1200,10 @@ impl BackupStore {
             #[cfg(test)]
             discovery_entry_limit: MAX_SESSION_DISCOVERY_ENTRIES,
             #[cfg(test)]
-            discovery_entries_examined: AtomicU64::new(0),
+            discovery_entries_examined: Arc::new(AtomicU64::new(0)),
             #[cfg(test)]
             discovery_deadline_override: None,
+            status_meta_caches: Arc::default(),
             #[cfg(test)]
             discard_outcome_for_tests: None,
             #[cfg(test)]
@@ -1235,6 +1244,7 @@ impl BackupStore {
     /// Forget reconstructible stacks, not undo history or unfinished mutation
     /// annotations. An in-flight request can reload its stack before stamping.
     pub fn release_session_memory(&mut self, session: &str) {
+        self.status_meta_caches.release_session(session);
         if self.storage_dir.is_none() {
             return;
         }
@@ -1249,6 +1259,7 @@ impl BackupStore {
 
     /// Release all durable stack metadata; later undo reloads it from disk.
     pub fn release_memory(&mut self) {
+        self.status_meta_caches.release_all();
         if self.storage_dir.is_none() {
             return;
         }
@@ -1361,6 +1372,7 @@ impl BackupStore {
         self.session_meta.clear();
         self.skipped_backups.clear();
         self.clear_db_mirror_sync();
+        self.status_meta_caches.release_all();
     }
 
     /// Retry moving root backups from `<storage>/backups` into
@@ -1571,6 +1583,17 @@ impl BackupStore {
         self.disk_io_count.load(Ordering::SeqCst)
     }
 
+    #[cfg(test)]
+    pub(crate) fn status_discovery_entries_for_test(&self) -> u64 {
+        self.discovery_entries_examined.load(Ordering::Relaxed)
+    }
+
+    /// How many `meta.json` files status inventories have parsed so far.
+    #[cfg(test)]
+    pub(crate) fn status_meta_parses_for_test(&self) -> u64 {
+        self.status_meta_caches.parses()
+    }
+
     #[cfg(test)]
     fn migration_backups_dir_reads_for_tests(&self) -> u64 {
         self.migration_backups_dir_reads.load(Ordering::Relaxed)
@@ -4890,10 +4913,14 @@ impl BackupStore {
         let Some(session_dir) = self.session_dir(session) else {
             return Ok(HashMap::new());
         };
-        if !session_dir.exists() {
-            return Ok(HashMap::new());
-        }
+        status_inventory::discover_session_stacks(
+            &session_dir,
+            &self.discovery_limits(budget),
+            None,
+        )
+    }
 
+    fn discovery_limits(&self, budget: BackupIoBudget) -> status_inventory::DiscoveryLimits {
         #[cfg(test)]
         let budget = BackupIoBudget {
             deadline: self
@@ -4905,84 +4932,25 @@ impl BackupStore {
         let entry_limit = MAX_SESSION_DISCOVERY_ENTRIES;
         #[cfg(test)]
         let entry_limit = self.discovery_entry_limit;
-        let mut path_dirs = std::fs::read_dir(&session_dir).map_err(|error| AftError::IoError {
-            path: session_dir.display().to_string(),
-            message: error.to_string(),
-        })?;
-        let mut per_session = HashMap::new();
-        let mut examined = 0;
-        loop {
-            // Check before advancing ReadDir, including entries that will be
-            // ignored. An incomplete scan must never certify absent history.
-            budget.check(&session_dir)?;
-            if examined >= entry_limit {
-                return Err(AftError::IoError {
-                    path: session_dir.display().to_string(),
-                    message: format!("backup stack discovery reached its {entry_limit}-entry limit; use per-file undo or retry"),
-                });
-            }
-            let Some(path_entry) = path_dirs.next() else {
-                break;
-            };
-            examined += 1;
+        status_inventory::DiscoveryLimits {
+            budget,
+            entry_limit,
             #[cfg(test)]
-            self.discovery_entries_examined
-                .fetch_add(1, Ordering::Relaxed);
-            let path_entry = path_entry.map_err(|error| AftError::IoError {
-                path: session_dir.display().to_string(),
-                message: error.to_string(),
-            })?;
-            let path_dir = path_entry.path();
-            if !path_dir.is_dir() {
-                continue;
-            }
-            let meta_path = path_dir.join("meta.json");
-            if !meta_path.exists() {
-                continue;
-            }
-            let content = read_history_text(&meta_path).map_err(|error| AftError::IoError {
-                path: meta_path.display().to_string(),
-                message: error.to_string(),
-            })?;
-            let meta = serde_json::from_str::<serde_json::Value>(&content).map_err(|error| {
-                AftError::IoError {
-                    path: meta_path.display().to_string(),
-                    message: error.to_string(),
-                }
-            })?;
-            check_backup_meta_format(&meta_path, Some(&meta)).map_err(|refusal| {
-                AftError::IoError {
-                    path: meta_path.display().to_string(),
-                    message: refusal.to_string(),
-                }
-            })?;
-            let path_str = meta
-                .get("path")
-                .and_then(|value| value.as_str())
-                .ok_or_else(|| AftError::IoError {
-                    path: meta_path.display().to_string(),
-                    message: "backup meta missing path".to_string(),
-                })?;
-            let key = PathBuf::from(path_str);
-            if !is_loadable_backup_path(&key, &path_dir) {
-                continue;
-            }
-            let count = meta_entry_count(&meta).ok_or_else(|| AftError::IoError {
-                path: meta_path.display().to_string(),
-                message: "backup meta missing entry count".to_string(),
-            })?;
-            if count > 0 {
-                per_session.insert(
-                    key,
-                    DiskMeta {
-                        dir: path_dir,
-                        count,
-                    },
-                );
-            }
+            examined: Arc::clone(&self.discovery_entries_examined),
         }
+    }
 
-        Ok(per_session)
+    /// Copy what a status push needs to count `session`'s tracked files, so the
+    /// directory pass can run after the caller drops this store's mutex. The
+    /// count equals `tracked_files(session).len()`; see `StatusInventory`.
+    pub(crate) fn status_inventory(&self, session: &str) -> StatusInventory {
+        StatusInventory {
+            session: session.to_string(),
+            resident: self.cached_tracked_files(session),
+            session_dir: self.session_dir(session),
+            limits: self.discovery_limits(BackupIoBudget::request()),
+            caches: Arc::clone(&self.status_meta_caches),
+        }
     }
 
     fn restore_operation_candidate_keys(
@@ -5844,6 +5812,13 @@ fn check_backup_meta_format(
             .and_then(|bytes| serde_json::from_slice::<serde_json::Value>(&bytes).ok())
             .and_then(|meta| meta.get("schema_version")?.as_u64()),
     };
+    check_backup_meta_version(meta_path, version)
+}
+
+fn check_backup_meta_version(
+    meta_path: &Path,
+    version: Option<u64>,
+) -> Result<(), crate::persisted_format::UnsupportedPersistedFormat> {
     crate::persisted_format::gate(
         crate::persisted_format::PersistedStore::BackupMeta,
         meta_path,
diff --git a/crates/aft/src/backup/status_inventory.rs b/crates/aft/src/backup/status_inventory.rs
new file mode 100644
index 0000000000..ff0db63c4d
--- /dev/null
+++ b/crates/aft/src/backup/status_inventory.rs
@@ -0,0 +1,379 @@
+//! Durable undo-stack discovery, and the tracked-file count that status pushes
+//! read without holding the `BackupStore` mutex.
+//!
+//! A session's tracked files are the union of the stacks this process holds in
+//! memory and every loadable, non-empty stack whose `meta.json` sits in the
+//! session's backup directory. [`discover_session_stacks`] is the one
+//! implementation of that directory pass. Restore points and explicit status
+//! run it with a fresh read of every `meta.json`.
+//!
+//! A status push runs often (about once a second per busy root) and only needs
+//! the count. Reading and parsing every `meta.json` on each push costs
+//! milliseconds per hundred stacks, and the push used to do it while holding the
+//! store mutex that every edit needs. [`StatusInventory`] copies the resident
+//! keys under that mutex and runs the pass after the caller drops it. The pass
+//! keeps what it parsed from each `meta.json` and re-reads a file only when its
+//! stamp (file identity, size and modification time) differs from the stamp the
+//! parse was taken from. Writers always publish `meta.json` by renaming a fresh
+//! temporary file over it, so every rewrite changes the file identity even when
+//! the size and modification time stay the same. Every pass still refuses a
+//! `meta.json` that is a hard link to an open SQLite database file, exactly as
+//! a full read would. The format gate, whose storage-root resolution is the
+//! most expensive step of the whole pass, runs fully for each newly parsed file
+//! and again only when its outcome could have changed; see the comment where it
+//! is called. The count is therefore the one the full discovery would report.
+
+use super::{
+    check_backup_meta_version, is_loadable_backup_path, meta_entry_count, refuse_live_history_file,
+    AftError, BackupIoBudget, DiskMeta,
+};
+use crate::file_identity::FileIdentity;
+use crate::persisted_format::{PersistedStore, UnsupportedPersistedFormat};
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+#[cfg(test)]
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc,
+};
+use std::time::SystemTime;
+
+/// How far one discovery pass may go before it gives up. A pass that stops
+/// early fails instead of returning the stacks it saw so far.
+pub(super) struct DiscoveryLimits {
+    pub(super) budget: BackupIoBudget,
+    pub(super) entry_limit: usize,
+    #[cfg(test)]
+    pub(super) examined: Arc<AtomicU64>,
+}
+
+/// The fields of one `meta.json` that discovery decides with.
+#[derive(Debug, Clone)]
+struct ParsedStackMeta {
+    schema_version: Option<u64>,
+    /// The recorded path, and whether it hashes to the stack directory's name
+    /// (a pure function of the two, so it is decided once per parse).
+    path: Option<(String, bool)>,
+    count: Option<usize>,
+}
+
+impl ParsedStackMeta {
+    /// The caller has already refused live-database aliases for `meta_path`.
+    fn read(meta_path: &Path, path_dir: &Path) -> Result<Self, AftError> {
+        let io_error = |message: String| AftError::IoError {
+            path: meta_path.display().to_string(),
+            message,
+        };
+        let content =
+            std::fs::read_to_string(meta_path).map_err(|error| io_error(error.to_string()))?;
+        let meta = serde_json::from_str::<serde_json::Value>(&content)
+            .map_err(|error| io_error(error.to_string()))?;
+        Ok(Self {
+            schema_version: meta
+                .get("schema_version")
+                .and_then(serde_json::Value::as_u64),
+            path: meta
+                .get("path")
+                .and_then(serde_json::Value::as_str)
+                .map(|path| {
+                    let loadable = is_loadable_backup_path(Path::new(path), path_dir);
+                    (path.to_string(), loadable)
+                }),
+            count: meta_entry_count(&meta),
+        })
+    }
+}
+
+/// Identifies one published version of a `meta.json`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct MetaStamp {
+    identity: FileIdentity,
+    len: u64,
+    modified: Option<SystemTime>,
+}
+
+#[derive(Debug)]
+struct CachedStackMeta {
+    stamp: MetaStamp,
+    meta: ParsedStackMeta,
+}
+
+/// Parsed `meta.json` fields for one session directory, keyed by stack
+/// directory. It holds only entries seen by the latest pass, so it never grows
+/// past the directory's own size.
+#[derive(Debug, Default)]
+pub(super) struct SessionMetaCache {
+    dir: PathBuf,
+    stacks: HashMap<PathBuf, CachedStackMeta>,
+    #[cfg(test)]
+    parses: u64,
+}
+
+#[derive(Debug, Default)]
+struct CacheState {
+    /// Bumped whenever memory is released, so a pass that started before the
+    /// release does not put its cache back afterwards.
+    epoch: u64,
+    sessions: HashMap<String, SessionMetaCache>,
+}
+
+/// Status-push metadata caches for every session of one store. It has its own
+/// lock, which is held only to take a session's cache out or put it back, never
+/// during a directory pass.
+#[derive(Debug, Default)]
+pub(super) struct StatusMetaCaches {
+    state: Mutex<CacheState>,
+    #[cfg(test)]
+    parses: AtomicU64,
+}
+
+impl StatusMetaCaches {
+    pub(super) fn take(&self, session: &str, dir: &Path) -> (u64, SessionMetaCache) {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let cache = state
+            .sessions
+            .remove(session)
+            .filter(|cache| cache.dir == dir)
+            .unwrap_or_else(|| SessionMetaCache {
+                dir: dir.to_path_buf(),
+                ..SessionMetaCache::default()
+            });
+        (state.epoch, cache)
+    }
+
+    pub(super) fn put_back(&self, session: &str, epoch: u64, cache: SessionMetaCache) {
+        #[cfg(test)]
+        let cache = {
+            let mut cache = cache;
+            self.parses
+                .fetch_add(std::mem::take(&mut cache.parses), Ordering::Relaxed);
+            cache
+        };
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if state.epoch == epoch {
+            state.sessions.insert(session.to_string(), cache);
+        }
+    }
+
+    pub(super) fn release_session(&self, session: &str) {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        state.epoch += 1;
+        state.sessions.remove(session);
+    }
+
+    pub(super) fn release_all(&self) {
+        let mut state = self
+            .state
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        state.epoch += 1;
+        state.sessions.clear();
+    }
+
+    #[cfg(test)]
+    pub(super) fn parses(&self) -> u64 {
+        self.parses.load(Ordering::Relaxed)
+    }
+
+    #[cfg(test)]
+    pub(super) fn cached_stacks(&self, session: &str) -> usize {
+        self.state
+            .lock()
+            .unwrap()
+            .sessions
+            .get(session)
+            .map_or(0, |cache| cache.stacks.len())
+    }
+}
+
+/// Everything a status push needs to count one session's tracked files,
+/// copied out of the store so the directory pass runs without its mutex.
+pub(crate) struct StatusInventory {
+    pub(super) session: String,
+    pub(super) resident: HashSet<PathBuf>,
+    pub(super) session_dir: Option<PathBuf>,
+    pub(super) limits: DiscoveryLimits,
+    pub(super) caches: std::sync::Arc<StatusMetaCaches>,
+}
+
+impl StatusInventory {
+    /// Equal to `BackupStore::tracked_files(session).len()` at the moment the
+    /// inventory was taken, except that a stack written or removed by this
+    /// process while the pass runs may already be reflected in the directory
+    /// half: a stack removed after the copy still counts once through the
+    /// resident keys, and the next push no longer sees it. As with
+    /// `tracked_files`, a failed pass is logged and only the resident keys
+    /// count.
+    pub(crate) fn tracked_file_count(self) -> usize {
+        let mut files = self.resident;
+        let discovered = match &self.session_dir {
+            None => Ok(HashMap::new()),
+            Some(dir) => {
+                let (epoch, mut cache) = self.caches.take(&self.session, dir);
+                let result = discover_session_stacks(dir, &self.limits, Some(&mut cache));
+                self.caches.put_back(&self.session, epoch, cache);
+                result
+            }
+        };
+        match discovered {
+            Ok(stacks) => files.extend(stacks.into_keys()),
+            Err(error) => crate::slog_warn!(
+                "backup path discovery failed for session {}: {error}",
+                self.session
+            ),
+        }
+        files.len()
+    }
+}
+
+/// Discover every loadable, non-empty stack in `session_dir`. Any entry that
+/// cannot be read or understood fails the whole pass: an incomplete scan must
+/// never certify that history is absent. With `cache`, unchanged `meta.json`
+/// files are not read again, and the cache afterwards holds exactly the stacks
+/// this pass reached.
+pub(super) fn discover_session_stacks(
+    session_dir: &Path,
+    limits: &DiscoveryLimits,
+    mut cache: Option<&mut SessionMetaCache>,
+) -> Result<HashMap<PathBuf, DiskMeta>, AftError> {
+    let mut previous = cache
+        .as_deref_mut()
+        .map(|cache| std::mem::take(&mut cache.stacks))
+        .unwrap_or_default();
+    let mut reached = HashMap::new();
+    let result = discover_into(session_dir, limits, &mut previous, &mut reached, &mut cache);
+    if let Some(cache) = cache {
+        cache.stacks = reached;
+    }
+    result
+}
+
+fn discover_into(
+    session_dir: &Path,
+    limits: &DiscoveryLimits,
+    previous: &mut HashMap<PathBuf, CachedStackMeta>,
+    reached: &mut HashMap<PathBuf, CachedStackMeta>,
+    cache: &mut Option<&mut SessionMetaCache>,
+) -> Result<HashMap<PathBuf, DiskMeta>, AftError> {
+    if !session_dir.exists() {
+        return Ok(HashMap::new());
+    }
+    let session_error = |message: String| AftError::IoError {
+        path: session_dir.display().to_string(),
+        message,
+    };
+    let mut path_dirs =
+        std::fs::read_dir(session_dir).map_err(|error| session_error(error.to_string()))?;
+    let mut per_session = HashMap::new();
+    let mut examined = 0;
+    loop {
+        // Check before advancing ReadDir, including entries that will be
+        // ignored. An incomplete scan must never certify absent history.
+        limits.budget.check(session_dir)?;
+        if examined >= limits.entry_limit {
+            return Err(session_error(format!(
+                "backup stack discovery reached its {}-entry limit; use per-file undo or retry",
+                limits.entry_limit
+            )));
+        }
+        let Some(path_entry) = path_dirs.next() else {
+            break;
+        };
+        examined += 1;
+        #[cfg(test)]
+        limits.examined.fetch_add(1, Ordering::Relaxed);
+        let path_entry = path_entry.map_err(|error| session_error(error.to_string()))?;
+        let path_dir = path_entry.path();
+        let meta_path = path_dir.join("meta.json");
+        // A stack is a directory holding `meta.json`. The stat fails for any
+        // other entry, including files such as `session.json` and directories
+        // without metadata such as `.locks`, which therefore hold no stack.
+        let Ok((stat, identity)) = crate::file_identity::metadata(&meta_path) else {
+            continue;
+        };
+        let meta_error = |message: String| AftError::IoError {
+            path: meta_path.display().to_string(),
+            message,
+        };
+        refuse_live_history_file(&meta_path).map_err(|error| meta_error(error.to_string()))?;
+        // `fresh` is false only when this exact published file was parsed and
+        // fully gated by an earlier pass.
+        let (meta, fresh) = match cache.as_deref_mut() {
+            None => (ParsedStackMeta::read(&meta_path, &path_dir)?, true),
+            Some(cache) => {
+                let stamp = MetaStamp {
+                    identity,
+                    len: stat.len(),
+                    modified: stat.modified().ok(),
+                };
+                let cached = previous
+                    .remove(&path_dir)
+                    .filter(|cached| cached.stamp == stamp);
+                let (cached, fresh) = match cached {
+                    Some(cached) => (cached, false),
+                    None => {
+                        #[cfg(test)]
+                        {
+                            cache.parses += 1;
+                        }
+                        #[cfg(not(test))]
+                        let _ = cache;
+                        let meta = ParsedStackMeta::read(&meta_path, &path_dir)?;
+                        (CachedStackMeta { stamp, meta }, true)
+                    }
+                };
+                let meta = cached.meta.clone();
+                reached.insert(path_dir.clone(), cached);
+                (meta, fresh)
+            }
+        };
+        // The full format gate resolves which storage root owns the file,
+        // which costs far more than everything else here. For a file an
+        // earlier pass already gated, the outcome can differ only through a
+        // reader-floor refusal recorded since (checked here process-wide) or a
+        // version this build does not read (a pure check). Its other effect,
+        // forgetting a stale refusal recorded for this file, already happened
+        // when the file was first gated, and a refusal is only ever recorded
+        // for a file whose own version is too new.
+        let regate = fresh
+            || crate::persisted_format::has_floor_refusal(PersistedStore::BackupMeta)
+            || meta.schema_version.is_some_and(|version| {
+                UnsupportedPersistedFormat::check(PersistedStore::BackupMeta, &meta_path, version)
+                    .is_some()
+            });
+        if regate {
+            check_backup_meta_version(&meta_path, meta.schema_version)
+                .map_err(|refusal| meta_error(refusal.to_string()))?;
+        }
+        let (path_str, loadable) = meta
+            .path
+            .ok_or_else(|| meta_error("backup meta missing path".to_string()))?;
+        if !loadable {
+            continue;
+        }
+        let key = PathBuf::from(path_str);
+        let count = meta
+            .count
+            .ok_or_else(|| meta_error("backup meta missing entry count".to_string()))?;
+        if count > 0 {
+            per_session.insert(
+                key,
+                DiskMeta {
+                    dir: path_dir,
+                    count,
+                },
+            );
+        }
+    }
+    Ok(per_session)
+}
diff --git a/crates/aft/src/backup/status_inventory_tests.rs b/crates/aft/src/backup/status_inventory_tests.rs
new file mode 100644
index 0000000000..a4bda2787c
--- /dev/null
+++ b/crates/aft/src/backup/status_inventory_tests.rs
@@ -0,0 +1,334 @@
+//! A status push's tracked-file count must equal `tracked_files().len()` in
+//! every state the store passes through, while re-reading only `meta.json`
+//! files that changed since the previous push.
+
+use super::*;
+use std::fs;
+
+const SESSION: &str = "status-inventory";
+
+fn store_with_files(count: usize) -> (BackupStore, tempfile::TempDir, Vec<PathBuf>) {
+    let temp = tempfile::tempdir().unwrap();
+    let project = temp.path().join("project");
+    fs::create_dir(&project).unwrap();
+    let paths = (0..count)
+        .map(|index| {
+            let path = project.join(format!("file_{index}.txt"));
+            fs::write(&path, format!("original {index}")).unwrap();
+            path
+        })
+        .collect();
+    let mut store = BackupStore::new();
+    store.set_storage_dir(temp.path().join("storage"), 72);
+    (store, temp, paths)
+}
+
+fn meta_path(store: &BackupStore, session: &str, path: &Path) -> PathBuf {
+    store
+        .session_dir(session)
+        .unwrap()
+        .join(BackupStore::path_hash(&canonicalize_key(path)))
+        .join("meta.json")
+}
+
+/// Assert that the push count equals today's count both with the store's
+/// resident stacks and after they are released, and return the count.
+fn assert_matches_tracked_files(store: &mut BackupStore, session: &str, step: &str) -> usize {
+    let expected = store.tracked_files(session).len();
+    let pushed = store.status_inventory(session).tracked_file_count();
+    assert_eq!(pushed, expected, "resident count differs after {step}");
+    // A second push serves unchanged metadata from the cache.
+    let pushed = store.status_inventory(session).tracked_file_count();
+    assert_eq!(pushed, expected, "cached count differs after {step}");
+    store.release_session_memory(session);
+    let released = store.tracked_files(session).len();
+    let pushed = store.status_inventory(session).tracked_file_count();
+    assert_eq!(pushed, released, "released count differs after {step}");
+    expected
+}
+
+#[test]
+fn status_inventory_count_matches_tracked_files_through_store_lifecycle() {
+    let (mut store, _temp, paths) = store_with_files(5);
+
+    for path in &paths[..3] {
+        store.snapshot(SESSION, path, "create").unwrap();
+    }
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "create"),
+        3
+    );
+
+    store.restore_latest(SESSION, &paths[0]).unwrap();
+    assert_eq!(assert_matches_tracked_files(&mut store, SESSION, "undo"), 2);
+    // The cache keeps only stacks the latest pass reached.
+    assert_eq!(store.status_meta_caches.cached_stacks(SESSION), 2);
+
+    store
+        .snapshot_with_op(SESSION, &paths[3], "rolled back", Some("bad"))
+        .unwrap();
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "operation snapshot"),
+        3
+    );
+    store.discard_operation_entries(SESSION, "bad");
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "discard"),
+        2
+    );
+
+    // Two entries on one stack, then pruning to depth one rewrites its
+    // metadata; pruning to depth zero leaves empty metadata behind, which the
+    // directory pass excludes while the store still lists the key it indexed.
+    store.snapshot(SESSION, &paths[1], "second entry").unwrap();
+    store.set_policy(BackupPolicy {
+        max_depth: 1,
+        ..store.policy()
+    });
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "policy pruning"),
+        2
+    );
+    store
+        .snapshot(SESSION, &paths[4], "before empty pruning")
+        .unwrap();
+    store.set_policy(BackupPolicy {
+        max_depth: 0,
+        ..store.policy()
+    });
+    assert_matches_tracked_files(&mut store, SESSION, "pruning to depth zero");
+    store.set_policy(BackupPolicy {
+        max_depth: DEFAULT_MAX_UNDO_DEPTH,
+        ..store.policy()
+    });
+
+    for path in &paths {
+        store.snapshot(SESSION, path, "refill").unwrap();
+    }
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "refill"),
+        5
+    );
+
+    let shared = parking_lot::Mutex::new(store);
+    purge::purge_session_path(&shared, SESSION, &paths[2], |_| None).unwrap();
+    let mut store = shared.into_inner();
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "purge"),
+        4
+    );
+
+    // A corrupt metadata file fails discovery, and both counts fall back to the
+    // resident keys.
+    fs::write(meta_path(&store, SESSION, &paths[1]), b"{ not json").unwrap();
+    store.snapshot(SESSION, &paths[0], "resident").unwrap();
+    assert_eq!(store.tracked_files(SESSION).len(), 1);
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "corrupt metadata"),
+        1
+    );
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 0);
+}
+
+#[test]
+fn status_inventory_count_matches_tracked_files_after_import() {
+    use crate::agent_data::{ExpectedState, FileRecord, SnapshotGroup};
+    let temp = tempfile::tempdir().unwrap();
+    let paths = ["native.txt", "imported.txt"].map(|name| {
+        let path = temp.path().join(name);
+        fs::write(&path, name).unwrap();
+        path
+    });
+    // Imported history raises the storage root's reader floor, which needs a
+    // prepared root, as in the portable-import format tests.
+    let storage = temp.path().join("store");
+    create_private_dir_all(&storage).unwrap();
+    assert!(crate::reader_floor::prepare(&storage).is_empty());
+    let mut store = BackupStore::new();
+    store.set_storage_dir_for_harness(storage, crate::harness::Harness::Pi, 0);
+    store.snapshot(SESSION, &paths[0], "native").unwrap();
+    let key = crate::agent_data::registry::PortablePath {
+        project_id: "fixture-project".into(),
+        root_key: cortexkit_project_identity::RootKey::new(
+            cortexkit_project_identity::RootKeyKind::Label,
+            "fixture".into(),
+        ),
+        relative_path: "imported.txt".into(),
+    };
+    let group = SnapshotGroup::Undo {
+        id: "imported-operation".into(),
+        files: vec![FileRecord {
+            path: key,
+            id: "imported-entry".into(),
+            order: 1,
+            timestamp: 1,
+            mode: None,
+            before: Some(b"before".to_vec()),
+            expected: ExpectedState::capture(&paths[1]).unwrap(),
+        }],
+    };
+    store
+        .install_portable_undo(SESSION, &[(group, vec![paths[1].clone()])])
+        .unwrap();
+    // Import replaces the resident map with the imported stacks, while the
+    // native stack stays on disk.
+    assert_eq!(
+        assert_matches_tracked_files(&mut store, SESSION, "import"),
+        2
+    );
+}
+
+#[test]
+fn status_inventory_rereads_metadata_replaced_with_same_size_and_mtime() {
+    let (mut store, _temp, paths) = store_with_files(1);
+    store.snapshot(SESSION, &paths[0], "create").unwrap();
+    store.release_session_memory(SESSION);
+    let parses = store.status_meta_parses_for_test();
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 1);
+    assert_eq!(store.status_meta_parses_for_test(), parses + 1);
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 1);
+    assert_eq!(
+        store.status_meta_parses_for_test(),
+        parses + 1,
+        "unchanged metadata must come from the cache"
+    );
+
+    // Publish metadata naming a different path of the same length, exactly as
+    // writers do (a temporary file renamed over the old one), with the old
+    // size and modification time. The new path does not hash to the stack's
+    // directory name, so the stack no longer counts.
+    let meta = meta_path(&store, SESSION, &paths[0]);
+    let before = fs::metadata(&meta).unwrap();
+    let original = fs::canonicalize(&paths[0]).unwrap().display().to_string();
+    let renamed = format!("{}x", &original[..original.len() - 1]);
+    let mut value: serde_json::Value =
+        serde_json::from_str(&fs::read_to_string(&meta).unwrap()).unwrap();
+    assert_eq!(value["path"], original.as_str());
+    value["path"] = renamed.into();
+    let content = serde_json::to_string_pretty(&value).unwrap();
+    assert_eq!(content.len() as u64, before.len());
+    let temp = meta.with_file_name("meta.json.tmp");
+    fs::write(&temp, &content).unwrap();
+    filetime::set_file_mtime(
+        &temp,
+        filetime::FileTime::from_last_modification_time(&before),
+    )
+    .unwrap();
+    fs::rename(&temp, &meta).unwrap();
+    let after = fs::metadata(&meta).unwrap();
+    assert_eq!(after.len(), before.len());
+    assert_eq!(after.modified().unwrap(), before.modified().unwrap());
+
+    assert_eq!(store.tracked_files(SESSION).len(), 0);
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 0);
+    assert_eq!(store.status_meta_parses_for_test(), parses + 2);
+}
+
+#[test]
+fn status_inventory_regates_cached_metadata_after_a_reader_floor_refusal() {
+    use crate::persisted_format::{self, PersistedStore, UnsupportedPersistedFormat};
+    let (mut store, temp, paths) = store_with_files(2);
+    for path in &paths {
+        store.snapshot(SESSION, path, "create").unwrap();
+    }
+    store.release_session_memory(SESSION);
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 2);
+    let parses = store.status_meta_parses_for_test();
+
+    // A newer build raised this storage root's reader floor for backup
+    // metadata. Discovery now fails, and both counts fall back to the
+    // (released, so empty) resident keys even though no file changed.
+    let storage = temp.path().join("storage");
+    let refusal = UnsupportedPersistedFormat::floor(
+        PersistedStore::BackupMeta,
+        storage.join("reader-floor.json"),
+        999,
+    );
+    persisted_format::record(&refusal, &storage);
+    let refused = (
+        store.tracked_files(SESSION).len(),
+        store.status_inventory(SESSION).tracked_file_count(),
+    );
+    persisted_format::replace_floor_refusals(&storage, &[]);
+    assert_eq!(refused, (0, 0));
+    assert_eq!(store.status_meta_parses_for_test(), parses);
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 2);
+}
+
+#[test]
+fn status_inventory_cache_is_freed_with_session_memory() {
+    let (mut store, _temp, paths) = store_with_files(2);
+    for path in &paths {
+        store.snapshot(SESSION, path, "create").unwrap();
+    }
+    assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 2);
+    assert_eq!(store.status_meta_caches.cached_stacks(SESSION), 2);
+
+    // A pass that started before the release must not put its cache back.
+    let inventory = store.status_inventory(SESSION);
+    store.release_session_memory(SESSION);
+    assert_eq!(store.status_meta_caches.cached_stacks(SESSION), 0);
+    let caches = Arc::clone(&store.status_meta_caches);
+    let (epoch, cache) = caches.take(SESSION, inventory.session_dir.as_deref().unwrap());
+    store.release_memory();
+    caches.put_back(SESSION, epoch, cache);
+    assert_eq!(caches.cached_stacks(SESSION), 0);
+    assert_eq!(inventory.tracked_file_count(), 2);
+}
+
+/// Splits the warm status-inventory pass into its per-stack checks, to show
+/// which one dominates the push cost.
+#[test]
+#[ignore = "manual status inventory component cost probe"]
+fn status_inventory_component_cost_probe() {
+    use crate::run_tool_call::ThreadCpuSample;
+    let (mut store, _temp, paths) = store_with_files(256);
+    for path in &paths {
+        store.snapshot(SESSION, path, "probe").unwrap();
+    }
+    store.release_session_memory(SESSION);
+    let metas = paths
+        .iter()
+        .map(|path| meta_path(&store, SESSION, path))
+        .collect::<Vec<_>>();
+    let version = Some(u64::from(ORDINARY_SCHEMA_VERSION));
+    let session_dir = store.session_dir(SESSION).unwrap();
+    let measure = |label: &str, f: &dyn Fn()| {
+        let start = ThreadCpuSample::now();
+        for _ in 0..50 {
+            f();
+        }
+        let cpu = ThreadCpuSample::elapsed(start, ThreadCpuSample::now()).unwrap();
+        eprintln!("{label}: 256 stacks, CPU/pass={:?}", cpu / 50);
+    };
+    measure("read_dir only", &|| {
+        std::hint::black_box(fs::read_dir(&session_dir).unwrap().count());
+    });
+    measure("file_identity::metadata", &|| {
+        for meta in &metas {
+            std::hint::black_box(crate::file_identity::metadata(meta).unwrap());
+        }
+    });
+    measure("refuse_live_history_file", &|| {
+        for meta in &metas {
+            refuse_live_history_file(meta).unwrap();
+        }
+    });
+    measure("check_backup_meta_version", &|| {
+        for meta in &metas {
+            check_backup_meta_version(meta, version).unwrap();
+        }
+    });
+    measure("is_loadable_backup_path", &|| {
+        for (path, meta) in paths.iter().zip(&metas) {
+            assert!(is_loadable_backup_path(
+                &canonicalize_key(path),
+                meta.parent().unwrap()
+            ));
+        }
+    });
+    store.status_inventory(SESSION).tracked_file_count();
+    measure("whole warm pass", &|| {
+        assert_eq!(store.status_inventory(SESSION).tracked_file_count(), 256);
+    });
+}
diff --git a/crates/aft/src/bash_background/kill_survivor_tests.rs b/crates/aft/src/bash_background/kill_survivor_tests.rs
index 5ef0460d57..297e48cc5d 100644
--- a/crates/aft/src/bash_background/kill_survivor_tests.rs
+++ b/crates/aft/src/bash_background/kill_survivor_tests.rs
@@ -212,7 +212,10 @@ fn bash_kill_of_a_finished_task_names_what_survived_it() {
     let task_id = spawn_for_kill(
         &registry,
         dir.path(),
-        "(trap '' TERM; touch ready; exec sleep 30) & while [ ! -f ready ]; do sleep 0.01; done",
+        &format!(
+            "(trap '' TERM; touch ready; exec sleep 30) & {}",
+            crate::test_gate::gate("ready", "sleep 0.01")
+        ),
     );
     wait_for_file(&dir.path().join("ready"), "the command did not start");
     let pgid = task_pgid(&registry, &task_id);
@@ -446,7 +449,7 @@ fn finish_leaving_a_survivor(
         dir,
         // Write the pid to a temp file and rename it, so the reader never sees
         // the file between its creation and the write (an empty read failed once).
-        "sh -c 'trap \"\" TERM; echo $$ > survivor.pid.tmp && mv survivor.pid.tmp survivor.pid; exec sleep 30' & while [ ! -f go ]; do sleep 0.01; done",
+        &format!("sh -c 'trap \"\" TERM; echo $$ > survivor.pid.tmp && mv survivor.pid.tmp survivor.pid; exec sleep 30' & {}", crate::test_gate::gate("go", "sleep 0.01")),
     );
     wait_for_file(&dir.join("survivor.pid"), "the survivor did not start");
     let survivor = std::fs::read_to_string(dir.join("survivor.pid"))
diff --git a/crates/aft/src/bash_background/metadata_persistence_test.rs b/crates/aft/src/bash_background/metadata_persistence_test.rs
index e53d53b8b8..807dbcde03 100644
--- a/crates/aft/src/bash_background/metadata_persistence_test.rs
+++ b/crates/aft/src/bash_background/metadata_persistence_test.rs
@@ -122,6 +122,8 @@ fn metadata_persistence_equal_checkpoint_keeps_durability_upgrade() {
     let storage = tempfile::tempdir().unwrap();
     let task = allocate_task_layout(storage.path(), "metadata-persistence").unwrap();
     let metadata = metadata(&task);
+    let _owner =
+        super::super::registry::DbWriteOrder::for_task(&metadata.session_id, &metadata.task_id);
     write_task_at_with(&task, &metadata, ReplaceSync::File).unwrap();
     work_counts::reset();
     write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
@@ -132,6 +134,89 @@ fn metadata_persistence_equal_checkpoint_keeps_durability_upgrade() {
         counts.syncs, 2,
         "equal bytes must not elide a durability upgrade"
     );
+    work_counts::reset();
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(work_counts::get().syncs, 0);
+}
+
+#[test]
+fn metadata_persistence_changed_checkpoint_invalidates_durable_memo() {
+    let storage = tempfile::tempdir().unwrap();
+    let task = allocate_task_layout(storage.path(), "metadata-persistence").unwrap();
+    let mut metadata = metadata(&task);
+    let _owner =
+        super::super::registry::DbWriteOrder::for_task(&metadata.session_id, &metadata.task_id);
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    let original = metadata.clone();
+    metadata.command.push_str(" checkpoint");
+    write_task_at_with(&task, &metadata, ReplaceSync::File).unwrap();
+    write_task_at_with(&task, &original, ReplaceSync::File).unwrap();
+    work_counts::reset();
+    write_task_at_with(&task, &original, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(work_counts::get().syncs, 2);
+    assert_eq!(work_counts::get().renames, 0);
+}
+
+#[test]
+fn metadata_persistence_durable_memo_observes_other_writers_and_directories() {
+    let storage = tempfile::tempdir().unwrap();
+    let task = allocate_task_layout(storage.path(), "metadata-persistence").unwrap();
+    let metadata = metadata(&task);
+    let _owner =
+        super::super::registry::DbWriteOrder::for_task(&metadata.session_id, &metadata.task_id);
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    let mut acknowledged = metadata.clone();
+    acknowledged.completion_delivered = true;
+    write_task_at_with(&task, &acknowledged, ReplaceSync::FileAndDirectory).unwrap();
+    work_counts::reset();
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(work_counts::get().renames, 1);
+    assert_eq!(work_counts::get().syncs, 2);
+
+    let other_storage = tempfile::tempdir().unwrap();
+    let other = create_task_layout(
+        other_storage.path(),
+        &metadata.session_id,
+        &metadata.task_id,
+    )
+    .unwrap();
+    // An equal file in a different store has not inherited this directory's sync.
+    write_task_at_with(&other, &metadata, ReplaceSync::File).unwrap();
+    work_counts::reset();
+    write_task_at_with(&other, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(work_counts::get().renames, 0);
+    assert_eq!(work_counts::get().syncs, 2);
+}
+
+#[test]
+fn metadata_persistence_failed_directory_sync_does_not_seed_memo() {
+    let storage = tempfile::tempdir().unwrap();
+    let task = allocate_task_layout(storage.path(), "metadata-persistence").unwrap();
+    let mut metadata = metadata(&task);
+    let owner =
+        super::super::registry::DbWriteOrder::for_task(&metadata.session_id, &metadata.task_id);
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    metadata.command.push_str(" changed");
+    with_task_io_fault(TaskIoFault::SyncFailureAfter(1), || {
+        write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory)
+    })
+    .unwrap_err();
+    work_counts::reset();
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(
+        work_counts::get().syncs,
+        2,
+        "retry must finish the failed directory sync"
+    );
+    assert_eq!(work_counts::get().renames, 0);
+    drop(owner);
+    work_counts::reset();
+    write_task_at_with(&task, &metadata, ReplaceSync::FileAndDirectory).unwrap();
+    assert_eq!(
+        work_counts::get().syncs,
+        2,
+        "an unowned record has no durability memo"
+    );
 }
 
 #[test]
@@ -140,6 +225,8 @@ fn metadata_persistence_shortcut_sync_failure_retries_durable_replacement() {
         let storage = tempfile::tempdir().unwrap();
         let task = allocate_task_layout(storage.path(), "metadata-persistence").unwrap();
         let metadata = metadata(&task);
+        let _owner =
+            super::super::registry::DbWriteOrder::for_task(&metadata.session_id, &metadata.task_id);
         write_task_at_with(&task, &metadata, ReplaceSync::File).unwrap();
         work_counts::reset();
         with_task_io_fault(TaskIoFault::SyncFailureAfter(failed_sync), || {
diff --git a/crates/aft/src/bash_background/mod.rs b/crates/aft/src/bash_background/mod.rs
index 592f6599db..47bd672352 100644
--- a/crates/aft/src/bash_background/mod.rs
+++ b/crates/aft/src/bash_background/mod.rs
@@ -1100,6 +1100,8 @@ pub struct BgTaskInfo {
     pub status_reason: Option<String>,
 }
 
+pub(crate) const PTY_EXIT_STATUS_UNKNOWN_REASON: &str = "AFT could not read how it ended";
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum BgTaskStatus {
@@ -2654,7 +2656,7 @@ mod legacy_root_task_repair_tests {
         let mut command = Command::new("/bin/sh");
         command.args([
             "-c",
-            "printf before; while ! test -f \"$1\"; do sleep 0.02; done; printf after; printf error-after >&2; printf 37 > \"$2\"; exit 37",
+            &format!("printf before; {}; printf after; printf error-after >&2; printf 37 > \"$2\"; exit 37", crate::test_gate::gate("\"$1\"", "sleep 0.02")),
             "legacy-writer",
         ]);
         command.arg(&release).arg(&task.paths.exit);
diff --git a/crates/aft/src/bash_background/persistence.rs b/crates/aft/src/bash_background/persistence.rs
index 7428fe11b5..c2f4b9c586 100644
--- a/crates/aft/src/bash_background/persistence.rs
+++ b/crates/aft/src/bash_background/persistence.rs
@@ -634,7 +634,7 @@ impl PinnedDir {
     pub(crate) fn repair_sync(&self) -> io::Result<()> {
         #[cfg(unix)]
         {
-            self.file.sync_all()?;
+            aft_store::sync::sync_all(&self.file, &self.path)?;
         }
         Ok(())
     }
@@ -1968,6 +1968,7 @@ fn is_zero(value: &usize) -> bool {
 pub enum ExitMarker {
     Code(i32),
     Killed,
+    Unknown,
 }
 
 impl PersistedTask {
@@ -3100,6 +3101,14 @@ enum ReplaceSync {
     FileAndDirectory,
 }
 
+/// Kept only while a registry owns the task. The file is still compared on
+/// every request: another registry can replace or acknowledge its metadata.
+pub(super) struct MetadataSync {
+    directory: DirectoryIdentity,
+    content: Vec<u8>,
+    sync: ReplaceSync,
+}
+
 impl ReplaceSync {
     /// Remote tasks and local fallbacks of remote tasks resume from their
     /// metadata after a crash, so their records are written durably.
@@ -3154,27 +3163,67 @@ fn write_task_in_dir(
     let mut upgraded = task.clone();
     upgraded.schema_version = SCHEMA_VERSION;
     let content = serde_json::to_vec_pretty(&upgraded).map_err(io::Error::other)?;
-    if sync_unchanged_metadata(dir, name, &content, sync) {
+    let order = super::registry::DbWriteOrder::lookup(&task.session_id, &task.task_id);
+    let mut memo = order.as_ref().map(|order| {
+        order
+            .metadata_sync
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+    });
+    let directory = memo.as_ref().and_then(|_| dir.identity().ok());
+    let already_synced = memo
+        .as_deref()
+        .and_then(Option::as_ref)
+        .is_some_and(|saved| {
+            Some(&saved.directory) == directory.as_ref()
+                && saved.content == content
+                && (saved.sync == ReplaceSync::FileAndDirectory || saved.sync == sync)
+        });
+    if sync_unchanged_metadata(dir, name, &content, sync, already_synced) {
+        if !already_synced && sync != ReplaceSync::None {
+            if let (Some(memo), Some(directory)) = (memo.as_deref_mut(), directory) {
+                *memo = Some(MetadataSync {
+                    directory,
+                    content,
+                    sync,
+                });
+            }
+        }
         return Ok(());
     }
+    // A different replacement, or a failed shortcut sync, invalidates the old
+    // durability even if the replacement later fails after its rename.
+    if let Some(memo) = memo.as_deref_mut() {
+        *memo = None;
+    }
     #[cfg(test)]
     work_counts::record_metadata_write();
     super::gc_memo::metadata_written(&dir.path().join(name));
     let result = atomic_replace(dir, name, &content, sync);
     super::gc_memo::metadata_written(&dir.path().join(name));
+    if result.is_ok() && sync != ReplaceSync::None {
+        if let (Some(memo), Some(directory)) = (memo.as_deref_mut(), directory) {
+            *memo = Some(MetadataSync {
+                directory,
+                content,
+                sync,
+            });
+        }
+    }
     result
 }
 
 /// Compare the file, not an in-memory cache: another registry can acknowledge
 /// a completed task through the same pinned directory. Equal bytes need no
-/// replacement, but a durable state write must still sync an earlier checkpoint
-/// whose rename may not have reached disk yet. A failed shortcut sync falls
-/// back to replacement with the same durability requirements.
+/// replacement or repeated syncs, but a durable state write must still sync an
+/// earlier checkpoint whose rename may not have reached disk yet. A failed
+/// shortcut sync falls back to replacement with the same durability requirements.
 fn sync_unchanged_metadata(
     dir: &PinnedDir,
     name: &OsStr,
     content: &[u8],
     sync: ReplaceSync,
+    already_synced: bool,
 ) -> bool {
     let Ok(mut file) = dir.open_file(name, sync != ReplaceSync::None) else {
         // Missing, unreadable or non-regular metadata can still be replaced.
@@ -3187,7 +3236,10 @@ fn sync_unchanged_metadata(
     {
         return false;
     }
-    if sync != ReplaceSync::None && sync_task_file(&file).is_err() {
+    if already_synced {
+        return true;
+    }
+    if sync != ReplaceSync::None && sync_task_file(&file, &dir.path.join(name)).is_err() {
         return false;
     }
     if sync == ReplaceSync::FileAndDirectory && sync_task_directory(dir).is_err() {
@@ -4658,6 +4710,9 @@ pub(super) fn read_exit_marker_with_reason(
     if content == "killed" {
         return Ok(Some(ExitMarker::Killed));
     }
+    if content == "unknown" {
+        return Ok(Some(ExitMarker::Unknown));
+    }
     Ok(content.parse::<i32>().ok().map(ExitMarker::Code))
 }
 
@@ -4810,7 +4865,7 @@ pub fn randomized_atomic_replace(dir: &PinnedDir, name: &OsStr, content: &[u8])
     atomic_replace(dir, name, content, ReplaceSync::None)
 }
 
-pub(crate) fn sync_task_file(file: &File) -> io::Result<()> {
+pub(crate) fn sync_task_file(file: &File, path: &Path) -> io::Result<()> {
     #[cfg(test)]
     work_counts::record_sync();
     #[cfg(test)]
@@ -4832,7 +4887,7 @@ pub(crate) fn sync_task_file(file: &File) -> io::Result<()> {
     }
     #[cfg(test)]
     let started = std::time::Instant::now();
-    let result = file.sync_all();
+    let result = aft_store::sync::sync_all(file, path);
     #[cfg(test)]
     work_counts::record_sync_time(started.elapsed());
     result
@@ -4841,7 +4896,7 @@ pub(crate) fn sync_task_file(file: &File) -> io::Result<()> {
 fn sync_task_directory(dir: &PinnedDir) -> io::Result<()> {
     #[cfg(unix)]
     {
-        sync_task_file(&dir.file)
+        sync_task_file(&dir.file, &dir.path)
     }
     #[cfg(windows)]
     {
@@ -4865,7 +4920,7 @@ fn sync_task_directory(dir: &PinnedDir) -> io::Result<()> {
                 "pinned directory path identity changed",
             ));
         }
-        sync_task_file(&writable.file)?;
+        sync_task_file(&writable.file, &dir.path)?;
         dir.ensure_current_identity()
     }
 }
@@ -4886,7 +4941,7 @@ fn atomic_replace(
         let result = (|| {
             file.write_all(content)?;
             if sync != ReplaceSync::None {
-                sync_task_file(&file)?;
+                sync_task_file(&file, &dir.path.join(&temporary))?;
             }
             // Atomic replacement protects readers after a daemon kill. Task
             // history is mirrored in a weaker database and is not a durable log.
@@ -7183,6 +7238,18 @@ mod tests {
         assert_eq!(counts.parses, 1);
     }
 
+    #[test]
+    fn pty_unknown_exit_marker_round_trips() {
+        let storage = tempfile::tempdir().unwrap();
+        let (task, _) = counted_task(storage.path());
+        let mut handles = TaskIoHandles::create(&task, BgMode::Pty, false).unwrap();
+        handles.write(TaskArtifact::Exit, b"unknown").unwrap();
+        assert_eq!(
+            read_exit_marker(&task.paths).unwrap(),
+            Some(ExitMarker::Unknown)
+        );
+    }
+
     #[cfg(unix)]
     #[test]
     fn task_lifecycle_round_trips_payloads_and_metadata() {
diff --git a/crates/aft/src/bash_background/process.rs b/crates/aft/src/bash_background/process.rs
index 407647a4e3..672f6757c0 100644
--- a/crates/aft/src/bash_background/process.rs
+++ b/crates/aft/src/bash_background/process.rs
@@ -891,14 +891,46 @@ fn macos_pid_exists(pid: u32) -> bool {
 // 32-bit exit range, so neither this gate nor its marker interpretation is used there.
 pub(crate) const BOOTSTRAP_ABORTED_MARKER: i32 = i32::MIN;
 
+// Use shell builtins before user code, keeping the posix_spawn fast path. A
+// subshell here would adjust only itself, not the shell that launches the command.
+#[cfg(target_os = "linux")]
+macro_rules! shell_oom_priority {
+    ($init:literal) => {
+        concat!(
+            $init,
+            r#"if [ -n "$__aft_oom_failure" ]; then
+  { printf '%s' 1000 > /proc/self/oom_score_adj; } 2>/dev/null || :
+  __aft_oom_value=unreadable
+  { IFS= read -r __aft_oom_value < /proc/self/oom_score_adj; } 2>/dev/null || :
+  if [ "$__aft_oom_value" != 1000 ]; then
+    { printf '%s\n' "$__aft_oom_value" > "$__aft_oom_failure"; } 2>/dev/null || :
+  fi
+fi
+unset __aft_oom_failure __aft_oom_value
+"#
+        )
+    };
+}
+#[cfg(all(unix, not(target_os = "linux")))]
+macro_rules! shell_oom_priority {
+    ($init:literal) => {
+        ""
+    };
+}
+#[cfg(target_os = "linux")]
+pub(crate) use shell_oom_priority;
+
 #[cfg(unix)]
-pub(crate) const PAYLOAD_WRAPPER: &[u8] = br#"#!/bin/sh
+pub(crate) const PAYLOAD_WRAPPER: &[u8] = concat!(
+    r#"#!/bin/sh
 shell=$1
 command=$2
 exit_fd=$3
 pipeline_status_path=$4
 pipeline_shell=$5
-if [ "${6-}" = "wait-for-identity" ]; then
+"#,
+    shell_oom_priority!("__aft_oom_failure=${7-}\n"),
+    r#"if [ "${6-}" = "wait-for-identity" ]; then
   if ! IFS= read -r __aft_start || [ "$__aft_start" != "run" ]; then
     printf '%s' '-2147483648' >&"$exit_fd"
     exit 125
@@ -937,7 +969,9 @@ esac
 code=$?
 printf "%s" "$code" >&"$exit_fd"
 exit "$code"
-"#;
+"#
+)
+.as_bytes();
 
 #[cfg(unix)]
 pub(crate) fn pipeline_shell_kind(shell: &Path) -> Option<&'static str> {
@@ -966,6 +1000,42 @@ pub(crate) fn start_new_session(command: &mut std::process::Command) {
     }
 }
 
+#[cfg(target_os = "linux")]
+pub(crate) fn oom_priority_marker(scratch: Option<&Path>, io_dir: &Path) -> std::path::PathBuf {
+    scratch.unwrap_or(io_dir).join("oom-priority-failure")
+}
+
+#[cfg(target_os = "linux")]
+static OOM_PRIORITY_FAILURES: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
+#[cfg(target_os = "linux")]
+pub(crate) fn oom_priority_failures() -> u64 {
+    OOM_PRIORITY_FAILURES.load(std::sync::atomic::Ordering::Relaxed)
+}
+
+#[cfg(target_os = "linux")]
+pub(crate) fn observe_oom_priority_failure(marker: &Path) {
+    let Some(bytes) = crate::file_kind::read_head(marker, 16) else {
+        return;
+    };
+    // Removing the marker claims it even when terminal publication is retried.
+    if std::fs::remove_file(marker).is_err() {
+        return;
+    }
+    let value = std::str::from_utf8(&bytes)
+        .ok()
+        .and_then(|value| value.trim().parse::<i32>().ok())
+        .filter(|value| (-1000..=1000).contains(value));
+    if OOM_PRIORITY_FAILURES.fetch_add(1, std::sync::atomic::Ordering::Relaxed) == 0 {
+        crate::slog_warn!(
+            "Linux agent shell OOM priority could not be raised to 1000; observed oom_score_adj={}",
+            value
+                .map(|value| value.to_string())
+                .unwrap_or_else(|| "unreadable".into())
+        );
+    }
+}
+
 #[cfg(unix)]
 pub fn terminate_process(child: &mut Child) {
     let pgid = child.id() as i32;
@@ -1068,6 +1138,131 @@ pub fn is_process_alive(pid: u32) -> bool {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(target_os = "linux")]
+    fn oom_priority_wrapper_output(
+        wrapper: &str,
+        shell: &str,
+        command: &str,
+        marker: &Path,
+        enabled: bool,
+    ) -> std::process::Output {
+        // The exit marker normally uses fd 3; send it to a separate file here.
+        let script = format!("exec 3>\"$8\"\n{wrapper}");
+        std::process::Command::new("/bin/sh")
+            .args([
+                "-c",
+                &script,
+                "aft-wrapper-test",
+                shell,
+                command,
+                "3",
+                "",
+                "",
+                "",
+            ])
+            .arg(if enabled { marker } else { Path::new("") })
+            .arg(marker.with_extension("exit"))
+            .output()
+            .unwrap()
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn linux_oom_priority_wrapper_preserves_output_exit_and_pipeline_status() {
+        let root = tempfile::tempdir().unwrap();
+        let marker = root.path().join("failure");
+        let wrapper = std::str::from_utf8(PAYLOAD_WRAPPER).unwrap();
+        // Omitting the marker disables only the OOM step, not the payload wrapper.
+        for shell in ["/bin/sh", "/bin/bash"] {
+            let command = "printf 'stdout\\000bytes\\n'; printf 'stderr\\n' >&2; exit 37";
+            let before = oom_priority_wrapper_output(wrapper, shell, command, &marker, false);
+            let after = oom_priority_wrapper_output(wrapper, shell, command, &marker, true);
+            assert_eq!(after.stdout, b"stdout\0bytes\n");
+            assert_eq!(before.stdout, after.stdout);
+            assert_eq!(before.stderr, after.stderr);
+            assert_eq!(before.status.code(), Some(37));
+            assert_eq!(before.status, after.status);
+        }
+        let status = root.path().join("pipeline");
+        let script = format!("exec 3>\"$8\"\n{wrapper}");
+        let result = std::process::Command::new("/bin/sh")
+            .args([
+                "-c",
+                &script,
+                "aft-wrapper-test",
+                "/bin/bash",
+                "false | true",
+                "3",
+            ])
+            .arg(&status)
+            .args(["bash", ""])
+            .arg(&marker)
+            .arg(root.path().join("exit"))
+            .output()
+            .unwrap();
+        assert!(result.status.success(), "{:?}", result.stderr);
+        assert_eq!(std::fs::read_to_string(status).unwrap(), "1\n0\n");
+        assert!(
+            !marker.exists(),
+            "successful adjustment must not write a failure marker"
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn linux_oom_priority_write_failure_runs_command_and_warns_once() {
+        // The warning budget is process-wide; unrelated parallel tests must not
+        // consume it before this forced-failure scenario runs.
+        const CHILD: &str = "AFT_TEST_OOM_PRIORITY_FAILURE_CHILD";
+        if std::env::var_os(CHILD).is_none() {
+            let result = std::process::Command::new(std::env::current_exe().unwrap())
+                .args([
+                    "--exact",
+                    "bash_background::process::tests::linux_oom_priority_write_failure_runs_command_and_warns_once",
+                    "--nocapture",
+                ])
+                .env(CHILD, "1")
+                .output()
+                .unwrap();
+            assert!(result.status.success(), "{result:?}");
+            return;
+        }
+        let root = tempfile::tempdir().unwrap();
+        let readback = root.path().join("readback");
+        std::fs::write(&readback, "17\n").unwrap();
+        let wrapper = std::str::from_utf8(PAYLOAD_WRAPPER)
+            .unwrap()
+            .replacen("/proc/self/oom_score_adj", "/dev/full", 1)
+            .replace("/proc/self/oom_score_adj", readback.to_str().unwrap());
+        assert_eq!(oom_priority_failures(), 0);
+        let (_, logs) = crate::logging::capture_log_lines(|| {
+            for i in 0..2 {
+                let marker = root.path().join(format!("failure-{i}"));
+                let result = oom_priority_wrapper_output(
+                    &wrapper,
+                    "/bin/sh",
+                    "printf ran; exit 23",
+                    &marker,
+                    true,
+                );
+                assert_eq!(result.stdout, b"ran");
+                assert_eq!(result.stderr, b"");
+                assert_eq!(result.status.code(), Some(23));
+                assert_eq!(std::fs::read_to_string(&marker).unwrap(), "17\n");
+                observe_oom_priority_failure(&marker);
+                observe_oom_priority_failure(&marker);
+            }
+        });
+        assert_eq!(oom_priority_failures(), 2);
+        let warnings: Vec<_> = logs
+            .iter()
+            .filter(|line| line.contains("Linux agent shell OOM priority"))
+            .collect();
+        assert_eq!(warnings.len(), 1, "{logs:?}");
+        assert!(warnings[0].contains("WARN"));
+        assert!(warnings[0].contains("oom_score_adj=17"));
+    }
+
     #[test]
     fn documented_termination_grace_matches_policy() {
         let comment = include_str!("process.rs")
@@ -1429,7 +1624,8 @@ mod tests {
         // the descendant.
         let script = format!(
             "sh -c \"trap '' TERM; echo \\$$ > '{pid}'; touch '{ready}'; sleep 30\" & \
-             while [ ! -f '{ready}' ]; do sleep 0.02; done; exit 0",
+             {}; exit 0",
+            crate::test_gate::gate(&format!("'{}'", ready.display()), "sleep 0.02"),
             pid = pidfile.display(),
             ready = ready.display(),
         );
diff --git a/crates/aft/src/bash_background/pty_process.rs b/crates/aft/src/bash_background/pty_process.rs
index 95b5daae1d..e8bb637b47 100644
--- a/crates/aft/src/bash_background/pty_process.rs
+++ b/crates/aft/src/bash_background/pty_process.rs
@@ -168,6 +168,25 @@ pub(crate) fn spawn_pty_for_command(
         } else {
             shell_path.as_os_str()
         };
+        // PTY commands do not use PAYLOAD_WRAPPER. Adjust the outer shell before
+        // it execs the existing secret/memory gate or the requested user shell.
+        #[cfg(target_os = "linux")]
+        let program = {
+            let mut wrapped = vec![
+                OsString::from("-c"),
+                OsString::from(concat!(
+                    super::process::shell_oom_priority!("__aft_oom_failure=$1\nshift\n"),
+                    "exec \"$@\""
+                )),
+                OsString::from("aft-oom-priority"),
+                super::process::oom_priority_marker(spawn_plan.temp_dir(), &paths.io_dir)
+                    .into_os_string(),
+                program.to_owned(),
+            ];
+            wrapped.append(&mut args);
+            args = wrapped;
+            std::ffi::OsStr::new("/bin/sh")
+        };
         try_spawn_pty(
             registry,
             spawn_plan,
@@ -771,7 +790,11 @@ pub(crate) fn spawn_waiter(
                         coordinator.session_id,
                         coordinator.task_id
                     );
-                    break ExitMarker::Killed;
+                    break if was_killed.load(Ordering::SeqCst) {
+                        ExitMarker::Killed
+                    } else {
+                        ExitMarker::Unknown
+                    };
                 }
             }
         };
@@ -796,6 +819,7 @@ fn write_exit_marker(file: &mut File, marker: &ExitMarker) -> io::Result<()> {
     let content = match marker {
         ExitMarker::Code(code) => code.to_string(),
         ExitMarker::Killed => "killed".to_string(),
+        ExitMarker::Unknown => "unknown".to_string(),
     };
     file.set_len(0)?;
     file.seek(SeekFrom::Start(0))?;
@@ -833,6 +857,7 @@ mod tests {
     #[derive(Debug)]
     struct InterruptedOnceChild {
         waits: usize,
+        lost_exit: bool,
     }
 
     impl ChildKiller for InterruptedOnceChild {
@@ -851,6 +876,9 @@ mod tests {
         }
 
         fn wait(&mut self) -> io::Result<ExitStatus> {
+            if self.lost_exit {
+                return Err(io::Error::from_raw_os_error(libc::ECHILD));
+            }
             self.waits += 1;
             if self.waits == 1 {
                 Err(io::Error::from(io::ErrorKind::Interrupted))
@@ -884,7 +912,10 @@ mod tests {
         let exit_observed = Arc::new(AtomicBool::new(false));
 
         spawn_waiter(
-            Box::new(InterruptedOnceChild { waits: 0 }),
+            Box::new(InterruptedOnceChild {
+                waits: 0,
+                lost_exit: false,
+            }),
             exit_file,
             was_killed,
             Arc::clone(&exit_observed),
@@ -903,6 +934,37 @@ mod tests {
         assert_eq!(fs::read_to_string(exit_path).unwrap(), "0");
     }
 
+    #[test]
+    fn pty_waiter_lost_exit_is_unknown_but_real_kill_stays_killed() {
+        for (killed, expected) in [(false, "unknown"), (true, "killed")] {
+            let temp = tempfile::tempdir().unwrap();
+            let exit_path = temp.path().join("task.exit");
+            let (wake_tx, wake_rx) = crossbeam_channel::bounded(1);
+            let coordinator = Arc::new(CompletionCoordinator::new(
+                "task".to_string(),
+                "session".to_string(),
+                wake_tx,
+            ));
+            let exit_observed = Arc::new(AtomicBool::new(false));
+            spawn_waiter(
+                Box::new(InterruptedOnceChild {
+                    waits: 0,
+                    lost_exit: true,
+                }),
+                File::create(&exit_path).unwrap(),
+                Arc::new(AtomicBool::new(killed)),
+                Arc::clone(&exit_observed),
+                Arc::clone(&coordinator),
+                None,
+            )
+            .unwrap();
+            coordinator.signal_one_done();
+            wake_rx.recv_timeout(Duration::from_secs(2)).unwrap();
+            assert!(exit_observed.load(Ordering::SeqCst));
+            assert_eq!(fs::read_to_string(exit_path).unwrap(), expected);
+        }
+    }
+
     #[derive(Debug)]
     struct NeverExitsChild;
 
diff --git a/crates/aft/src/bash_background/registry.rs b/crates/aft/src/bash_background/registry.rs
index da4aed719d..f2206b05be 100644
--- a/crates/aft/src/bash_background/registry.rs
+++ b/crates/aft/src/bash_background/registry.rs
@@ -1810,6 +1810,9 @@ pub(crate) struct DbWriteOrder {
     /// the count while it holds `state`, then writes only if the count has
     /// not moved since (see [`BgTaskRegistry::persist_task_checkpoint`]).
     json_writes: Mutex<u64>,
+    /// Durability already completed for the current metadata bytes. Shared by
+    /// all registries holding this task, including direct acknowledgement writes.
+    pub(super) metadata_sync: Mutex<Option<super::persistence::MetadataSync>>,
     #[cfg(test)]
     before_fenced_change: Mutex<Option<Box<dyn FnOnce() + Send>>>,
 }
@@ -1834,7 +1837,7 @@ fn db_write_orders() -> &'static Mutex<HashMap<DbWriteOrderKey, std::sync::Weak<
 impl DbWriteOrder {
     /// The shared write order for a task, created on first use. Entries whose
     /// tasks are all gone are swept as the map grows.
-    fn for_task(session_id: &str, task_id: &str) -> Arc<Self> {
+    pub(super) fn for_task(session_id: &str, task_id: &str) -> Arc<Self> {
         let mut orders = db_write_orders()
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
@@ -1850,7 +1853,7 @@ impl DbWriteOrder {
         order
     }
 
-    fn lookup(session_id: &str, task_id: &str) -> Option<Arc<Self>> {
+    pub(super) fn lookup(session_id: &str, task_id: &str) -> Option<Arc<Self>> {
         db_write_orders()
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner)
@@ -3140,6 +3143,25 @@ impl BgTaskRegistry {
             }
             append_remote_report(&mut snapshot.output_preview, &state.metadata);
         }
+        #[cfg(unix)]
+        if let Some(runtime) = self
+            .inner
+            .secret_proxies
+            .lock()
+            .ok()
+            .and_then(|proxies| proxies.get(&task.task_id).cloned())
+        {
+            for line in runtime
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .approval_status()
+            {
+                if !snapshot.output_preview.is_empty() {
+                    snapshot.output_preview.push('\n');
+                }
+                snapshot.output_preview.push_str(&line);
+            }
+        }
         snapshot
     }
 
@@ -3250,6 +3272,22 @@ impl BgTaskRegistry {
     ) -> Result<(), String> {
         #[cfg(unix)]
         self.stop_secret_proxy(&task.task_id);
+        #[cfg(target_os = "linux")]
+        {
+            let marker = task.lock_state().ok().and_then(|state| {
+                (state.metadata.remote.is_none() || state.metadata.local_fallback_started).then(
+                    || {
+                        super::process::oom_priority_marker(
+                            state.metadata.sandbox_temp_dir.as_deref(),
+                            &task.paths.io_dir,
+                        )
+                    },
+                )
+            });
+            if let Some(marker) = marker {
+                super::process::observe_oom_priority_failure(&marker);
+            }
+        }
         self.settle_memory_accounting(task)?;
         #[cfg(test)]
         {
@@ -17974,6 +18012,11 @@ fn terminal_metadata_from_marker(
             terminal_exit_code_for_status(&BgTaskStatus::Killed),
             reason,
         ),
+        ExitMarker::Unknown => metadata.mark_terminal(
+            BgTaskStatus::FateUnknown,
+            None,
+            Some(super::PTY_EXIT_STATUS_UNKNOWN_REASON.to_owned()),
+        ),
     }
     metadata
 }
@@ -18302,6 +18345,9 @@ fn spawn_detached_child(
                 LocalIdentityGate::Required => "wait-for-identity",
                 LocalIdentityGate::CommittedFallback => "",
             }),
+            #[cfg(target_os = "linux")]
+            super::process::oom_priority_marker(spawn_plan.temp_dir(), &paths.io_dir)
+                .into_os_string(),
         ];
         #[cfg(target_os = "linux")]
         let (executable, args) = if linux_scope && !memory_gated {
@@ -20340,7 +20386,27 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let release = dir.path().join("release");
         let original = BgTaskRegistry::default();
-        let task_id = original.spawn_with_shell(SpawnPlan::Unsandboxed, &format!("sh -c 'while [ ! -f \"{}\" ]; do sleep 0.01; done; printf \"381 tests run: 381 passed\\n\" >&2; exit 1' | true", release.display()), crate::bash_background::BashShell::Bash, PathBuf::from("/bin/bash"), "session".into(), dir.path().into(), HashMap::new(), crate::bash_background::HardKill::After(Duration::from_secs(30)), None, dir.path().into(), 10, true, false, Some(dir.path().into())).unwrap();
+        let task_id = original
+            .spawn_with_shell(
+                SpawnPlan::Unsandboxed,
+                &format!(
+                    "sh -c '{}; printf \"381 tests run: 381 passed\\n\" >&2; exit 1' | true",
+                    crate::test_gate::gate(&format!("\"{}\"", release.display()), "sleep 0.01")
+                ),
+                crate::bash_background::BashShell::Bash,
+                PathBuf::from("/bin/bash"),
+                "session".into(),
+                dir.path().into(),
+                HashMap::new(),
+                crate::bash_background::HardKill::After(Duration::from_secs(30)),
+                None,
+                dir.path().into(),
+                10,
+                true,
+                false,
+                Some(dir.path().into()),
+            )
+            .unwrap();
         let paths = original.task(&task_id).unwrap().paths.clone();
         original.detach();
         drop(original);
@@ -21401,6 +21467,47 @@ mod tests {
         assert_eq!(terminal.exit_code, Some(137));
     }
 
+    #[test]
+    fn pty_unknown_exit_marker_has_no_exit_code_and_preserves_real_kills() {
+        let mut metadata = PersistedTask::starting(
+            "bash-lost".to_string(),
+            "session".to_string(),
+            "interactive".to_string(),
+            PathBuf::from("."),
+            None,
+            None,
+            true,
+            true,
+        );
+        metadata.mode = BgMode::Pty;
+        let terminal = terminal_metadata_from_marker(metadata.clone(), ExitMarker::Unknown, None);
+        assert_eq!(terminal.status, BgTaskStatus::FateUnknown);
+        assert_eq!(terminal.exit_code, None);
+        assert_eq!(
+            crate::subc_format::format_bash_task_status_header(
+                &terminal.task_id,
+                "fate_unknown",
+                terminal.exit_code,
+                terminal.status_reason.as_deref(),
+            ),
+            "Task bash-lost: exit status unknown (AFT could not read how it ended)"
+        );
+        let killed =
+            terminal_metadata_from_marker(metadata, ExitMarker::Killed, Some("bash_kill".into()));
+        assert_eq!(killed.status, BgTaskStatus::Killed);
+        assert_eq!(killed.exit_code, Some(137));
+        assert_eq!(killed.status_reason.as_deref(), Some("bash_kill"));
+        assert_eq!(
+            crate::subc_format::format_bash_task_status_header(
+                &killed.task_id,
+                "killed",
+                killed.exit_code,
+                killed.status_reason.as_deref(),
+            ),
+            "Task bash-lost: killed (exit 137)"
+        );
+    }
+
     #[test]
     fn terminal_status_polls_use_cached_render_once_and_off_lock() {
         let registry = BgTaskRegistry::default();
@@ -25980,7 +26087,7 @@ mod tests {
             // deferred by bash, the sleep is born after the signal, and it
             // outlives the trapped shell as a survivor this TERM-only kill
             // then waits for.
-            "trap 'echo trapped > trapped; while [ ! -e release ]; do sleep 0.01; done; exit 0' TERM\nsleep 30 & sleeper=$!\necho ready > ready\nwait $sleeper\nwhile :; do sleep 30 & wait $!; done\n").unwrap();
+            format!("trap 'echo trapped > trapped; {}; exit 0' TERM\nsleep 30 & sleeper=$!\necho ready > ready\nwait $sleeper\nwhile :; do sleep 30 & wait $!; done\n", crate::test_gate::gate_exists("release", "sleep 0.01"))).unwrap();
         let task_id =
             spawn_unsandboxed_for_kill_test(&registry, dir.path(), "bash child.sh & wait");
         let ready_deadline = Instant::now() + Duration::from_secs(10);
@@ -26238,7 +26345,10 @@ mod tests {
         let task_id = registry
             .spawn_pty(
                 SpawnPlan::Unsandboxed,
-                "/bin/sh -c 'while [ ! -f ready ]; do sleep 0.01; done; printf done'",
+                &format!(
+                    "/bin/sh -c '{}; printf done'",
+                    crate::test_gate::gate("ready", "sleep 0.01")
+                ),
                 "session".to_string(),
                 dir.path().to_path_buf(),
                 HashMap::new(),
@@ -26300,7 +26410,10 @@ mod tests {
         let task_id = registry
             .spawn_pty(
                 SpawnPlan::Unsandboxed,
-                "/bin/sh -c 'while [ ! -f ready ]; do sleep 0.01; done'",
+                &format!(
+                    "/bin/sh -c '{}'",
+                    crate::test_gate::gate("ready", "sleep 0.01")
+                ),
                 "session".to_string(),
                 dir.path().to_path_buf(),
                 HashMap::new(),
@@ -26659,8 +26772,8 @@ mod tests {
             let dir = tempfile::tempdir().unwrap();
             let finish = dir.path().join("finish");
             let command = format!(
-                "while [ ! -f '{}' ]; do sleep 0.01; done; exit {code}",
-                finish.display()
+                "{}; exit {code}",
+                crate::test_gate::gate(&format!("'{}'", finish.display()), "sleep 0.01")
             );
             let task_id = spawn_unsandboxed_for_kill_test(&registry, dir.path(), &command);
             let task = registry.task_for_test(&task_id).unwrap();
@@ -26915,9 +27028,9 @@ mod tests {
         let quote =
             |path: &Path| format!("'{}'", path.display().to_string().replace('\'', "'\\''"));
         let command = format!(
-            "printf 'spawn\\n' >> {}; while [ ! -e {} ]; do sleep 0.05; done",
+            "printf 'spawn\\n' >> {}; {}",
             quote(&spawn_marker),
-            quote(&stop_marker)
+            crate::test_gate::gate_exists(&quote(&stop_marker), "sleep 0.05")
         );
 
         let original = BgTaskRegistry::new(Arc::new(Mutex::new(None)));
@@ -27714,7 +27827,7 @@ mod tests {
         let root = Path::new("/project");
         let durable = |command: &str| -> String {
             let ((), lines) = crate::logging::capture_log_lines(|| {
-                log_bash_spawn("bgb_test", 1, "session", root, command)
+                log_bash_spawn("bgb_0123456789", 1, "ses_abcDEF0123456789", root, command)
             });
             assert_eq!(lines.len(), 1, "{lines:?}");
             crate::log_redact::aft_redactor(&lines[0]).into_owned()
@@ -27723,12 +27836,24 @@ mod tests {
         // cut, too few for the GitHub token pattern to recognise.
         let cut_token_body = "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
         let cut_token_command = format!("#{} ghp_{cut_token_body}", "x".repeat(179));
+        let inline_password = "Ab3dEfGhIjKlMnOpQrStUvWxYz0123456789-_aBcDe";
+        assert_eq!(inline_password.len(), 43);
+        let inline_command = format!(
+            "cd /work/x/opencode PW={inline_password} curl -s -u \"opencode:$PW\" http://127.0.0.1:4599/api/status"
+        );
+        // Only ten value characters would survive a cut made before masking.
+        let cut_assignment = format!("#{} X={inline_password}", "x".repeat(186));
         let mut problems = Vec::new();
         for (command, secret) in [
             ("GITHUB_TOKEN=plainvalue123 gh api /user", "plainvalue123"),
             ("export OPENAI_API_KEY=plainvalue123", "plainvalue123"),
             ("export DB_PASSWORD='plain value 123'", "plain value 123"),
             ("PGPASSWORD=plainvalue123 psql -h db", "plainvalue123"),
+            ("PASS=plainvalue123 ./run", "plainvalue123"),
+            ("DB_PW=plainvalue123 ./run", "plainvalue123"),
+            ("DB_PASS=plainvalue123 ./run", "plainvalue123"),
+            (inline_command.as_str(), inline_password),
+            (cut_assignment.as_str(), &inline_password[..10]),
             (
                 "docker login --password plainvalue123 -u me",
                 "plainvalue123",
@@ -27750,12 +27875,26 @@ mod tests {
             "GIT_AUTHOR_NAME=Someone GH_SHIM_BYPASS=1 git commit -m x",
             "export GITHUB_TOKEN=$GH_TOKEN",
             "gcloud secrets versions access latest --secret=prod-db",
+            "PWD=/tmp/x SHA=3f2c9a1b7e4d5c6a8b9f0e1d2c3b4a5968778695 ./run",
+            "COUNT=12345678901234567 URL=https://example.com/a ./run",
         ] {
             let line = durable(command);
             if !line.ends_with(&format!("cmd={command}")) {
                 problems.push(format!("mangled: {line}"));
             }
         }
+        let fixture: serde_json::Value = serde_json::from_str(include_str!(
+            "../../tests/fixtures/log_redaction_cases.json"
+        ))
+        .unwrap();
+        let command_logs = fixture["command_logs"].as_array().unwrap();
+        assert!(!command_logs.is_empty());
+        for case in command_logs {
+            let input = case["input"].as_str().unwrap();
+            let (_, command) = input.split_once(" cmd=").unwrap();
+            let line = durable(command);
+            assert!(line.ends_with(case["expected"].as_str().unwrap()), "{line}");
+        }
         assert!(problems.is_empty(), "{}", problems.join("\n"));
     }
 
@@ -29319,7 +29458,10 @@ mod tests {
         let go = storage.join("go");
         // The line break keeps LATE's line within the watch preview's mask cap;
         // LATE still arrives in the fourth 64 KiB scan chunk.
-        let command = format!("while [ ! -e '{}' ]; do sleep 0.01; done; head -c 196608 /dev/zero; printf '\\nLATE'; sleep 30", go.display());
+        let command = format!(
+            "{}; head -c 196608 /dev/zero; printf '\\nLATE'; sleep 30",
+            crate::test_gate::gate_exists(&format!("'{}'", go.display()), "sleep 0.01")
+        );
         let id = registry
             .spawn(
                 SpawnPlan::Unsandboxed,
diff --git a/crates/aft/src/bash_background/remote.rs b/crates/aft/src/bash_background/remote.rs
index eab5c87fdc..c6f9f4318c 100644
--- a/crates/aft/src/bash_background/remote.rs
+++ b/crates/aft/src/bash_background/remote.rs
@@ -1286,21 +1286,26 @@ struct DirtyOutput {
 impl DirtyOutput {
     fn sync(
         &mut self,
+        paths: &TaskPaths,
         stdout: &fs::File,
         stderr: &fs::File,
         unknown: Option<&fs::File>,
     ) -> io::Result<()> {
-        fn sync_dirty(file: &fs::File, dirty: &mut bool) -> io::Result<()> {
+        fn sync_dirty(file: &fs::File, path: &Path, dirty: &mut bool) -> io::Result<()> {
             if *dirty {
-                super::super::persistence::sync_task_file(file)?;
+                super::super::persistence::sync_task_file(file, path)?;
                 *dirty = false;
             }
             Ok(())
         }
-        sync_dirty(stdout, &mut self.stdout)?;
-        sync_dirty(stderr, &mut self.stderr)?;
+        sync_dirty(stdout, &paths.stdout, &mut self.stdout)?;
+        sync_dirty(stderr, &paths.stderr, &mut self.stderr)?;
         if let Some(file) = unknown {
-            sync_dirty(file, &mut self.unknown)?;
+            sync_dirty(
+                file,
+                &paths.io_dir.join("remote-unknown-output"),
+                &mut self.unknown,
+            )?;
         }
         Ok(())
     }
@@ -1491,8 +1496,12 @@ impl TaskSink {
         )
         .collect();
         if !losses.is_empty() {
-            sink.dirty
-                .sync(&sink.stdout, &sink.stderr, sink.unknown.as_ref())?;
+            sink.dirty.sync(
+                &sink.task.paths,
+                &sink.stdout,
+                &sink.stderr,
+                sink.unknown.as_ref(),
+            )?;
             let mut db = DeferredDbWrites::new(registry, &sink.task);
             let mut state = sink
                 .task
@@ -1562,8 +1571,12 @@ impl TaskSink {
     fn commit(&mut self, update: impl FnOnce(&mut RemoteTask)) -> io::Result<()> {
         // Acceptance, start, and terminal records save output progress too, so
         // their metadata must not become durable before the output files.
-        self.dirty
-            .sync(&self.stdout, &self.stderr, self.unknown.as_ref())?;
+        self.dirty.sync(
+            &self.task.paths,
+            &self.stdout,
+            &self.stderr,
+            self.unknown.as_ref(),
+        )?;
         let mut db = DeferredDbWrites::new(&self.registry, &self.task);
         let mut state = self
             .task
@@ -1638,8 +1651,12 @@ impl TaskSink {
     fn checkpoint_progress(&mut self) -> io::Result<()> {
         // A saved cursor must never cover output bytes that are not yet on
         // disk: after a restart the output files are cut to the saved lengths.
-        self.dirty
-            .sync(&self.stdout, &self.stderr, self.unknown.as_ref())?;
+        self.dirty.sync(
+            &self.task.paths,
+            &self.stdout,
+            &self.stderr,
+            self.unknown.as_ref(),
+        )?;
         let progress = self.output_progress;
         let (snapshot, json_writes_seen, previous) = {
             let mut state = self
@@ -1927,8 +1944,12 @@ impl OutputSink for TaskSink {
         }
         // The acceptance saves output progress too, so its record must not
         // become durable before the output files (as in `commit`).
-        self.dirty
-            .sync(&self.stdout, &self.stderr, self.unknown.as_ref())?;
+        self.dirty.sync(
+            &self.task.paths,
+            &self.stdout,
+            &self.stderr,
+            self.unknown.as_ref(),
+        )?;
         let mut db = DeferredDbWrites::new(&self.registry, &self.task);
         let mut state = self
             .task
@@ -2260,8 +2281,12 @@ impl TaskSink {
     }
 
     fn truncate_output(&mut self, before_seq: u64, kind: MissingRecords) -> io::Result<()> {
-        self.dirty
-            .sync(&self.stdout, &self.stderr, self.unknown.as_ref())?;
+        self.dirty.sync(
+            &self.task.paths,
+            &self.stdout,
+            &self.stderr,
+            self.unknown.as_ref(),
+        )?;
         let mut db = DeferredDbWrites::new(&self.registry, &self.task);
         let mut state = self
             .task
@@ -2323,7 +2348,8 @@ fn save_named_retry_request(
     // Environment values stay in a private control file, not mirrored task metadata.
     let file = crate::bash_background::persistence::create_control_file(&layout.dirs, name, &bytes)
         .map_err(|e| e.to_string())?;
-    file.sync_all().map_err(|e| e.to_string())?;
+    aft_store::sync::sync_all(&file, &layout.dirs.control.path().join(name))
+        .map_err(|e| e.to_string())?;
     Ok(retry_request_digest(task, &bytes))
 }
 
diff --git a/crates/aft/src/bash_background/remote_tests.rs b/crates/aft/src/bash_background/remote_tests.rs
index 9e077f5acf..d78a77d4b8 100644
--- a/crates/aft/src/bash_background/remote_tests.rs
+++ b/crates/aft/src/bash_background/remote_tests.rs
@@ -1019,7 +1019,11 @@ async fn every_local_spawn_entrypoint_executes_command_once() {
         let counter = dir.path().join("executions");
         let release = dir.path().join("release");
         let _release_on_failure = ReleaseOnDrop(release.clone());
-        let command = format!("printf x >> '{}'; while [ ! -f '{}' ]; do /bin/sleep 0.01; done; printf entrypoint-proof", counter.display(), release.display());
+        let command = format!(
+            "printf x >> '{}'; {}; printf entrypoint-proof",
+            counter.display(),
+            crate::test_gate::gate(&format!("'{}'", release.display()), "/bin/sleep 0.01")
+        );
         if entry == "deferred-wait" {
             crate::subc::test_support::assert_deferred_wait_entrypoint(&command, &release).await;
             assert_eq!(
@@ -1564,8 +1568,10 @@ async fn assert_new_remote_changed_files(fallback: bool) {
             storage.path().join("remote-output.txt").display()
         )
     };
-    let command =
-        format!("{write}; while [ ! -e \"$CHANGED_FILES_RELEASE\" ]; do sleep 0.01; done");
+    let command = format!(
+        "{write}; {}",
+        crate::test_gate::gate_exists("\"$CHANGED_FILES_RELEASE\"", "sleep 0.01")
+    );
     let task_id = {
         let _capture = crate::bash_changed_files::scope(Some(capture.clone()));
         ctx.bash_background()
@@ -5201,6 +5207,74 @@ async fn exec_remote_bash_terminal_gap_keeps_outcome_when_attach_is_unavailable(
         .any(|(_, b)| b["method"] == "exec.run"));
 }
 
+#[test]
+fn exec_remote_bash_unchanged_metadata_saves_and_progress_skip_syncs_then_recover() {
+    use crate::bash_background::persistence::work_counts;
+    let dir = tempfile::tempdir().unwrap();
+    let (registry, task_id, paths) =
+        persist_accepted_with_snapshot(dir.path(), dir.path().join("unused"), "printf remote");
+    let task = registry.task(&task_id).unwrap();
+    let mut sink = TaskSink::new(&registry, task.clone()).unwrap();
+    let started = Started::new(0, 123, 1);
+    sink.started(&started).unwrap();
+    let saved = fs::read(&paths.json).unwrap();
+    work_counts::reset();
+    const RECORDS: u64 = 300;
+    for _ in 0..RECORDS {
+        // Repeated persistence requests must not sync the same durable state.
+        sink.started(&started).unwrap();
+    }
+    let unchanged = work_counts::get();
+    assert_eq!(
+        (
+            unchanged.metadata_writes,
+            unchanged.renames,
+            unchanged.syncs
+        ),
+        (0, 0, 0)
+    );
+    assert_eq!(fs::read(&paths.json).unwrap(), saved);
+
+    // Freeze the checkpoint deadline so this measures only in-memory progress.
+    sink.last_progress_persist = Instant::now() + Duration::from_secs(60);
+    work_counts::reset();
+    for seq in 1..=RECORDS {
+        sink.output(seq, OutputStream::Stdout, b"progress\n")
+            .unwrap();
+    }
+    let progress = work_counts::get();
+    eprintln!(
+        "remote metadata: {RECORDS} unchanged saves: writes={} renames={} syncs={}; {RECORDS} progress records: writes={} renames={} syncs={}",
+        unchanged.metadata_writes, unchanged.renames, unchanged.syncs,
+        progress.metadata_writes, progress.renames, progress.syncs,
+    );
+    assert_eq!(
+        (progress.metadata_writes, progress.renames, progress.syncs),
+        (0, 0, 0)
+    );
+    assert_eq!(fs::read(&paths.json).unwrap(), saved);
+    drop(sink);
+    drop(task);
+    drop(registry);
+
+    let restarted = self::registry();
+    let disk = read_task(&paths.json).unwrap();
+    let expected = serde_json::to_value(&disk).unwrap();
+    restarted
+        .insert_rehydrated_task(disk, paths.clone(), false)
+        .unwrap();
+    let task = restarted.task(&task_id).unwrap();
+    let sink = TaskSink::new(&restarted, task.clone()).unwrap();
+    assert_eq!(
+        serde_json::to_value(&task.state.lock().unwrap().metadata).unwrap(),
+        expected
+    );
+    assert_eq!(sink.output_progress.last_seq, Some(0));
+    assert_eq!(sink.output_progress.stdout_len, 0);
+    assert_eq!(fs::metadata(&paths.stdout).unwrap().len(), 0);
+    assert_eq!(fs::read(&paths.json).unwrap(), saved);
+}
+
 #[test]
 fn exec_remote_bash_plain_output_has_no_per_record_durable_io() {
     use crate::bash_background::persistence::work_counts;
@@ -6894,9 +6968,9 @@ async fn exec_remote_bash_double_restart_starts_local_fallback_once() {
     let release = dir.path().join("release");
     let _release_on_failure = ReleaseOnDrop(release.clone());
     let command = format!(
-        "printf x >> '{}'; while [ ! -f '{}' ]; do /bin/sleep 0.01; done",
+        "printf x >> '{}'; {}",
         counter.display(),
-        release.display()
+        crate::test_gate::gate(&format!("'{}'", release.display()), "/bin/sleep 0.01")
     );
     let (original, task_id, paths) =
         persist_accepted_with_snapshot(dir.path(), daemon.connection.clone(), &command);
@@ -7023,8 +7097,8 @@ async fn exec_remote_bash_refusal_queue_wait_is_not_local_run_time() {
     let release = dir.path().join("release");
     let _release_on_failure = ReleaseOnDrop(release.clone());
     let command = format!(
-        "while [ ! -f '{}' ]; do /bin/sleep 0.01; done; printf budget-proof",
-        release.display()
+        "{}; printf budget-proof",
+        crate::test_gate::gate(&format!("'{}'", release.display()), "/bin/sleep 0.01")
     );
     let (original, task_id, paths) =
         persist_accepted_with_snapshot(dir.path(), daemon.connection.clone(), &command);
diff --git a/crates/aft/src/bash_background/return_files.rs b/crates/aft/src/bash_background/return_files.rs
index 7d483e3e4e..17982add07 100644
--- a/crates/aft/src/bash_background/return_files.rs
+++ b/crates/aft/src/bash_background/return_files.rs
@@ -706,7 +706,8 @@ mod receiver {
                     error: format!("staged {} bytes, expected {size}", staged_stat.st_size),
                 });
             }
-            staged.file.sync_all().map_err(local)?;
+            aft_store::sync::sync_all(&staged.file, &self.private.path().join(&staged.name))
+                .map_err(local)?;
             // The private entry must still be the file the bytes were written to.
             if !stat_at(self.private.as_raw_fd(), &staged.name)
                 .map_err(local)?
@@ -799,7 +800,7 @@ mod receiver {
                 source.seek(SeekFrom::Start(0))?;
                 copy_staged(&mut source, &mut out)?;
                 out.set_permissions(fs::Permissions::from_mode(mode))?;
-                out.sync_all()?;
+                aft_store::sync::sync_all(&out, &directory_path.join(&temp))?;
                 before_publish_for_test(&directory_path.join(&temp))?;
                 rename_at(directory.as_raw_fd(), &temp, directory.as_raw_fd(), name)
             })();
diff --git a/crates/aft/src/bash_background/secrets.rs b/crates/aft/src/bash_background/secrets.rs
index 45f67d9c8a..7162212d6b 100644
--- a/crates/aft/src/bash_background/secrets.rs
+++ b/crates/aft/src/bash_background/secrets.rs
@@ -19,7 +19,7 @@ use crate::sandbox_spawn::SpawnPlan;
 use crate::sandbox_spawn::{RequestedSandboxTier, SandboxRequirement, SandboxTaskKind};
 use crate::secret::{SecretVault, UnavailableVault};
 #[cfg(unix)]
-use crate::secret_proxy::{GrantedLabel, ProxyConfig, SecretProxy};
+use crate::secret_proxy::{ProxyConfig, SecretProxy};
 
 pub(crate) const REMOTE_REFUSED: &str =
     "Secret placeholders stay local; remote commands cannot use them.";
@@ -62,7 +62,10 @@ pub(crate) fn vault() -> Arc<dyn SecretVault> {
     if let Some(vault) = TEST_VAULT.with(|slot| slot.borrow().clone()) {
         return vault;
     }
-    Arc::new(UnavailableVault)
+    match crate::secret::transport::for_current_command() {
+        Some(transport) => Arc::new(crate::secret::SubcSecretVault::new(Arc::new(transport))),
+        None => Arc::new(UnavailableVault),
+    }
 }
 
 pub(crate) fn refusal(id: &str, labels: &[String], code: &str, message: &str) -> Response {
@@ -155,6 +158,9 @@ pub(crate) struct Runtime {
 
 #[cfg(unix)]
 impl Runtime {
+    pub(crate) fn approval_status(&self) -> Vec<String> {
+        self.proxy.approval_status()
+    }
     #[cfg(test)]
     pub(crate) fn address(&self) -> std::net::SocketAddr {
         self.proxy.address()
@@ -244,40 +250,17 @@ pub(crate) fn authorize(
         )
     })?;
     let vault = vault();
-    let mut grants = Vec::new();
-    for label in labels {
-        match crate::subc::resolve_current_secret_label(vault.as_ref(), label) {
-            crate::subc::LaunchDecision::Proceed {
-                mut rule,
-                grant_id,
-                expires_at_ms,
-            } => {
-                rule.grant_id = grant_id;
-                grants.push(GrantedLabel {
-                    rule,
-                    expires_at_ms,
-                });
-            }
-            crate::subc::LaunchDecision::Refuse(outcome) => {
-                return Err(outcome_response(id, labels, outcome))
-            }
-            crate::subc::LaunchDecision::Pending(pending) => {
-                return Err(refusal(
-                    id,
-                    labels,
-                    crate::secret::SECRET_ACCESS_PENDING,
-                    pending.message,
-                ))
-            }
-        }
-    }
     let task = preflight.task.as_ref().expect("preflight owns layout");
     let proxy = start_proxy(ProxyConfig {
         vault,
         authorization_scope: scopes.authorization.clone(),
         lifetime_scope: scopes.lifetime.clone(),
         scanned_labels: labels.to_vec(),
-        grants,
+        consent_context: crate::subc::current_secret_consent_context(),
+        #[cfg(test)]
+        test_https_port: TEST_HTTPS_PORT.with(std::cell::Cell::get),
+        #[cfg(test)]
+        approval_clock: None,
         origin: task.paths.task_id.clone(),
     })
     .map_err(|_| refusal(id, labels, "secrets_unavailable", PROXY_UNAVAILABLE))?;
@@ -442,6 +425,7 @@ fn native_roots() -> Result<Vec<u8>, ()> {
 
 #[cfg(test)]
 thread_local! {
+    static TEST_HTTPS_PORT: std::cell::Cell<Option<u16>> = const { std::cell::Cell::new(None) };
     static TEST_VAULT: std::cell::RefCell<Option<Arc<dyn SecretVault>>> = const { std::cell::RefCell::new(None) };
     #[cfg(unix)]
     static TEST_UPSTREAM: std::cell::RefCell<Option<rustls::ClientConfig>> = const { std::cell::RefCell::new(None) };
diff --git a/crates/aft/src/bash_background/secrets_audit_tests.rs b/crates/aft/src/bash_background/secrets_audit_tests.rs
index 8dcff76792..9cf613d0f6 100644
--- a/crates/aft/src/bash_background/secrets_audit_tests.rs
+++ b/crates/aft/src/bash_background/secrets_audit_tests.rs
@@ -37,6 +37,7 @@ struct Fixture {
     server: Option<std::thread::JoinHandle<()>>,
     _launcher: Box<dyn std::any::Any>,
     tasks: Mutex<Vec<String>>,
+    echo_key: Arc<AtomicBool>,
 }
 impl Fixture {
     fn new() -> Self {
@@ -90,6 +91,8 @@ impl Fixture {
         let seen = Arc::new(Mutex::new(Vec::new()));
         let stop = Arc::new(AtomicBool::new(false));
         let (seen_server, stopping) = (seen.clone(), stop.clone());
+        let echo_key = Arc::new(AtomicBool::new(false));
+        let echo_response = echo_key.clone();
         let server = std::thread::spawn(move || {
             while !stopping.load(Ordering::SeqCst) {
                 let socket = match listener.accept() {
@@ -120,9 +123,13 @@ impl Fixture {
                             .lock()
                             .unwrap()
                             .push(String::from_utf8(bytes).unwrap());
-                        let _ = stream.write_all(
-                            b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok",
-                        );
+                        let body: &[u8] = if echo_response.load(Ordering::SeqCst) {
+                            KEY
+                        } else {
+                            b"ok"
+                        };
+                        let _ = stream.write_all(format!("HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\n\r\n", body.len()).as_bytes());
+                        let _ = stream.write_all(body);
                         let _ = stream.flush();
                         break;
                     }
@@ -140,6 +147,7 @@ impl Fixture {
             server: Some(server),
             _launcher: Box::new(launcher),
             tasks: Mutex::new(Vec::new()),
+            echo_key,
         }
     }
     fn curl(&self) -> String {
@@ -152,6 +160,15 @@ impl Fixture {
         serde_json::from_value(json!({"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"audit-run","kind":"ephemeral","scope_epoch":1,"owner_authorized":true,"parent":{"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"secret-bash","scope_epoch":1},"parent_state":"linked"})).unwrap()
     }
     fn launch(&self, command: &str, bound: bool, extra: serde_json::Value) -> Response {
+        self.launch_with_vault(self.vault.clone(), command, bound, extra)
+    }
+    fn launch_with_vault(
+        &self,
+        vault: Arc<dyn SecretVault>,
+        command: &str,
+        bound: bool,
+        extra: serde_json::Value,
+    ) -> Response {
         let mut req = request(command);
         req.params["params"]
             .as_object_mut()
@@ -163,7 +180,7 @@ impl Fixture {
                 crate::commands::bash::handle(&req, &self.ctx)
             })
         };
-        with_vault(self.vault.clone(), || {
+        with_vault(vault, || {
             if bound {
                 crate::subc::with_secret_bound_identity_for_test(
                     self.root.path(),
@@ -266,8 +283,9 @@ fn audit_authorizing_head_end_stops_run_proxy() {
     isolated("audit_authorizing_head_end_stops_run_proxy", || {
         let f = Fixture::new();
         let command = format!(
-            "{}; : > first; while [ ! -f next ]; do sleep 0.05; done; {}; : > second; sleep 30",
+            "{}; : > first; {}; {}; : > second; sleep 30",
             f.curl(),
+            crate::test_gate::gate("next", "sleep 0.05"),
             f.curl()
         );
         let id = f.task(&f.launch(&command, true, json!({})));
@@ -400,7 +418,11 @@ fn audit_arm_failure_cleans_transferred_scratch() {
 fn audit_killing_revokes_before_term_grace() {
     isolated("audit_killing_revokes_before_term_grace", || {
         let f = Fixture::new();
-        let command = format!("trap ':' TERM; : > ready; while [ ! -f during-kill ]; do sleep 0.05; done; {}; : > term-request; while :; do sleep 0.05; done", f.curl());
+        let command = format!(
+            "trap ':' TERM; : > ready; {}; {}; : > term-request; while :; do sleep 0.05; done",
+            crate::test_gate::gate("during-kill", "sleep 0.05"),
+            f.curl()
+        );
         let id = f.task(&f.launch(&command, false, json!({})));
         f.wait_file("ready");
         let address = f
@@ -495,7 +517,7 @@ fn audit_runtime_built_unscanned_label_is_refused() {
             std::fs::read_to_string(f.root.path().join("result")).unwrap(),
             "22"
         );
-        assert_eq!(f.vault.resolves.load(Ordering::SeqCst), 1);
+        assert_eq!(f.vault.resolves.load(Ordering::SeqCst), 0);
         assert_eq!(f.vault.materials.load(Ordering::SeqCst), 0);
         assert!(f.seen.lock().unwrap().is_empty());
     });
@@ -515,7 +537,11 @@ fn audit_timeout_removes_proxy() {
 
 fn completion_cleanup(timeout: bool) {
     let f = Fixture::new();
-    let command = format!("printf '%s' \"${{SSL_CERT_FILE%/*}}\" > scratch-path; {}; : > first; while [ ! -f finish ]; do sleep 0.05; done", f.curl());
+    let command = format!(
+        "printf '%s' \"${{SSL_CERT_FILE%/*}}\" > scratch-path; {}; : > first; {}",
+        f.curl(),
+        crate::test_gate::gate("finish", "sleep 0.05")
+    );
     let extra = if timeout {
         json!({"timeout":2500})
     } else {
@@ -552,8 +578,9 @@ fn audit_epoch_rebind_revokes_secret_not_ordinary_job() {
         let f = Fixture::new();
         let id = f.task(&f.launch(
             &format!(
-                "{}; : > first; while [ ! -f next ]; do sleep 0.05; done; {}; : > second; sleep 30",
+                "{}; : > first; {}; {}; : > second; sleep 30",
                 f.curl(),
+                crate::test_gate::gate("next", "sleep 0.05"),
                 f.curl()
             ),
             true,
@@ -633,3 +660,141 @@ fn audit_hardened_daemon_preserves_child_fd_aliases() {
         );
     });
 }
+
+#[test]
+fn audit_live_vault_key_never_reaches_task_logs_previews_or_status() {
+    isolated(
+        "audit_live_vault_key_never_reaches_task_logs_previews_or_status",
+        || {
+            use crate::secret::transport::fake::{FakeClaustrum, Record, NONCE};
+            use crate::secret::{
+                ConsentOutcome, SecretConsentRequest, SecretConsentTransport, SubcSecretVault,
+            };
+            struct Phone {
+                cards: std::sync::mpsc::Sender<SecretConsentRequest>,
+                answer: Mutex<std::sync::mpsc::Receiver<ConsentOutcome>>,
+            }
+            impl SecretConsentTransport for Phone {
+                fn file(&self, request: &SecretConsentRequest) -> ConsentOutcome {
+                    self.hold(request, &Default::default())
+                }
+                fn hold(
+                    &self,
+                    request: &SecretConsentRequest,
+                    cancel: &crate::secret::consent::Cancellation,
+                ) -> ConsentOutcome {
+                    if cancel.is_cancelled() {
+                        return ConsentOutcome::Cancelled;
+                    }
+                    self.cards.send(request.clone()).unwrap();
+                    self.answer
+                        .lock()
+                        .unwrap()
+                        .recv_timeout(Duration::from_secs(10))
+                        .unwrap_or(ConsentOutcome::Expired)
+                }
+                fn withhold(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+                    ConsentOutcome::Expired
+                }
+            }
+            let (cards, received_card) = std::sync::mpsc::channel();
+            let (answer, answered) = std::sync::mpsc::channel();
+            crate::secret::consent::install_transport(Some(Arc::new(Phone {
+                cards,
+                answer: Mutex::new(answered),
+            })));
+            let f = Fixture::new();
+            f.echo_key.store(true, Ordering::SeqCst);
+            let daemon = FakeClaustrum::start();
+            daemon.state.lock().unwrap().record = Some(Record {
+                name: "test".into(),
+                host: "localhost".into(),
+                path: "/api".into(),
+                location: "authorization_bearer".into(),
+                key: KEY.to_vec(),
+            });
+            let transport = crate::secret::transport::SubcSecretUseTransport::for_test(
+                daemon.path.clone(),
+                subc_protocol::BindIdentity::new("live-secret-bash", "secret-bash"),
+                Duration::from_secs(2),
+                subc_client_rs::ConsumerIdentity {
+                    module_id: "aft".into(),
+                    launch_nonce: NONCE.into(),
+                },
+            );
+            let vault = Arc::new(SubcSecretVault::new(Arc::new(transport)));
+            let curl = f.curl().replace("--max-time 2", "--max-time 20");
+            let command = format!("{curl}; printf '\\n'; {curl} >&2");
+            let response = f.launch_with_vault(vault, &command, false, json!({}));
+            let id = f.task(&response);
+            let pending = received_card
+                .recv_timeout(Duration::from_secs(5))
+                .expect("the real request files its card");
+            assert_eq!(
+                pending.scope,
+                crate::secret::SecretScope::from_stamp(&stamp("worker"))
+            );
+            assert!(
+                f.seen.lock().unwrap().is_empty(),
+                "approval holds the request before upstream dispatch"
+            );
+            let status_request: RawRequest = serde_json::from_value(json!({"id":"waiting-vault-status", "command":"bash_status", "session_id":"secret-bash", "params":{"task_id":id}})).unwrap();
+            let waiting = crate::commands::bash_status::handle(&status_request, &f.ctx);
+            let waiting_json = serde_json::to_string(&waiting).unwrap();
+            assert!(waiting.success, "{waiting:?}");
+            assert!(waiting_json.contains("secret test: waiting for approval on the phone for localhost (requests wait up to 10 minutes)"));
+            assert!(!waiting_json.contains(std::str::from_utf8(KEY).unwrap()));
+            daemon
+                .state
+                .lock()
+                .unwrap()
+                .approve(&pending.statement_b64url);
+            answer.send(ConsentOutcome::Answered).unwrap();
+            f.wait_terminal(&id);
+            let snapshot = f
+                .ctx
+                .bash_background()
+                .status(
+                    &id,
+                    "secret-bash",
+                    Some(f.root.path()),
+                    Some(f._storage.path()),
+                    8192,
+                )
+                .unwrap();
+            assert_eq!(snapshot.exit_code, Some(0), "{}", f.diagnostics());
+            let key = std::str::from_utf8(KEY).unwrap();
+            let status_request: RawRequest = serde_json::from_value(json!({"id":"live-vault-status", "command":"bash_status", "session_id":"secret-bash", "params":{"task_id":id}})).unwrap();
+            let status_reply = crate::commands::bash_status::handle(&status_request, &f.ctx);
+            assert!(status_reply.success, "{status_reply:?}");
+            for text in [
+                serde_json::to_string(&response).unwrap(),
+                snapshot.output_preview.clone(),
+                serde_json::to_string(&snapshot).unwrap(),
+                f.diagnostics(),
+                serde_json::to_string(&status_reply).unwrap(),
+            ] {
+                assert!(
+                    !text.contains(key),
+                    "released material escaped into task observability"
+                );
+            }
+            assert!(snapshot.output_preview.contains("{{ck-secret:test}}"));
+            assert_eq!(f.seen.lock().unwrap().len(), 2);
+            assert!(
+                f.seen
+                    .lock()
+                    .unwrap()
+                    .iter()
+                    .all(|request| request.contains(key)),
+                "the vault key actually reached the approved upstream"
+            );
+            assert_eq!(
+                daemon.state.lock().unwrap().calls,
+                3,
+                "one approval ask and one release per real request"
+            );
+            assert_eq!(daemon.state.lock().unwrap().connections, 1);
+        },
+    );
+}
diff --git a/crates/aft/src/bash_background/secrets_tests.rs b/crates/aft/src/bash_background/secrets_tests.rs
index c261c3cc71..2b2b64f6b3 100644
--- a/crates/aft/src/bash_background/secrets_tests.rs
+++ b/crates/aft/src/bash_background/secrets_tests.rs
@@ -1,7 +1,6 @@
 use super::*;
 use crate::protocol::RawRequest;
-use crate::secret::{Material, MaterialError, Resolution};
-use secret_rules::location::{LabelRule, Location};
+use crate::secret::{ApiKeyTarget, Material, ReleasedApiKey, UseAnswer};
 use serde_json::json;
 use std::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
 
@@ -12,6 +11,7 @@ mod audit_followups;
 struct Vault {
     resolves: AtomicUsize,
     materials: AtomicUsize,
+    #[cfg(unix)]
     port: u16,
     audits: Mutex<Vec<secret_rules::audit::AuditRecordV1>>,
     resolve_kinds: Mutex<Vec<String>>,
@@ -20,11 +20,14 @@ struct Vault {
 }
 
 impl Vault {
-    fn new(port: u16) -> Arc<Self> {
+    fn new(_port: u16) -> Arc<Self> {
+        #[cfg(unix)]
+        TEST_HTTPS_PORT.with(|slot| slot.set((_port != 0).then_some(_port)));
         Arc::new(Self {
             resolves: AtomicUsize::new(0),
             materials: AtomicUsize::new(0),
-            port,
+            #[cfg(unix)]
+            port: _port,
             audits: Mutex::new(Vec::new()),
             resolve_kinds: Mutex::new(Vec::new()),
             material_kinds: Mutex::new(Vec::new()),
@@ -36,13 +39,14 @@ impl Vault {
 const KEY: &[u8] = b"s4-test-api-key-0123456789";
 
 impl SecretVault for Vault {
-    fn resolve(&self, scope: &crate::secret::SecretScope, label: &str) -> Resolution {
+    fn use_secret(
+        &self,
+        scope: &crate::secret::SecretScope,
+        label: &str,
+        target: &ApiKeyTarget,
+    ) -> UseAnswer {
         #[cfg(unix)]
         {
-            assert!(
-                crate::secret_proxy::test_hardening::hardened_on_this_thread(),
-                "hardening must precede vault resolution"
-            );
             // The real limits change only in the audit tests' isolated child
             // processes; a shared test process keeps its limits.
             if std::env::var_os(crate::secret_proxy::test_hardening::REAL_ENV).is_some() {
@@ -64,25 +68,13 @@ impl SecretVault for Vault {
             .lock()
             .unwrap()
             .push(scope.kind().to_owned());
-        Resolution::Granted {
-            rule: LabelRule {
-                label: label.into(),
-                host: "localhost".into(),
-                port: self.port,
-                path_prefix: "/api".into(),
-                location: Location::Bearer,
-                grant_id: "grant".into(),
-            },
-            grant_id: "grant".into(),
-            expires_at_ms: u64::MAX,
+        if target.scheme != "https"
+            || target.host != "localhost"
+            || target.port != Some(443)
+            || target.path != "/api"
+        {
+            return UseAnswer::NotFound;
         }
-    }
-    fn material(
-        &self,
-        scope: &crate::secret::SecretScope,
-        label: &str,
-        grant_id: &str,
-    ) -> Result<Material, MaterialError> {
         self.materials.fetch_add(1, Ordering::SeqCst);
         assert_eq!(scope.reference(), "secret-bash");
         assert_eq!(scope.owner(), "reserved:prefrontal-core");
@@ -91,12 +83,14 @@ impl SecretVault for Vault {
             self.expected_epoch.load(Ordering::SeqCst)
         );
         assert_eq!(label, "test");
-        assert_eq!(grant_id, "grant");
         self.material_kinds
             .lock()
             .unwrap()
             .push(scope.kind().to_owned());
-        Ok(Material::new(KEY.to_vec()))
+        UseAnswer::Released(ReleasedApiKey::new(
+            "authorization_bearer".into(),
+            Material::new(KEY.to_vec()),
+        ))
     }
     fn audit(
         &self,
@@ -654,7 +648,10 @@ fn secret_bash_real_plan_precedence_and_untrusted_request_scope() {
     let reply = crate::subc::with_secret_identity_for_test(root.path(), stamp("head"), || {
         crate::commands::bash::handle(&req, &ctx)
     });
-    assert_eq!(code(&reply), Some("secrets_unavailable"));
+    assert!(
+        reply.success,
+        "an eligible launch does not ask an unavailable vault: {reply:?}"
+    );
     for key in PROXY_KEYS.iter().chain(REMOVE_KEYS.iter()) {
         let mut conflict = req.clone();
         conflict.params["params"]["env"] = json!({*key: "conflict"});
@@ -865,7 +862,7 @@ assert open(sys.argv[2], 'rb').read() in open(paths[0], 'rb').read().replace(b'\
             config.sandbox.profile.worker = mode;
         });
         let gate = root.path().join(format!("go-{index}"));
-        let command = format!("while [ ! -f '{}' ]; do sleep 0.05; done; test -n \"$HTTPS_PROXY\" && test \"$HTTPS_PROXY\" = \"$https_proxy\" && test \"$HTTP_PROXY\" = \"$http_proxy\" && test -z \"${{NO_PROXY+x}}\" && test -z \"${{no_proxy+x}}\" && test -z \"${{ALL_PROXY+x}}\" && test -z \"${{all_proxy+x}}\" || exit 70; printf 'proxy-env-ok\\n' >&2; curl --connect-timeout 5 --max-time 10 --silent --show-error --fail -H 'Authorization: Bearer {{{{ck-secret:test}}}}' https://localhost:{}/api; curl --connect-timeout 5 --max-time 10 --silent --show-error --fail -H 'Authorization: Bearer {{{{ck-secret:test}}}}' https://localhost:{}/api; sleep 30", gate.display(), vault.port, vault.port);
+        let command = format!("{}; test -n \"$HTTPS_PROXY\" && test \"$HTTPS_PROXY\" = \"$https_proxy\" && test \"$HTTP_PROXY\" = \"$http_proxy\" && test -z \"${{NO_PROXY+x}}\" && test -z \"${{no_proxy+x}}\" && test -z \"${{ALL_PROXY+x}}\" && test -z \"${{all_proxy+x}}\" || exit 70; printf 'proxy-env-ok\\n' >&2; curl --connect-timeout 5 --max-time 10 --silent --show-error --fail -H 'Authorization: Bearer {{{{ck-secret:test}}}}' https://localhost:{}/api; curl --connect-timeout 5 --max-time 10 --silent --show-error --fail -H 'Authorization: Bearer {{{{ck-secret:test}}}}' https://localhost:{}/api; sleep 30", crate::test_gate::gate(&format!("'{}'", gate.display()), "sleep 0.05"), vault.port, vault.port);
         let command = format!(
             "python3 '{}' {} '{}' || exit 71; printf 'memory-and-bundle-ok\\n' >&2; {command}",
             memory_probe.display(),
@@ -907,8 +904,8 @@ assert open(sys.argv[2], 'rb').read() in open(paths[0], 'rb').read().replace(b'\
             .unwrap();
         assert_eq!(
             vault.resolves.load(Ordering::SeqCst),
-            index + 1,
-            "one resolve per distinct label, never per occurrence"
+            index * 2,
+            "launch asks nothing; each previous outgoing request asked once"
         );
         assert_eq!(
             seen.load(Ordering::SeqCst),
@@ -1012,7 +1009,7 @@ assert open(sys.argv[2], 'rb').read() in open(paths[0], 'rb').read().replace(b'\
     assert_eq!(vault.materials.load(Ordering::SeqCst), expected_requests);
     assert_eq!(
         *vault.resolve_kinds.lock().unwrap(),
-        ["worker", "head"].repeat(expected_requests / 4)
+        ["worker", "worker", "head", "head"].repeat(expected_requests / 4)
     );
     assert_eq!(
         *vault.material_kinds.lock().unwrap(),
diff --git a/crates/aft/src/bash_background/slot_limit_tests.rs b/crates/aft/src/bash_background/slot_limit_tests.rs
index 2246f5ac33..0c9f774021 100644
--- a/crates/aft/src/bash_background/slot_limit_tests.rs
+++ b/crates/aft/src/bash_background/slot_limit_tests.rs
@@ -220,8 +220,8 @@ fn foreground_command_promoted_at_cap_keeps_running_and_then_holds_a_slot() {
     let holders = fill_background_slots(&ctx);
     let release = project.path().join("release");
     let command = format!(
-        "while [ ! -e '{}' ]; do sleep 0.05; done; echo promoted-done",
-        release.display()
+        "{}; echo promoted-done",
+        crate::test_gate::gate_exists(&format!("'{}'", release.display()), "sleep 0.05")
     );
 
     let foreground_id = task_id(&launch(&ctx, "session-c", &command, false));
diff --git a/crates/aft/src/bash_background/spawn_tests.rs b/crates/aft/src/bash_background/spawn_tests.rs
index a0f9e27c7c..2b70fd06c6 100644
--- a/crates/aft/src/bash_background/spawn_tests.rs
+++ b/crates/aft/src/bash_background/spawn_tests.rs
@@ -63,6 +63,54 @@ fn wait_done(registry: &BgTaskRegistry, id: &str) {
     }
 }
 
+#[cfg(target_os = "linux")]
+#[test]
+fn linux_oom_priority_local_pipes_and_pty_raise_children_not_aft() {
+    let before = std::fs::read_to_string("/proc/self/oom_score_adj").unwrap();
+    let root = tempfile::tempdir().unwrap();
+    let registry = BgTaskRegistry::default();
+    let command = "IFS= read -r value < /proc/self/oom_score_adj; printf '%s\\n' \"$value\"; /bin/sh -c 'cat /proc/self/oom_score_adj'";
+    for background in [false, true] {
+        let id = spawn(&registry, root.path(), command, background);
+        wait_done(&registry, &id);
+        let task = registry.task(&id).unwrap();
+        assert_eq!(std::fs::read(&task.paths.stdout).unwrap(), b"1000\n1000\n");
+        assert_eq!(std::fs::read(&task.paths.stderr).unwrap(), b"");
+    }
+    let id = registry
+        .spawn_pty_with_shell(
+            SpawnPlan::Unsandboxed,
+            command,
+            super::super::BashShell::Bash,
+            PathBuf::from("/bin/bash"),
+            "spawn-contract".into(),
+            root.path().to_owned(),
+            HashMap::new(),
+            super::super::HardKill::After(Duration::from_secs(30)),
+            None,
+            root.path().to_owned(),
+            4,
+            false,
+            false,
+            Some(root.path().to_owned()),
+            24,
+            80,
+        )
+        .unwrap();
+    wait_done(&registry, &id);
+    let task = registry.task(&id).unwrap();
+    assert_eq!(
+        std::fs::read_to_string(&task.paths.pty)
+            .unwrap()
+            .replace("\r\n", "\n"),
+        "1000\n1000\n"
+    );
+    assert_eq!(
+        std::fs::read_to_string("/proc/self/oom_score_adj").unwrap(),
+        before
+    );
+}
+
 #[cfg(target_os = "linux")]
 #[test]
 fn linux_scope_preserves_shell_dollar_expressions() {
@@ -248,8 +296,8 @@ fn bash_posix_spawn_zero_daemon_forks() {
             let release = dir.path().join(format!("release-{iteration}"));
             let command = if mode == "promoted" {
                 format!(
-                    "while [ ! -f '{}' ]; do sleep 0.01; done; printf spawn-ok",
-                    release.display()
+                    "{}; printf spawn-ok",
+                    crate::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.01")
                 )
             } else {
                 "printf spawn-ok".into()
diff --git a/crates/aft/src/bash_background/task_image_cleanup.rs b/crates/aft/src/bash_background/task_image_cleanup.rs
index 3338be6355..5c9e669034 100644
--- a/crates/aft/src/bash_background/task_image_cleanup.rs
+++ b/crates/aft/src/bash_background/task_image_cleanup.rs
@@ -282,7 +282,7 @@ mod tests {
         let (task, mut metadata) = saved_image(storage.path(), 1);
         let mut command = Command::new("sh");
         command.current_dir(storage.path()).args(["-c",
-            "sh -c 'echo $$ > descendant.tmp; mv descendant.tmp descendant; exec sleep 30' & while [ ! -f release-shell ]; do sleep 0.01; done",
+            &format!("sh -c 'echo $$ > descendant.tmp; mv descendant.tmp descendant; exec sleep 30' & {}", crate::test_gate::gate("release-shell", "sleep 0.01")),
         ]).stdout(Stdio::null()).stderr(Stdio::null());
         start_new_session(&mut command);
         let mut shell = Shell(command.spawn().unwrap());
diff --git a/crates/aft/src/bounded_io.rs b/crates/aft/src/bounded_io.rs
index cbff17ff22..35c18b66e9 100644
--- a/crates/aft/src/bounded_io.rs
+++ b/crates/aft/src/bounded_io.rs
@@ -554,6 +554,16 @@ impl Drop for Scope {
 pub(crate) fn current() -> Option<Budget> {
     CURRENT.with(|current| current.borrow().clone())
 }
+
+/// Person approval has its own deadline; preserve the remaining filesystem and
+/// reply budget when a held fetch resumes on this tool thread.
+pub(crate) fn exclude_secret_approval_wait(elapsed: Duration) {
+    CURRENT.with(|current| {
+        if let Some(budget) = current.borrow_mut().as_mut() {
+            budget.deadline += elapsed;
+        }
+    });
+}
 pub(crate) fn enter_if_absent(duration: Duration) -> Scope {
     let budget = current().unwrap_or_else(|| Budget::after(duration));
     Scope(CURRENT.with(|current| current.replace(Some(budget))))
diff --git a/crates/aft/src/build_breaker_audit_tests.rs b/crates/aft/src/build_breaker_audit_tests.rs
index 21ad4428d1..11ce44e787 100644
--- a/crates/aft/src/build_breaker_audit_tests.rs
+++ b/crates/aft/src/build_breaker_audit_tests.rs
@@ -64,7 +64,7 @@ fn write_durable_marker(path: &Path, marker: &DurableMarker) {
     let mut file = File::create(&temporary).unwrap();
     serde_json::to_writer(&mut file, marker).unwrap();
     file.flush().unwrap();
-    file.sync_all().unwrap();
+    aft_store::sync::sync_all(&file, &temporary).unwrap();
     fs::rename(&temporary, path).unwrap();
 }
 
diff --git a/crates/aft/src/cache_freshness.rs b/crates/aft/src/cache_freshness.rs
index e0d8bbd8fd..7befb71edc 100644
--- a/crates/aft/src/cache_freshness.rs
+++ b/crates/aft/src/cache_freshness.rs
@@ -705,7 +705,7 @@ mod tests {
         let fresh = collect(&path).unwrap();
         let mut file = fs::OpenOptions::new().append(true).open(&path).unwrap();
         file.write_all(b"").unwrap();
-        file.sync_all().unwrap();
+        aft_store::sync::sync_all(&file, &path).unwrap();
         filetime::set_file_mtime(&path, filetime::FileTime::from_unix_time(1, 0)).unwrap();
         assert!(matches!(
             verify_file(&path, &fresh),
diff --git a/crates/aft/src/cache_location.rs b/crates/aft/src/cache_location.rs
index 6474e059bc..02c33bfae8 100644
--- a/crates/aft/src/cache_location.rs
+++ b/crates/aft/src/cache_location.rs
@@ -1174,7 +1174,7 @@ pub fn prepare_cache_root(
                         })
                         .map_err(io::Error::other)?,
                     )?;
-                    marker.sync_all()?;
+                    aft_store::sync::sync_all(&marker, &lease.root.path().join(OWNER))?;
                 }
                 Err(error) => return Err(error),
             }
diff --git a/crates/aft/src/checkpoint.rs b/crates/aft/src/checkpoint.rs
index 65c375562e..e05025c1f8 100644
--- a/crates/aft/src/checkpoint.rs
+++ b/crates/aft/src/checkpoint.rs
@@ -18,6 +18,69 @@ const CHECKPOINT_LOCK_TIMEOUT: Duration = Duration::from_secs(30);
 /// Named checkpoints are deliberately bounded per session so a busy session
 /// cannot grow an unbounded durable artifact store.
 const MAX_NAMED_CHECKPOINTS_PER_SESSION: usize = 20;
+
+// Status is a bounded observation, not hydration. Generous session budgets keep
+// normal stores numeric; larger or ambiguous stores report null and `list`
+// remains the authoritative, unbounded recovery/mutation path.
+const STATUS_DIRECTORY_ENTRIES: usize = 256;
+const STATUS_MANIFEST_BYTES: usize = 1024 * 1024;
+const STATUS_BLOB_CHECKS: usize = 4096;
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+struct StatusFileVersion {
+    identity: crate::file_identity::FileIdentity,
+    modified: std::time::SystemTime,
+    len: u64,
+    #[cfg(unix)]
+    change_time: (i64, i64),
+}
+
+impl StatusFileVersion {
+    fn of_path(path: &Path) -> Option<Self> {
+        let (meta, identity) = crate::file_identity::metadata(path).ok()?;
+        Self::from_metadata(meta, identity)
+    }
+
+    fn of_file(file: &fs::File) -> Option<Self> {
+        Self::from_metadata(
+            file.metadata().ok()?,
+            crate::file_identity::FileIdentity::of_file(file),
+        )
+    }
+
+    fn from_metadata(
+        meta: fs::Metadata,
+        identity: crate::file_identity::FileIdentity,
+    ) -> Option<Self> {
+        if !matches!(identity, crate::file_identity::FileIdentity::Known { .. }) {
+            return None;
+        }
+        Some(Self {
+            identity,
+            modified: meta.modified().ok()?,
+            len: meta.len(),
+            #[cfg(unix)]
+            change_time: {
+                use std::os::unix::fs::MetadataExt;
+                (meta.ctime(), meta.ctime_nsec())
+            },
+        })
+    }
+}
+
+#[cfg(test)]
+thread_local! {
+    static STATUS_MUTATION_LOCKS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+    static STATUS_SCAN_ENTRIES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+pub(crate) fn status_read_counters_for_test() -> (usize, usize) {
+    (
+        STATUS_MUTATION_LOCKS.with(|count| count.replace(0)),
+        STATUS_SCAN_ENTRIES.with(|count| count.replace(0)),
+    )
+}
 /// Durable named checkpoints keep decisions long enough to survive ordinary
 /// work interruptions without becoming permanent storage.
 const NAMED_CHECKPOINT_RETENTION_DAYS: u64 = 14;
@@ -508,6 +571,8 @@ impl CheckpointStore {
     }
 
     fn acquire_mutation_lock(&self) -> Result<CheckpointLockGuard, AftError> {
+        #[cfg(test)]
+        STATUS_MUTATION_LOCKS.with(|count| count.set(count.get() + 1));
         let scope_dir = self.lock_path.parent().map(Path::to_path_buf);
         let deadline = Instant::now() + self.lock_timeout;
         let acquire_result = loop {
@@ -1136,6 +1201,134 @@ impl CheckpointStore {
             .sum()
     }
 
+    pub(crate) fn resident_session_count(&self, session: &str) -> usize {
+        self.checkpoints.get(session).map_or(0, HashMap::len)
+    }
+
+    /// A read-only, bounded observation of the durable session. `list` remains
+    /// authoritative: recovery, migration, retention or insufficient evidence
+    /// makes this observation unknown rather than repairing storage on a push.
+    pub(crate) fn status_count(&self, session: &str) -> Option<usize> {
+        use std::io::Read;
+        // Checkpoint commit records and blobs are published by replacement,
+        // so file identity detects a concurrent publication on Windows too.
+        use self::StatusFileVersion as DiskFileVersion;
+        if self.namespace_request.0.lock().ok()?.is_some()
+            || self.pending_unbound_migration.is_some()
+            || crate::backup::request_harness_segment()
+                .is_some_and(|harness| self.storage_harness.as_ref() != Some(&harness))
+        {
+            return None;
+        }
+        let Some(dir) = self.durable_session_dir(session) else {
+            return Some(self.checkpoints.get(session).map_or(0, HashMap::len));
+        };
+        let dir_version = match crate::file_identity::metadata(&dir) {
+            Ok((meta, identity)) => StatusFileVersion::from_metadata(meta, identity)?,
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Some(0),
+            Err(_) => return None,
+        };
+        let entries = match fs::read_dir(&dir) {
+            Ok(entries) => entries,
+            Err(_) => return None,
+        };
+        let mut evidence = vec![(dir.clone(), dir_version)];
+        let mut bytes_left = STATUS_MANIFEST_BYTES;
+        let mut blobs_left = STATUS_BLOB_CHECKS;
+        let mut count = 0;
+        let mut examined = 0;
+        for entry in entries.take(STATUS_DIRECTORY_ENTRIES) {
+            examined += 1;
+            #[cfg(test)]
+            STATUS_SCAN_ENTRIES.with(|count| count.set(count.get() + 1));
+            let entry = entry.ok()?;
+            if !entry.file_type().ok()?.is_dir() {
+                continue;
+            }
+            let name = entry.file_name().to_string_lossy().into_owned();
+            if name.ends_with(REPLACED_CHECKPOINT_SUFFIX) {
+                return None;
+            }
+            if !is_safe_checkpoint_name(&name) {
+                continue;
+            }
+            let checkpoint_dir = entry.path();
+            evidence.push((
+                checkpoint_dir.clone(),
+                DiskFileVersion::of_path(&checkpoint_dir)?,
+            ));
+            let meta_path = checkpoint_dir.join("meta.json");
+            let mut file = match fs::File::open(&meta_path) {
+                Ok(file) => file,
+                // A directory without its commit record may be a writer in flight.
+                Err(_) => return None,
+            };
+            let version = DiskFileVersion::of_file(&file)?;
+            let len = usize::try_from(file.metadata().ok()?.len()).ok()?;
+            bytes_left = bytes_left.checked_sub(len)?;
+            let mut bytes = vec![0; len];
+            file.read_exact(&mut bytes).ok()?;
+            if file.read(&mut [0]).ok()? != 0 {
+                return None;
+            }
+            evidence.push((meta_path, version));
+            let Ok(meta) = serde_json::from_slice::<DiskCheckpointMeta>(&bytes) else {
+                // Hydration omits corrupt JSON while retaining its neighbours.
+                continue;
+            };
+            if !matches!(
+                meta.schema_version,
+                CHECKPOINT_SCHEMA_VERSION | IMPORTED_CHECKPOINT_SCHEMA_VERSION
+            ) || meta.session_id != session
+                || meta.name != name
+                || meta.pending_drop
+                || !meta.pending_purge.is_empty()
+                || current_timestamp().saturating_sub(meta.created_at)
+                    >= NAMED_CHECKPOINT_RETENTION_SECS
+            {
+                return None;
+            }
+            let mut paths = HashSet::new();
+            for blob in &meta.files {
+                blobs_left = blobs_left.checked_sub(1)?;
+                if !is_safe_blob_name(&blob.blob) || !paths.insert(&blob.original_path) {
+                    return None;
+                }
+                let path = checkpoint_dir.join(&blob.blob);
+                let version = DiskFileVersion::of_path(&path)?;
+                let mut file = fs::File::open(&path).ok()?;
+                if DiskFileVersion::of_file(&file)? != version {
+                    return None;
+                }
+                if !file.metadata().ok()?.is_file() {
+                    return None;
+                }
+                if matches!(blob.kind, DiskCheckpointFileKind::Symlink) {
+                    let len = usize::try_from(file.metadata().ok()?.len()).ok()?;
+                    bytes_left = bytes_left.checked_sub(len)?;
+                    let mut bytes = vec![0; len];
+                    file.read_exact(&mut bytes).ok()?;
+                    String::from_utf8(bytes).ok()?;
+                } else {
+                    file.read(&mut [0]).ok()?;
+                }
+                evidence.push((path, version));
+            }
+            count += 1;
+            if count > MAX_NAMED_CHECKPOINTS_PER_SESSION {
+                return None;
+            }
+        }
+        // Hitting the allowance is not evidence that the iterator ended.
+        if examined == STATUS_DIRECTORY_ENTRIES {
+            return None;
+        }
+        evidence
+            .iter()
+            .all(|(path, version)| DiskFileVersion::of_path(path) == Some(*version))
+            .then_some(count)
+    }
+
     /// Sweep checkpoints older than the fixed fourteen-day retention window.
     /// The limit is intentionally not configurable: named checkpoints protect
     /// irreplaceable decisions, while predictable retention keeps the store bounded.
@@ -4550,3 +4743,128 @@ mod tests {
         assert_eq!(blob_contents(&theirs_dir), vec!["token=1".to_string()]);
     }
 }
+
+#[cfg(all(test, unix))]
+mod status_count_tests {
+    use super::*;
+
+    const SESSION: &str = "status-count-session";
+
+    fn fixture() -> (tempfile::TempDir, CheckpointStore, PathBuf) {
+        let dir = tempfile::tempdir().unwrap();
+        let file = dir.path().join("source.rs");
+        fs::write(&file, "pub fn original() {}\n").unwrap();
+        let store = CheckpointStore::unbound_in_for_test(dir.path());
+        (dir, store, file)
+    }
+
+    fn authoritative(store: &mut CheckpointStore) -> Option<usize> {
+        store.list(SESSION).ok().map(|entries| entries.len())
+    }
+
+    #[test]
+    fn status_count_matches_list_without_mutation_lock_and_observes_external_writers() {
+        let (dir, mut store, file) = fixture();
+        let first = store
+            .create_for_files(SESSION, "first", vec![file.clone()])
+            .unwrap();
+        assert_eq!(store.status_count(SESSION), authoritative(&mut store));
+        let mut external = CheckpointStore::unbound_in_for_test(dir.path());
+        external
+            .create_for_files(SESSION, "external", vec![file.clone()])
+            .unwrap();
+        status_read_counters_for_test();
+        let held =
+            fs_lock::try_acquire(store.lock_path_for_test(), Duration::from_secs(1)).unwrap();
+        assert_eq!(store.status_count(SESSION), Some(2));
+        assert_eq!(status_read_counters_for_test().0, 0);
+        drop(held);
+        assert_eq!(store.status_count(SESSION), authoritative(&mut store));
+        assert!(external.delete(SESSION, "external"));
+        assert_eq!(store.status_count(SESSION), authoritative(&mut store));
+        let corrupt = store
+            .create_for_files(SESSION, "corrupt", vec![file])
+            .unwrap();
+        fs::write(corrupt.storage_path.unwrap().join("meta.json"), "{").unwrap();
+        assert_eq!(store.status_count(SESSION), Some(1));
+        assert_eq!(store.status_count(SESSION), authoritative(&mut store));
+        let path = first.storage_path.unwrap();
+        let meta: DiskCheckpointMeta =
+            serde_json::from_slice(&fs::read(path.join("meta.json")).unwrap()).unwrap();
+        fs::remove_file(path.join(&meta.files[0].blob)).unwrap();
+        assert_eq!(store.status_count(SESSION), None);
+        assert_eq!(authoritative(&mut store), None);
+    }
+
+    #[test]
+    fn status_count_caps_work_without_returning_a_partial_number() {
+        let (_dir, mut store, file) = fixture();
+        let mut dirs = Vec::new();
+        for index in 0..MAX_NAMED_CHECKPOINTS_PER_SESSION {
+            dirs.push(
+                store
+                    .create_for_files(SESSION, &format!("checkpoint_{index}"), vec![file.clone()])
+                    .unwrap()
+                    .storage_path
+                    .unwrap(),
+            );
+        }
+        let session_dir = dirs[0].parent().unwrap();
+        for index in 20..STATUS_DIRECTORY_ENTRIES - 1 {
+            fs::write(session_dir.join(format!("stray_{index}")), "ignored").unwrap();
+        }
+        // One immutable blob may back several distinct original paths. This
+        // exercises the validation budget without allocating thousands of blobs.
+        let meta_path = dirs[0].join("meta.json");
+        let mut meta: DiskCheckpointMeta =
+            serde_json::from_slice(&fs::read(&meta_path).unwrap()).unwrap();
+        let template = meta.files[0].clone();
+        meta.files = (0..STATUS_BLOB_CHECKS - 20)
+            .map(|index| {
+                let mut file = template.clone();
+                file.original_path = format!("original_{index}");
+                file
+            })
+            .collect();
+        let mut bytes = serde_json::to_vec(&meta).unwrap();
+        let other_bytes = dirs[1..]
+            .iter()
+            .map(|dir| fs::metadata(dir.join("meta.json")).unwrap().len() as usize)
+            .sum::<usize>();
+        bytes.resize(STATUS_MANIFEST_BYTES - other_bytes - 1, b' ');
+        fs::write(&meta_path, &bytes).unwrap();
+        assert_eq!(store.status_count(SESSION), Some(20));
+        assert_eq!(store.status_count(SESSION), authoritative(&mut store));
+        status_read_counters_for_test();
+        assert_eq!(store.status_count(SESSION), Some(20));
+        assert_eq!(
+            status_read_counters_for_test(),
+            (0, STATUS_DIRECTORY_ENTRIES - 1)
+        );
+        fs::write(session_dir.join("stray_extra_one"), "ignored").unwrap();
+        fs::write(session_dir.join("stray_extra_two"), "ignored").unwrap();
+        assert_eq!(store.status_count(SESSION), None);
+        assert_eq!(status_read_counters_for_test().1, STATUS_DIRECTORY_ENTRIES);
+        fs::remove_file(session_dir.join("stray_extra_one")).unwrap();
+        fs::remove_file(session_dir.join("stray_extra_two")).unwrap();
+        bytes.resize(bytes.len() + 2, b' ');
+        fs::write(&meta_path, bytes).unwrap();
+        assert_eq!(store.status_count(SESSION), None);
+    }
+
+    #[test]
+    fn status_count_never_recovers_replaced_entries() {
+        let (_dir, mut store, file) = fixture();
+        let checkpoint = store
+            .create_for_files(SESSION, "first", vec![file])
+            .unwrap()
+            .storage_path
+            .unwrap();
+        let aside = replaced_checkpoint_path(&checkpoint);
+        fs::rename(&checkpoint, &aside).unwrap();
+        assert_eq!(store.status_count(SESSION), None);
+        assert!(aside.exists());
+        assert!(!checkpoint.exists());
+        assert_eq!(authoritative(&mut store), Some(1));
+    }
+}
diff --git a/crates/aft/src/cli/sandbox_launch.rs b/crates/aft/src/cli/sandbox_launch.rs
index c4eac48818..9093200789 100644
--- a/crates/aft/src/cli/sandbox_launch.rs
+++ b/crates/aft/src/cli/sandbox_launch.rs
@@ -339,7 +339,7 @@ fn write_failure_marker(path: &Path) -> std::io::Result<()> {
         .mode(0o600)
         .open(path)?;
     file.write_all(b"sandbox_unavailable")?;
-    file.sync_all()
+    aft_store::sync::sync_all(&file, path)
 }
 
 #[cfg(any(target_os = "macos", target_os = "linux"))]
diff --git a/crates/aft/src/commands/bash_optional_broker_tests.rs b/crates/aft/src/commands/bash_optional_broker_tests.rs
index 2ceaa8d845..1b02623adb 100644
--- a/crates/aft/src/commands/bash_optional_broker_tests.rs
+++ b/crates/aft/src/commands/bash_optional_broker_tests.rs
@@ -91,8 +91,8 @@ fn exercise_profile(
     };
     if kind == "promoted" {
         command.push_str(&format!(
-            "; while ! test -f '{}'; do sleep .02; done",
-            release.display()
+            "; {}",
+            crate::test_gate::gate(&format!("'{}'", release.display()), "sleep .02")
         ));
     }
     let mut request =
diff --git a/crates/aft/src/commands/bash_watch_keepalive_tests.rs b/crates/aft/src/commands/bash_watch_keepalive_tests.rs
index e1f8dfccef..d918faffcd 100644
--- a/crates/aft/src/commands/bash_watch_keepalive_tests.rs
+++ b/crates/aft/src/commands/bash_watch_keepalive_tests.rs
@@ -27,7 +27,7 @@ impl QuietWatch {
         ));
         let spawn: RawRequest = serde_json::from_value(json!({
             "id":"quiet-child", "command":"bash", "session_id":SESSION,
-            "params":{"command":"while [ ! -f release ]; do sleep 0.02; done; exit 7", "background":true, "timeout":30_000}
+            "params":{"command":format!("{}; exit 7", crate::test_gate::gate("release", "sleep 0.02")), "background":true, "timeout":30_000}
         })).unwrap();
         let launched = crate::commands::bash::handle(&spawn, &ctx);
         assert!(launched.success, "{launched:?}");
diff --git a/crates/aft/src/commands/glob.rs b/crates/aft/src/commands/glob.rs
index 130a41d6d8..7f41d3637e 100644
--- a/crates/aft/src/commands/glob.rs
+++ b/crates/aft/src/commands/glob.rs
@@ -439,7 +439,11 @@ fn handle_glob_inner(req: &RawRequest, ctx: &AppContext) -> Response {
         }
     }
 
-    Response::success(&req.id, body)
+    let mut response = Response::success(&req.id, body);
+    if source == "index" {
+        crate::data_layer::surfaces::disclose_index_gaps(ctx, &search_roots, &mut response);
+    }
+    response
 }
 
 fn named_ignored_root(
@@ -619,74 +623,32 @@ fn glob_root(
             }
         }
     }
-    let indexed_snapshot: Option<std::sync::Arc<crate::search_index::SearchIndexSnapshot>> = None;
-    let index_covers_root = indexed_snapshot
-        .as_ref()
-        .is_some_and(|snapshot| snapshot.has_file_in_scope(&search_scope.root));
-    let indexed = indexed_snapshot.map(|snapshot| {
-        let (files, scope_has_files, entries_visited) =
-            snapshot.glob_profiled(pattern, &search_scope.root, false);
-        let indexed_mtimes = files
-            .iter()
-            .filter_map(|path| {
-                snapshot
-                    .file_modified(path)
-                    .map(|time| (path.clone(), time))
-            })
-            .collect();
-        GlobDiscovery {
-            entries_visited,
-            files,
-            indexed_mtimes,
-            walk_truncated: false,
-            walk_time_limit_reached: false,
-            source: "index",
-            walk_time: Duration::ZERO,
-            scope_has_files,
-            scope_probe: Duration::ZERO,
-            skipped_foreign_mounts: 0,
+    if !search_scope.use_index && !ignored_target {
+        let walk_started = Instant::now();
+        if let Some(outcome) = super::grep::ripgrep_glob(&search_scope.root, pattern, max_results) {
+            let walk_time = walk_started.elapsed();
+            let scope_started = Instant::now();
+            let scope_has_files = !outcome.files.is_empty() || outcome.walk_truncated;
+            return Ok(GlobDiscovery {
+                files: outcome.files,
+                indexed_mtimes: HashMap::new(),
+                walk_truncated: outcome.walk_truncated,
+                walk_time_limit_reached: outcome.walk_time_limit_reached,
+                source: "fallback",
+                entries_visited: outcome.entries_visited,
+                walk_time,
+                scope_has_files,
+                scope_probe: scope_started.elapsed(),
+                skipped_foreign_mounts: 0,
+            });
         }
-    });
-    Ok(match indexed {
-        Some(discovery)
-            if index_covers_root
-                || crate::grep_executor::is_same_directory(&search_scope.root, project_root) =>
-        {
-            discovery
-        }
-        // The index is ready but holds no file under this explicitly named
-        // subdirectory: an ignore rule keeps it out of the index (a gitignored
-        // `node_modules/pkg`, for example) or it is a symlinked directory the
-        // index walk never follows. Walk it rather than report zero files; the
-        // walk applies ignore rules only to entries nested inside the named
-        // root. A project-wide glob answers from the index even when empty.
-        Some(_) => fallback_glob(project_root, &search_scope.root, pattern, ignored_target),
-        None => {
-            if !search_scope.use_index && !ignored_target {
-                let walk_started = Instant::now();
-                if let Some(outcome) =
-                    super::grep::ripgrep_glob(&search_scope.root, pattern, max_results)
-                {
-                    let walk_time = walk_started.elapsed();
-                    let scope_started = Instant::now();
-                    let scope_has_files = !outcome.files.is_empty() || outcome.walk_truncated;
-                    return Ok(GlobDiscovery {
-                        files: outcome.files,
-                        indexed_mtimes: HashMap::new(),
-                        walk_truncated: outcome.walk_truncated,
-                        walk_time_limit_reached: outcome.walk_time_limit_reached,
-                        source: "fallback",
-                        entries_visited: outcome.entries_visited,
-                        walk_time,
-                        scope_has_files,
-                        scope_probe: scope_started.elapsed(),
-                        skipped_foreign_mounts: 0,
-                    });
-                }
-            }
-            fallback_glob(project_root, &search_scope.root, pattern, ignored_target)
-        }
-    })
+    }
+    Ok(fallback_glob(
+        project_root,
+        &search_scope.root,
+        pattern,
+        ignored_target,
+    ))
 }
 
 /// [`glob_root`] answered from the data layer's view of the checkout: the
diff --git a/crates/aft/src/commands/grep.rs b/crates/aft/src/commands/grep.rs
index 5572290677..db1b333040 100644
--- a/crates/aft/src/commands/grep.rs
+++ b/crates/aft/src/commands/grep.rs
@@ -516,7 +516,16 @@ fn handle_grep_inner(req: &RawRequest, ctx: &AppContext) -> Response {
         }
     }
 
-    Response::success(&req.id, body)
+    let mut response = Response::success(&req.id, body);
+    if matches!(result.index_status, crate::search_index::IndexStatus::Ready) {
+        let roots = scope
+            .roots
+            .iter()
+            .map(|root| root.search_root.clone())
+            .collect::<Vec<_>>();
+        crate::data_layer::surfaces::disclose_index_gaps(ctx, &roots, &mut response);
+    }
+    response
 }
 
 /// `{"trigram": {status, reason}}` for grep/glob responses, from the shared
diff --git a/crates/aft/src/commands/mod.rs b/crates/aft/src/commands/mod.rs
index 2c676616f6..3c2f1ab64e 100644
--- a/crates/aft/src/commands/mod.rs
+++ b/crates/aft/src/commands/mod.rs
@@ -79,6 +79,8 @@ pub mod undo;
 pub mod untrust_filter_project;
 pub(crate) mod url_output;
 mod url_resolution;
+#[cfg(all(test, unix))]
+pub(crate) use url_resolution::with_secret_fetch_for_test;
 pub mod write;
 pub mod writes_census;
 pub mod zoom;
diff --git a/crates/aft/src/commands/semantic_search/external_disk_check.rs b/crates/aft/src/commands/semantic_search/external_disk_check.rs
index 8566600dc0..553a2d7ecf 100644
--- a/crates/aft/src/commands/semantic_search/external_disk_check.rs
+++ b/crates/aft/src/commands/semantic_search/external_disk_check.rs
@@ -1,24 +1,10 @@
-//! Checking another project's saved search index against its files on disk.
+//! Bounded text corpus for explicit patterns in an unpublished external repository.
 //!
-//! `aft_search` with a `path` in another project answers from that project's
-//! saved AFT index when one exists. Nothing in this session refreshes that
-//! index, and opening it only parses the saved file, so a file edited, added
-//! or deleted since the index was saved would otherwise be answered from what
-//! it held then, or not at all.
-//!
-//! Before such an index answers a query, [`check_against_disk`] walks the
-//! project once, checking a deadline at every walk entry, and compares each
-//! file's size and modification time with the index's record of it:
-//!
-//! - unchanged files keep the saved postings and are not read;
-//! - changed and new files are read from disk into an in-memory copy of the
-//!   index (the saved file is never written), source files first, under a
-//!   second deadline;
-//! - files the index lists but the finished walk did not find are dropped.
-//!
-//! The returned [`DiskCheck`] says how many files were examined and whether the
-//! walk and the re-reading finished, so the reply can say whether its answer
-//! reflects every file on disk or only part of the project.
+//! Published repositories are read through `ExternalSearch` and the index store.
+//! Only the unpublished pattern fallback builds an ephemeral trigram corpus:
+//! it walks with a deadline, reads source before docs under a second deadline,
+//! and reports incomplete coverage when either budget runs out. It never reads
+//! a saved legacy index or publishes anything to the target repository.
 
 use std::cell::Cell;
 use std::path::{Path, PathBuf};
@@ -27,14 +13,13 @@ use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use super::external_exact::classify_file;
 use crate::search_index::SearchIndex;
-use crate::semantic_index::SemanticIndex;
 
 /// Time allowed for walking the project and comparing file metadata.
 const WALK_BUDGET: Duration = Duration::from_secs(2);
 /// Time allowed, after the walk, for reading changed and new files.
 const REREAD_BUDGET: Duration = Duration::from_secs(1);
 
-/// Walk budget, re-read budget and reuse window.
+/// Separate budgets for walking the root and reading its files.
 #[derive(Clone, Copy, Debug)]
 pub(crate) struct Budgets {
     pub walk: Duration,
@@ -45,11 +30,6 @@ thread_local! {
     static BUDGETS_FOR_TEST: Cell<Option<Budgets>> = const { Cell::new(None) };
 }
 
-#[cfg(test)]
-thread_local! {
-    static WALKS_FOR_TEST: Cell<usize> = const { Cell::new(0) };
-}
-
 /// The budgets, overridable per thread by tests.
 pub(super) fn budgets() -> Budgets {
     BUDGETS_FOR_TEST.with(Cell::get).unwrap_or(Budgets {
@@ -58,42 +38,23 @@ pub(super) fn budgets() -> Budgets {
     })
 }
 
-/// What comparing a saved index with the files on disk found. Every count
-/// describes the checked copy that answers the query, measured against the
-/// saved index, so a copy completed over several passes reports all of them.
+/// Coverage of the bounded walk and reads used by one pattern request.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub(crate) struct DiskCheck {
-    /// Files the latest walk reached and compared with the copy.
+    /// Files reached before the walk deadline.
     pub files_examined: usize,
     /// The latest walk reached every file under the root before its deadline.
     pub walk_complete: bool,
-    /// Saved files whose bytes on disk differ from the saved index; the copy
-    /// holds their current content.
-    pub changed: usize,
-    /// Saved files whose modification time differs from the saved index but
-    /// whose bytes, hashed, are the same; their saved postings still answer.
-    pub content_unchanged: usize,
-    /// Files on disk the saved index has no record of.
+    /// Files admitted to the corpus or still awaiting a read.
     pub added: usize,
-    /// Saved files the finished walk did not find. Only counted when the walk
-    /// completed: an unfinished walk cannot tell missing from unvisited.
-    pub removed: usize,
-    /// Changed or new files whose current content the copy holds.
+    /// Files whose current content the corpus holds.
     pub reread: usize,
-    /// Files whose size or modification time differs from the copy and that
-    /// were neither hashed nor read before the deadline; the copy still
-    /// answers for them as the saved index does (or, for new files, does not
-    /// know them).
+    /// Walked files not read before the read deadline.
     pub not_reread: usize,
-    /// Examined files the saved semantic index describes with older content,
-    /// plus new files it has no vectors for. Zero when no semantic index was
-    /// given.
-    pub semantic_outdated: usize,
 }
 
 impl DiskCheck {
-    /// True when every file on disk was compared and every difference was
-    /// read, so the checked index answers exactly as the files are now.
+    /// True when the walk finished and every reached file had a read attempted.
     pub(super) fn verified(&self) -> bool {
         self.walk_complete && self.not_reread == 0
     }
@@ -103,40 +64,34 @@ impl DiskCheck {
             "complete": self.verified(),
             "files_examined": self.files_examined,
             "walk_complete": self.walk_complete,
-            "changed": self.changed,
-            "content_unchanged": self.content_unchanged,
+            // Keep the public coverage shape; this corpus has no saved predecessor.
+            "changed": 0,
+            "content_unchanged": 0,
             "added": self.added,
-            "removed": self.removed,
+            "removed": 0,
             "reread": self.reread,
             "not_reread": self.not_reread,
-            "semantic_outdated": self.semantic_outdated,
+            "semantic_outdated": 0,
         })
     }
 }
 
-/// A saved index brought in line with the disk as far as the budgets allowed.
+/// The ephemeral pattern index and the coverage of the reads that built it.
 #[derive(Clone, Debug)]
 pub(crate) struct CheckedIndex {
-    /// The saved index itself when nothing differed, otherwise an in-memory
-    /// copy with the differences applied.
+    /// Only the files the bounded walk read; never persisted.
     pub index: Arc<SearchIndex>,
     pub check: DiskCheck,
-    /// Stable digest of the differences that were applied, `None` when none
-    /// were. Two queries over the same unchanged files get the same digest, so
-    /// caches keyed by index generation stay usable without mixing versions.
+    /// Stable digest of the admitted paths and their observed stats, or `None`
+    /// for an empty corpus; keeps ranking caches tied to the files read.
     pub applied_digest: Option<String>,
 }
 
-/// Changed files whose size still matches are hashed this many at a time, so
-/// the re-read deadline is checked between batches.
-const VERIFY_BATCH: usize = 512;
-
 #[cfg(test)]
 thread_local! {
-    /// Most hashed or read files one check may handle, standing in for the
-    /// re-read deadline in tests that need a pass to stop at a known point.
+    /// Maximum read attempts in one corpus build, standing in for the read
+    /// deadline in tests that need a pass to stop at a known point.
     static WORK_LIMIT_FOR_TEST: Cell<Option<usize>> = const { Cell::new(None) };
-    static REINDEXES_FOR_TEST: Cell<usize> = const { Cell::new(0) };
 }
 
 fn work_limit() -> usize {
@@ -152,60 +107,24 @@ struct WalkedFile {
     path: PathBuf,
     size: u64,
     modified: SystemTime,
-    /// Its size or modification time differs from the copy being checked.
-    differs: bool,
-    /// The difference was resolved: hashed and found unchanged, or read.
+    /// A read was attempted before the deadline.
     resolved: bool,
 }
 
-/// Compare the files under `root` with the saved index `saved` and bring a
-/// copy of it in line with them.
-///
-/// `previous`, when given, is the copy an earlier check of this same saved
-/// index produced. The walk then compares the disk with that copy, so only
-/// what changed since, or what the earlier check had no time for, is hashed
-/// or read. The counts in the result always compare the final copy with
-/// `saved`, however many passes built it.
-///
-/// A file whose size still matches but whose modification time differs (every
-/// file of a fresh checkout or worktree) is hashed first and compared with
-/// the content hash the index recorded; only a real content difference is
-/// re-indexed. Hashing and reading share the re-read deadline.
-///
-/// `semantic`, when given, is the project's saved semantic index; files it
-/// describes with older content are counted in
-/// [`DiskCheck::semantic_outdated`] (vectors cannot be recomputed here).
-pub(super) fn check_against_disk(
-    saved: &Arc<SearchIndex>,
-    previous: Option<&Arc<SearchIndex>>,
-    root: &Path,
-    semantic: Option<&SemanticIndex>,
-) -> CheckedIndex {
+/// Build the unpublished external pattern corpus with bounded, source-first reads.
+/// Published repositories are served by `ExternalSearch` instead; this corpus
+/// starts empty on every request and is never saved to the target repository.
+pub(super) fn collect_bounded_corpus(root: &Path) -> CheckedIndex {
     let budgets = budgets();
-    #[cfg(test)]
-    WALKS_FOR_TEST.with(|walks| walks.set(walks.get() + 1));
-    let base = previous.unwrap_or(saved);
-    let base_is_saved = Arc::ptr_eq(base, saved);
     let walk_deadline = Instant::now() + budgets.walk;
     let stop_requested =
         |deadline: Instant| Instant::now() >= deadline || crate::executor::current_job_cancelled();
-
     let mut check = DiskCheck::default();
-    let mut walked: Vec<WalkedFile> = Vec::new();
-    let mut seen_base = vec![false; base.files.len()];
-    let mut seen_saved = if base_is_saved {
-        Vec::new()
-    } else {
-        vec![false; saved.files.len()]
-    };
-    let mut walk_complete = true;
-    // `SearchIndex::build` enumerates files with this same walker
-    // (`project_walk_builder`, which honours .gitignore and .aftignore and
-    // skips build directories), so a path this walk skips is one the index
-    // never held either, and a file the finished walk does not reach is gone.
+    let mut walked = Vec::new();
+    check.walk_complete = true;
     for entry in crate::search_index::project_walk_builder(root).build() {
         if stop_requested(walk_deadline) {
-            walk_complete = false;
+            check.walk_complete = false;
             break;
         }
         let Ok(entry) = entry else { continue };
@@ -215,227 +134,62 @@ pub(super) fn check_against_disk(
         let Ok(metadata) = entry.metadata() else {
             continue;
         };
-        let size = metadata.len();
-        let modified = metadata.modified().unwrap_or(UNIX_EPOCH);
-        let path = entry.path();
-        let in_base = base.path_to_id.get(path).copied();
-        if let Some(slot) = in_base.and_then(|file_id| seen_base.get_mut(file_id as usize)) {
-            *slot = true;
-        }
-        let in_saved = if base_is_saved {
-            in_base.is_some()
-        } else {
-            let file_id = saved.path_to_id.get(path).copied();
-            if let Some(slot) = file_id.and_then(|file_id| seen_saved.get_mut(file_id as usize)) {
-                *slot = true;
-            }
-            file_id.is_some()
-        };
-        let matches_base = in_base
-            .and_then(|file_id| base.files.get(file_id as usize))
-            .is_some_and(|recorded| recorded.size == size && recorded.modified == modified);
-        if let Some(semantic) = semantic {
-            let outdated = match semantic.recorded_stat(path) {
-                Some((recorded_mtime, recorded_size)) => {
-                    recorded_mtime != modified
-                        || recorded_size.is_some_and(|recorded| recorded != size)
-                }
-                None => !in_saved,
-            };
-            if outdated {
-                check.semantic_outdated += 1;
-            }
-        }
         walked.push(WalkedFile {
-            path: path.to_path_buf(),
-            size,
-            modified,
-            differs: !matches_base,
+            path: entry.path().to_path_buf(),
+            size: metadata.len(),
+            modified: metadata.modified().unwrap_or(UNIX_EPOCH),
             resolved: false,
         });
     }
     check.files_examined = walked.len();
-    check.walk_complete = walk_complete;
-
-    let unseen = |index: &SearchIndex, seen: &[bool]| -> Vec<PathBuf> {
-        index
-            .files
-            .iter()
-            .zip(seen)
-            .filter(|(entry, seen)| !**seen && !entry.path.as_os_str().is_empty())
-            .map(|(entry, _)| entry.path.clone())
-            .collect()
-    };
-    let (removed_from_base, removed_from_saved) = if !walk_complete {
-        (Vec::new(), Vec::new())
-    } else if base_is_saved {
-        let removed = unseen(base, &seen_base);
-        (removed.clone(), removed)
-    } else {
-        (unseen(base, &seen_base), unseen(saved, &seen_saved))
-    };
-
-    let mut work: Vec<usize> = (0..walked.len()).filter(|&i| walked[i].differs).collect();
-    let mut copy = None;
-    if !work.is_empty() || !removed_from_base.is_empty() {
-        let mut overlay = SearchIndex::clone(base);
-        for path in &removed_from_base {
-            overlay.remove_file(path);
+    let mut work: Vec<usize> = (0..walked.len()).collect();
+    work.sort_by_cached_key(|&i| (classify_file(&walked[i].path), walked[i].path.clone()));
+    let deadline = Instant::now() + budgets.reread;
+    let mut index = SearchIndex::empty_ready_for_root(root);
+    let mut remaining = work_limit();
+    for &i in &work {
+        if stop_requested(deadline) || remaining == 0 {
+            break;
         }
-        resolve_differences(&mut overlay, &mut walked, &mut work, budgets.reread);
-        copy = Some(overlay);
+        remaining -= 1;
+        index.update_file(&walked[i].path);
+        walked[i].resolved = true;
     }
-
-    // Describe the final copy against the saved index.
-    let current: &SearchIndex = copy.as_ref().unwrap_or(base.as_ref());
-    let mut digest_entries: Vec<(&Path, u64, SystemTime)> = Vec::new();
+    let mut digest_entries = Vec::new();
     for file in &walked {
-        let recorded = saved
-            .path_to_id
-            .get(&file.path)
-            .and_then(|&file_id| saved.files.get(file_id as usize));
-        if file.differs && !file.resolved {
+        if !file.resolved {
             check.not_reread += 1;
-            if recorded.is_none() {
-                check.added += 1;
-            }
-            continue;
-        }
-        let held = current
-            .path_to_id
-            .get(&file.path)
-            .and_then(|&file_id| current.files.get(file_id as usize));
-        let Some(held) = held else {
-            // Gone between the walk and the read.
-            continue;
-        };
-        match recorded {
-            None => {
-                check.added += 1;
-                check.reread += 1;
-                digest_entries.push((&file.path, file.size, file.modified));
-            }
-            Some(recorded) if recorded.size == file.size && recorded.modified == file.modified => {}
-            Some(recorded) if recorded.content_hash == held.content_hash => {
-                check.content_unchanged += 1;
-            }
-            Some(_) => {
-                check.changed += 1;
-                check.reread += 1;
-                digest_entries.push((&file.path, file.size, file.modified));
-            }
+            check.added += 1;
+        } else if index.path_to_id.contains_key(&file.path) {
+            check.added += 1;
+            check.reread += 1;
+            digest_entries.push((&file.path, file.size, file.modified));
         }
     }
-    check.removed = removed_from_saved.len();
-
-    let applied_digest =
-        (!digest_entries.is_empty() || !removed_from_saved.is_empty()).then(|| {
-            digest_entries.sort();
-            let mut removed: Vec<&PathBuf> = removed_from_saved.iter().collect();
-            removed.sort();
-            let mut digest = blake3::Hasher::new();
-            for path in removed {
-                digest.update(b"-");
-                digest.update(path.as_os_str().as_encoded_bytes());
-            }
-            for (path, size, modified) in digest_entries {
-                digest.update(b"+");
-                digest.update(path.as_os_str().as_encoded_bytes());
-                digest.update(&size.to_le_bytes());
-                let since_epoch = modified.duration_since(UNIX_EPOCH).unwrap_or_default();
-                digest.update(&since_epoch.as_nanos().to_le_bytes());
-            }
-            digest.finalize().to_hex()[..16].to_string()
-        });
-
+    let applied_digest = (!digest_entries.is_empty()).then(|| {
+        digest_entries.sort();
+        let mut digest = blake3::Hasher::new();
+        for (path, size, modified) in digest_entries {
+            digest.update(b"+");
+            digest.update(path.as_os_str().as_encoded_bytes());
+            digest.update(&size.to_le_bytes());
+            digest.update(
+                &modified
+                    .duration_since(UNIX_EPOCH)
+                    .unwrap_or_default()
+                    .as_nanos()
+                    .to_le_bytes(),
+            );
+        }
+        digest.finalize().to_hex()[..16].to_string()
+    });
     CheckedIndex {
-        index: copy.map(Arc::new).unwrap_or_else(|| Arc::clone(base)),
+        index: Arc::new(index),
         check,
         applied_digest,
     }
 }
 
-/// Hash or read the walked files listed in `work` into `copy`, program source
-/// first, until `budget` runs out. Files whose size matches the copy's record
-/// are hashed in parallel batches and only re-indexed when their bytes
-/// differ; a hash match just records the new modification time, so the next
-/// check of this copy sees the file as unchanged.
-fn resolve_differences(
-    copy: &mut SearchIndex,
-    walked: &mut [WalkedFile],
-    work: &mut [usize],
-    budget: Duration,
-) {
-    use crate::cache_freshness::{FileFreshness, FreshnessVerdict, VerifyStrategy};
-
-    // Read program source before documentation and data files (the
-    // `classify_file` order), so if the deadline stops the re-read, the files
-    // a code search most needs current are the ones already read.
-    work.sort_by_cached_key(|&i| (classify_file(&walked[i].path), walked[i].path.clone()));
-    let deadline = Instant::now() + budget;
-    let stop_requested = || Instant::now() >= deadline || crate::executor::current_job_cancelled();
-    let mut remaining = work_limit();
-    for batch in work.chunks(VERIFY_BATCH) {
-        if stop_requested() || remaining == 0 {
-            return;
-        }
-        let batch = &batch[..batch.len().min(remaining)];
-        remaining -= batch.len();
-        let mut to_hash = Vec::new();
-        let mut to_read = Vec::new();
-        for &i in batch {
-            let file = &walked[i];
-            let recorded = copy
-                .path_to_id
-                .get(&file.path)
-                .and_then(|&file_id| copy.files.get(file_id as usize));
-            match recorded {
-                Some(recorded) if recorded.size == file.size => to_hash.push((
-                    i,
-                    file.path.clone(),
-                    FileFreshness {
-                        mtime: recorded.modified,
-                        size: recorded.size,
-                        content_hash: recorded.content_hash,
-                    },
-                )),
-                _ => to_read.push(i),
-            }
-        }
-        for (i, path, verdict) in
-            crate::cache_freshness::verify_files_bounded(to_hash, VerifyStrategy::StatFirst)
-        {
-            match verdict {
-                FreshnessVerdict::HotFresh => walked[i].resolved = true,
-                FreshnessVerdict::ContentFresh {
-                    new_mtime,
-                    new_size,
-                } => {
-                    if let Some(&file_id) = copy.path_to_id.get(&path) {
-                        if let Some(entry) =
-                            Arc::make_mut(&mut copy.files).get_mut(file_id as usize)
-                        {
-                            entry.modified = new_mtime;
-                            entry.size = new_size;
-                        }
-                    }
-                    walked[i].resolved = true;
-                }
-                FreshnessVerdict::Stale | FreshnessVerdict::Deleted => to_read.push(i),
-            }
-        }
-        for i in to_read {
-            if stop_requested() {
-                return;
-            }
-            #[cfg(test)]
-            REINDEXES_FOR_TEST.with(|count| count.set(count.get() + 1));
-            copy.update_file(&walked[i].path);
-            walked[i].resolved = true;
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -452,16 +206,44 @@ mod tests {
     }
 
     #[test]
-    fn unchanged_project_is_verified_and_keeps_the_saved_index() {
-        let (_dir, root) = project(&[("src/lib.rs", "pub fn kept_needle() {}\n")]);
-        let index = Arc::new(SearchIndex::build(&root));
-
-        let checked = check_against_disk(&index, None, &root, None);
+    fn unpublished_pattern_corpus_is_bounded_and_source_first() {
+        let (_dir, root) = project(&[
+            ("a.md", "needle in docs\n"),
+            ("src/z.rs", "pub fn needle() {}\n"),
+        ]);
+        WORK_LIMIT_FOR_TEST.with(|limit| limit.set(Some(1)));
+        let checked = collect_bounded_corpus(&root);
+        WORK_LIMIT_FOR_TEST.with(|limit| limit.set(None));
+
+        assert!(!checked.check.verified(), "{:?}", checked.check);
+        assert_eq!(checked.check.files_examined, 2);
+        assert_eq!(checked.check.added, 2);
+        assert_eq!(checked.check.reread, 1);
+        assert_eq!(checked.check.not_reread, 1);
+        assert!(checked
+            .index
+            .path_to_id
+            .contains_key(&root.join("src/z.rs")));
+        assert!(!checked.index.path_to_id.contains_key(&root.join("a.md")));
+    }
 
+    #[test]
+    fn unpublished_pattern_corpus_reports_complete_coverage() {
+        let (_dir, root) = project(&[("src/lib.rs", "pub fn kept_needle() {}\n")]);
+        let checked = collect_bounded_corpus(&root);
         assert!(checked.check.verified(), "{:?}", checked.check);
         assert_eq!(checked.check.files_examined, 1);
-        assert_eq!(checked.check.changed + checked.check.added, 0);
-        assert!(Arc::ptr_eq(&checked.index, &index));
-        assert!(checked.applied_digest.is_none());
+        assert_eq!(checked.check.added, 1);
+        assert_eq!(checked.check.reread, 1);
+        assert!(checked.applied_digest.is_some());
+        let data = checked.check.to_json();
+        for key in [
+            "changed",
+            "content_unchanged",
+            "removed",
+            "semantic_outdated",
+        ] {
+            assert_eq!(data[key], 0, "{data}");
+        }
     }
 }
diff --git a/crates/aft/src/commands/semantic_search/external_pattern.rs b/crates/aft/src/commands/semantic_search/external_pattern.rs
index 89e6e54339..80b3bee9a9 100644
--- a/crates/aft/src/commands/semantic_search/external_pattern.rs
+++ b/crates/aft/src/commands/semantic_search/external_pattern.rs
@@ -167,8 +167,7 @@ pub(super) fn handle(
     }
     // A bounded, ignore-aware walk reads the project's files into an
     // in-memory index; nothing is saved to the other project's storage.
-    let empty = SearchIndex::empty_ready_for_root(root);
-    let checked = external_disk_check::check_against_disk(&Arc::new(empty), None, root, None);
+    let checked = external_disk_check::collect_bounded_corpus(root);
     let generation = GenerationToken::new_with_str(&format!(
         "external:walk:{}",
         checked.applied_digest.as_deref().unwrap_or("empty"),
diff --git a/crates/aft/src/commands/semantic_search/mod.rs b/crates/aft/src/commands/semantic_search/mod.rs
index 8e53456f3b..1c9c3a55b8 100644
--- a/crates/aft/src/commands/semantic_search/mod.rs
+++ b/crates/aft/src/commands/semantic_search/mod.rs
@@ -660,6 +660,7 @@ pub fn handle_semantic_search(req: &RawRequest, ctx: &AppContext) -> Response {
             response.data["text"] = serde_json::json!(format!("{line}\n\n{output}"));
         }
     }
+    disclose_skipped_folders(req, ctx, &mut response);
     response
 }
 
@@ -667,11 +668,26 @@ pub fn handle_semantic_search(req: &RawRequest, ctx: &AppContext) -> Response {
 /// must still run the bounded exact/lexical scan while the indexes warm.
 pub(crate) fn handle_parent_child_search(req: &RawRequest, ctx: &AppContext) -> Response {
     let config = ctx.config();
-    handle_semantic_search_with_disk_fallback(
+    let mut response = handle_semantic_search_with_disk_fallback(
         req,
         ctx,
         config.indexes.trigram || config.indexes.semantic,
-    )
+    );
+    disclose_skipped_folders(req, ctx, &mut response);
+    response
+}
+
+fn disclose_skipped_folders(req: &RawRequest, ctx: &AppContext, response: &mut Response) {
+    let Some(root) = ctx.config().project_root.clone() else {
+        return;
+    };
+    let scope = req
+        .params
+        .get("path")
+        .and_then(serde_json::Value::as_str)
+        .map_or_else(|| root.clone(), |path| root.join(path));
+    let scope = std::fs::canonicalize(&scope).unwrap_or(scope);
+    crate::data_layer::surfaces::disclose_index_gaps(ctx, &[scope], response);
 }
 
 thread_local! {
@@ -3871,22 +3887,12 @@ fn matching_line_in_text(
     symbol_range: Option<SymbolOffsetRange>,
 ) -> Option<(u32, String)> {
     let _cost = telemetry::CostPhase::start("matching_line");
-    static CACHE: std::sync::OnceLock<MatchingSourceCache> = std::sync::OnceLock::new();
-    let prepare_cost = telemetry::CostPhase::start("matching_prepare");
-    let prepare_wait = waits::time(waits::SearchWait::MatchingPrepare);
-    let prepared = CACHE
-        .get_or_init(|| MatchingSourceCache::new(32 * 1024 * 1024))
-        .prepare(source);
-    drop(prepare_cost);
-    drop(prepare_wait);
+    telemetry::cost_count("matching_calls", 1);
     let phrase_cost = telemetry::CostPhase::start("matching_phrase");
     let phrase_wait = waits::time(waits::SearchWait::MatchingPhrase);
     let normalized_phrase = exact_lane::normalize_exact_phrase(exact_lane::exact_phrase(query));
     if !normalized_phrase.is_empty() {
-        if let Some((line_index, line)) = source.lines().enumerate().find(|(index, _)| {
-            prepared.normalized[prepared.lines[*index].normalized.clone()]
-                .contains(&normalized_phrase)
-        }) {
+        if let Some((line_index, line)) = matching_phrase_line(source, &normalized_phrase) {
             // The phrase matched after whitespace normalization, so its first
             // word locates the match in the raw line.
             let anchor = normalized_phrase
@@ -3915,6 +3921,17 @@ fn matching_line_in_text(
         })
         .filter(|token| token.len() >= 3)
         .collect::<Vec<_>>();
+    if compact_tokens.is_empty() {
+        return line_at_offset(source, symbol_range?.start);
+    }
+    static CACHE: std::sync::OnceLock<MatchingSourceCache> = std::sync::OnceLock::new();
+    let prepare_cost = telemetry::CostPhase::start("matching_prepare");
+    let prepare_wait = waits::time(waits::SearchWait::MatchingPrepare);
+    let prepared = CACHE
+        .get_or_init(|| MatchingSourceCache::new(32 * 1024 * 1024))
+        .prepare(source);
+    drop(prepare_cost);
+    drop(prepare_wait);
     let best_cost = telemetry::CostPhase::start("matching_best_line");
     let best_wait = waits::time(waits::SearchWait::MatchingBestLine);
     let best = prepared.best_line(source, &compact_tokens);
@@ -3939,51 +3956,93 @@ fn matching_line_in_text(
     line_at_offset(source, symbol_range?.start)
 }
 
+fn matching_phrase_line<'a>(source: &'a str, phrase: &str) -> Option<(usize, &'a str)> {
+    let word = phrase.split(' ').next()?;
+    let first = *word.as_bytes().first()?;
+    let bytes = source.as_bytes();
+    let mut after_line = 0;
+    let mut line_index = 0;
+    let mut normalized = String::new();
+    // Whitespace folding cannot create a word. Find its raw bytes first and
+    // normalize only lines containing it; ASCII case folding preserves offsets
+    // and leaves non-ASCII bytes unchanged, just like phrase normalization.
+    for start in memchr::memchr2_iter(first, first.to_ascii_uppercase(), bytes) {
+        if start < after_line
+            || !bytes[start..]
+                .get(..word.len())
+                .is_some_and(|candidate| candidate.eq_ignore_ascii_case(word.as_bytes()))
+        {
+            continue;
+        }
+        let preceding = &bytes[after_line..start];
+        line_index += memchr::memchr_iter(b'\n', preceding).count();
+        let line_start = memchr::memrchr(b'\n', preceding)
+            .map_or(after_line, |newline| after_line + newline + 1);
+        let line_end =
+            memchr::memchr(b'\n', &bytes[start..]).map_or(bytes.len(), |newline| start + newline);
+        let raw = &source[line_start..line_end];
+        let line = if line_end < bytes.len() {
+            raw.strip_suffix('\r').unwrap_or(raw)
+        } else {
+            raw
+        };
+        telemetry::cost_count("matching_phrase_lines_prepared", 1);
+        #[cfg(test)]
+        MATCHING_PHRASE_LINES_PREPARED.with(|count| count.set(count.get() + 1));
+        normalized.clear();
+        exact_lane::push_normalized_exact_phrase(line, &mut normalized);
+        if normalized.contains(phrase) {
+            return Some((line_index, line));
+        }
+        after_line = line_end.saturating_add(1);
+        line_index += 1;
+    }
+    None
+}
+
 struct MatchingContentLine {
-    normalized: std::ops::Range<usize>,
     compact: std::ops::Range<usize>,
     trigrams: std::sync::OnceLock<Box<[[u8; 3]]>>,
 }
 
 struct MatchingSource {
     lines: Vec<MatchingContentLine>,
-    normalized: String,
     compact: String,
 }
 
 impl MatchingSource {
     fn new(source: &str) -> Self {
-        // Two source-wide buffers avoid allocating and freeing two strings
-        // per line while concurrent searches churn the bounded content cache.
-        // Ranges keep line boundaries: neither phrase nor trigram matches may
-        // cross a newline, even though adjacent lines share an allocation.
-        let mut normalized = String::new();
+        let _cost = telemetry::CostPhase::start("matching_source_new");
+        // The fuzzy scorer needs compact text only after the phrase scan misses.
+        // Pack it in one buffer, keeping line boundaries so trigrams cannot
+        // cross a newline. Phrase normalization needs no retained per-line text.
         let mut compact = String::new();
         let lines = source
             .lines()
             .map(|line| {
-                let normalized_start = normalized.len();
-                exact_lane::push_normalized_exact_phrase(line, &mut normalized);
+                telemetry::cost_count("matching_lines_prepared", 1);
                 let compact_start = compact.len();
-                compact.extend(
-                    line.chars()
-                        .filter(|ch| ch.is_alphanumeric())
-                        .flat_map(char::to_lowercase),
-                );
+                if line.is_ascii() {
+                    compact.extend(
+                        line.bytes()
+                            .filter(u8::is_ascii_alphanumeric)
+                            .map(|byte| byte.to_ascii_lowercase() as char),
+                    );
+                } else {
+                    compact.extend(
+                        line.chars()
+                            .filter(|ch| ch.is_alphanumeric())
+                            .flat_map(char::to_lowercase),
+                    );
+                }
                 MatchingContentLine {
-                    normalized: normalized_start..normalized.len(),
                     compact: compact_start..compact.len(),
                     trigrams: std::sync::OnceLock::new(),
                 }
             })
             .collect();
-        normalized.shrink_to_fit();
         compact.shrink_to_fit();
-        Self {
-            lines,
-            normalized,
-            compact,
-        }
+        Self { lines, compact }
     }
 
     // Reserve the worst-case trigram storage before lazy initialization, so
@@ -3991,7 +4050,6 @@ impl MatchingSource {
     fn retained_bytes(&self) -> usize {
         std::mem::size_of::<Self>()
             + self.lines.capacity() * std::mem::size_of::<MatchingContentLine>()
-            + self.normalized.capacity()
             + self.compact.capacity()
             + self
                 .lines
@@ -4012,6 +4070,7 @@ impl MatchingSource {
         let mut best_score = 0_usize;
         let mut missing = Vec::with_capacity(tokens.len());
         for (index, (line, prepared)) in source.lines().zip(&self.lines).enumerate() {
+            telemetry::cost_count("matching_best_lines_used", 1);
             let compact = &self.compact[prepared.compact.clone()];
             missing.clear();
             let mut score = 0_usize;
@@ -4201,6 +4260,7 @@ fn best_content_line<'a>(
 #[cfg(test)]
 thread_local! {
     static MATCHING_LINE_TRIGRAM_VISITS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+    static MATCHING_PHRASE_LINES_PREPARED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 
 /// The line holding byte `offset` of `source`, as a 0-based line number and
@@ -4886,9 +4946,8 @@ fn run_engine_ranking(
     use telemetry::{ConfidenceTelemetry, TelemetryAssembler, TelemetryRun};
     use trailer::{ExactPassState, SearchTrailer};
 
-    // With the data layer running and its view's text plane ready, the
-    // lexical and exact lanes read that view; otherwise they read the legacy
-    // index, or the borrowed one of an external root.
+    // Published roots read their store's text plane. Only an unpublished
+    // external pattern request supplies an ephemeral, bounded corpus here.
     let data_text = borrowed_index
         .is_none()
         .then(|| crate::data_layer::tools::search::DataText::ready(ctx))
@@ -4908,7 +4967,6 @@ fn run_engine_ranking(
             return Err("request_cancelled".to_string());
         }
     }
-    let view_snapshot: Option<crate::search_index::SearchIndexSnapshot> = None;
     let empty_index = SearchIndex::new();
     let index = borrowed_index
         .map(|(index, _)| index)
@@ -4928,11 +4986,6 @@ fn run_engine_ranking(
     let generation = data_text
         .as_ref()
         .map(|text| GenerationToken::new_with_str(&with_meaning(text.generation())))
-        .or_else(|| {
-            view_snapshot.as_ref().map(|snapshot| {
-                GenerationToken::new_with_str(&with_meaning(snapshot.content_generation()))
-            })
-        })
         .or_else(|| borrowed_index.map(|(_, generation)| generation.clone()))
         .unwrap_or_else(|| {
             GenerationToken::new_with_str(&with_meaning(format!(
@@ -4940,8 +4993,8 @@ fn run_engine_ranking(
                 ctx.semantic_index_rx_generation()
             )))
         });
-    let index_ready = data_text.is_some() || view_snapshot.is_some() || index.is_ready();
-    let snapshot = view_snapshot.unwrap_or_else(|| index.snapshot());
+    let index_ready = data_text.is_some() || index.is_ready();
+    let snapshot = index.snapshot();
     let text_index = match &data_text {
         Some(text) => TextIndex::Data(text),
         None => TextIndex::Snapshot(&snapshot),
@@ -4952,7 +5005,7 @@ fn run_engine_ranking(
         .iter()
         .map(String::as_str)
         .collect::<Vec<_>>();
-    let query_trigrams = SearchIndex::query_trigrams_from_tokens(&token_refs);
+    let query_trigrams = crate::search_index::query_trigrams_from_tokens(&token_refs);
     // The lexical lane still ranks by the query's words, but only the tokens the
     // exact lane accepts may promote a lexical candidate to exact evidence; a
     // hyphenated literal has none, so only a file holding the whole string can.
@@ -12960,14 +13013,10 @@ mod tests {
     }
 
     #[test]
-    fn matching_line_packed_buffers_preserve_line_boundaries_and_normalization() {
+    fn matching_line_compact_buffer_preserves_line_boundaries_and_normalization() {
         let source = "  Alpha\tBETA \r\n\nİ café 中中中\u{2003}tail\nabc\ndef\n";
         let prepared = MatchingSource::new(source);
         for (line, stored) in source.lines().zip(&prepared.lines) {
-            assert_eq!(
-                &prepared.normalized[stored.normalized.clone()],
-                exact_lane::normalize_exact_phrase(line)
-            );
             assert_eq!(
                 &prepared.compact[stored.compact.clone()],
                 line.chars()
@@ -12976,7 +13025,6 @@ mod tests {
                     .collect::<String>()
             );
         }
-        assert_eq!(prepared.normalized.capacity(), prepared.normalized.len());
         assert_eq!(prepared.compact.capacity(), prepared.compact.len());
         let boundary = MatchingSource::new("ab\nc");
         assert_eq!(boundary.best_line("ab\nc", &["abc".into()]), None);
@@ -12990,6 +13038,82 @@ mod tests {
         );
     }
 
+    #[test]
+    fn matching_line_phrase_prepares_only_possible_lines() {
+        let mut source = "unrelated line\n".repeat(5_000);
+        source.push_str("TARGET wrong\r\n\n  target\tVALUE\r\ntarget value\n");
+        MATCHING_PHRASE_LINES_PREPARED.with(|count| count.set(0));
+        assert_eq!(
+            matching_phrase_line(&source, "target value"),
+            Some((5_002, "  target\tVALUE"))
+        );
+        assert_eq!(MATCHING_PHRASE_LINES_PREPARED.with(|count| count.get()), 2);
+        MATCHING_PHRASE_LINES_PREPARED.with(|count| count.set(0));
+        assert_eq!(matching_phrase_line(&source, "absent word"), None);
+        assert_eq!(MATCHING_PHRASE_LINES_PREPARED.with(|count| count.get()), 0);
+    }
+
+    #[test]
+    fn matching_line_phrase_prefilter_is_differentially_byte_identical() {
+        let glyphs = [
+            'a', 'A', 'b', 'c', 'é', 'É', 'İ', '中', '🙂', '_', ' ', '\t', '\r', '\n', '\u{2003}',
+        ];
+        let mut random = 0x7a31_5d09_4c2e_8b17_u64;
+        let mut next = || {
+            random ^= random << 13;
+            random ^= random >> 7;
+            random ^= random << 17;
+            random
+        };
+        for case in 0..400 {
+            let mut source = (0..(next() % 700))
+                .map(|_| glyphs[next() as usize % glyphs.len()])
+                .collect::<String>();
+            source.push_str("\r\n xxALPHA\tBeTA_suffix\nİ café 中中中\u{2003}tail\r\nlast\r");
+            for phrase in [
+                "alpha beta",
+                "é",
+                "É",
+                "İ café",
+                "中中中 tail",
+                "last",
+                "a",
+                " ",
+                "",
+                "missing",
+                "beTA_suffix",
+            ] {
+                let phrase = exact_lane::normalize_exact_phrase(phrase);
+                let expected = (!phrase.is_empty())
+                    .then(|| {
+                        source.lines().enumerate().find(|(_, line)| {
+                            exact_lane::normalize_exact_phrase(line).contains(&phrase)
+                        })
+                    })
+                    .flatten();
+                assert_eq!(
+                    matching_phrase_line(&source, &phrase),
+                    expected,
+                    "case {case}: {phrase:?}"
+                );
+            }
+        }
+        for source in [
+            "",
+            "\n",
+            "word\r",
+            "word\r\n",
+            "xxword word\n",
+            "\n\nword\n",
+        ] {
+            let expected = source
+                .lines()
+                .enumerate()
+                .find(|(_, line)| exact_lane::normalize_exact_phrase(line).contains("word"));
+            assert_eq!(matching_phrase_line(source, "word"), expected);
+        }
+    }
+
     #[test]
     fn matching_line_packed_storage_does_not_increase_cache_charge() {
         type LegacyLine = (String, String, std::sync::OnceLock<Box<[[u8; 3]]>>);
@@ -13023,9 +13147,9 @@ mod tests {
                     })
                     .sum::<usize>();
             let packed_bytes = MatchingSource::new(source).retained_bytes();
-            // Only the two source-wide String headers are new fixed overhead;
+            // Only the source-wide String header is new fixed overhead;
             // every nonempty line saves headers and per-string spare capacity.
-            assert!(packed_bytes <= legacy_bytes + 2 * std::mem::size_of::<String>());
+            assert!(packed_bytes <= legacy_bytes + std::mem::size_of::<String>());
             eprintln!("matching storage: {} source bytes, {legacy_bytes} legacy charge, {packed_bytes} packed charge", source.len());
         }
     }
diff --git a/crates/aft/src/commands/semantic_search/telemetry.rs b/crates/aft/src/commands/semantic_search/telemetry.rs
index e9f22a16f1..8cc24cb4c6 100644
--- a/crates/aft/src/commands/semantic_search/telemetry.rs
+++ b/crates/aft/src/commands/semantic_search/telemetry.rs
@@ -204,6 +204,7 @@ mod cost_trace {
     thread_local! {
         static PHASES: RefCell<Option<Vec<(&'static str, f64)>>> = const { RefCell::new(None) };
         static CPU_PHASES: RefCell<Vec<(&'static str, f64)>> = const { RefCell::new(Vec::new()) };
+        static COUNTS: RefCell<std::collections::BTreeMap<&'static str, usize>> = const { RefCell::new(std::collections::BTreeMap::new()) };
     }
 
     fn thread_cpu_ms() -> Option<f64> {
@@ -236,6 +237,7 @@ mod cost_trace {
             if enabled {
                 PHASES.with(|phases| *phases.borrow_mut() = Some(Vec::new()));
                 CPU_PHASES.with(|phases| phases.borrow_mut().clear());
+                COUNTS.with(|counts| counts.borrow_mut().clear());
             }
             Self {
                 id: id.to_string(),
@@ -251,17 +253,25 @@ mod cost_trace {
                 let phases = PHASES.with(|phases| std::mem::take(&mut *phases.borrow_mut()));
                 let cpu_phases =
                     CPU_PHASES.with(|phases| std::mem::take(&mut *phases.borrow_mut()));
+                let counts = COUNTS.with(|counts| std::mem::take(&mut *counts.borrow_mut()));
                 eprintln!(
                     "AFT_SEARCH_COST {}",
                     serde_json::json!({
                         "id": self.id, "total_ms": self.started.elapsed().as_secs_f64() * 1000.0,
                         "phases": phases, "cpu_phases": cpu_phases,
+                        "counts": counts,
                     })
                 );
             }
         }
     }
 
+    pub(crate) fn count(name: &'static str, value: usize) {
+        if PHASES.with(|phases| phases.borrow().is_some()) {
+            COUNTS.with(|counts| *counts.borrow_mut().entry(name).or_default() += value);
+        }
+    }
+
     pub(crate) struct Phase(&'static str, Option<Instant>, Option<f64>);
 
     impl Phase {
@@ -290,6 +300,7 @@ mod cost_trace {
 
 #[cfg(not(feature = "test-timing-hooks"))]
 mod cost_trace {
+    pub(crate) fn count(_: &'static str, _: usize) {}
     pub(crate) struct Request;
     impl Request {
         pub(crate) fn start(_: &str) -> Self {
@@ -304,4 +315,5 @@ mod cost_trace {
     }
 }
 
+pub(crate) use cost_trace::count as cost_count;
 pub(crate) use cost_trace::{Phase as CostPhase, Request as CostRequest};
diff --git a/crates/aft/src/commands/status.rs b/crates/aft/src/commands/status.rs
index 4b465156bf..c93d28a14c 100644
--- a/crates/aft/src/commands/status.rs
+++ b/crates/aft/src/commands/status.rs
@@ -5,16 +5,22 @@ use crate::context::SemanticIndexStatus;
 use crate::db::compression_events::CompressionAggregate;
 use crate::protocol::{RawRequest, Response, StatusPayload, DEFAULT_SESSION_ID};
 
+#[cfg(test)]
+#[path = "status_cost_tests.rs"]
+mod cost_tests;
+
 // Operator-only copy: never use these lines as fill errors or agent reply reasons.
 
 #[derive(Debug, Clone, Default, serde::Serialize)]
 pub struct CompressionStats {
     pub project: CompressionAggregateSerde,
     pub session: CompressionAggregateSerde,
-    /// True when another thread held the database connection, so the totals
-    /// are the last ones this process computed (zero if it never had any).
+    /// True while the last exact totals await background revalidation, or
+    /// while another thread holds the database connection.
     #[serde(skip_serializing_if = "std::ops::Not::not")]
     pub stale: bool,
+    #[serde(skip)]
+    unknown: bool,
 }
 
 #[derive(Debug, Clone, Default, serde::Serialize)]
@@ -160,6 +166,8 @@ impl AppContext {
         status_bar_values: crate::context::StatusBarCountValues,
         kind: StatusSnapshotKind,
     ) -> StatusPayload {
+        #[cfg(test)]
+        let mut cost = cost_tests::PushCost::start();
         #[cfg(test)]
         self.status_emitter()
             .snapshot_builds
@@ -369,42 +377,61 @@ impl AppContext {
 
         // Symbol cache stats
         let symbol_cache_stats = self.symbol_cache_stats();
+        #[cfg(test)]
+        cost.mark("indexes_config_symbols");
 
         // Per-session undo/checkpoint counts (issue #14 — one shared bridge serves
         // many sessions; surface both the global footprint and the current
         // session's own slice so `/aft-status` can split them in the UI).
         let backups_enabled =
             kind != StatusSnapshotKind::Operator && config.backup.enabled.unwrap_or(true);
-        let checkpoint_total = if backups_enabled {
-            self.checkpoint().lock().total_count()
+        let (checkpoint_total, session_checkpoints) = if backups_enabled {
+            let mut store = self.checkpoint().lock();
+            let resident_total = store.total_count();
+            if kind == StatusSnapshotKind::Push {
+                let session = store.status_count(session_id);
+                // Refresh this session's slice without hydrating blobs. Other
+                // sessions retain their resident, in-memory freshness as before.
+                let total = session
+                    .map(|count| resident_total - store.resident_session_count(session_id) + count);
+                (total, session)
+            } else {
+                let session = store
+                    .list(session_id)
+                    .map(|checkpoints| checkpoints.len())
+                    .unwrap_or_else(|error| {
+                        crate::slog_warn!("status checkpoint hydration failed: {}", error);
+                        0
+                    });
+                (Some(resident_total), Some(session))
+            }
         } else {
-            0
+            (Some(0), Some(0))
         };
-        let session_checkpoints = if backups_enabled {
-            self.checkpoint()
-                .lock()
-                .list(session_id)
-                .map(|checkpoints| checkpoints.len())
-                .unwrap_or_else(|error| {
-                    crate::slog_warn!("status checkpoint hydration failed: {}", error);
-                    0
-                })
-        } else {
+        let session_tracked_files = if !backups_enabled {
             0
-        };
-        let session_tracked_files = if backups_enabled {
-            self.backup().lock().tracked_files(session_id).len()
+        } else if kind == StatusSnapshotKind::Push {
+            // Copy the inputs under the store mutex and scan the session's
+            // backup directory after releasing it, so edits never wait on a
+            // push. Unchanged metadata files are not re-read.
+            let inventory = self.backup().lock().status_inventory(session_id);
+            inventory.tracked_file_count()
         } else {
-            0
+            self.backup().lock().tracked_files(session_id).len()
         };
+        #[cfg(test)]
+        cost.mark("checkpoints_and_backup");
         // Shell sidebar status consumes neither undo nor compression history.
         // In particular, idle operator refreshes must not reacquire aft.db to
         // hydrate aggregates unrelated to readiness and health counts.
         let compression = if kind == StatusSnapshotKind::Operator {
             CompressionStats::default()
         } else {
-            self.compression_stats_for_session(session_id)
+            self.compression_stats_for_session_kind(session_id, kind)
         };
+        let compression_unknown = compression.unknown;
+        #[cfg(test)]
+        cost.mark("compression");
 
         // Degraded-mode reasons recorded by `handle_configure` when the
         // project root doesn't look like a real project (`home_root`). Heavy
@@ -432,7 +459,13 @@ impl AppContext {
         // build wrote as today's stores refuse theirs, and is listed the
         // same way, after them. Push projection adds it itself, with this
         // project's other refusals.
-        let data_store_report = crate::data_layer::surfaces::report(self);
+        let data_store_report = if kind == StatusSnapshotKind::Push {
+            crate::data_layer::surfaces::report_for_push(self)
+        } else {
+            crate::data_layer::surfaces::report(self)
+        };
+        #[cfg(test)]
+        cost.mark("data_report");
         let data_store_refusal = data_store_report
             .as_ref()
             .and_then(|report| report.refusal.as_ref())
@@ -589,9 +622,21 @@ impl AppContext {
 
         // With the data layer on, its planes replace today's stores for text
         // and the call graph on every status surface.
+        if compression_unknown {
+            payload["compression"]["project"] = serde_json::Value::Null;
+            payload["compression"]["session"] = serde_json::Value::Null;
+        }
+        #[cfg(test)]
+        cost.mark("payload");
         if let Some(report) = &data_store_report {
-            crate::data_layer::surfaces::apply_to_status(&mut payload, report);
+            if kind == StatusSnapshotKind::Push {
+                crate::data_layer::surfaces::apply_to_status_push(&mut payload, report);
+            } else {
+                crate::data_layer::surfaces::apply_to_status(&mut payload, report);
+            }
         }
+        #[cfg(test)]
+        cost.mark("data_apply");
         if kind != StatusSnapshotKind::Explicit {
             // Read only this root's LSP applicability rather than cloning
             // applicability for every root and the other lifecycle details.
@@ -636,10 +681,16 @@ impl AppContext {
                 runtime["bash_spawn"] = crate::posix_spawn::health();
             }
         }
+        #[cfg(test)]
+        cost.mark("lifecycle");
         payload
     }
 
-    fn compression_stats_for_session(&self, session_id: &str) -> CompressionStats {
+    fn compression_stats_for_session_kind(
+        &self,
+        session_id: &str,
+        kind: StatusSnapshotKind,
+    ) -> CompressionStats {
         let mut compression = CompressionStats::default();
         let Some(project_root) = self.config().project_root.clone() else {
             return compression;
@@ -663,17 +714,46 @@ impl AppContext {
                 {
                     compression.project = project.into();
                     compression.session = session.into();
+                } else if kind == StatusSnapshotKind::Push {
+                    compression.unknown = true;
+                }
+                if kind == StatusSnapshotKind::Push {
+                    self.refresh_compression_for_status(
+                        harness,
+                        project_key,
+                        session_id.to_string(),
+                    );
                 }
                 return compression;
             }
             Err(std::sync::TryLockError::Poisoned(_)) => return compression,
         };
 
-        if let Ok((project, session)) =
-            cache.aggregates_for_session(&conn, &harness, &project_key, session_id)
-        {
+        let totals = if kind == StatusSnapshotKind::Push {
+            cache
+                .validated_for_status(&conn, &harness, &project_key, session_id)
+                .ok()
+                .flatten()
+        } else {
+            cache
+                .aggregates_for_session(&conn, &harness, &project_key, session_id)
+                .ok()
+        };
+        if let Some((project, session)) = totals {
             compression.project = project.into();
             compression.session = session.into();
+        } else if kind == StatusSnapshotKind::Push {
+            compression.stale = true;
+            if let Some((project, session)) =
+                cache.cached_for_session(&harness, &project_key, session_id)
+            {
+                compression.project = project.into();
+                compression.session = session.into();
+            } else {
+                compression.unknown = true;
+            }
+            drop(conn);
+            self.refresh_compression_for_status(harness, project_key, session_id.to_string());
         }
 
         compression
diff --git a/crates/aft/src/commands/status_cost_tests.rs b/crates/aft/src/commands/status_cost_tests.rs
new file mode 100644
index 0000000000..a6db0aa9c3
--- /dev/null
+++ b/crates/aft/src/commands/status_cost_tests.rs
@@ -0,0 +1,578 @@
+//! Filled-store probe for the producer-triggered status path.
+
+use super::*;
+use crate::data_layer::runtime::{DataCheckout, Fresh};
+use crate::data_layer::vectors::{FillBudget, Producer, VectorPlane};
+use crate::run_tool_call::ThreadCpuSample;
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+thread_local! {
+    static COSTS: RefCell<Option<BTreeMap<&'static str, Duration>>> = const { RefCell::new(None) };
+    static SQL: RefCell<Vec<String>> = const { RefCell::new(Vec::new()) };
+}
+
+fn trace_sql(sql: &str) {
+    SQL.with(|statements| statements.borrow_mut().push(sql.to_string()));
+}
+
+fn db_page_reads(ctx: &AppContext) -> (i32, i32) {
+    let db = ctx.db().unwrap();
+    let conn = db.lock().unwrap();
+    let read = |operation| {
+        let (mut current, mut high) = (0, 0);
+        // The connection mutex keeps the SQLite handle live and exclusively held.
+        let code = unsafe {
+            rusqlite::ffi::sqlite3_db_status(conn.handle(), operation, &mut current, &mut high, 1)
+        };
+        assert_eq!(code, rusqlite::ffi::SQLITE_OK);
+        current
+    };
+    (
+        read(rusqlite::ffi::SQLITE_DBSTATUS_CACHE_HIT),
+        read(rusqlite::ffi::SQLITE_DBSTATUS_CACHE_MISS),
+    )
+}
+
+pub(super) struct PushCost(Option<ThreadCpuSample>);
+
+impl PushCost {
+    pub(super) fn start() -> Self {
+        Self(COSTS.with(|costs| costs.borrow().as_ref().and_then(|_| ThreadCpuSample::now())))
+    }
+
+    pub(super) fn mark(&mut self, phase: &'static str) {
+        if self.0.is_none() {
+            return;
+        }
+        let end = ThreadCpuSample::now();
+        if let Some(elapsed) = ThreadCpuSample::elapsed(self.0, end) {
+            COSTS.with(|costs| {
+                *costs
+                    .borrow_mut()
+                    .as_mut()
+                    .unwrap()
+                    .entry(phase)
+                    .or_default() += elapsed;
+            });
+        }
+        self.0 = end;
+    }
+}
+
+struct Fixture {
+    ctx: Arc<AppContext>,
+    checkout: Arc<DataCheckout>,
+    plane: VectorPlane,
+    _dir: tempfile::TempDir,
+}
+
+impl Fixture {
+    fn new(files: usize) -> Self {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("repo");
+        std::fs::create_dir(&root).unwrap();
+        std::fs::write(
+            root.join("Cargo.toml"),
+            "[package]\nname = \"status-probe\"\n",
+        )
+        .unwrap();
+        for file in 0..files {
+            let source = (0..16)
+                .map(|function| {
+                    format!("pub fn item_{file}_{function}() -> usize {{ {file} + {function} }}\n")
+                })
+                .collect::<String>();
+            std::fs::write(root.join(format!("file_{file}.rs")), source).unwrap();
+        }
+        let root = std::fs::canonicalize(root).unwrap();
+        let storage = dir.path().join("storage");
+        let mut config = crate::config::Config::default();
+        config.project_root = Some(root.clone());
+        config.storage_dir = Some(storage.clone());
+        let semantic = config.semantic.clone();
+        let ctx = Arc::new(AppContext::from_app(
+            crate::context::App::default_shared(),
+            config,
+        ));
+        ctx.set_harness(crate::harness::Harness::Opencode);
+        ctx.set_canonical_cache_root(root.clone());
+        std::fs::create_dir_all(&storage).unwrap();
+        let mut db = crate::db::TrackedConnection::open(
+            &storage.join("aft.db"),
+            crate::db::SqliteStore::AftDb,
+        )
+        .unwrap();
+        crate::db::run_migrations(&mut db).unwrap();
+        db.execute_batch("BEGIN").unwrap();
+        let project_key = crate::path_identity::project_scope_key(&root);
+        let harness = ctx.harness().storage_segment();
+        for event in 0..10_000 {
+            crate::db::compression_events::insert_compression_event(
+                &db,
+                &crate::db::compression_events::CompressionEventRow {
+                    harness: &harness,
+                    session_id: Some(DEFAULT_SESSION_ID),
+                    project_key: &project_key,
+                    tool: "bash",
+                    task_id: Some(&format!("task-{event}")),
+                    compressor: "probe",
+                    original_bytes: 1000,
+                    compressed_bytes: 100,
+                    original_tokens: 250,
+                    compressed_tokens: 25,
+                    created_at: 1_700_000_000_000,
+                },
+            )
+            .unwrap();
+        }
+        db.execute_batch("COMMIT").unwrap();
+        db.trace(Some(trace_sql));
+        ctx.set_db(Arc::new(std::sync::Mutex::new(db)));
+        let checkout = DataCheckout::open_planes(
+            &root,
+            &storage,
+            None,
+            crate::data_layer::checkout::Planes::ALL,
+        )
+        .unwrap();
+        assert!(matches!(
+            checkout.fresh_view(Duration::from_secs(120)),
+            Fresh::Ready(_)
+        ));
+        let fingerprint =
+            crate::semantic_index::SemanticIndexFingerprint::for_config_dimension(&semantic, 2);
+        let plane = VectorPlane::new(
+            checkout.checkout_arc_for_test(),
+            Producer::from_fingerprint(&fingerprint),
+            files + 10,
+        );
+        let filled = plane
+            .fill(
+                &mut |texts| Ok(texts.iter().map(|_| vec![1.0, 0.0]).collect()),
+                FillBudget::default(),
+                &mut |_| {},
+            )
+            .unwrap();
+        assert_eq!(filled.files_left, 0);
+        checkout.read_meaning_only(&semantic, &fingerprint).unwrap();
+        ctx.pin_data_checkout(Arc::clone(&checkout));
+        *ctx.checkpoint().lock() =
+            crate::checkpoint::CheckpointStore::unbound_in_for_test(&storage);
+        for checkpoint in 0..20 {
+            ctx.checkpoint()
+                .lock()
+                .create_for_files(
+                    DEFAULT_SESSION_ID,
+                    &format!("checkpoint_{checkpoint}"),
+                    vec![root.join("file_0.rs")],
+                )
+                .unwrap();
+        }
+        Self {
+            ctx,
+            checkout,
+            plane,
+            _dir: dir,
+        }
+    }
+
+    fn edit(&self, edit: usize) {
+        let path = self.checkout.root().join("file_0.rs");
+        std::fs::write(&path, format!("pub fn edited_{edit}() {{}}\n")).unwrap();
+        self.checkout.note_paths(&[path]);
+        assert!(matches!(
+            self.checkout.fresh_view(Duration::from_secs(60)),
+            Fresh::Ready(_)
+        ));
+    }
+}
+
+#[test]
+fn status_push_matches_legacy_after_fill_refresh_checkpoint_create_and_delete_without_store_reads()
+{
+    let fixture = Fixture::new(32);
+    fixture.ctx.bind_status_context();
+    let assert_parity = || {
+        // Explicit status retains the old hydration/report/disk-walk function.
+        // Disk bytes on pushes are now a timestamped sample, so take a fresh
+        // sample while the fixture is idle before comparing that measurement.
+        fixture.checkout.disk_measurement().expire_for_test();
+        let start = Instant::now();
+        loop {
+            let push = fixture.ctx.try_build_status_push_snapshot().unwrap();
+            if push["disk"]["data_store_bytes_stale"] == false
+                && push["compression"].get("stale").is_none()
+            {
+                break;
+            }
+            assert!(
+                start.elapsed() < Duration::from_secs(60),
+                "status producers did not settle: {push}"
+            );
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        crate::checkpoint::status_read_counters_for_test();
+        crate::data_layer::vectors::status_member_builds_for_test();
+        crate::data_layer::surfaces::status_disk_walks_for_test();
+        SQL.with(|statements| statements.borrow_mut().clear());
+        let mut push = fixture.ctx.try_build_status_push_snapshot().unwrap();
+        assert_eq!(crate::checkpoint::status_read_counters_for_test().0, 0);
+        assert_eq!(
+            crate::data_layer::vectors::status_member_builds_for_test(),
+            0
+        );
+        assert_eq!(crate::data_layer::surfaces::status_disk_walks_for_test(), 0);
+        let sql = SQL.with(|statements| std::mem::take(&mut *statements.borrow_mut()));
+        assert!(
+            sql.iter()
+                .all(|sql| !sql.contains("SUM(") && !sql.contains("COUNT(")),
+            "push scanned SQLite: {sql:?}"
+        );
+        assert_eq!(push["disk"]["data_store_bytes_stale"], false);
+        push["disk"]
+            .as_object_mut()
+            .unwrap()
+            .remove("data_store_bytes_stale");
+        let old = crate::status_push::project(
+            &fixture.ctx,
+            fixture
+                .ctx
+                .build_status_snapshot_for_session(DEFAULT_SESSION_ID),
+        );
+        assert_eq!(push, old);
+    };
+    assert_parity();
+    fixture.edit(1000);
+    fixture
+        .plane
+        .fill(
+            &mut |texts| Ok(texts.iter().map(|_| vec![1.0, 0.0]).collect()),
+            FillBudget::default(),
+            &mut |_| {},
+        )
+        .unwrap();
+    fixture.checkout.refresh_meaning_for_test();
+    assert_parity();
+    fixture
+        .ctx
+        .checkpoint()
+        .lock()
+        .create_for_files(
+            DEFAULT_SESSION_ID,
+            "new_checkpoint",
+            vec![fixture.checkout.root().join("file_0.rs")],
+        )
+        .unwrap();
+    assert_parity();
+    assert!(fixture
+        .ctx
+        .checkpoint()
+        .lock()
+        .delete(DEFAULT_SESSION_ID, "new_checkpoint"));
+    assert_parity();
+    assert!(fixture
+        .ctx
+        .checkpoint()
+        .lock()
+        .delete(DEFAULT_SESSION_ID, "checkpoint_1"));
+    assert_eq!(
+        fixture.ctx.try_build_status_push_snapshot().unwrap()["checkpoints_total"],
+        18
+    );
+    let mut external = crate::checkpoint::CheckpointStore::unbound_in_for_test(
+        &fixture._dir.path().join("storage"),
+    );
+    external
+        .create_for_files(
+            DEFAULT_SESSION_ID,
+            "external",
+            vec![fixture.checkout.root().join("file_0.rs")],
+        )
+        .unwrap();
+    let push = fixture.ctx.try_build_status_push_snapshot().unwrap();
+    assert_eq!(push["session"]["checkpoints"], 19);
+    assert_eq!(push["checkpoints_total"], 19);
+    assert_eq!(
+        fixture
+            .ctx
+            .checkpoint()
+            .lock()
+            .resident_session_count(DEFAULT_SESSION_ID),
+        18,
+        "push must not hydrate"
+    );
+
+    // Record a new text view without running its producer. The previous
+    // coverage is no longer a certificate for this view: a push must report
+    // unknown counts rather than rebuild or borrow the previous coverage.
+    fixture.checkout.pause_meaning_summary_for_test();
+    std::fs::write(
+        fixture.checkout.root().join("file_0.rs"),
+        "pub fn pending_view() {}\n",
+    )
+    .unwrap();
+    fixture
+        .checkout
+        .checkout()
+        .record_paths(&[b"file_0.rs".to_vec()])
+        .unwrap();
+    crate::data_layer::vectors::status_member_builds_for_test();
+    crate::checkpoint::status_read_counters_for_test();
+    crate::data_layer::surfaces::status_disk_walks_for_test();
+    SQL.with(|statements| statements.borrow_mut().clear());
+    let pending = fixture.ctx.try_build_status_push_snapshot().unwrap();
+    assert_eq!(
+        crate::data_layer::vectors::status_member_builds_for_test(),
+        0
+    );
+    assert_eq!(crate::checkpoint::status_read_counters_for_test().0, 0);
+    assert_eq!(crate::data_layer::surfaces::status_disk_walks_for_test(), 0);
+    assert!(pending["semantic_index"]["files"].is_null(), "{pending}");
+    assert!(SQL.with(|statements| statements
+        .borrow()
+        .iter()
+        .all(|sql| !sql.contains("SUM(") && !sql.contains("COUNT("))));
+}
+
+#[test]
+#[ignore = "manual per-phase CPU and edit-loop push frequency probe"]
+fn status_push_filled_store_cost_probe() {
+    let fixture = Fixture::new(256);
+    for edited in [false, true] {
+        db_page_reads(&fixture.ctx);
+        SQL.with(|statements| statements.borrow_mut().clear());
+        COSTS.with(|costs| *costs.borrow_mut() = Some(BTreeMap::new()));
+        let mut cpu = Duration::ZERO;
+        for sample in 0..50 {
+            if edited {
+                fixture.edit(sample);
+            }
+            let start = ThreadCpuSample::now();
+            std::hint::black_box(fixture.ctx.try_build_status_push_snapshot().unwrap());
+            cpu += ThreadCpuSample::elapsed(start, ThreadCpuSample::now()).unwrap();
+        }
+        let phases = COSTS.with(|costs| costs.borrow_mut().take().unwrap());
+        eprintln!(
+            "status cost: edited={edited}, files=256, checkpoints=20, pushes=50, CPU/push={:?}",
+            cpu / 50
+        );
+        for (phase, elapsed) in phases {
+            eprintln!("  {phase}: {:?}/push", elapsed / 50);
+        }
+        let statements = SQL.with(|statements| std::mem::take(&mut *statements.borrow_mut()));
+        let mut grouped = BTreeMap::new();
+        for sql in statements {
+            *grouped.entry(sql).or_insert(0usize) += 1;
+        }
+        eprintln!("SQL across 50 pushes: {grouped:?}");
+        eprintln!(
+            "SQLite page-cache hits/misses across 50 pushes: {:?}",
+            db_page_reads(&fixture.ctx)
+        );
+    }
+    let (sender, receiver) = std::sync::mpsc::channel();
+    fixture
+        .ctx
+        .set_progress_sender(Some(Arc::new(Box::new(move |frame| {
+            let _ = sender.send(frame);
+        }))));
+    fixture.ctx.bind_status_context();
+    let start = Instant::now();
+    let before = fixture
+        .ctx
+        .status_emitter()
+        .snapshot_builds
+        .load(std::sync::atomic::Ordering::Relaxed);
+    let mut edits = 0;
+    while start.elapsed() < Duration::from_secs(60) {
+        fixture.edit(edits);
+        fixture.ctx.signal_status_changed();
+        edits += 1;
+        std::thread::sleep(Duration::from_millis(100));
+    }
+    receiver.recv_timeout(Duration::from_secs(60)).unwrap();
+    let after = fixture
+        .ctx
+        .status_emitter()
+        .snapshot_builds
+        .load(std::sync::atomic::Ordering::Relaxed);
+    eprintln!(
+        "edit loop: {} edits in {:?}, {} snapshot builds, {:.1} builds/root/min",
+        edits,
+        start.elapsed(),
+        after - before,
+        (after - before) as f64 * 60.0 / start.elapsed().as_secs_f64()
+    );
+}
+
+#[test]
+#[ignore = "manual deferred backup-inventory cost probe"]
+fn status_push_backup_inventory_cost_probe() {
+    let fixture = Fixture::new(256);
+    let mut backup = fixture.ctx.backup().lock();
+    backup.set_storage_dir_for_harness(
+        fixture._dir.path().join("storage"),
+        crate::harness::Harness::Opencode,
+        0,
+    );
+    for file in 0..256 {
+        assert!(backup
+            .snapshot(
+                DEFAULT_SESSION_ID,
+                &fixture.checkout.root().join(format!("file_{file}.rs")),
+                "status inventory probe"
+            )
+            .unwrap()
+            .is_some());
+    }
+    for resident in [true, false] {
+        if !resident {
+            backup.release_session_memory(DEFAULT_SESSION_ID);
+        }
+        let before = backup.status_discovery_entries_for_test();
+        let start = ThreadCpuSample::now();
+        for _ in 0..50 {
+            assert_eq!(
+                std::hint::black_box(backup.tracked_files(DEFAULT_SESSION_ID)).len(),
+                256
+            );
+        }
+        let cpu = ThreadCpuSample::elapsed(start, ThreadCpuSample::now()).unwrap();
+        eprintln!("backup inventory (unchanged push call): paths=256, resident={resident}, calls=50, CPU/call={:?}, directory entries/call={}", cpu/50, (backup.status_discovery_entries_for_test() - before)/50);
+    }
+}
+
+/// Compares the unchanged `tracked_files` call with listing-only alternatives
+/// over the same 256 durable stacks. The listing variants never open a
+/// `meta.json`: they read directory names (path-hash names are 16 lowercase hex
+/// digits) and union them with the hashed resident keys.
+#[test]
+#[ignore = "manual backup-inventory listing cost probe"]
+fn status_push_backup_listing_cost_probe() {
+    use sha2::{Digest, Sha256};
+    use std::collections::HashSet;
+    fn path_hash(key: &std::path::Path) -> String {
+        Sha256::digest(key.to_string_lossy().as_bytes())[..8]
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect()
+    }
+    fn is_path_hash(name: &str) -> bool {
+        name.len() == 16 && name.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+    }
+    fn find_session_dir(dir: &std::path::Path) -> Option<std::path::PathBuf> {
+        if dir.join("session.json").is_file() {
+            return Some(dir.to_path_buf());
+        }
+        std::fs::read_dir(dir)
+            .ok()?
+            .flatten()
+            .filter(|entry| entry.path().is_dir())
+            .find_map(|entry| find_session_dir(&entry.path()))
+    }
+
+    let fixture = Fixture::new(256);
+    let mut backup = fixture.ctx.backup().lock();
+    let storage = fixture._dir.path().join("storage");
+    backup.set_storage_dir_for_harness(storage.clone(), crate::harness::Harness::Opencode, 0);
+    for file in 0..256 {
+        assert!(backup
+            .snapshot(
+                DEFAULT_SESSION_ID,
+                &fixture.checkout.root().join(format!("file_{file}.rs")),
+                "status inventory probe"
+            )
+            .unwrap()
+            .is_some());
+    }
+    let session_dir = find_session_dir(&storage).unwrap();
+    let mut others = std::fs::read_dir(&session_dir)
+        .unwrap()
+        .flatten()
+        .map(|entry| entry.file_name().to_string_lossy().into_owned())
+        .filter(|name| !is_path_hash(name))
+        .collect::<Vec<_>>();
+    others.sort();
+    let resident_keys = backup.tracked_files(DEFAULT_SESSION_ID);
+    eprintln!("session dir non-path-hash entries: {others:?}");
+
+    let names_only = |resident: &[std::path::PathBuf]| -> usize {
+        let mut names: HashSet<String> = resident.iter().map(|key| path_hash(key)).collect();
+        if !session_dir.exists() {
+            return names.len();
+        }
+        for entry in std::fs::read_dir(&session_dir).unwrap() {
+            let entry = entry.unwrap();
+            let name = entry.file_name();
+            let Some(name) = name.to_str() else { continue };
+            if is_path_hash(name) && entry.file_type().unwrap().is_dir() {
+                names.insert(name.to_string());
+            }
+        }
+        names.len()
+    };
+    let names_and_meta_stat = |resident: &[std::path::PathBuf]| -> usize {
+        let mut names: HashSet<String> = resident.iter().map(|key| path_hash(key)).collect();
+        if !session_dir.exists() {
+            return names.len();
+        }
+        for entry in std::fs::read_dir(&session_dir).unwrap() {
+            let entry = entry.unwrap();
+            let name = entry.file_name();
+            let Some(name) = name.to_str() else { continue };
+            if !is_path_hash(name) || !entry.file_type().unwrap().is_dir() {
+                continue;
+            }
+            // Length and modification time are what a stat-keyed parse cache
+            // would compare; reading them costs one stat per stack.
+            if let Ok(meta) = std::fs::symlink_metadata(entry.path().join("meta.json")) {
+                std::hint::black_box((meta.len(), meta.modified().ok()));
+                names.insert(name.to_string());
+            }
+        }
+        names.len()
+    };
+
+    for resident in [true, false] {
+        if !resident {
+            backup.release_session_memory(DEFAULT_SESSION_ID);
+        }
+        let resident_now: Vec<std::path::PathBuf> = if resident {
+            resident_keys.clone()
+        } else {
+            Vec::new()
+        };
+        let measure = |label: &str, f: &dyn Fn() -> usize| {
+            let start = ThreadCpuSample::now();
+            for _ in 0..50 {
+                assert_eq!(std::hint::black_box(f()), 256);
+            }
+            let cpu = ThreadCpuSample::elapsed(start, ThreadCpuSample::now()).unwrap();
+            eprintln!(
+                "{label}: resident={resident}, calls=50, CPU/call={:?}",
+                cpu / 50
+            );
+        };
+        measure("tracked_files (unchanged)", &|| {
+            backup.tracked_files(DEFAULT_SESSION_ID).len()
+        });
+        // Warm the parse cache once; steady pushes find every file unchanged.
+        backup
+            .status_inventory(DEFAULT_SESSION_ID)
+            .tracked_file_count();
+        measure("status_inventory push count (warm cache)", &|| {
+            backup
+                .status_inventory(DEFAULT_SESSION_ID)
+                .tracked_file_count()
+        });
+        measure("names only + hashed resident keys", &|| {
+            names_only(&resident_now)
+        });
+        measure("names + meta.json stat + hashed resident keys", &|| {
+            names_and_meta_stat(&resident_now)
+        });
+    }
+}
diff --git a/crates/aft/src/commands/storage_floor_tests.rs b/crates/aft/src/commands/storage_floor_tests.rs
index 6455199140..ff5d17e716 100644
--- a/crates/aft/src/commands/storage_floor_tests.rs
+++ b/crates/aft/src/commands/storage_floor_tests.rs
@@ -49,7 +49,7 @@ impl Fixture {
         assert_eq!(
             response.data["message"],
             format!(
-                "path '{}' is denied by the access policy floor",
+                "path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.",
                 self.store.display()
             )
         );
diff --git a/crates/aft/src/commands/url_resolution.rs b/crates/aft/src/commands/url_resolution.rs
index 21fa338df3..3b4457480f 100644
--- a/crates/aft/src/commands/url_resolution.rs
+++ b/crates/aft/src/commands/url_resolution.rs
@@ -160,7 +160,6 @@ fn resolve_secret_fetch(
     });
 
     let mut authorization = None;
-    let mut rules = Vec::with_capacity(labels.len());
     if let Some(first) = labels.first() {
         let scopes = match crate::subc::current_call_scopes() {
             Ok((scopes, _)) => scopes,
@@ -174,33 +173,6 @@ fn resolve_secret_fetch(
                 ));
             }
         };
-        for label in labels {
-            match crate::subc::resolve_current_secret_label(vault.as_ref(), label) {
-                crate::subc::LaunchDecision::Proceed {
-                    mut rule, grant_id, ..
-                } => {
-                    rule.grant_id = grant_id;
-                    rules.push(rule);
-                }
-                crate::subc::LaunchDecision::Refuse(outcome) => {
-                    return Err(secret_outcome_refusal(
-                        &req.id,
-                        vault.as_ref(),
-                        labels,
-                        outcome,
-                    ));
-                }
-                crate::subc::LaunchDecision::Pending(pending) => {
-                    return Err(secret_fetch_refusal(
-                        &req.id,
-                        vault.as_ref(),
-                        labels,
-                        crate::secret::SECRET_ACCESS_PENDING,
-                        pending.message,
-                    ));
-                }
-            }
-        }
         authorization = Some(scopes.authorization);
     }
 
@@ -210,11 +182,13 @@ fn resolve_secret_fetch(
     // failures included, leaves the folder to be deleted at the call's end.
     FetchTempScope::adopt(document_dir.clone());
     let secrets = SecretFetch {
-        vault: vault.as_ref(),
+        vault: vault.clone(),
         authorization,
         labels: labels.to_vec(),
-        rules,
+        #[cfg(test)]
+        test_https_port: url::Url::parse(file).ok().and_then(|url| url.port()),
         call_id: req.id.clone(),
+        cancellation: crate::url_fetch::SecretFetchCancellation::for_current_call(),
     };
     let document = crate::url_fetch::fetch_url_with_secrets(file, &document_dir, options, &secrets)
         .map_err(|error| url_fetch_error_response(&req.id, &error))?;
@@ -228,8 +202,8 @@ fn resolve_secret_fetch(
     Ok(document)
 }
 
-/// The vault a placeholder fetch resolves through: the one bash uses, which in
-/// production answers `Unavailable` to everything. Tests may install their own.
+/// The same per-call vault factory bash uses: the live scoped subc transport
+/// under AFT's daemon identity, or UnavailableVault without a usable daemon.
 fn fetch_vault() -> Arc<dyn SecretVault> {
     #[cfg(test)]
     if let Some(vault) = TEST_FETCH_VAULT.with(|slot| slot.borrow().clone()) {
@@ -375,6 +349,30 @@ thread_local! {
     static TEST_DOCUMENT_OBSERVER: RefCell<Option<Box<dyn Fn(&Path)>>> = const { RefCell::new(None) };
 }
 
+#[cfg(all(test, unix))]
+pub(crate) fn with_secret_fetch_for_test<T>(
+    vault: Arc<dyn SecretVault>,
+    options: UrlFetchOptions,
+    run: impl FnOnce() -> T,
+) -> T {
+    struct Restore(
+        Option<Arc<dyn SecretVault>>,
+        Option<Box<dyn Fn(&mut UrlFetchOptions)>>,
+    );
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            TEST_FETCH_VAULT.with(|slot| slot.replace(self.0.take()));
+            TEST_FETCH_OPTIONS.with(|slot| slot.replace(self.1.take()));
+        }
+    }
+    let _restore = Restore(
+        TEST_FETCH_VAULT.with(|slot| slot.replace(Some(vault))),
+        TEST_FETCH_OPTIONS
+            .with(|slot| slot.replace(Some(Box::new(move |current| *current = options.clone())))),
+    );
+    run()
+}
+
 #[cfg(test)]
 mod url_tests {
     use super::*;
@@ -602,7 +600,7 @@ mod url_tests {
 
     mod secret_fetch {
         use super::super::*;
-        use crate::secret::{FakeVault, Resolution};
+        use crate::secret::{FakeReply, FakeVault};
         use secret_rules::location::{LabelRule, Location};
         use std::io::{Read as _, Write as _};
         use std::net::{IpAddr, Ipv4Addr, SocketAddr, TcpListener};
@@ -769,17 +767,79 @@ mod url_tests {
                 port,
                 path_prefix: prefix.into(),
                 location: Location::Query("key".into()),
-                grant_id: String::new(),
             }
         }
 
         fn granted_vault(rule: LabelRule) -> FakeVault {
             let vault = FakeVault::new();
-            vault.set_resolution("test", crate::secret::granted(rule, "grant-1"));
+            vault.set_answer("test", crate::secret::granted(rule));
             vault.set_material("test", vec![KEY.to_vec()]);
             vault
         }
 
+        #[test]
+        fn released_fetch_is_not_replayed_after_peer_receives_credential_and_resets() {
+            let fixture = fixture(crate::config::Config::default());
+            let server = serve(&fixture.tls, |_| None);
+            let vault = granted_vault(rule("api.secret.test", 443, "/"));
+            let req = request(
+                "outline",
+                &format!("https://api.secret.test/document.md?key={PLACEHOLDER}"),
+                serde_json::json!({}),
+            );
+            let result = run(
+                &fixture,
+                &vault,
+                &[("api.secret.test", server.addr)],
+                &req,
+                true,
+            );
+            assert!(result.documents.is_empty());
+            assert!(result.text().contains("Failed to fetch"));
+            assert_eq!(
+                server.heads().len(),
+                1,
+                "a consumed release cannot authorize a retry after an ambiguous send failure"
+            );
+            assert!(server.targets()[0].contains(ENCODED_KEY));
+            assert!(!result.text().contains(std::str::from_utf8(KEY).unwrap()));
+        }
+
+        #[test]
+        fn literal_not_found_fetch_keeps_ordinary_transport_retries_without_a_release() {
+            let fixture = fixture(Default::default());
+            let count = Arc::new(AtomicUsize::new(0));
+            let seen = count.clone();
+            let server = serve(&fixture.tls, move |_| {
+                if seen.fetch_add(1, Ordering::SeqCst) == 0 {
+                    None
+                } else {
+                    Some(markdown(b"# Literal\n"))
+                }
+            });
+            let vault = FakeVault::new();
+            vault.set_answer("test", FakeReply::NotFound);
+            let req = request(
+                "outline",
+                &format!("https://api.secret.test/document.md?key={PLACEHOLDER}"),
+                serde_json::json!({}),
+            );
+            let result = run(
+                &fixture,
+                &vault,
+                &[("api.secret.test", server.addr)],
+                &req,
+                true,
+            );
+            assert!(result.response.success, "{}", result.text());
+            assert_eq!(server.heads().len(), 2);
+            assert_eq!(vault.material_calls(), 0);
+            assert!(server
+                .targets()
+                .iter()
+                .all(|target| target.contains("ck-secret:test")));
+        }
+
         fn stamp() -> subc_protocol::scope::ScopeStamp {
             serde_json::from_value(serde_json::json!({"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"secret-fetch","kind":"head","scope_epoch":1,"owner_authorized":true})).unwrap()
         }
@@ -991,7 +1051,7 @@ mod url_tests {
                 );
                 assert_documents_removed(&run, &cache);
 
-                assert_eq!(vault.resolve_calls(), 1);
+                assert_eq!(vault.use_calls(), 1);
                 assert_eq!(vault.material_calls(), 1);
                 let records = vault.audit_records();
                 assert_eq!(records.len(), 1, "{records:?}");
@@ -1269,7 +1329,7 @@ mod url_tests {
                     "{command}"
                 );
                 assert!(!run.text().contains("SENTINEL"), "{command}");
-                assert_eq!(vault.resolve_calls(), 0, "{command}");
+                assert_eq!(vault.use_calls(), 0, "{command}");
                 assert!(run.documents.is_empty());
             }
             assert_eq!(cache_entries(&cache), before);
@@ -1337,7 +1397,7 @@ mod url_tests {
         }
 
         #[test]
-        fn ineligible_or_refused_labels_fetch_nothing() {
+        fn ineligible_and_unavailable_fetch_nothing_but_not_found_is_literal() {
             let fixture = fixture(Default::default());
             let server = serve(&fixture.tls, |_| Some(markdown(&echo_document())));
             let port = server.addr.port();
@@ -1348,17 +1408,17 @@ mod url_tests {
             let vault = granted_vault(rule("api.secret.test", port, "/v1"));
             let unscoped = run(&fixture, &vault, &routes, &req, false);
             assert_eq!(unscoped.code(), Some(crate::secret::SECRET_REFUSED));
-            assert_eq!(vault.resolve_calls(), 0);
+            assert_eq!(vault.use_calls(), 0);
 
             let denied = FakeVault::new();
-            denied.set_resolution(
-                "test",
-                Resolution::Denied {
-                    reason: "no".into(),
-                },
-            );
+            denied.set_answer("test", FakeReply::NotFound);
             let run_denied = run(&fixture, &denied, &routes, &req, true);
-            assert_eq!(run_denied.code(), Some(crate::secret::SECRET_REFUSED));
+            assert!(run_denied.response.success);
+            assert_eq!(denied.material_calls(), 0);
+            assert_eq!(
+                denied.audit_summary(),
+                vec![("test".into(), secret_rules::audit::Decision::Literal)]
+            );
 
             let unavailable = FakeVault::new();
             let run_unavailable = run(&fixture, &unavailable, &routes, &req, true);
@@ -1366,10 +1426,10 @@ mod url_tests {
                 run_unavailable.code(),
                 Some(crate::secret::SECRETS_UNAVAILABLE)
             );
-            assert_eq!(unavailable.resolve_calls(), 1);
+            assert_eq!(unavailable.use_calls(), 1);
 
-            assert_eq!(server.connections.load(Ordering::SeqCst), 0);
-            for vault in [&vault, &denied, &unavailable] {
+            assert_eq!(server.connections.load(Ordering::SeqCst), 1);
+            for vault in [&vault, &unavailable] {
                 let summary = vault.audit_summary();
                 assert_eq!(
                     summary,
@@ -1469,7 +1529,7 @@ mod url_tests {
 
         fn granted_vault_with(rule: LabelRule, key: &[u8]) -> FakeVault {
             let vault = FakeVault::new();
-            vault.set_resolution("test", crate::secret::granted(rule, "grant-1"));
+            vault.set_answer("test", crate::secret::granted(rule));
             vault.set_material("test", vec![key.to_vec()]);
             vault
         }
@@ -1935,11 +1995,10 @@ mod url_tests {
             assert_absent(&run, &documents, &[KEY, ENCODED_KEY.as_bytes()]);
         }
 
-        /// `material` is asked only for a hop that substitutes: not for a
-        /// placeholder in another parameter, and not for a same-prefix
-        /// redirect hop that carries no placeholder.
+        /// A request must ask the vault before it knows the key's location.
+        /// A redirect without a placeholder has nothing to ask about.
         #[test]
-        fn material_is_requested_only_for_a_hop_that_substitutes() {
+        fn present_labels_ask_before_location_planning_but_empty_redirects_do_not() {
             let fixture = fixture(Default::default());
             let server = serve(&fixture.tls, |target| {
                 if target.starts_with("/v1/first.md") {
@@ -1961,7 +2020,11 @@ mod url_tests {
                 no_extra,
             );
             assert!(run.response.success, "{:?}", run.response.data);
-            assert_eq!(vault.material_calls(), 0, "nothing was substituted");
+            assert_eq!(
+                vault.material_calls(),
+                1,
+                "release names the location; a placeholder in another parameter stays literal"
+            );
 
             let redirected =
                 format!("https://api.secret.test:{port}/v1/first.md?key={PLACEHOLDER}");
@@ -2063,9 +2126,9 @@ mod url_tests {
                 "https://api.secret.test:{port}/v1/doc.md?key={PLACEHOLDER}&other={{{{ck-secret:other}}}}"
             );
             let vault = FakeVault::new();
-            vault.set_resolution(
+            vault.set_answer(
                 "test",
-                crate::secret::granted(rule("api.secret.test", port, "/v1"), "grant-1"),
+                crate::secret::granted(rule("api.secret.test", port, "/v1")),
             );
             vault.set_material("test", vec![K_A.to_vec()]);
             let other = LabelRule {
@@ -2073,7 +2136,7 @@ mod url_tests {
                 location: Location::Query("other".into()),
                 ..rule("api.secret.test", port, "/v1")
             };
-            vault.set_resolution("other", crate::secret::granted(other, "grant-2"));
+            vault.set_answer("other", crate::secret::granted(other));
             vault.set_material("other", vec![K_B.to_vec()]);
             let (run, documents) = run_with(
                 &fixture,
diff --git a/crates/aft/src/config_fix.rs b/crates/aft/src/config_fix.rs
index 3037e61e40..07ea2b27c4 100644
--- a/crates/aft/src/config_fix.rs
+++ b/crates/aft/src/config_fix.rs
@@ -615,7 +615,7 @@ fn write_backup(target: &Path, text: &str) -> std::io::Result<PathBuf> {
             Ok(mut file) => {
                 let written = (|| {
                     file.write_all(text.as_bytes())?;
-                    file.sync_all()?;
+                    aft_store::sync::sync_all(&file, &candidate)?;
                     if let Ok(metadata) = std::fs::metadata(target) {
                         std::fs::set_permissions(&candidate, metadata.permissions())?;
                     }
diff --git a/crates/aft/src/context.rs b/crates/aft/src/context.rs
index 47d657d949..f258d4a39a 100644
--- a/crates/aft/src/context.rs
+++ b/crates/aft/src/context.rs
@@ -2157,13 +2157,21 @@ pub struct QueryPendingChanges {
     pub callgraph: CallgraphUnappliedChanges,
 }
 
-/// Points between two stage reads of [`AppContext::pending_changes_for_query`]
-/// where a test can move a file one stage downstream.
+/// Points in pending-change capture where a test can move work downstream or
+/// release a concurrent metadata reader before the capture continues.
 #[cfg(test)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(crate) enum PendingCaptureBoundary {
     /// After the flush-window set, before the dispatch channel and drain.
     AfterFlushWindow,
+    /// After a contended intake-counter probe, before reading the snapshot.
+    AfterIntakeProbe,
+    /// After a contended cleanup-state probe, before reading the snapshot.
+    AfterCleanupProbe,
+    /// After a contended receiver-slot probe, before reading the snapshot.
+    AfterReceiverProbe,
+    /// After probing the continuation mutex, before waiting for its metadata.
+    AfterContinuationProbe,
 }
 
 #[cfg(test)]
@@ -2218,6 +2226,20 @@ pub(crate) struct WatcherDrainGuard<'a> {
     activity: &'a AtomicU64,
 }
 
+fn watcher_metadata_probe<'a, T>(
+    slot: &'a parking_lot::Mutex<T>,
+    wait_for_metadata: bool,
+    on_contention: impl FnOnce(),
+) -> Option<parking_lot::MutexGuard<'a, T>> {
+    let value = slot.try_lock();
+    if wait_for_metadata && value.is_none() {
+        on_contention();
+        Some(slot.lock())
+    } else {
+        value
+    }
+}
+
 impl Drop for WatcherDrainGuard<'_> {
     fn drop(&mut self) {
         self.in_flight.fetch_sub(1, Ordering::AcqRel);
@@ -4461,6 +4483,37 @@ impl AppContext {
             .unwrap_or_else(std::sync::PoisonError::into_inner) = Arc::downgrade(self);
     }
 
+    pub(crate) fn status_completion_notifier(&self) -> Arc<dyn Fn() + Send + Sync> {
+        let context = self
+            .status_emitter
+            .context
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .clone();
+        Arc::new(move || {
+            if let Some(context) = context.upgrade() {
+                context.signal_status_changed();
+            }
+        })
+    }
+
+    pub(crate) fn refresh_compression_for_status(
+        &self,
+        harness: String,
+        project: String,
+        session: String,
+    ) {
+        if let Some(db) = self.db() {
+            self.compression_aggregates.refresh_for_status(
+                db,
+                harness,
+                project,
+                session,
+                self.status_completion_notifier(),
+            );
+        }
+    }
+
     pub fn signal_status_changed(&self) {
         let context = self
             .status_emitter
@@ -5688,8 +5741,7 @@ impl AppContext {
         })
     }
 
-    // Only the Unix-only idle language-server tests inject a probe.
-    #[cfg(all(test, unix))]
+    #[cfg(test)]
     pub(crate) fn try_cleanup_deleted_root_with_probe(
         &self,
         expected_generation: u64,
@@ -5714,10 +5766,12 @@ impl AppContext {
                     else {
                         return false;
                     };
-                    let mut cleanup = self.deleted_root_cleanup.lock();
-                    match root_metadata(&root) {
+                    // Keep the state lock limited to metadata: query capture
+                    // reads it without waiting for filesystem checks or cleanup.
+                    let metadata = root_metadata(&root);
+                    match metadata {
                         Ok(metadata) if metadata.is_dir() => {
-                            *cleanup = None;
+                            *self.deleted_root_cleanup.lock() = None;
                             return false;
                         }
                         Ok(_) => {}
@@ -5727,8 +5781,11 @@ impl AppContext {
                                 std::io::ErrorKind::NotFound | std::io::ErrorKind::NotADirectory
                             ) => {}
                         Err(error) => {
+                            let previous = self.deleted_root_cleanup.lock().replace(
+                                DeletedRootCleanup::Inconclusive(expected_generation),
+                            );
                             let already_logged = matches!(
-                                *cleanup,
+                                previous,
                                 Some(DeletedRootCleanup::Inconclusive(generation))
                                     if generation == expected_generation
                             );
@@ -5739,14 +5796,18 @@ impl AppContext {
                                     error
                                 );
                             }
-                            *cleanup = Some(DeletedRootCleanup::Inconclusive(expected_generation));
                             return true;
                         }
                     }
-                    if matches!(*cleanup, Some(DeletedRootCleanup::Complete(generation)) if generation == expected_generation) {
+                    if matches!(*self.deleted_root_cleanup.lock(), Some(DeletedRootCleanup::Complete(generation)) if generation == expected_generation) {
                         return true;
                     }
-                    *cleanup = Some(DeletedRootCleanup::Pending(expected_generation));
+                    // Directory cleanup can modify the same cached state as
+                    // event delivery, so guard it even without a receiver.
+                    let _in_flight = self.watcher_drain_guard();
+                    // The lifecycle gate serializes cleanup operations. Publish
+                    // retry demand, then release the metadata lock before teardown.
+                    *self.deleted_root_cleanup.lock() = Some(DeletedRootCleanup::Pending(expected_generation));
                     // A concurrent drain may hold the receiver while awaiting
                     // lifecycle admission. Never wait for it under this gate.
                     if !self.try_stop_watcher_runtime_in_background() {
@@ -5760,7 +5821,7 @@ impl AppContext {
                     // Also invalidate starts that have not published a client yet.
                     let clients = lsp.take_all_clients();
                     drop(lsp);
-                    *cleanup = Some(DeletedRootCleanup::Complete(expected_generation));
+                    *self.deleted_root_cleanup.lock() = Some(DeletedRootCleanup::Complete(expected_generation));
                     let _ = self.add_degraded_reason("project_root_deleted".to_string());
                     crate::slog_warn!(
                         "project root deleted {}: shut down {} language server(s); dropping watcher",
@@ -5856,27 +5917,47 @@ impl AppContext {
     /// use `try_lock` and treat contention as pending work. The verification
     /// registry lock must never cover per-view locks or I/O.
     pub fn watcher_drain_has_work(&self) -> bool {
-        let cleanup_pending = self.deleted_root_cleanup.try_lock().is_none_or(|cleanup| {
+        self.watcher_drain_has_work_inner(false)
+    }
+
+    /// Query capture and drain admission inspect metadata instead of treating
+    /// contention as changes. These slots never cover I/O or applying events;
+    /// actual cleanup and drains publish pending state and an in-flight fence.
+    /// The frame-loop scheduler keeps its fully nonblocking probe above.
+    pub(crate) fn watcher_drain_has_work_snapshot(&self) -> bool {
+        self.watcher_drain_has_work_inner(true)
+    }
+
+    fn watcher_drain_has_work_inner(&self, wait_for_metadata: bool) -> bool {
+        let cleanup_pending = watcher_metadata_probe(&self.deleted_root_cleanup, wait_for_metadata, || {
+            #[cfg(test)]
+            pending_capture_boundary_for_test(PendingCaptureBoundary::AfterCleanupProbe);
+        }).is_none_or(|cleanup| {
             matches!(
                 *cleanup,
                 Some(DeletedRootCleanup::Pending(generation) | DeletedRootCleanup::Inconclusive(generation))
                     if generation == self.configure_generation()
             )
         });
-        let receiver_pending = self
-            .watcher_rx
-            .try_lock()
-            .is_none_or(|slot| slot.as_ref().is_some_and(|rx| !rx.is_empty()));
-        cleanup_pending
-            || receiver_pending
-            || self.watcher_drain_slice.try_lock().is_none_or(|slot| {
+        let receiver_pending = watcher_metadata_probe(&self.watcher_rx, wait_for_metadata, || {
+            #[cfg(test)]
+            pending_capture_boundary_for_test(PendingCaptureBoundary::AfterReceiverProbe);
+        })
+        .is_none_or(|slot| slot.as_ref().is_some_and(|rx| !rx.is_empty()));
+        cleanup_pending || receiver_pending || {
+            let slot = watcher_metadata_probe(&self.watcher_drain_slice, wait_for_metadata, || {
+                #[cfg(test)]
+                pending_capture_boundary_for_test(PendingCaptureBoundary::AfterContinuationProbe);
+            });
+            slot.is_none_or(|slot| {
                 slot.as_ref().is_some_and(|state| {
                     state.has_pending_work()
-                        || state
-                            .ignore_refresh_due
-                            .is_some_and(|due| Instant::now() >= due)
+                        || state.ignore_refresh_due.is_some_and(|due| {
+                            crate::runtime_drain::ignore_rule_refresh_now() >= due
+                        })
                 })
             })
+        }
     }
 
     pub fn lsp_drain_has_work(&self) -> bool {
@@ -5902,16 +5983,24 @@ impl AppContext {
         // Directory discovery publishes children to the flush window before
         // ending its pending guard; dispatch publishes before clearing that
         // window or its backlog. Read these stages before the channel below.
-        let intake_pending = match self.watcher_counters.try_read() {
+        let counters = self.watcher_counters.try_read();
+        #[cfg(test)]
+        if matches!(&counters, Err(std::sync::TryLockError::WouldBlock)) {
+            pending_capture_boundary_for_test(PendingCaptureBoundary::AfterIntakeProbe);
+        }
+        let intake_pending = match counters {
             Ok(counters) => counters.query_delivery_pending(),
             Err(std::sync::TryLockError::Poisoned(counters)) => {
                 counters.into_inner().query_delivery_pending()
             }
-            // Contended: assume events may be held, as the probes below do.
-            Err(std::sync::TryLockError::WouldBlock) => true,
+            // Publication swaps only the Arc; root lookup and I/O happen before
+            // taking the write lock, so contention is not evidence of events.
+            Err(std::sync::TryLockError::WouldBlock) => {
+                self.watcher_counters().query_delivery_pending()
+            }
         };
         intake_pending
-            || self.watcher_drain_has_work()
+            || self.watcher_drain_has_work_snapshot()
             || self.watcher_drains_in_flight.load(Ordering::Acquire) > 0
             || self.watcher_drain_activity.load(Ordering::Acquire) != activity
     }
@@ -7473,14 +7562,15 @@ impl AppContext {
         self.reconcile_rerank_backend(&next);
         if project_root_changed {
             self.path_restriction_root_memo.lock().take();
-            *self
-                .watcher_counters
-                .write()
-                .unwrap_or_else(std::sync::PoisonError::into_inner) = next
+            let counters = next
                 .project_root
                 .as_deref()
                 .map(watcher_counters_for_root)
                 .unwrap_or_else(|| Arc::new(WatcherCounters::default()));
+            *self
+                .watcher_counters
+                .write()
+                .unwrap_or_else(std::sync::PoisonError::into_inner) = counters;
         }
         Some(next)
     }
@@ -12062,10 +12152,7 @@ impl AppContext {
             AccessDecision::Deny(AccessDenial::Floor) => Err(crate::protocol::Response::error(
                 req_id,
                 "denied_floor",
-                format!(
-                    "path '{}' is denied by the access policy floor",
-                    original.display()
-                ),
+                policy.floor_denial_message(operation, &identity, original, owned_artifact),
             )),
             AccessDecision::Deny(AccessDenial::OutsideRoots | AccessDenial::ScopeGrants(_)) => {
                 let root = self
@@ -13751,6 +13838,222 @@ mod callgraph_store_for_ops_tests {
                 .any(|gap| gap["path"] == path)
     }
 
+    #[test]
+    fn empty_watcher_drains_do_not_advance_the_pending_capture_fence() {
+        let (_dirs, ctx) = cold_build_context();
+        ctx.set_canonical_cache_root(
+            std::fs::canonicalize(ctx.config().project_root.as_ref().unwrap()).unwrap(),
+        );
+        let (_tx, rx) = crate::watcher_filter::watcher_dispatch_channel();
+        for receiver in [None, Some(rx)] {
+            *ctx.watcher_rx().lock() = receiver;
+            let activity = ctx.watcher_drain_activity.load(Ordering::Acquire);
+            let outcome = crate::runtime_drain::drain_watcher_events_bounded(&ctx, 1);
+            assert_eq!(outcome, crate::runtime_drain::DrainBatchOutcome::default());
+            assert_eq!(
+                ctx.watcher_drain_activity.load(Ordering::Acquire),
+                activity,
+                "an empty maintenance pass must not mark a concurrent grep incomplete"
+            );
+            assert!(!ctx.watcher_query_has_pending_changes());
+        }
+    }
+
+    fn with_contended_watcher_metadata<T>(
+        ctx: &Arc<AppContext>,
+        boundary: PendingCaptureBoundary,
+        capture: impl FnOnce() -> T,
+    ) -> T {
+        let (held_tx, held_rx) = std::sync::mpsc::sync_channel(1);
+        let (release_tx, release_rx) = std::sync::mpsc::sync_channel(1);
+        let (unlocked_tx, unlocked_rx) = std::sync::mpsc::sync_channel(1);
+        let reader_ctx = Arc::clone(ctx);
+        let reader = std::thread::spawn(move || {
+            let hold = || {
+                held_tx.send(()).unwrap();
+                release_rx.recv_timeout(Duration::from_secs(10)).unwrap();
+            };
+            match boundary {
+                PendingCaptureBoundary::AfterCleanupProbe => {
+                    let _held = reader_ctx.deleted_root_cleanup.lock();
+                    hold();
+                }
+                PendingCaptureBoundary::AfterReceiverProbe => {
+                    let _held = reader_ctx.watcher_rx.lock();
+                    hold();
+                }
+                PendingCaptureBoundary::AfterContinuationProbe => {
+                    let _held = reader_ctx.watcher_drain_slice.lock();
+                    hold();
+                }
+                PendingCaptureBoundary::AfterIntakeProbe => {
+                    let _held = reader_ctx.watcher_counters.write().unwrap();
+                    hold();
+                }
+                PendingCaptureBoundary::AfterFlushWindow => unreachable!(),
+            }
+            unlocked_tx.send(()).unwrap();
+        });
+        held_rx.recv_timeout(Duration::from_secs(10)).unwrap();
+        if boundary != PendingCaptureBoundary::AfterIntakeProbe {
+            assert!(ctx.watcher_drain_has_work(), "the scheduler must not wait");
+        }
+        let hook = install_pending_capture_hook_for_test(move |reached| {
+            if reached == boundary {
+                // Capture has observed contention, not a changed value. Release
+                // only the other reader; the pending metadata stays unchanged.
+                release_tx.send(()).unwrap();
+                unlocked_rx.recv_timeout(Duration::from_secs(10)).unwrap();
+            }
+        });
+        let result = capture();
+        drop(hook);
+        reader.join().unwrap();
+        result
+    }
+
+    #[test]
+    fn watcher_query_reads_contended_metadata_instead_of_inventing_changes() {
+        let (_dirs, ctx) = cold_build_context();
+        for boundary in [
+            PendingCaptureBoundary::AfterCleanupProbe,
+            PendingCaptureBoundary::AfterReceiverProbe,
+            PendingCaptureBoundary::AfterContinuationProbe,
+            PendingCaptureBoundary::AfterIntakeProbe,
+        ] {
+            for pending in [false, true] {
+                *ctx.deleted_root_cleanup.lock() = None;
+                *ctx.watcher_drain_slice.lock() = None;
+                let (tx, rx) = crate::watcher_filter::watcher_dispatch_channel();
+                *ctx.watcher_rx.lock() = Some(rx);
+                ctx.watcher_counters().set_dispatch_backlog(0);
+                if pending {
+                    match boundary {
+                        PendingCaptureBoundary::AfterCleanupProbe => {
+                            *ctx.deleted_root_cleanup.lock() =
+                                Some(DeletedRootCleanup::Pending(ctx.configure_generation()));
+                        }
+                        PendingCaptureBoundary::AfterReceiverProbe => {
+                            tx.send(WatcherDispatchEvent::Paths(vec![PathBuf::from(
+                                "src/lib.rs",
+                            )]))
+                            .unwrap();
+                        }
+                        PendingCaptureBoundary::AfterContinuationProbe => {
+                            let mut state = WatcherDrainSliceState::new(
+                                ctx.configure_generation(),
+                                ctx.configure_content_generation(),
+                            );
+                            state.pending_paths.push_back(PathBuf::from("src/lib.rs"));
+                            *ctx.watcher_drain_slice.lock() = Some(state);
+                        }
+                        PendingCaptureBoundary::AfterIntakeProbe => {
+                            ctx.watcher_counters().set_dispatch_backlog(1);
+                        }
+                        PendingCaptureBoundary::AfterFlushWindow => unreachable!(),
+                    }
+                }
+                let actual = with_contended_watcher_metadata(&ctx, boundary, || {
+                    ctx.watcher_query_has_pending_changes()
+                });
+                assert_eq!(actual, pending, "{boundary:?}, pending={pending}");
+            }
+        }
+    }
+
+    #[test]
+    fn watcher_drain_does_not_fence_contended_empty_metadata() {
+        let (_dirs, ctx) = cold_build_context();
+        ctx.set_canonical_cache_root(
+            std::fs::canonicalize(ctx.config().project_root.as_ref().unwrap()).unwrap(),
+        );
+        for boundary in [
+            PendingCaptureBoundary::AfterCleanupProbe,
+            PendingCaptureBoundary::AfterReceiverProbe,
+            PendingCaptureBoundary::AfterContinuationProbe,
+        ] {
+            for parked in [false, true] {
+                *ctx.watcher_drain_slice().lock() = parked.then(|| {
+                    WatcherDrainSliceState::new(
+                        ctx.configure_generation(),
+                        ctx.configure_content_generation(),
+                    )
+                });
+                let activity = ctx.watcher_drain_activity.load(Ordering::Acquire);
+                with_contended_watcher_metadata(&ctx, boundary, || {
+                    if boundary == PendingCaptureBoundary::AfterCleanupProbe {
+                        // Root existence checks also publish cleanup metadata.
+                        // Exercise admission directly while that slot is held.
+                        assert!(!ctx.watcher_drain_has_work_snapshot());
+                    } else {
+                        assert_eq!(
+                            crate::runtime_drain::drain_watcher_events_bounded(&ctx, 1),
+                            crate::runtime_drain::DrainBatchOutcome::default(),
+                        );
+                    }
+                });
+                if boundary == PendingCaptureBoundary::AfterCleanupProbe {
+                    assert_eq!(
+                        crate::runtime_drain::drain_watcher_events_bounded(&ctx, 1),
+                        crate::runtime_drain::DrainBatchOutcome::default(),
+                    );
+                }
+                assert_eq!(ctx.watcher_drain_activity.load(Ordering::Acquire), activity);
+                assert!(!ctx.watcher_query_has_pending_changes());
+            }
+        }
+    }
+
+    #[test]
+    fn watcher_query_preserves_contended_cleanup_retry_states() {
+        let (_dirs, ctx) = cold_build_context();
+        let generation = ctx.configure_generation();
+        for (state, pending) in [
+            (Some(DeletedRootCleanup::Pending(generation)), true),
+            (Some(DeletedRootCleanup::Inconclusive(generation)), true),
+            (Some(DeletedRootCleanup::Complete(generation)), false),
+            (
+                Some(DeletedRootCleanup::Pending(generation.wrapping_add(1))),
+                false,
+            ),
+            (None, false),
+        ] {
+            *ctx.deleted_root_cleanup.lock() = state;
+            assert_eq!(
+                with_contended_watcher_metadata(
+                    &ctx,
+                    PendingCaptureBoundary::AfterCleanupProbe,
+                    || { ctx.watcher_query_has_pending_changes() }
+                ),
+                pending,
+            );
+        }
+    }
+
+    #[test]
+    fn nonempty_watcher_drains_keep_the_pending_capture_fence() {
+        let (_dirs, ctx) = cold_build_context();
+        let root = std::fs::canonicalize(ctx.config().project_root.as_ref().unwrap()).unwrap();
+        ctx.set_canonical_cache_root(root.clone());
+        let source = root.join("src/lib.rs");
+        let (tx, rx) = crate::watcher_filter::watcher_dispatch_channel();
+        *ctx.watcher_rx().lock() = Some(rx);
+        let (reached, release) =
+            crate::runtime_drain::install_watcher_phase_commit_gate_for_test(source.clone());
+        tx.send(WatcherDispatchEvent::Paths(vec![source])).unwrap();
+        let drain_ctx = Arc::clone(&ctx);
+        let drain = std::thread::spawn(move || {
+            crate::runtime_drain::drain_watcher_events_bounded(&drain_ctx, 1)
+        });
+        reached.recv_timeout(Duration::from_secs(10)).unwrap();
+        let pending = ctx.watcher_query_has_pending_changes();
+        let in_flight = ctx.watcher_drains_in_flight.load(Ordering::Acquire);
+        release.send(()).unwrap();
+        drain.join().unwrap();
+        assert!(pending, "a dequeued event must remain visible to queries");
+        assert!(in_flight > 0, "real work must retain its in-flight guard");
+    }
+
     /// The watcher thread hands a flush window's files to the dispatch
     /// channel and only then clears the window. A flush that lands while an
     /// answer is capturing what is pending must not hide the file from both
diff --git a/crates/aft/src/cross_volume.rs b/crates/aft/src/cross_volume.rs
index e8ed4b4e9d..d20fdd8dc4 100644
--- a/crates/aft/src/cross_volume.rs
+++ b/crates/aft/src/cross_volume.rs
@@ -499,7 +499,7 @@ fn copy_tree(from: &Path, to: &Path) -> io::Result<()> {
     if kind.is_file() {
         fs::copy(from, to)?;
         #[cfg(not(windows))]
-        fs::File::open(to)?.sync_all()?;
+        aft_store::sync::sync_all(&fs::File::open(to)?, to)?;
         #[cfg(windows)]
         {
             // FlushFileBuffers requires a writable handle. fs::copy preserves
diff --git a/crates/aft/src/data_layer/callgraph.rs b/crates/aft/src/data_layer/callgraph.rs
index cd383a80dd..bd47f24b1c 100644
--- a/crates/aft/src/data_layer/callgraph.rs
+++ b/crates/aft/src/data_layer/callgraph.rs
@@ -592,6 +592,23 @@ impl EncodedResolution {
 }
 
 impl Resolutions {
+    #[cfg(feature = "test-hooks")]
+    pub(crate) fn profile_parts(&self) -> [usize; 5] {
+        use aft_store::heap::HeapBytes as _;
+        let mut seen = aft_store::heap::Seen::new();
+        let mut parts = [0; 5];
+        for slot in self.map.values() {
+            if let Some(Some(file)) = slot.value.get() {
+                parts[0] += file.rows.heap_bytes(&mut seen);
+                parts[1] += file.binding.heap_bytes(&mut seen);
+                parts[2] += file.dispatch.heap_bytes(&mut seen);
+                parts[3] += file.sites.heap_bytes(&mut seen);
+                parts[4] += file.site_dependencies.heap_bytes(&mut seen);
+            }
+        }
+        parts
+    }
+
     /// Every file `stored` has a resolution for, each decoded on first read.
     pub(crate) fn stored(stored: &Arc<StoredSlices>) -> Self {
         Self {
@@ -1270,6 +1287,8 @@ pub(crate) fn resolve_checkout_into(
     crate::alloc_trace::install(&pool(threads)?, || {
         let paths = inputs.parses.keys().cloned().collect::<Vec<_>>();
         let bound = BindCache::default();
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("binding");
         // The whole-checkout lists read every parse, so they are built here,
         // a batch at a time: each parse is decoded once, for its kinds, and
         // kept until binding (which keeps none it decodes) has read it.
@@ -1299,6 +1318,8 @@ pub(crate) fn resolve_checkout_into(
         relieve_allocator();
         lap(&mut memory, "bind");
         let mut resolved = Vec::with_capacity(paths.len());
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("resolution");
         for batch in paths.chunks(BATCH) {
             let parses = &inputs.parses;
             resolved.extend(resolve_files_with(
@@ -1352,6 +1373,8 @@ pub(crate) fn resolve_checkout_into(
         // in parallel, and the sink builds their fragments in parallel too;
         // a whole batch decoded and built at once held about 750 MB more.
         let mut sites_ms = 0u128;
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("sites");
         for batch in paths.chunks(BATCH) {
             let started = std::time::Instant::now();
             let mut reached = calls
@@ -1723,6 +1746,29 @@ pub(crate) struct MethodCallInputs {
 const SMALL_SITE_RUN: usize = 64;
 
 impl MethodCallInputs {
+    /// Declaration changes already identify method readers before resolving
+    /// any importer. Compare raw facts on both sides: import/type targets are
+    /// filled by resolution and are admitted separately when they are known.
+    pub(crate) fn changed_parse_method_keys(
+        old: &CheckoutInputs,
+        next: &CheckoutInputs,
+        changed: &BTreeSet<String>,
+    ) -> BTreeSet<String> {
+        let mut keys = BTreeSet::new();
+        for path in changed {
+            let before = old
+                .parses
+                .read(path)
+                .map(|(_, parse)| FileFacts::new(&parse));
+            let after = next
+                .parses
+                .read(path)
+                .map(|(_, parse)| FileFacts::new(&parse));
+            FileFacts::changed_keys_by_method(path, before.as_ref(), after.as_ref(), &mut keys);
+        }
+        keys
+    }
+
     /// The files whose inputs the resolver computed itself since the last
     /// call.
     #[cfg(test)]
diff --git a/crates/aft/src/data_layer/checkout.rs b/crates/aft/src/data_layer/checkout.rs
index 9354b01c32..17899a5dae 100644
--- a/crates/aft/src/data_layer/checkout.rs
+++ b/crates/aft/src/data_layer/checkout.rs
@@ -34,9 +34,10 @@ use aft_store::text::{
 use super::callgraph::{CheckoutInputs, EncodedResolution, FileResolution};
 use super::content::{blob_from_record, extract, language_for, EXTRACTOR_VERSION};
 use super::graph_store::{Held, SectionsWriter, StoredSlices};
-use super::incremental::{LiveCheckout, UpdateStats};
+use super::incremental::{LiveCheckout, UpdateError, UpdateStats};
 use super::overlay::{CacheKey, OverlaySlices, PreparedSlice};
 use super::query::{SliceReader, SliceSource};
+use super::refresh_budget::{RefreshBudget, RefreshLimit};
 use super::slice::FileSlice;
 use crate::callgraph_store::join::{CallgraphBlob, ParseBlob};
 
@@ -79,6 +80,9 @@ pub(crate) struct SourceWork {
     /// Passes over the files: a scan reads every file whose stat does not
     /// prove its recorded content, and a build's scan parses what it reads.
     pub(crate) scans: usize,
+    /// Full graph rebuilds, not text-only scans or incremental builds from
+    /// another checkout's published graph.
+    pub(crate) cold_builds: usize,
     /// Call-graph resolutions: a build's, or a refresh's update.
     pub(crate) resolutions: usize,
     /// The most stored parses, and separately resolutions, a refresh's
@@ -372,6 +376,29 @@ struct GraphEngine {
     measure_after_publication: bool,
 }
 
+enum EngineUpdate {
+    Applied(
+        Option<UpdateStats>,
+        Option<(OverlaySlices<Arc<StoredSlices>>, Refreshed)>,
+    ),
+    Cold(RefreshLimit),
+}
+
+/// A checkout's single queued or running build. Dropping a queued task also
+/// releases its reservation, so another reader can request the build again.
+pub(crate) struct BuildReservation {
+    live: Arc<RwLock<Live>>,
+}
+
+impl Drop for BuildReservation {
+    fn drop(&mut self) {
+        self.live
+            .write()
+            .expect("no panics while holding it")
+            .building = false;
+    }
+}
+
 impl GraphEngine {
     /// This engine moved onto `to`, the publication of what it resolved:
     /// the engine a start from `to` gives, keeping every file it bound and
@@ -1208,9 +1235,12 @@ impl Checkout {
         )
         .map_err(|error| DataError::Scan(error.to_string()))?;
         let changed = changed_members(&current, &scanned.state);
+        let mut retry = changed.iter().cloned().collect::<BTreeSet<_>>();
+        retry.extend(current.skipped_directories().keys().cloned());
+        retry.extend(scanned.state.skipped_directories().keys().cloned());
         // Recording scans each path again under the same rules, so a change
         // recorded meanwhile is taken from the disk once more, not lost.
-        self.record_paths(&changed)?;
+        self.record_paths(&retry.into_iter().collect::<Vec<_>>())?;
         Ok(changed.len())
     }
 
@@ -1451,11 +1481,50 @@ impl Checkout {
     }
 
     fn build_as(&self, measure: bool) -> Result<BuildReport, DataError> {
+        let Some(reservation) = self.reserve_build() else {
+            return Ok(BuildReport {
+                superseded: true,
+                ..BuildReport::default()
+            });
+        };
+        self.build_reserved(measure, reservation)
+    }
+
+    pub(crate) fn reserve_build(&self) -> Option<BuildReservation> {
+        let mut live = self.write_live();
+        if live.building {
+            return None;
+        }
+        live.building = true;
+        Some(BuildReservation {
+            live: Arc::clone(&self.live),
+        })
+    }
+
+    pub(crate) fn is_building(&self) -> bool {
+        self.live
+            .read()
+            .expect("no panics while holding it")
+            .building
+    }
+
+    pub(crate) fn build_reserved(
+        &self,
+        measure: bool,
+        reservation: BuildReservation,
+    ) -> Result<BuildReport, DataError> {
+        // A refresh already inside the engine finishes first. The reservation
+        // blocks new refreshes, so no decoded engine overlaps the cold scan.
+        let mut engine = self
+            .engine
+            .lock()
+            .unwrap_or_else(|poisoned| poisoned.into_inner());
+        *engine = None;
+        drop(engine);
         let _alloc_label =
             crate::alloc_trace::scope(crate::alloc_trace::Label::INDEX_BUILD, Some(&self.root));
-        self.write_live().building = true;
         let result = self.build_inner(measure);
-        self.write_live().building = false;
+        drop(reservation);
         self.note_outcome("build", &result);
         result
     }
@@ -1512,6 +1581,7 @@ impl Checkout {
         checkpoint()?;
         // A change recorded before the scan starts is in what the scan
         // reads; one recorded later may not be.
+        note_source_work(&self.root, |work| work.cold_builds += 1);
         let covered = self
             .live
             .read()
@@ -1533,6 +1603,8 @@ impl Checkout {
             stored: self.stored_records()?,
             ..BuildSink::default()
         };
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("extraction");
         let scanned = scan(&self.root, &self.layer.policy, None, &sink)
             .map_err(|error| DataError::Scan(error.to_string()))?;
         let mut collected = sink.finish();
@@ -1650,6 +1722,8 @@ impl Checkout {
         report.resolve_ms = elapsed_ms(started);
         checkpoint()?;
 
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("publication");
         let started = Instant::now();
         #[cfg(test)]
         wait_while_publication_held_for_test(&self.root);
@@ -1861,9 +1935,12 @@ impl Checkout {
         let text_ready_ms = elapsed_ms(build_started);
         checkpoint()?;
         let started = Instant::now();
-        self.refresh_callgraph()?;
+        let update = self.refresh_callgraph_as(true)?;
+        log::debug!("sibling callgraph update: {update:?}");
         let resolve_ms = elapsed_ms(started);
         let started = Instant::now();
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("publication");
         let delta = self.publish_changes_as(true)?;
         let publish_ms = elapsed_ms(started);
         let segment_bytes = self
@@ -1908,9 +1985,31 @@ impl Checkout {
         Ok(StoredRecords {
             _snapshot: Some(snapshot),
             segments,
+            pending: self.ready_change_records(),
         })
     }
 
+    /// A cold scan can reuse content already extracted by an aborted update.
+    /// Reading this cache must not start parsing: a batch rejected before
+    /// extraction should reach the cold scan unparsed. The scan looks up each
+    /// record by its on-disk content and extractor key.
+    fn ready_change_records(&self) -> HashMap<String, Arc<EncodedRecord>> {
+        #[cfg(feature = "test-hooks")]
+        if std::env::var_os("PROBE_SKIP_HANDOFF").is_some() {
+            return HashMap::new();
+        }
+        self.live
+            .read()
+            .expect("no panics while holding it")
+            .changes
+            .values()
+            .filter_map(|change| match change.content.peek() {
+                Some(Extracted::Parse(key, _, record)) => Some((key.clone(), Arc::clone(record))),
+                _ => None,
+            })
+            .collect()
+    }
+
     /// Waits up to [`WRITER_WAIT`] for the store's writer, and refuses it
     /// below the free-disk floor. The store itself refuses it, before
     /// anything is written, when a newer build wrote a file the newest
@@ -2473,12 +2572,16 @@ impl Checkout {
     /// When a stored record or fragment cannot be read, or resolution
     /// fails. The pending paths stay pending then.
     pub fn refresh_callgraph(&self) -> Result<Option<UpdateStats>, DataError> {
+        self.refresh_callgraph_as(false)
+    }
+
+    fn refresh_callgraph_as(&self, by_build: bool) -> Result<Option<UpdateStats>, DataError> {
         let _alloc_label = crate::alloc_trace::scope(
             crate::alloc_trace::Label::CALLGRAPH_REFRESH,
             Some(&self.root),
         );
         checkpoint()?;
-        let result = self.refresh_inner();
+        let result = self.refresh_inner(by_build);
         self.touch_memory();
         self.note_outcome("refresh", &result);
         result
@@ -2496,9 +2599,12 @@ impl Checkout {
             .fetch_add(1, std::sync::atomic::Ordering::AcqRel);
     }
 
-    fn refresh_inner(&self) -> Result<Option<UpdateStats>, DataError> {
-        let (published, state, changes, covered) = {
+    fn refresh_inner(&self, by_build: bool) -> Result<Option<UpdateStats>, DataError> {
+        let (published, state, changes, covered, invalidated) = {
             let live = self.live.read().expect("no panics while holding it");
+            if live.building && !by_build {
+                return Ok(None);
+            }
             let Some(published) = live.published.clone() else {
                 return Ok(None);
             };
@@ -2506,7 +2612,24 @@ impl Checkout {
                 .state
                 .clone()
                 .unwrap_or_else(|| Arc::new(published.state.clone()));
-            (published, state, live.changes.clone(), live.sequence)
+            let invalidated = live
+                .refreshed
+                .as_ref()
+                .map_or_else(BTreeSet::new, |refreshed| {
+                    refreshed
+                        .replaced
+                        .keys()
+                        .chain(&refreshed.removed)
+                        .cloned()
+                        .collect()
+                });
+            (
+                published,
+                state,
+                live.changes.clone(),
+                live.sequence,
+                invalidated,
+            )
         };
         // Without a call graph there is nothing to update; the build that
         // makes one covers every change recorded before its scan.
@@ -2522,15 +2645,57 @@ impl Checkout {
             *slot = None;
             slot
         });
+        if self.is_building() && !by_build {
+            return Ok(None);
+        }
+        let parsed = slot.as_ref().map_or_else(
+            || published.graph.parsed_files().count(),
+            |engine| engine.live.inputs.parses.len(),
+        );
+        let mut budget = RefreshBudget::new(parsed, invalidated);
         // A damaged stored record or fragment can stop the update where it
         // expects one (every file the engine lists has a parse and a
         // resolution). Such a stop fails this refresh as damage, and the
         // engine, whose state it may have left half-updated, starts again.
         let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-            self.update_engine(&mut slot, &published, &state, &changes)
+            self.update_engine(&mut slot, &published, &state, &changes, &mut budget)
         }));
         let (stats, served) = match outcome {
-            Ok(Ok(outcome)) => outcome,
+            Ok(Ok(EngineUpdate::Applied(stats, served))) => (stats, served),
+            Ok(Ok(EngineUpdate::Cold(limit))) => {
+                // No incremental engine or its decoded state overlaps the cold
+                // builder. Watcher events keep recording over the publication.
+                *slot = None;
+                let reservation = if by_build { None } else { self.reserve_build() };
+                drop(slot);
+                drop(changes);
+                drop(state);
+                drop(published);
+                if !by_build && reservation.is_none() {
+                    return Ok(None);
+                }
+                crate::slog_info!(
+                    "data layer cold refresh: root={} invalidated={} threshold={} parsed={}",
+                    self.root.display(),
+                    limit.invalidated,
+                    limit.threshold,
+                    limit.parsed
+                );
+                let started = Instant::now();
+                let rebuilt = if let Some(reservation) = reservation {
+                    self.build_reserved(false, reservation)?
+                } else {
+                    // The outer build is reusing another checkout's publication
+                    // and already holds the reservation.
+                    self.build_inner(false)?
+                };
+                return Ok(Some(UpdateStats {
+                    cold_build: true,
+                    cold_reused_records: rebuilt.stored_records,
+                    total_ms: elapsed_ms(started),
+                    ..UpdateStats::default()
+                }));
+            }
             Ok(Err(error)) => {
                 *slot = None;
                 return Err(error);
@@ -2618,13 +2783,20 @@ impl Checkout {
         published: &Arc<Published>,
         state: &Arc<CheckoutState>,
         changes: &BTreeMap<Vec<u8>, Change>,
-    ) -> Result<
-        (
-            Option<UpdateStats>,
-            Option<(OverlaySlices<Arc<StoredSlices>>, Refreshed)>,
-        ),
-        DataError,
-    > {
+        budget: &mut RefreshBudget,
+    ) -> Result<EngineUpdate, DataError> {
+        // This test needs neither extraction nor an engine start. A single
+        // watcher batch can already be larger than incremental admission.
+        if let Err(limit) = budget.check(changes.len()) {
+            return Ok(EngineUpdate::Cold(limit));
+        }
+        let changed_members = changes
+            .keys()
+            .filter_map(|path| std::str::from_utf8(path).ok().map(str::to_owned))
+            .collect::<BTreeSet<_>>();
+        if let Err(limit) = budget.include(&changed_members) {
+            return Ok(EngineUpdate::Cold(limit));
+        }
         if slot
             .as_ref()
             .is_some_and(|engine| !Arc::ptr_eq(&engine.published, &published))
@@ -2644,6 +2816,8 @@ impl Checkout {
         let mut stats = None;
         if !changed.is_empty() {
             note_source_work(&self.root, |work| work.resolutions += 1);
+            #[cfg(feature = "test-hooks")]
+            super::refresh_probe::stage("extraction");
             // The changed files are extracted here, all at once on the
             // engine's threads, rather than each when its edit was recorded.
             let extracting = changed
@@ -2658,12 +2832,19 @@ impl Checkout {
                     change.content.get();
                 });
             });
+            #[cfg(feature = "test-hooks")]
+            super::refresh_probe::stage("planning");
             let next = next_inputs(state, &engine.live.inputs, changes, &changed);
+            if let Err(limit) = budget.set_parsed(next.parses.len()) {
+                return Ok(EngineUpdate::Cold(limit));
+            }
             let changed_names = changed
                 .iter()
                 .filter_map(|path| std::str::from_utf8(path).ok().map(str::to_string))
                 .collect::<BTreeSet<_>>();
-            let update = engine.live.update(next, &changed_names);
+            let update = engine
+                .live
+                .update_with_budget(next, &changed_names, Some(budget));
             // The engine reads stored parses and resolutions as it goes; a
             // read that failed made it work from an empty one.
             let failures = published.graph.failures();
@@ -2675,7 +2856,16 @@ impl Checkout {
             }
             // The caller drops a partly updated engine after either error,
             // so the next refresh starts again from the publication.
-            let update = update.map_err(|error| DataError::Resolve(error.to_string()))?;
+            let update = match update {
+                Ok(update) => update,
+                Err(UpdateError::Limit(limit)) => return Ok(EngineUpdate::Cold(limit)),
+                Err(UpdateError::Resolve(error)) => {
+                    return Err(DataError::Resolve(error.to_string()))
+                }
+            };
+            log::debug!("callgraph refresh work: changed={} rebound={} replayed={} resolved={} dispatch_replayed={} dispatch_recomputed={} sites={} touched={}", update.changed_paths, update.rebound, update.replayed, update.resolved, update.dispatch_replayed, update.dispatch_recomputed, update.sites_resolved, update.touched.len());
+            #[cfg(feature = "test-hooks")]
+            super::refresh_probe::stage("slices");
             // Only the files this update touched get new slices; every file
             // touched by an earlier update keeps the slice it got then. Each
             // is laid over the publication encoded, as a publication stores
@@ -2765,7 +2955,7 @@ impl Checkout {
         let served = stats
             .is_some()
             .then(|| (engine.overlay.clone(), engine.refreshed.clone()));
-        Ok((stats, served))
+        Ok(EngineUpdate::Applied(stats, served))
     }
 
     /// Publishes what changed since the publication in a segment of its
@@ -4577,6 +4767,9 @@ struct StoredRecords {
     _snapshot: Option<Snapshot>,
     /// Newest last.
     segments: Vec<Arc<Segment>>,
+    /// Encoded parses computed by pending changes, keyed exactly as a stored
+    /// content record. They need not be published just to avoid parsing twice.
+    pending: HashMap<String, Arc<EncodedRecord>>,
 }
 
 impl StoredRecords {
@@ -4584,6 +4777,11 @@ impl StoredRecords {
     /// segment that fails to read counts as not holding it, so the file is
     /// parsed instead.
     fn record(&self, key: RecordKey) -> Option<ContentRecord> {
+        if let Some(record) = self.pending.get(&key.digest().to_string()) {
+            if let Ok(record) = record.decode() {
+                return Some(record);
+            }
+        }
         self.segments.iter().rev().find_map(|segment| {
             let content = ContentSegment::open(segment).ok().flatten()?;
             let ordinal = content.find(key).ok().flatten()?;
@@ -6237,7 +6435,13 @@ pub fn other() { callee(); }
             )
         };
         assert!(matches!(
-            checkout.update_engine(&mut None, &published, &state, &changes),
+            checkout.update_engine(
+                &mut None,
+                &published,
+                &state,
+                &changes,
+                &mut RefreshBudget::new(published.graph.parsed_files().count(), BTreeSet::new())
+            ),
             Err(DataError::Damaged(_))
         ));
         for attempt in 0..2 {
@@ -7102,14 +7306,11 @@ pub fn other() { callee(); }
         );
     }
 
-    /// A change recorded while a build runs, after its scan, stays laid over
-    /// the build's publication. A refresh that resolved it during the build
-    /// laid its answer over the old publication's call graph, which the
-    /// build's replaces, so the change is pending again until a refresh
-    /// resolves it over the new one. The call graph used to report ready
-    /// then and answer without the change.
+    /// A change after a build's scan stays pending over its publication.
+    /// Refreshes now coalesce with that build instead of resolving against
+    /// the old publication and discarding those results when the build ends.
     #[test]
-    fn a_change_resolved_while_a_build_ran_is_resolved_again_over_its_publication() {
+    fn a_change_recorded_while_a_build_runs_resolves_over_its_publication() {
         let root = tempfile::tempdir().unwrap();
         let store = tempfile::tempdir().unwrap();
         demo(root.path());
@@ -7138,12 +7339,8 @@ pub fn other() { callee(); }
         checkout
             .record_paths(&[b"src/extra.rs".to_vec(), b"src/lib.rs".to_vec()])
             .unwrap();
-        checkout.refresh_callgraph().unwrap();
-        let view = checkout.view().unwrap();
-        assert_eq!(view.status().callgraph, PlaneStatus::Ready);
-        let resolved = callers_of(&view, "src/util.rs", "callee");
-        assert!(resolved.contains("src/extra.rs"), "{resolved}");
-        drop(view);
+        assert!(checkout.refresh_callgraph().unwrap().is_none());
+        assert_eq!(checkout.status().callgraph_pending, 2);
 
         drop(hold);
         building.join().unwrap().unwrap();
@@ -7157,7 +7354,7 @@ pub fn other() { callee(); }
         checkout.refresh_callgraph().unwrap();
         assert_eq!(checkout.status().callgraph, PlaneStatus::Ready);
         let callers = callers_of(&checkout.view().unwrap(), "src/util.rs", "callee");
-        assert_eq!(callers, resolved);
+        assert!(callers.contains("src/extra.rs"), "{callers}");
         let cold_store = tempfile::tempdir().unwrap();
         let cold = Checkout::bind(layer, cold_store.path(), family(), root.path()).unwrap();
         cold.build().unwrap();
@@ -7582,6 +7779,140 @@ pub fn other() { callee(); }
 
     const CHAIN: usize = 8;
 
+    #[test]
+    fn bounded_refresh_accumulates_invalidations_across_two_passes() {
+        let store = tempfile::tempdir().unwrap();
+        let layer = Arc::new(DataLayer::new(8 << 20, 2));
+        let mut files = BTreeMap::new();
+        for group in ["a", "b"] {
+            files.insert(
+                format!("{group}.ts"),
+                format!("export function helper_{group}() {{}}\n"),
+            );
+            for i in 0..550 {
+                files.insert(format!("{group}{i}.ts"), format!(
+                    "import {{ helper_{group} }} from './{group}';\nexport function f_{group}{i}() {{ helper_{group}(); }}\n"
+                ));
+            }
+        }
+        let worktree = Worktree::new(&layer, store.path(), files);
+        let root = worktree.dir.path();
+        let checkout = &worktree.checkout;
+        let before = source_work_for_test(root).cold_builds;
+        let edit = |group: &str| {
+            let path = format!("{group}.ts");
+            write(
+                root,
+                &path,
+                &format!("export function renamed_{group}() {{}}\n"),
+            );
+            checkout.record_paths(&[path.into_bytes()]).unwrap();
+            checkout.refresh_callgraph().unwrap().unwrap()
+        };
+        let first = edit("a");
+        assert!(!first.cold_build);
+        assert!((500..1024).contains(&first.touched.len()), "{first:?}");
+        assert_eq!(source_work_for_test(root).cold_builds, before);
+        let second = edit("b");
+        assert!(
+            second.cold_build,
+            "two disjoint sub-threshold passes exceed the union limit"
+        );
+        assert_eq!(source_work_for_test(root).cold_builds, before + 1);
+        assert_eq!(
+            second.cold_reused_records, 1102,
+            "the cold scan reuses both unpublished extracts"
+        );
+        assert_eq!(checkout.status().callgraph, PlaneStatus::Ready);
+        assert!(checkout.refresh_callgraph().unwrap().is_none());
+        assert_eq!(source_work_for_test(root).cold_builds, before + 1);
+        let cold_store = tempfile::tempdir().unwrap();
+        let cold = Checkout::bind(Arc::clone(&layer), cold_store.path(), family(), root).unwrap();
+        cold.build().unwrap();
+        let compared = super::super::checkout_gate::compare_engines(checkout, &cold).unwrap();
+        assert_eq!(compared.files, 1102);
+    }
+
+    fn record_many_notes(checkout: &Checkout, root: &Path, generation: usize) {
+        let paths = (0..1025)
+            .map(|i| {
+                let path = format!("notes_{generation}_{i}.txt");
+                write(root, &path, "changed while the checkout is being rebased\n");
+                path.into_bytes()
+            })
+            .collect::<Vec<_>>();
+        checkout.record_paths(&paths).unwrap();
+    }
+
+    fn bounded_refresh_catch_up(broad: bool) {
+        let root = tempfile::tempdir().unwrap();
+        let store = tempfile::tempdir().unwrap();
+        demo(root.path());
+        let layer = Arc::new(DataLayer::new(8 << 20, 2));
+        let checkout =
+            Arc::new(Checkout::bind(layer, store.path(), family(), root.path()).unwrap());
+        checkout.build().unwrap();
+        let before = source_work_for_test(root.path()).cold_builds;
+        record_many_notes(&checkout, root.path(), 0);
+        let hold = hold_build_publication_for_test(root.path());
+        let refreshing = {
+            let checkout = Arc::clone(&checkout);
+            std::thread::spawn(move || checkout.refresh_callgraph().unwrap().unwrap())
+        };
+        hold.wait_until_held();
+        if broad {
+            record_many_notes(&checkout, root.path(), 1);
+        } else {
+            write(root.path(), "src/extra.rs", "pub fn late() {}\n");
+            checkout.record_paths(&[b"src/extra.rs".to_vec()]).unwrap();
+        }
+        assert!(checkout.refresh_callgraph().unwrap().is_none());
+        assert!(
+            checkout.build().unwrap().superseded,
+            "a running cold build absorbs another request"
+        );
+        assert_eq!(source_work_for_test(root.path()).cold_builds, before + 1);
+        drop(hold);
+        assert!(refreshing.join().unwrap().cold_build);
+        assert!(checkout.status().callgraph_pending > 0);
+        let caught_up = checkout.refresh_callgraph().unwrap().unwrap();
+        assert_eq!(caught_up.cold_build, broad);
+        assert_eq!(
+            source_work_for_test(root.path()).cold_builds,
+            before + 1 + usize::from(broad)
+        );
+        assert_eq!(checkout.status().callgraph, PlaneStatus::Ready);
+    }
+
+    #[test]
+    fn bounded_refresh_catches_up_small_events_during_a_cold_build_incrementally() {
+        bounded_refresh_catch_up(false);
+    }
+
+    #[test]
+    fn bounded_refresh_runs_one_more_cold_build_for_a_broad_preserved_batch() {
+        bounded_refresh_catch_up(true);
+    }
+
+    #[test]
+    fn bounded_refresh_coalesces_with_a_queued_cold_build() {
+        let root = tempfile::tempdir().unwrap();
+        let store = tempfile::tempdir().unwrap();
+        demo(root.path());
+        let layer = Arc::new(DataLayer::new(8 << 20, 2));
+        let checkout = Checkout::bind(layer, store.path(), family(), root.path()).unwrap();
+        checkout.build().unwrap();
+        record_many_notes(&checkout, root.path(), 0);
+        let before = source_work_for_test(root.path()).cold_builds;
+        let reservation = checkout.reserve_build().unwrap();
+        assert!(checkout.refresh_callgraph().unwrap().is_none());
+        assert!(checkout.reserve_build().is_none());
+        assert_eq!(source_work_for_test(root.path()).cold_builds, before);
+        checkout.build_reserved(false, reservation).unwrap();
+        assert_eq!(source_work_for_test(root.path()).cold_builds, before + 1);
+        assert_eq!(checkout.status().callgraph, PlaneStatus::Ready);
+    }
+
     /// Worktrees of one repository keep editing while a main checkout takes
     /// in their changes, as one merging its workers' branches does, and a
     /// new worktree is made from main every few rounds; older worktrees go
diff --git a/crates/aft/src/data_layer/checkout_gate.rs b/crates/aft/src/data_layer/checkout_gate.rs
index d1e4c58f72..5ad800e905 100644
--- a/crates/aft/src/data_layer/checkout_gate.rs
+++ b/crates/aft/src/data_layer/checkout_gate.rs
@@ -162,6 +162,27 @@ impl EngineComparison {
     }
 }
 
+/// Compares every engine input, answer, recording and encoded fragment after a
+/// probe has forced a refresh to switch to cold. Unlike a query sample, this
+/// fails when any file differs or when no file was compared.
+#[cfg(any(test, feature = "test-hooks"))]
+pub fn compare_engines(checkout: &Checkout, cold: &Checkout) -> Result<EngineComparison, String> {
+    let mut examples = Vec::new();
+    let compared = cold
+        .inspect_engine(|cold| {
+            checkout.inspect_engine(|live| compare_engine(live, cold, &mut examples))
+        })
+        .map_err(|error| error.to_string())?
+        .ok_or("the cold build published no call graph")?;
+    let comparison = compared
+        .map_err(|error| error.to_string())?
+        .ok_or("the checkout published no call graph")?;
+    if comparison.failed() {
+        return Err(format!("{comparison:?}: {examples:?}"));
+    }
+    Ok(comparison)
+}
+
 /// A folder under the system's temporary folder, removed when dropped.
 struct Scratch(PathBuf);
 
diff --git a/crates/aft/src/data_layer/incremental.rs b/crates/aft/src/data_layer/incremental.rs
index 2543832e05..cc28d8e306 100644
--- a/crates/aft/src/data_layer/incremental.rs
+++ b/crates/aft/src/data_layer/incremental.rs
@@ -48,11 +48,17 @@ use super::callgraph::{
     CheckoutInputs, FileResolution, MethodCallInputs, Resolutions,
 };
 use super::graph_store::StoredSlices;
+use super::refresh_budget::{RefreshBudget, RefreshLimit};
 use super::subjects::{affected_by, subjects, Subject};
 
 /// What one update did, for measurement.
 #[derive(Clone, Debug, Default)]
 pub struct UpdateStats {
+    /// A broad incremental update was replaced by a stored-record cold build.
+    pub cold_build: bool,
+    /// Content records reused by the cold build, including extracted changes
+    /// handed over by the abandoned incremental update.
+    pub cold_reused_records: usize,
     pub changed_paths: usize,
     /// Recorded checkout reads asked again, and how many got a different
     /// answer.
@@ -84,6 +90,27 @@ pub struct UpdateStats {
     pub touched: BTreeSet<String>,
 }
 
+pub(crate) enum UpdateError {
+    Resolve(ManifestJoinError),
+    Limit(RefreshLimit),
+}
+
+impl From<ManifestJoinError> for UpdateError {
+    fn from(error: ManifestJoinError) -> Self {
+        Self::Resolve(error)
+    }
+}
+
+fn admit<'a>(
+    budget: &mut Option<&mut RefreshBudget>,
+    files: impl IntoIterator<Item = &'a String>,
+) -> Result<(), UpdateError> {
+    if let Some(budget) = budget.as_deref_mut() {
+        budget.include(files).map_err(UpdateError::Limit)?;
+    }
+    Ok(())
+}
+
 /// Which files recorded each input key, for one kind of recording: the
 /// reverse inputs a change is looked up in.
 ///
@@ -609,15 +636,34 @@ impl LiveCheckout {
         next: CheckoutInputs,
         changed: &BTreeSet<String>,
     ) -> Result<UpdateStats, ManifestJoinError> {
+        self.update_with_budget(next, changed, None)
+            .map_err(|error| match error {
+                UpdateError::Resolve(error) => error,
+                UpdateError::Limit(_) => {
+                    unreachable!("an unbounded update cannot hit a refresh limit")
+                }
+            })
+    }
+
+    /// A limit aborts before the newly invalidated pass runs. The caller must
+    /// drop this partly updated engine before rebuilding the checkout.
+    pub(crate) fn update_with_budget(
+        &mut self,
+        next: CheckoutInputs,
+        changed: &BTreeSet<String>,
+        budget: Option<&mut RefreshBudget>,
+    ) -> Result<UpdateStats, UpdateError> {
         let started = Instant::now();
         let pool = Arc::clone(&self.pool);
         let mut stats = crate::alloc_trace::install(&pool, || {
-            let stats = self.update_in_pool(next, changed)?;
+            let stats = self.update_in_pool(next, changed, budget)?;
+            #[cfg(feature = "test-hooks")]
+            super::refresh_probe::stage("encode");
             // Every resolution the update made or changed is encoded, so
             // that it can be let go between updates like a stored one.
             let parses = &self.inputs.parses;
             self.resolved.encode_changed(|path| parses.key(path));
-            Ok::<_, ManifestJoinError>(stats)
+            Ok::<_, UpdateError>(stats)
         })?;
         stats.total_ms = started.elapsed().as_secs_f64() * 1000.0;
         Ok(stats)
@@ -708,12 +754,18 @@ impl LiveCheckout {
         &mut self,
         next: CheckoutInputs,
         changed: &BTreeSet<String>,
-    ) -> Result<UpdateStats, ManifestJoinError> {
+        mut budget: Option<&mut RefreshBudget>,
+    ) -> Result<UpdateStats, UpdateError> {
+        admit(&mut budget, changed)?;
         let mut stats = UpdateStats {
             changed_paths: changed.len(),
             ..UpdateStats::default()
         };
         let old = std::mem::replace(&mut self.inputs, next);
+        #[cfg(feature = "test-hooks")]
+        let mut profile_clock = Instant::now();
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("start", &mut profile_clock);
         let inputs = &self.inputs;
         let membership = changed
             .iter()
@@ -759,6 +811,15 @@ impl LiveCheckout {
             })
             .cloned()
             .collect::<Vec<_>>();
+        if budget.is_some() {
+            // A module move can invalidate thousands of method readers even
+            // when few paths changed. Admit those declaration readers before
+            // binding or resolving other files, rather than waiting until
+            // method-call sites are processed.
+            let keys = MethodCallInputs::changed_parse_method_keys(&old, inputs, &contents);
+            let readers = self.reverse.sites_of(&keys);
+            admit(&mut budget, &readers)?;
+        }
         // Configuration files added or removed. A content change of an
         // existing one reaches its readers through their recorded field
         // answers, which are asked again below. Adding or removing one
@@ -854,6 +915,8 @@ impl LiveCheckout {
         // read is asked again; a file any of whose answers differ is bound,
         // resolved or traced again. This needs no rule about which change can
         // affect which read.
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("facts");
         let started = Instant::now();
         let stale = if membership.is_empty() && links.is_empty() && configs.is_empty() {
             StaleAnswers::default()
@@ -864,9 +927,13 @@ impl LiveCheckout {
         stats.answers_checked = stale.checked;
         stats.answers_changed = stale.changed;
         stats.facts_ms = started.elapsed().as_secs_f64() * 1000.0;
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("facts", &mut profile_clock);
 
         // Pass 1. A binding depends on the file's own parse, on which paths
         // exist, and on configuration it read.
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("binding");
         let started = Instant::now();
         let mut binding_keys = membership.clone();
         binding_keys.extend(changed_packages.iter().cloned());
@@ -893,6 +960,7 @@ impl LiveCheckout {
         rebind.extend(contents.iter().cloned());
         rebind.extend(stale.binding.iter().cloned());
         rebind.retain(|path| inputs.parses.contains_key(path));
+        admit(&mut budget, rebind.iter().chain(&removed_parses))?;
         let rebind = rebind.into_iter().collect::<Vec<_>>();
         let rebind_refs = rebind.iter().collect::<Vec<_>>();
         let new_bound = bind_all(inputs, &rebind_refs)?;
@@ -986,6 +1054,8 @@ impl LiveCheckout {
             self.bound.set(path, bound);
         }
         stats.bind_ms = started.elapsed().as_secs_f64() * 1000.0;
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("bind", &mut profile_clock);
 
         // What a recorded answer can depend on that changed.
         let mut changed_keys = surface_keys.clone();
@@ -1007,6 +1077,8 @@ impl LiveCheckout {
         changed_keys.extend(changed_crates);
 
         // Pass 2.
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("replay");
         let started = Instant::now();
         let facts = Rc::new(ViewBindingFacts::typed(Rc::new(CheckoutFacts { inputs })));
         let (index, files) = resolver_index(inputs, &self.bound, &facts);
@@ -1020,6 +1092,7 @@ impl LiveCheckout {
                 resolve.insert(path.clone());
             }
         }
+        admit(&mut budget, &resolve)?;
         // Resolving a Rust file reads the module tree, which the resolver
         // builds by binding every module-declaring file; bind those in
         // parallel first (see `BindCache::bind_module_declaring`).
@@ -1092,6 +1165,11 @@ impl LiveCheckout {
         }
         drop(answers);
         drop(trace_answers);
+        admit(&mut budget, &resolve)?;
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("replay", &mut profile_clock);
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("resolution");
         // Files kept whose binding was redone carry their resolution over.
         for path in &rebind {
             if resolve.contains(path) {
@@ -1132,11 +1210,15 @@ impl LiveCheckout {
             self.resolved.insert(path, file);
         }
         stats.resolve_ms = started.elapsed().as_secs_f64() * 1000.0;
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("resolve", &mut profile_clock);
 
         // Pass 3, for files whose rows were kept: each trace was replayed
         // with its file's surface answers above. Resolving files again
         // changes no surface a trace reads, since every file whose binding
         // could change was bound again in pass 1.
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("dispatch");
         let started = Instant::now();
         let mut recompute = Vec::new();
         // Stale answers were asked before this update removed files; a
@@ -1150,6 +1232,7 @@ impl LiveCheckout {
             }
         }
         recompute.extend(traces_changed);
+        admit(&mut budget, &recompute)?;
         for path in &recompute {
             let (_, parse) = &inputs.parses[path.as_str()];
             let dispatch = dispatch_targets(path, parse, &index, &facts)?;
@@ -1170,12 +1253,16 @@ impl LiveCheckout {
         // A file bound on first use inside passes 2 and 3 cannot return its
         // error there.
         if let Some(error) = files.take_error() {
-            return Err(error);
+            return Err(error.into());
         }
         drop(index);
         drop(facts);
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("dispatch", &mut profile_clock);
 
         // Pass 4.
+        #[cfg(feature = "test-hooks")]
+        super::refresh_probe::stage("sites");
         let started = Instant::now();
         let mut site_keys = BTreeSet::new();
         let mut sites = contents.clone();
@@ -1197,6 +1284,7 @@ impl LiveCheckout {
         }
         sites.extend(self.reverse.sites_of(&site_keys));
         sites.retain(|path| inputs.parses.contains_key(path));
+        admit(&mut budget, &sites)?;
         let paths = sites.iter().collect::<Vec<_>>();
         for (path, kept, dependencies) in
             self.calls.resolve_sites(inputs, &self.resolved, &paths)?
@@ -1212,6 +1300,8 @@ impl LiveCheckout {
         }
         stats.sites_resolved = paths.len();
         stats.sites_ms = started.elapsed().as_secs_f64() * 1000.0;
+        #[cfg(feature = "test-hooks")]
+        self.profile_refresh("sites", &mut profile_clock);
         stats.touched = rebind
             .into_iter()
             .chain(resolve)
@@ -1221,6 +1311,24 @@ impl LiveCheckout {
             .collect();
         Ok(stats)
     }
+
+    #[cfg(feature = "test-hooks")]
+    fn profile_refresh(&self, stage: &str, clock: &mut Instant) {
+        if std::env::var_os("AFT_REFRESH_PROFILE").is_none() {
+            return;
+        }
+        let wall_ms = clock.elapsed().as_millis();
+        let cpu = std::fs::read_to_string("/proc/self/stat")
+            .ok()
+            .and_then(|line| {
+                let rest = line.get(line.rfind(')')? + 2..)?;
+                let fields = rest.split_whitespace().collect::<Vec<_>>();
+                Some(fields.get(11)?.parse::<u64>().ok()? + fields.get(12)?.parse::<u64>().ok()?)
+            });
+        let parts = self.memory_parts(&mut aft_store::heap::Seen::new());
+        log::info!("refresh profile {stage}: wall_ms={wall_ms} cpu_ticks={cpu:?} decoded_parses={} decoded_resolutions={} parts={parts:?} resolution_parts={:?}", self.inputs.parses.decoded_count(), self.resolved.decoded_count(), self.resolved.profile_parts());
+        *clock = Instant::now();
+    }
 }
 
 aft_store::heap_bytes_of_fields!(Readers {
diff --git a/crates/aft/src/data_layer/meaning.rs b/crates/aft/src/data_layer/meaning.rs
index b7c7fe191c..d3bf5da964 100644
--- a/crates/aft/src/data_layer/meaning.rs
+++ b/crates/aft/src/data_layer/meaning.rs
@@ -305,9 +305,30 @@ impl Meaning {
         lock(&self.config).clone().flatten()
     }
 
+    pub(super) fn synapse_lane(&self) -> Option<String> {
+        self.config()
+            .filter(|config| config.backend == crate::config::SemanticBackend::Synapse)
+            .map(|config| config.model)
+    }
+
     /// How meaning search stands for `view`, the checkout's current view
     /// (`None` before anything is published).
     pub(crate) fn state(&self, view: Option<&CheckoutView>) -> MeaningState {
+        self.state_inner(view, false)
+    }
+
+    pub(crate) fn cached_state(&self, view: Option<&CheckoutView>) -> MeaningState {
+        self.state_inner(view, true)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn refresh_for_test(&self, view: Option<&CheckoutView>) {
+        *lock(&self.refreshed_at) = None;
+        self.refresh_read_only();
+        self.state(view);
+    }
+
+    fn state_inner(&self, view: Option<&CheckoutView>, cached_only: bool) -> MeaningState {
         if !self.enabled() {
             return MeaningState::Off;
         }
@@ -324,7 +345,17 @@ impl Meaning {
                 None => MeaningState::Starting,
             };
         };
-        match plane.snapshot(view) {
+        let snapshot = if cached_only {
+            match plane.cached_snapshot(view) {
+                Some(snapshot) => Ok(snapshot),
+                // No counts are certified for this view yet; never label an
+                // older view's coverage as current during refresh.
+                None => return MeaningState::Starting,
+            }
+        } else {
+            plane.snapshot(view)
+        };
+        match snapshot {
             Ok(snapshot) => MeaningState::Serving { snapshot, failure },
             Err(error) => MeaningState::Blocked(FillFailure::Failed(error.to_string())),
         }
diff --git a/crates/aft/src/data_layer/mod.rs b/crates/aft/src/data_layer/mod.rs
index 9e7d7cbd6a..2624d3c783 100644
--- a/crates/aft/src/data_layer/mod.rs
+++ b/crates/aft/src/data_layer/mod.rs
@@ -27,6 +27,9 @@ pub mod parent_session;
 #[cfg(test)]
 mod publication_tests;
 pub(crate) mod query;
+mod refresh_budget;
+#[cfg(feature = "test-hooks")]
+pub mod refresh_probe;
 pub mod reuse;
 pub(crate) mod runtime;
 #[cfg(test)]
diff --git a/crates/aft/src/data_layer/refresh_budget.rs b/crates/aft/src/data_layer/refresh_budget.rs
new file mode 100644
index 0000000000..29c7cd63d2
--- /dev/null
+++ b/crates/aft/src/data_layer/refresh_budget.rs
@@ -0,0 +1,47 @@
+//! Limits an incremental update by the files invalidated since publication.
+
+use std::collections::BTreeSet;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct RefreshLimit {
+    pub(crate) invalidated: usize,
+    pub(crate) threshold: usize,
+    pub(crate) parsed: usize,
+}
+
+pub(crate) struct RefreshBudget {
+    files: BTreeSet<String>,
+    parsed: usize,
+}
+
+impl RefreshBudget {
+    pub(crate) fn new(parsed: usize, files: BTreeSet<String>) -> Self {
+        Self { files, parsed }
+    }
+
+    pub(crate) fn set_parsed(&mut self, parsed: usize) -> Result<(), RefreshLimit> {
+        self.parsed = parsed;
+        self.check(self.files.len())
+    }
+
+    pub(crate) fn check(&self, count: usize) -> Result<(), RefreshLimit> {
+        let threshold = self.parsed.div_ceil(4).max(1024);
+        if count > threshold {
+            Err(RefreshLimit {
+                invalidated: count,
+                threshold,
+                parsed: self.parsed,
+            })
+        } else {
+            Ok(())
+        }
+    }
+
+    pub(crate) fn include<'a>(
+        &mut self,
+        files: impl IntoIterator<Item = &'a String>,
+    ) -> Result<(), RefreshLimit> {
+        self.files.extend(files.into_iter().cloned());
+        self.check(self.files.len())
+    }
+}
diff --git a/crates/aft/src/data_layer/refresh_probe.rs b/crates/aft/src/data_layer/refresh_probe.rs
new file mode 100644
index 0000000000..43c6856172
--- /dev/null
+++ b/crates/aft/src/data_layer/refresh_probe.rs
@@ -0,0 +1,16 @@
+//! Stage boundaries for the allocation probe. Absent from production builds.
+
+use std::sync::OnceLock;
+
+static OBSERVER: OnceLock<fn(&'static str)> = OnceLock::new();
+
+/// Installs the process-wide measurement callback before a probe starts.
+pub fn set_observer(observer: fn(&'static str)) {
+    let _ = OBSERVER.set(observer);
+}
+
+pub(crate) fn stage(name: &'static str) {
+    if let Some(observer) = OBSERVER.get() {
+        observer(name);
+    }
+}
diff --git a/crates/aft/src/data_layer/runtime.rs b/crates/aft/src/data_layer/runtime.rs
index 07ca08a509..707d8fe84d 100644
--- a/crates/aft/src/data_layer/runtime.rs
+++ b/crates/aft/src/data_layer/runtime.rs
@@ -327,9 +327,103 @@ impl Runner {
 /// When a failed build is tried again.
 #[derive(Default)]
 struct BuildRetry {
-    /// No build starts before this; a waiting thread starts one then.
+    /// No build starts before this; a shared deadline starts one then.
     at: Option<Instant>,
     in_a_row: u32,
+    timer: Option<crate::shared_timer::Timer>,
+}
+
+/// A scheduled lane pause has one clock and one wakeup, regardless of how
+/// many checkouts are waiting for that embedding model.
+#[derive(Default)]
+struct FillPauses(std::collections::HashMap<String, FillPause>);
+
+struct FillPause {
+    pause: crate::synapse_embed::LanePause,
+    at: Instant,
+    waiters: std::collections::HashMap<PathBuf, Weak<Work>>,
+}
+
+impl FillPauses {
+    /// Returns true when the lane needs its first wakeup thread.
+    fn record(
+        &mut self,
+        mut pause: crate::synapse_embed::LanePause,
+        now_ms: u64,
+        now: Instant,
+    ) -> bool {
+        if pause.paused_until_ms == 0 {
+            if self.0.get(&pause.lane_id).is_some_and(|entry| {
+                now < entry.at
+                    && entry.pause.reason == pause.reason
+                    && entry.pause.retry_after_ms == pause.retry_after_ms
+            }) {
+                return false;
+            }
+            pause.paused_until_ms = now_ms.saturating_add(pause.retry_after_ms.unwrap_or(0));
+        }
+        let at = now + Duration::from_millis(pause.paused_until_ms.saturating_sub(now_ms));
+        let first = !self.0.contains_key(&pause.lane_id);
+        let entry = self
+            .0
+            .entry(pause.lane_id.clone())
+            .or_insert_with(|| FillPause {
+                pause: pause.clone(),
+                at,
+                waiters: Default::default(),
+            });
+        if first
+            || entry.pause.paused_until_ms != pause.paused_until_ms
+            || entry.pause.reason != pause.reason
+        {
+            crate::slog_info!(
+                "data layer meaning fill paused: lane={} until_ms={} reason={}",
+                pause.lane_id,
+                pause.paused_until_ms,
+                pause.reason
+            );
+            entry.at = at;
+            entry.pause = pause;
+        }
+        first
+    }
+
+    fn park(&mut self, lane: &str, root: &Path, work: Weak<Work>, now: Instant) -> bool {
+        let Some(entry) = self.0.get_mut(lane).filter(|entry| now < entry.at) else {
+            return false;
+        };
+        crate::synapse_embed::share_lane_pause(root, &entry.pause);
+        entry.waiters.insert(root.to_path_buf(), work);
+        true
+    }
+}
+
+fn fill_pauses() -> &'static parking_lot::Mutex<FillPauses> {
+    static PAUSES: OnceLock<parking_lot::Mutex<FillPauses>> = OnceLock::new();
+    PAUSES.get_or_init(Default::default)
+}
+
+static FILL_PAUSE_CHANGED: parking_lot::Condvar = parking_lot::Condvar::new();
+
+fn wake_paused_fills(lane: String) {
+    loop {
+        let waiters = {
+            let mut pauses = fill_pauses().lock();
+            let Some(entry) = pauses.0.get(&lane) else {
+                return;
+            };
+            let wait = entry.at.saturating_duration_since(Instant::now());
+            if !wait.is_zero() {
+                FILL_PAUSE_CHANGED.wait_for(&mut pauses, wait);
+                continue;
+            }
+            pauses.0.remove(&lane).unwrap().waiters
+        };
+        for work in waiters.into_values().filter_map(|work| work.upgrade()) {
+            work.start_fill();
+        }
+        return;
+    }
 }
 
 /// A checkout and the state of its background work, shared by the work
@@ -337,6 +431,7 @@ struct BuildRetry {
 struct Work {
     checkout: Arc<Checkout>,
     runner: Runner,
+    stopped: AtomicBool,
     /// A build is queued or running.
     building: Arc<AtomicBool>,
     /// A fold of the checkout's segments is queued or running.
@@ -357,6 +452,8 @@ struct Work {
     /// Told when a build, refresh or fill round ends (see
     /// [`DataCheckout::on_status_change`]).
     status_listener: std::sync::Mutex<Option<StatusListener>>,
+    #[cfg(test)]
+    status_summary_paused: std::sync::Mutex<bool>,
     /// Meaning search: its vector plane and the fill that embeds for it.
     meaning: Meaning,
     /// A fill round is queued or running.
@@ -400,9 +497,12 @@ impl Work {
     /// Starts a build unless one is queued or running, or a failed one is
     /// waiting to be tried again. A build that fails is tried again after a
     /// wait that doubles each time, until one succeeds or the checkout is
-    /// dropped; the wait is a sleeping thread, never an executor worker.
+    /// dropped; the wait uses the shared timer, never an executor worker.
     /// Returns whether this call queued a build, so its cause is logged once.
     fn start_build(self: &Arc<Self>) -> bool {
+        if self.stopped.load(Ordering::Acquire) {
+            return false;
+        }
         {
             let retry = self
                 .retry
@@ -416,8 +516,14 @@ impl Work {
             return false;
         }
         let flag = ClearOnDrop(Arc::clone(&self.building));
+        let Some(reservation) = self.checkout.reserve_build() else {
+            return false;
+        };
         let work = Arc::clone(self);
         self.runner.run(BUILD_REQUEST, Pool::Build, move || {
+            if work.stopped.load(Ordering::Acquire) {
+                return;
+            }
             #[cfg(test)]
             while build_holds_for_test()
                 .lock()
@@ -426,7 +532,7 @@ impl Work {
             {
                 std::thread::sleep(Duration::from_millis(5));
             }
-            let result = work.checkout.build();
+            let result = work.checkout.build_reserved(false, reservation);
             drop(flag);
             work.checkout.notify_readiness_change();
             if !matches!(result, Err(DataError::Cancelled)) {
@@ -464,15 +570,16 @@ impl Work {
     }
 
     fn retry_build_later(self: &Arc<Self>, error: &DataError) {
-        let wait = {
+        let (wait, at) = {
             let mut retry = self
                 .retry
                 .lock()
                 .unwrap_or_else(std::sync::PoisonError::into_inner);
             retry.in_a_row += 1;
             let wait = backoff(BUILD_RETRY, BUILD_RETRY_MAX, retry.in_a_row);
-            retry.at = Some(Instant::now() + wait);
-            wait
+            let at = Instant::now() + wait;
+            retry.at = Some(at);
+            (wait, at)
         };
         crate::slog_warn!(
             "data layer build failed for {} (trying again in {} s): {error}",
@@ -480,14 +587,20 @@ impl Work {
             wait.as_secs()
         );
         let weak = Arc::downgrade(self);
-        let _ = std::thread::Builder::new()
-            .name("aft-data-build-retry".to_string())
-            .spawn(move || {
-                std::thread::sleep(wait);
-                if let Some(work) = weak.upgrade() {
-                    work.start_build();
-                }
-            });
+        let timer = crate::shared_timer::Timer::at(at, move || {
+            if let Some(work) = weak.upgrade() {
+                work.start_build();
+            }
+            None
+        })
+        .ok();
+        let mut retry = self
+            .retry
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if !self.stopped.load(Ordering::Acquire) {
+            retry.timer = timer;
+        }
     }
 
     /// Resolves the call graph again until no recorded change is pending,
@@ -496,6 +609,9 @@ impl Work {
     /// ending, by the check after it lets go of the flag. A refresh that
     /// finds the stored call graph damaged starts a build, which replaces it.
     fn start_refresh(self: &Arc<Self>, publish: Publish) {
+        if self.stopped.load(Ordering::Acquire) {
+            return;
+        }
         if !self.checkout.planes().callgraph {
             // Without a call graph there is nothing to resolve: the changes
             // laid over the text index are folded in by a text-only build,
@@ -515,6 +631,9 @@ impl Work {
             let mut requested = self.publish_requested.lock();
             *requested = (*requested).max(publish);
         }
+        if self.checkout.is_building() {
+            return;
+        }
         if self.refreshing.swap(true, Ordering::AcqRel) {
             return;
         }
@@ -524,13 +643,28 @@ impl Work {
         // runs beside the root's reads and edits, one at a time per root
         // (the `refreshing` flag), in the refresh pool.
         self.runner.run(REFRESH_REQUEST, Pool::Refresh, move || {
+            if work.stopped.load(Ordering::Acquire) {
+                return;
+            }
             let mut flag = Some(flag);
             loop {
                 let result = work.checkout.refresh_callgraph();
+                if work.checkout.is_building() {
+                    return;
+                }
                 if !matches!(result, Ok(None) | Err(DataError::Cancelled)) {
                     work.notify_status_change();
                 }
                 if matches!(result, Ok(Some(_))) {
+                    if result
+                        .as_ref()
+                        .is_ok_and(|stats| stats.as_ref().is_some_and(|stats| stats.cold_build))
+                    {
+                        // A cold fallback already published its content, just
+                        // as start_build does, so semantic search can embed and
+                        // index the newly published content.
+                        work.start_fill();
+                    }
                     continue;
                 }
                 match &result {
@@ -838,9 +972,15 @@ impl Work {
     /// them. A failed round is tried again after a wait that doubles each
     /// time, as a failed build is.
     fn start_fill(self: &Arc<Self>) {
+        if self.stopped.load(Ordering::Acquire) {
+            return;
+        }
         if !self.meaning.enabled() || self.meaning.reads_only() {
             return;
         }
+        if self.park_for_lane_pause() {
+            return;
+        }
         {
             let retry = self
                 .fill_retry
@@ -856,10 +996,19 @@ impl Work {
         let flag = ClearOnDrop(Arc::clone(&self.filling));
         let work = Arc::clone(self);
         self.runner.run(FILL_REQUEST, Pool::Fill, move || {
-            if crate::executor::current_job_cancelled() {
+            if work.stopped.load(Ordering::Acquire) || crate::executor::current_job_cancelled() {
                 // Runs again when the root is bound and a search asks.
                 return;
             }
+            // Another root may have learned of the pause while this job
+            // waited for a place in the process-wide fill pool.
+            if work.park_for_lane_pause() {
+                drop(flag);
+                // If the pause ended just as this job parked, its wakeup
+                // may have seen the running flag. Recheck after releasing it.
+                work.start_fill();
+                return;
+            }
             let round = work.meaning.round(&work.checkout);
             drop(flag);
             work.notify_status_change();
@@ -886,15 +1035,44 @@ impl Work {
     }
 
     fn retry_fill_later(self: &Arc<Self>, error: &str) {
-        let wait = {
+        if let Some(pause) = crate::synapse_embed::LanePause::from_error(error)
+            .filter(|pause| pause.cause == crate::synapse_embed::PauseCause::LanePaused)
+        {
+            let lane = pause.lane_id.clone();
+            let first = {
+                let mut pauses = fill_pauses().lock();
+                let first = pauses.record(
+                    pause,
+                    crate::semantic_index::unix_millis_now(),
+                    Instant::now(),
+                );
+                // Also keep a waiter when an already-expired pause was returned:
+                // the lane's wakeup will start it immediately.
+                let entry = pauses.0.get_mut(&lane).unwrap();
+                crate::synapse_embed::share_lane_pause(self.checkout.root(), &entry.pause);
+                entry
+                    .waiters
+                    .insert(self.checkout.root().to_path_buf(), Arc::downgrade(self));
+                first
+            };
+            FILL_PAUSE_CHANGED.notify_all();
+            if first {
+                let _ = std::thread::Builder::new()
+                    .name("aft-data-lane-resume".to_string())
+                    .spawn(move || wake_paused_fills(lane));
+            }
+            return;
+        }
+        let (wait, at) = {
             let mut retry = self
                 .fill_retry
                 .lock()
                 .unwrap_or_else(std::sync::PoisonError::into_inner);
             retry.in_a_row += 1;
             let wait = backoff(BUILD_RETRY, BUILD_RETRY_MAX, retry.in_a_row);
-            retry.at = Some(Instant::now() + wait);
-            wait
+            let at = Instant::now() + wait;
+            retry.at = Some(at);
+            (wait, at)
         };
         crate::slog_warn!(
             "data layer meaning fill failed for {} (trying again in {} s): {error}",
@@ -902,19 +1080,49 @@ impl Work {
             wait.as_secs()
         );
         let weak = Arc::downgrade(self);
-        let _ = std::thread::Builder::new()
-            .name("aft-data-fill-retry".to_string())
-            .spawn(move || {
-                std::thread::sleep(wait);
-                if let Some(work) = weak.upgrade() {
-                    work.start_fill();
-                }
-            });
+        let timer = crate::shared_timer::Timer::at(at, move || {
+            if let Some(work) = weak.upgrade() {
+                work.start_fill();
+            }
+            None
+        })
+        .ok();
+        let mut retry = self
+            .fill_retry
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if !self.stopped.load(Ordering::Acquire) {
+            retry.timer = timer;
+        }
+    }
+
+    fn park_for_lane_pause(self: &Arc<Self>) -> bool {
+        self.meaning.synapse_lane().is_some_and(|lane| {
+            fill_pauses().lock().park(
+                &lane,
+                self.checkout.root(),
+                Arc::downgrade(self),
+                Instant::now(),
+            )
+        })
     }
 
     /// Tells the status listener, if any, that the checkout's status may
     /// have changed.
     fn notify_status_change(&self) {
+        // Build coverage on its producer, before announcing the new view. A
+        // push only consumes a cache entry for the exact view/generation pair.
+        #[cfg(test)]
+        let paused = self.status_summary_paused.lock().unwrap();
+        #[cfg(test)]
+        let prepare = !*paused;
+        #[cfg(not(test))]
+        let prepare = true;
+        if prepare {
+            self.meaning.state(self.checkout.view().as_ref());
+        }
+        #[cfg(test)]
+        drop(paused);
         self.checkout.notify_readiness_change();
         let listener = self
             .status_listener
@@ -944,16 +1152,30 @@ pub(crate) struct DataCheckout {
     /// The last memory figure the census walked for this checkout, and when
     /// (see [`Self::memory_figure`]).
     memory_figure: std::sync::Mutex<Option<(Instant, u64, super::surfaces::DataLayerMemory)>>,
+    disk_measurement: Arc<super::surfaces::DiskMeasurement>,
     /// Kept so the edit-intent listener lives as long as the checkout.
     _listener: Arc<dyn WriteIntentListener>,
 }
 
 impl Drop for DataCheckout {
-    // An evicted checkout must not leave its quiet-timer thread asleep for
-    // up to `QUIET`: its refresh would find nothing to refresh anyway.
+    // An evicted checkout must not dispatch delayed work even if an in-flight
+    // pool job still holds Work alive.
     fn drop(&mut self) {
+        self.work.stopped.store(true, Ordering::Release);
         self.quiet.stop();
         self.work.settle.stop();
+        self.work
+            .retry
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .timer
+            .take();
+        self.work
+            .fill_retry
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .timer
+            .take();
     }
 }
 
@@ -1061,6 +1283,7 @@ impl DataCheckout {
             }
         };
         let work = Arc::new_cyclic(|weak: &Weak<Work>| Work {
+            stopped: AtomicBool::new(false),
             runner: Runner {
                 root: checkout.root().to_path_buf(),
                 executor: parking_lot::Mutex::new(executor),
@@ -1086,6 +1309,8 @@ impl DataCheckout {
             rescanning: Arc::new(AtomicBool::new(false)),
             retry: std::sync::Mutex::default(),
             status_listener: std::sync::Mutex::new(None),
+            #[cfg(test)]
+            status_summary_paused: std::sync::Mutex::new(false),
             meaning: Meaning::new(storage),
             filling: Arc::new(AtomicBool::new(false)),
             fill_retry: std::sync::Mutex::default(),
@@ -1113,6 +1338,9 @@ impl DataCheckout {
         // A bind may have recorded what changed while nothing watched.
         work.catch_up(Publish::WhenMany);
         let checkout = Arc::new(Self {
+            disk_measurement: super::surfaces::DiskMeasurement::for_family(
+                work.checkout.family_dir(),
+            ),
             work,
             quiet,
             bound_once: AtomicBool::new(false),
@@ -1139,6 +1367,11 @@ impl DataCheckout {
         &self.work.checkout
     }
 
+    #[cfg(test)]
+    pub(crate) fn checkout_arc_for_test(&self) -> Arc<Checkout> {
+        Arc::clone(&self.work.checkout)
+    }
+
     /// Only a queued or running first text build warrants waiting. An old
     /// publication, a failure, or a checkout with no build scheduled does not.
     pub(crate) fn first_text_building(&self) -> bool {
@@ -1205,9 +1438,8 @@ impl DataCheckout {
 }
 
 /// Calls `fire` once a checkout has gone `quiet` without a recorded change
-/// (for the call graph, [`QUIET`], to refresh it). One timer thread runs per
-/// checkout at most, and only while a change is waiting: each change moves
-/// the deadline on, and the thread sleeps until the latest one.
+/// (for the call graph, [`QUIET`], to refresh it). Pending checkouts share the
+/// process timer; each change moves the deadline checked at its next wake.
 struct QuietTimer {
     quiet: Duration,
     /// When the last change was recorded, in milliseconds since `epoch`.
@@ -1215,10 +1447,9 @@ struct QuietTimer {
     armed: AtomicBool,
     epoch: Instant,
     fire: Box<dyn Fn() + Send + Sync>,
-    /// Set when the checkout is dropped: the waiting thread ends at once
-    /// instead of sleeping out its deadline.
+    /// Also fences dispatch against checkout shutdown.
     stopped: std::sync::Mutex<bool>,
-    wake: std::sync::Condvar,
+    timer: std::sync::Mutex<Option<crate::shared_timer::Timer>>,
     #[cfg(feature = "test-timing-hooks")]
     test_gate: bool,
 }
@@ -1232,33 +1463,22 @@ impl QuietTimer {
             epoch: Instant::now(),
             fire: Box::new(fire),
             stopped: std::sync::Mutex::new(false),
-            wake: std::sync::Condvar::new(),
+            timer: std::sync::Mutex::new(None),
             #[cfg(feature = "test-timing-hooks")]
             test_gate: false,
         }
     }
 
-    /// Ends the waiting thread, if any, without firing; later changes start
-    /// none.
+    /// Removes the pending callback without firing; later changes arm none.
     fn stop(&self) {
         *self
             .stopped
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner) = true;
-        self.wake.notify_all();
-    }
-
-    /// Sleeps up to `duration`, or until [`Self::stop`]; true once stopped.
-    fn sleep(&self, duration: Duration) -> bool {
-        let stopped = self
-            .stopped
+        self.timer
             .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        let (stopped, _) = self
-            .wake
-            .wait_timeout_while(stopped, duration, |stopped| !*stopped)
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        *stopped
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .take();
     }
 
     fn now_ms(&self) -> u64 {
@@ -1275,7 +1495,7 @@ impl QuietTimer {
     /// Changes continue moving its deadline while the integration test writes
     /// and removes a burst; the deadline is checked again after release.
     #[cfg(feature = "test-timing-hooks")]
-    fn hold_for_test(&self) -> Option<PathBuf> {
+    fn gate_for_test(&self) -> Option<PathBuf> {
         if !self.test_gate {
             return None;
         }
@@ -1284,16 +1504,10 @@ impl QuietTimer {
             return None;
         }
         std::fs::write(gate.with_extension("waiting"), b"waiting").expect("signal quiet gate");
-        while gate.exists() && !gate.with_extension("release").exists() {
-            if self.sleep(Duration::from_millis(10)) {
-                return None;
-            }
-        }
         Some(gate)
     }
 
-    /// Notes a recorded change, and starts the timer thread unless one is
-    /// waiting already.
+    /// Notes a recorded change, and arms a deadline unless one is pending.
     fn changed(self: &Arc<Self>) {
         self.note_change();
         self.arm();
@@ -1313,54 +1527,79 @@ impl QuietTimer {
 
     /// Wait from the last recorded change, not from the end of its refresh.
     fn arm(self: &Arc<Self>) {
-        if self.sleep(Duration::ZERO) || self.armed.swap(true, Ordering::AcqRel) {
+        let stopped = self
+            .stopped
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if *stopped || self.armed.swap(true, Ordering::AcqRel) {
             return;
         }
-        let timer = Arc::clone(self);
+        let timer = Arc::downgrade(self);
         let quiet_ms = u64::try_from(self.quiet.as_millis()).unwrap_or(u64::MAX);
-        let spawned = std::thread::Builder::new()
-            .name("aft-data-quiet".to_string())
-            .spawn(move || {
-                #[cfg(feature = "test-timing-hooks")]
-                let gate = timer.hold_for_test();
-                if timer.sleep(Duration::ZERO) {
-                    return;
+        #[cfg(feature = "test-timing-hooks")]
+        let mut gate = None;
+        #[cfg(feature = "test-timing-hooks")]
+        let mut gate_checked = false;
+        let scheduled = crate::shared_timer::Timer::at(Instant::now(), move || {
+            let timer = timer.upgrade()?;
+            let stopped = timer
+                .stopped
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            if *stopped {
+                return None;
+            }
+            #[cfg(feature = "test-timing-hooks")]
+            {
+                if !gate_checked {
+                    gate = timer.gate_for_test();
+                    gate_checked = true;
                 }
-                loop {
-                    let due = timer
-                        .last_change_ms
-                        .load(Ordering::Acquire)
-                        .saturating_add(quiet_ms);
-                    let now = timer.now_ms();
-                    if now < due {
-                        if timer.sleep(Duration::from_millis(due - now)) {
-                            break;
-                        }
-                        continue;
-                    }
-                    timer.armed.store(false, Ordering::Release);
-                    // A change recorded between the deadline check and letting
-                    // go of the flag found the timer armed and started none; if
-                    // there was one, this thread keeps waiting for it.
-                    if timer
-                        .last_change_ms
-                        .load(Ordering::Acquire)
-                        .saturating_add(quiet_ms)
-                        > timer.now_ms()
-                        && !timer.armed.swap(true, Ordering::AcqRel)
-                    {
-                        continue;
-                    }
-                    (timer.fire)();
-                    #[cfg(feature = "test-timing-hooks")]
-                    if let Some(gate) = &gate {
-                        std::fs::write(gate.with_extension("settled"), b"settled")
-                            .expect("signal quiet fire");
-                    }
-                    break;
+                if gate
+                    .as_ref()
+                    .is_some_and(|gate| gate.exists() && !gate.with_extension("release").exists())
+                {
+                    return Some(Instant::now() + Duration::from_millis(10));
                 }
-            });
-        if spawned.is_err() {
+            }
+            let due = timer
+                .last_change_ms
+                .load(Ordering::Acquire)
+                .saturating_add(quiet_ms);
+            let now = timer.now_ms();
+            if now < due {
+                return Some(Instant::now() + Duration::from_millis(due - now));
+            }
+            timer.armed.store(false, Ordering::Release);
+            // A change recorded between the deadline check and letting
+            // go of the flag found the timer armed and started none; if
+            // there was one, keep the deadline armed for it.
+            if timer
+                .last_change_ms
+                .load(Ordering::Acquire)
+                .saturating_add(quiet_ms)
+                > timer.now_ms()
+                && !timer.armed.swap(true, Ordering::AcqRel)
+            {
+                return Some(Instant::now());
+            }
+            // The callback only admits/enqueues work; refreshes, builds and
+            // fills still execute in their existing data pools.
+            drop(stopped);
+            (timer.fire)();
+            #[cfg(feature = "test-timing-hooks")]
+            if let Some(gate) = &gate {
+                std::fs::write(gate.with_extension("settled"), b"settled")
+                    .expect("signal quiet fire");
+            }
+            None
+        });
+        if let Ok(timer) = scheduled {
+            *self
+                .timer
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(timer);
+        } else {
             self.armed.store(false, Ordering::Release);
         }
     }
@@ -1552,6 +1791,7 @@ impl DataCheckout {
     /// round of this checkout ends, so status pushes follow the data layer.
     /// Replaces any earlier listener.
     pub(crate) fn on_status_change(&self, notify: StatusListener) {
+        self.disk_measurement.on_change(&notify);
         *self
             .work
             .status_listener
@@ -1559,6 +1799,10 @@ impl DataCheckout {
             .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(notify);
     }
 
+    pub(crate) fn disk_measurement(&self) -> &Arc<super::surfaces::DiskMeasurement> {
+        &self.disk_measurement
+    }
+
     /// Whether the checkout's TODO markers became readable since the last
     /// call: its call graph is published now and no build or rescan is
     /// running, where at the last call that was not so. The status listener
@@ -1616,6 +1860,20 @@ impl DataCheckout {
         self.work.meaning.state(self.view().as_ref())
     }
 
+    pub(crate) fn cached_meaning_status(&self) -> MeaningState {
+        self.work.meaning.cached_state(self.view().as_ref())
+    }
+
+    #[cfg(test)]
+    pub(crate) fn refresh_meaning_for_test(&self) {
+        self.work.meaning.refresh_for_test(self.view().as_ref());
+    }
+
+    #[cfg(test)]
+    pub(crate) fn pause_meaning_summary_for_test(&self) {
+        *self.work.status_summary_paused.lock().unwrap() = true;
+    }
+
     /// Makes this checkout's meaning search read only the vectors its
     /// repository's store already holds for `config`'s model (identified by
     /// `fingerprint`), and never fill: for a child repository of a parent
@@ -1631,7 +1889,9 @@ impl DataCheckout {
     ) -> Result<(), String> {
         self.work
             .meaning
-            .read_only(&self.work.checkout, config, fingerprint)
+            .read_only(&self.work.checkout, config, fingerprint)?;
+        self.meaning_status();
+        Ok(())
     }
 
     /// Whether a fill round is queued or running.
@@ -1708,6 +1968,115 @@ mod tests {
 
     use super::*;
 
+    fn planned_pause(until: u64) -> crate::synapse_embed::LanePause {
+        crate::synapse_embed::LanePause {
+            lane_id: "scheduled-embedding-lane".into(),
+            fingerprint: None,
+            retry_after_ms: Some(1_399_000),
+            paused_until_ms: until,
+            reason: "Neural Engine maintenance".into(),
+            cause: crate::synapse_embed::PauseCause::LanePaused,
+            safe_to_retry_same_request: true,
+            record_id: 0,
+        }
+    }
+
+    #[test]
+    fn planned_pause_deadline_and_log_are_shared_across_fill_roots() {
+        let mut pauses = FillPauses::default();
+        let now = Instant::now();
+        let now_ms = crate::semantic_index::unix_millis_now();
+        let pause = planned_pause(now_ms + 1_399_000);
+        let lane = pause.lane_id.clone();
+        let first = tempfile::tempdir().unwrap();
+        let second = tempfile::tempdir().unwrap();
+        let (_, lines) = crate::logging::capture_log_lines(|| {
+            assert!(pauses.record(pause.clone(), now_ms, now));
+            assert!(pauses.park(&lane, first.path(), Weak::new(), now));
+            let mut duplicate = pause.clone();
+            duplicate.record_id = 17;
+            duplicate.retry_after_ms = Some(1_390_000);
+            assert!(!pauses.record(duplicate, now_ms + 9_000, now + Duration::from_secs(9)));
+            assert!(pauses.park(&lane, second.path(), Weak::new(), now));
+        });
+        assert_eq!(pauses.0.len(), 1, "one lane timer, not one per root");
+        let entry = &pauses.0[&lane];
+        assert_eq!(entry.at, now + Duration::from_millis(1_399_000));
+        assert_eq!(entry.waiters.len(), 2);
+        assert!(pauses.park(
+            &lane,
+            first.path(),
+            Weak::new(),
+            now + Duration::from_millis(1_398_999)
+        ));
+        assert!(!pauses.park(
+            &lane,
+            first.path(),
+            Weak::new(),
+            now + Duration::from_millis(1_399_000)
+        ));
+        assert_eq!(lines.len(), 1, "{lines:?}");
+        assert!(lines[0].starts_with("INFO "), "{lines:?}");
+        for value in [&lane, &pause.paused_until_ms.to_string(), &pause.reason] {
+            assert!(lines[0].contains(value), "{lines:?}");
+        }
+        for root in [first.path(), second.path()] {
+            assert_eq!(
+                crate::synapse_embed::lane_pause_for_root(root),
+                Some(pause.clone())
+            );
+        }
+        let (_, lines) = crate::logging::capture_log_lines(|| {
+            assert!(!pauses.record(planned_pause(now_ms + 2_000_000), now_ms, now));
+        });
+        assert_eq!(lines.len(), 1, "a changed pause is reported once");
+        assert_eq!(pauses.0[&lane].at, now + Duration::from_millis(2_000_000));
+    }
+
+    #[test]
+    fn planned_pause_without_absolute_end_uses_retry_hint() {
+        let mut pauses = FillPauses::default();
+        let now = Instant::now();
+        assert!(pauses.record(planned_pause(0), 1_000, now));
+        let entry = &pauses.0["scheduled-embedding-lane"];
+        assert_eq!(entry.pause.paused_until_ms, 1_400_000);
+        assert_eq!(entry.at, now + Duration::from_millis(1_399_000));
+        assert!(!pauses.record(planned_pause(0), 10_000, now + Duration::from_secs(9)));
+        assert_eq!(
+            pauses.0["scheduled-embedding-lane"].at,
+            now + Duration::from_millis(1_399_000)
+        );
+    }
+
+    #[test]
+    fn planned_pause_fill_errors_bypass_per_root_failure_backoff() {
+        let first = PublicationFixture::new(Duration::from_secs(60), QUIET);
+        let second = PublicationFixture::new(Duration::from_secs(60), QUIET);
+        let mut pause = planned_pause(crate::semantic_index::unix_millis_now() + 1_399_000);
+        pause.lane_id = format!("fill-error-{}", first.handle.root().display());
+        let error = format!("[lane_paused] {}", serde_json::to_string(&pause).unwrap());
+        let (_, lines) = crate::logging::capture_log_lines(|| {
+            first.handle.work.retry_fill_later(&error);
+            second.handle.work.retry_fill_later(&error);
+        });
+        assert_eq!(lines.len(), 1, "{lines:?}");
+        assert!(lines[0].starts_with("INFO "), "{lines:?}");
+        for fixture in [&first, &second] {
+            let retry = fixture.handle.work.fill_retry.lock().unwrap();
+            assert_eq!(retry.in_a_row, 0);
+            assert!(retry.at.is_none());
+            assert_eq!(
+                crate::synapse_embed::lane_pause_for_root(fixture.handle.root()),
+                Some(pause.clone())
+            );
+        }
+        let pauses = fill_pauses().lock();
+        assert_eq!(pauses.0[&pause.lane_id].waiters.len(), 2);
+        assert!(
+            pauses.0[&pause.lane_id].at.duration_since(Instant::now()) > Duration::from_secs(1_390)
+        );
+    }
+
     struct PublicationFixture {
         handle: Arc<DataCheckout>,
         _root: tempfile::TempDir,
@@ -1775,6 +2144,114 @@ mod tests {
         }
     }
 
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn binding_many_roots_shares_waiting_threads_and_eviction_removes_deadlines() {
+        use crate::shared_timer::Timer;
+        const ROOTS: usize = 12;
+        let mut fixtures = Vec::new();
+        let mut managers = Vec::new();
+        let mut works = Vec::new();
+        for _ in 0..ROOTS {
+            let fixture = PublicationFixture::new(QUIET, QUIET);
+            fixture.handle.quiet.changed();
+            fixture.handle.work.settle.changed();
+            // Keep real retry registrations pending while all roots are bound.
+            fixture.handle.work.retry.lock().unwrap().in_a_row = 10;
+            fixture.handle.work.fill_retry.lock().unwrap().in_a_row = 10;
+            fixture.handle.work.retry_build_later(&DataError::Cancelled);
+            fixture
+                .handle
+                .work
+                .retry_fill_later("retry registration test");
+            let manager = Arc::new(crate::inspect::InspectManager::new());
+            manager.note_dead_code_request(Instant::now());
+            works.push(Arc::clone(&fixture.handle.work));
+            managers.push(manager);
+            fixtures.push(fixture);
+        }
+        // Initial checks run immediately, then register the actual idle deadline.
+        wait_until(|| {
+            managers.iter().all(|manager| {
+                manager
+                    .dead_code_timer_registration_for_test()
+                    .and_then(Timer::deadline_for_test)
+                    .is_some_and(|at| at > Instant::now() + Duration::from_secs(60))
+            })
+        });
+        let mut registrations = Vec::new();
+        for (fixture, manager) in fixtures.iter().zip(&managers) {
+            for timer in [&fixture.handle.quiet, &fixture.handle.work.settle] {
+                registrations.push(
+                    timer
+                        .timer
+                        .lock()
+                        .unwrap()
+                        .as_ref()
+                        .unwrap()
+                        .registration_for_test(),
+                );
+            }
+            for retry in [&fixture.handle.work.retry, &fixture.handle.work.fill_retry] {
+                registrations.push(
+                    retry
+                        .lock()
+                        .unwrap()
+                        .timer
+                        .as_ref()
+                        .unwrap()
+                        .registration_for_test(),
+                );
+            }
+            registrations.push(manager.dead_code_timer_registration_for_test().unwrap());
+        }
+        wait_until(|| {
+            registrations
+                .iter()
+                .all(|id| Timer::registered_for_test(*id))
+        });
+        let names = std::fs::read_dir("/proc/self/task")
+            .unwrap()
+            .map(|entry| {
+                std::fs::read_to_string(entry.unwrap().path().join("comm")).unwrap_or_default()
+            })
+            .collect::<Vec<_>>();
+        let count = |name: &str| names.iter().filter(|comm| comm.trim_end() == name).count();
+        // Linux comm truncates thread names to fifteen bytes.
+        assert_eq!(
+            count("aft-shared-time"),
+            1,
+            "one deadline service for every root"
+        );
+        assert_eq!(
+            count("aft-dead-code-r"),
+            2,
+            "release workers grew with roots"
+        );
+        assert_eq!(count("aft-data-quiet"), 0);
+        assert_eq!(count("aft-data-fill-r"), 0);
+        assert_eq!(count("aft-data-build-"), 0);
+
+        let quiet = Arc::downgrade(&fixtures[0].handle.quiet);
+        let manager = Arc::downgrade(&managers[0]);
+        drop(fixtures);
+        drop(managers);
+        wait_until(|| quiet.upgrade().is_none() && manager.upgrade().is_none());
+        assert!(
+            registrations
+                .iter()
+                .all(|id| !Timer::registered_for_test(*id)),
+            "an evicted root left a timer registered"
+        );
+        // Even a pool job retaining Work cannot rearm an evicted checkout.
+        for work in &works {
+            work.retry_build_later(&DataError::Cancelled);
+            work.retry_fill_later("evicted root");
+            assert!(work.retry.lock().unwrap().timer.is_none());
+            assert!(work.fill_retry.lock().unwrap().timer.is_none());
+        }
+    }
+
     #[test]
     fn the_next_edit_gets_a_fresh_view_before_a_slow_publication() {
         let fixture = PublicationFixture::new(Duration::from_secs(60), QUIET);
@@ -2283,22 +2760,34 @@ mod tests {
     }
 
     #[test]
-    fn a_stopped_quiet_timer_ends_its_thread_without_firing() {
+    fn a_stopped_quiet_timer_cancels_its_deadline_without_firing() {
         let fired = Arc::new(AtomicUsize::new(0));
         let count = Arc::clone(&fired);
         let timer = Arc::new(QuietTimer::new(Duration::from_secs(120), move || {
             count.fetch_add(1, Ordering::SeqCst);
         }));
         timer.changed();
-        // The waiting thread holds the timer.
-        assert_eq!(Arc::strong_count(&timer), 2);
+        let registration = timer
+            .timer
+            .lock()
+            .unwrap()
+            .as_ref()
+            .unwrap()
+            .registration_for_test();
         timer.stop();
         let deadline = Instant::now() + Duration::from_secs(10);
         while Arc::strong_count(&timer) > 1 && Instant::now() < deadline {
             std::thread::sleep(Duration::from_millis(10));
         }
-        assert_eq!(Arc::strong_count(&timer), 1, "the thread is still waiting");
-        // Changes after the stop start no thread.
+        assert_eq!(
+            Arc::strong_count(&timer),
+            1,
+            "the callback retained its owner"
+        );
+        assert!(!crate::shared_timer::Timer::registered_for_test(
+            registration
+        ));
+        // Changes after the stop register no deadline.
         timer.changed();
         assert_eq!(Arc::strong_count(&timer), 1);
         assert_eq!(fired.load(Ordering::SeqCst), 0);
diff --git a/crates/aft/src/data_layer/surfaces.rs b/crates/aft/src/data_layer/surfaces.rs
index 4a14ec2791..88978e3c9e 100644
--- a/crates/aft/src/data_layer/surfaces.rs
+++ b/crates/aft/src/data_layer/surfaces.rs
@@ -150,6 +150,8 @@ impl PlaneReport {
 /// surface.
 #[derive(Clone, Debug)]
 pub(crate) struct DataStoreReport {
+    pub(crate) skipped_folders: usize,
+    pub(crate) skipped_folder_note: Option<String>,
     pub(crate) text: PlaneReport,
     pub(crate) callgraph: PlaneReport,
     /// Paths of the checkout as last published; `None` before anything is.
@@ -172,6 +174,7 @@ pub(crate) struct DataStoreReport {
     pub(crate) refusal: Option<NewerFormat>,
     /// The family store's folder, for its disk use.
     pub(crate) family_dir: Option<PathBuf>,
+    disk_measurement: Option<Arc<DiskMeasurement>>,
     /// Meaning search's plane: the status tool's and each root's health
     /// `semantic_index`. `None` while semantic search is off for the
     /// checkout, or before anything gave it the root's semantic
@@ -182,6 +185,8 @@ pub(crate) struct DataStoreReport {
 impl DataStoreReport {
     fn both(plane: PlaneReport) -> Self {
         Self {
+            skipped_folders: 0,
+            skipped_folder_note: None,
             text: plane.clone(),
             callgraph: plane,
             files: None,
@@ -191,6 +196,7 @@ impl DataStoreReport {
             failure: None,
             refusal: None,
             family_dir: None,
+            disk_measurement: None,
             meaning: None,
         }
     }
@@ -221,6 +227,8 @@ impl DataStoreReport {
             .into_iter()
             .find(|plane| plane.reason.is_some());
         DataStoreHealth {
+            skipped_folders: self.skipped_folders,
+            skipped_folder_note: self.skipped_folder_note.clone(),
             reason: plane_reason.and_then(|plane| plane.reason),
             error: plane_reason.and_then(|plane| plane.error.clone()),
             pending_edits: self.pending_edits,
@@ -238,6 +246,10 @@ impl DataStoreReport {
 /// The `data_store` object of status and of each root's health.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize)]
 pub struct DataStoreHealth {
+    #[serde(skip_serializing_if = "no_skipped_folders")]
+    pub skipped_folders: usize,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub skipped_folder_note: Option<String>,
     /// Why a plane is off or unavailable; see [`reason`].
     #[serde(skip_serializing_if = "Option::is_none")]
     pub reason: Option<&'static str>,
@@ -249,6 +261,10 @@ pub struct DataStoreHealth {
     pub failure: Option<DataStoreFailure>,
 }
 
+fn no_skipped_folders(count: &usize) -> bool {
+    *count == 0
+}
+
 /// The last failed build or refresh of a checkout.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize)]
 pub struct DataStoreFailure {
@@ -337,7 +353,120 @@ pub fn text_plane_ready(ctx: &AppContext) -> Option<bool> {
     }
 }
 
+const INDEX_GAP_NOTE: &str =
+    "(Index skipped {folders}; results may miss files in them:\n{paths}\n)";
+const INDEX_GAP_PREVIEW: usize = 3;
+
+fn folder_count(count: usize) -> String {
+    format!(
+        "{count} unreadable folder{}",
+        if count == 1 { "" } else { "s" }
+    )
+}
+
+pub(crate) fn skipped_folder_health_note(root: &Path, count: usize) -> String {
+    format!("{}: index skipped {}", root.display(), folder_count(count))
+}
+
+/// Report only gaps intersecting the request's scope, under its read policy.
+/// The preview is bounded independently of the number of skipped folders.
+pub(crate) fn disclose_index_gaps(
+    ctx: &AppContext,
+    roots: &[PathBuf],
+    response: &mut crate::protocol::Response,
+) {
+    if !response.success {
+        return;
+    }
+    let views = if let Some(session) = super::parent_session::session_for(ctx) {
+        let children = session.children();
+        let children = children
+            .iter()
+            .filter(|child| {
+                roots
+                    .iter()
+                    .any(|scope| child.root.starts_with(scope) || scope.starts_with(&child.root))
+            })
+            .map(|child| child.root.as_path())
+            .collect::<Vec<_>>();
+        super::parent::text_planes(ctx, session.root(), &children)
+            .into_iter()
+            .filter_map(|plane| match plane {
+                super::parent_session::Plane::Ready(view) => Some((*view).clone()),
+                _ => None,
+            })
+            .collect::<Vec<_>>()
+    } else if let Some(DataCheckoutProbe::Bound(checkout)) = ctx.probe_data_checkout() {
+        checkout.view().into_iter().collect::<Vec<_>>()
+    } else {
+        return;
+    };
+    let fence = crate::context::confinement::capture();
+    let mut count = 0;
+    let mut gaps = Vec::new();
+    let mut lines = Vec::new();
+    for view in &views {
+        for (path, reason) in view.current_state().skipped_directories() {
+            let path = if path.is_empty() {
+                view.root().to_path_buf()
+            } else {
+                view.root().join(String::from_utf8_lossy(path).as_ref())
+            };
+            if !roots
+                .iter()
+                .any(|scope| path.starts_with(scope) || scope.starts_with(&path))
+                || !fence.admits_walk_entry(&path)
+            {
+                continue;
+            }
+            count += 1;
+            if gaps.len() < INDEX_GAP_PREVIEW {
+                lines.push(format!("{}: {reason}", path.display()));
+                gaps.push(
+                serde_json::json!({"kind": "unreadable_folder", "path": path, "reason": reason}),
+            );
+            }
+        }
+    }
+    if count == 0 {
+        return;
+    }
+    let omitted = count - gaps.len();
+    if omitted > 0 {
+        lines.push(format!("and {omitted} more"));
+    }
+    let note = INDEX_GAP_NOTE
+        .replace("{folders}", &folder_count(count))
+        .replace("{paths}", &lines.join("\n"));
+    let body = &mut response.data;
+    body["complete"] = Value::Bool(false);
+    body["skipped_folders"] = serde_json::json!(count);
+    body["skipped_folders_omitted"] = serde_json::json!(omitted);
+    let existing = body
+        .as_object_mut()
+        .expect("response body")
+        .entry("gaps")
+        .or_insert_with(|| Value::Array(Vec::new()));
+    if let Some(existing) = existing.as_array_mut() {
+        existing.extend(gaps);
+    }
+    let text = body["text"].as_str().unwrap_or_default();
+    body["text"] = Value::String(if text.is_empty() {
+        note
+    } else {
+        format!("{note}\n\n{text}")
+    });
+}
+
 pub(crate) fn report(ctx: &AppContext) -> Option<DataStoreReport> {
+    report_inner(ctx, false)
+}
+
+pub(crate) fn report_for_push(ctx: &AppContext) -> Option<DataStoreReport> {
+    report_inner(ctx, true)
+}
+
+fn report_inner(ctx: &AppContext, cached_only: bool) -> Option<DataStoreReport> {
     Some(match ctx.probe_data_checkout()? {
         DataCheckoutProbe::NotBound => {
             DataStoreReport::both(PlaneReport::because(OFF, reason::NOT_BOUND, None))
@@ -367,7 +496,7 @@ pub(crate) fn report(ctx: &AppContext) -> Option<DataStoreReport> {
         DataCheckoutProbe::Withheld(Withheld::IndexesOff) => {
             DataStoreReport::both(PlaneReport::of(OFF))
         }
-        DataCheckoutProbe::Bound(checkout) => report_of(&checkout),
+        DataCheckoutProbe::Bound(checkout) => report_of_inner(&checkout, cached_only),
     })
 }
 
@@ -375,7 +504,11 @@ pub(crate) fn report(ctx: &AppContext) -> Option<DataStoreReport> {
 /// at its last bind, build or refresh, without binding it; `None` when the
 /// data layer is off or nothing was refused.
 pub(crate) fn storage_refusal(ctx: &AppContext) -> Option<NewerFormat> {
-    report(ctx)?.refusal
+    match ctx.probe_data_checkout()? {
+        DataCheckoutProbe::BindFailed(error) => error.refusal().cloned(),
+        DataCheckoutProbe::Bound(checkout) => checkout.last_failure()?.refusal,
+        _ => None,
+    }
 }
 
 /// The degraded reason status gives a refused family store, in the form
@@ -399,6 +532,10 @@ pub(crate) fn refusal_json(refusal: &NewerFormat) -> Value {
 
 /// How a bound checkout stands.
 pub(crate) fn report_of(checkout: &DataCheckout) -> DataStoreReport {
+    report_of_inner(checkout, false)
+}
+
+fn report_of_inner(checkout: &DataCheckout, cached_only: bool) -> DataStoreReport {
     let status = checkout.checkout().status();
     let files = checkout.view().map(|view| view.state().paths().len());
     let mut report = report_from(
@@ -407,7 +544,17 @@ pub(crate) fn report_of(checkout: &DataCheckout) -> DataStoreReport {
         checkout.last_failure(),
         Some(checkout.checkout().family_dir().to_path_buf()),
     );
-    report.meaning = meaning_report(checkout);
+    report.meaning = meaning_report(checkout, cached_only);
+    report.disk_measurement = Some(Arc::clone(checkout.disk_measurement()));
+    report.skipped_folders = checkout
+        .view()
+        .map_or(0, |view| view.current_state().skipped_directories().len());
+    if report.skipped_folders > 0 {
+        report.skipped_folder_note = Some(skipped_folder_health_note(
+            checkout.checkout().root(),
+            report.skipped_folders,
+        ));
+    }
     report
 }
 
@@ -639,10 +786,14 @@ impl MeaningReport {
 
 /// How `checkout`'s meaning plane stands; `None` while semantic search is
 /// off for the checkout.
-fn meaning_report(checkout: &DataCheckout) -> Option<MeaningReport> {
+fn meaning_report(checkout: &DataCheckout, cached_only: bool) -> Option<MeaningReport> {
     use crate::context::SemanticIndexStatus;
     use crate::data_layer::tools::search::DataSemantic;
-    let semantic = DataSemantic::of_checkout(checkout)?;
+    let semantic = if cached_only {
+        DataSemantic::from_state(checkout.cached_meaning_status())?
+    } else {
+        DataSemantic::of_checkout(checkout)?
+    };
     let filling = checkout.filling();
     let plane = match semantic {
         DataSemantic::Serving(meaning) => MeaningPlane::Serving {
@@ -714,6 +865,8 @@ fn report_from(
         PlaneReport::of(READY)
     };
     DataStoreReport {
+        skipped_folders: 0,
+        skipped_folder_note: None,
         text,
         callgraph,
         files,
@@ -723,12 +876,15 @@ fn report_from(
         refusal: failure.as_ref().and_then(|failure| failure.refusal.clone()),
         failure,
         family_dir,
+        disk_measurement: None,
         meaning: None,
     }
 }
 
 /// The bytes of every file under `dir`; zero when it cannot be read.
 fn dir_bytes(dir: &Path) -> u64 {
+    #[cfg(test)]
+    STATUS_DISK_WALKS.with(|count| count.set(count.get() + 1));
     let Ok(entries) = std::fs::read_dir(dir) else {
         return 0;
     };
@@ -742,6 +898,134 @@ fn dir_bytes(dir: &Path) -> u64 {
         .fold(0, u64::saturating_add)
 }
 
+const DISK_REFRESH_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
+
+#[derive(Debug, Default)]
+struct DiskSample {
+    bytes: Option<u64>,
+    completed: Option<std::time::Instant>,
+    started: Option<std::time::Instant>,
+    running: bool,
+    #[cfg(test)]
+    walks: usize,
+}
+
+/// Physical bytes are a timestamped measurement, not a generation invariant:
+/// temporary files can grow without publishing a generation. All checkouts of
+/// a family share one coalesced sampler; no push walks the family directory.
+#[derive(Default)]
+pub(crate) struct DiskMeasurement {
+    sample: std::sync::Mutex<DiskSample>,
+    listeners: std::sync::Mutex<Vec<std::sync::Weak<dyn Fn() + Send + Sync>>>,
+    #[cfg(test)]
+    gate: std::sync::Mutex<Option<Arc<(std::sync::Mutex<bool>, std::sync::Condvar)>>>,
+}
+
+impl std::fmt::Debug for DiskMeasurement {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("DiskMeasurement").finish_non_exhaustive()
+    }
+}
+
+impl DiskMeasurement {
+    #[cfg(test)]
+    pub(crate) fn expire_for_test(&self) {
+        let mut sample = self.sample.lock().unwrap();
+        assert!(!sample.running);
+        sample.started = None;
+        sample.completed = None;
+    }
+    pub(crate) fn for_family(dir: &Path) -> Arc<Self> {
+        let dir = std::fs::canonicalize(dir).unwrap_or_else(|_| dir.to_path_buf());
+        static FAMILIES: std::sync::LazyLock<
+            std::sync::Mutex<std::collections::HashMap<PathBuf, std::sync::Weak<DiskMeasurement>>>,
+        > = std::sync::LazyLock::new(Default::default);
+        let mut families = FAMILIES
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        families.retain(|_, sample| sample.strong_count() > 0);
+        if let Some(sample) = families.get(&dir).and_then(std::sync::Weak::upgrade) {
+            return sample;
+        }
+        let sample = Arc::new(Self::default());
+        families.insert(dir, Arc::downgrade(&sample));
+        sample
+    }
+
+    pub(crate) fn on_change(&self, listener: &super::runtime::StatusListener) {
+        let mut listeners = self
+            .listeners
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        listeners.retain(|old| old.strong_count() > 0);
+        listeners.push(Arc::downgrade(listener));
+    }
+
+    fn observe(self: &Arc<Self>, dir: &Path) -> (Option<u64>, bool) {
+        let mut sample = self
+            .sample
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if !sample.running
+            && sample
+                .started
+                .is_none_or(|at| at.elapsed() >= DISK_REFRESH_INTERVAL)
+        {
+            sample.running = true;
+            sample.started = Some(std::time::Instant::now());
+            let own = Arc::clone(self);
+            let dir = dir.to_path_buf();
+            if std::thread::Builder::new()
+                .name("aft-status-disk".into())
+                .spawn(move || {
+                    #[cfg(test)]
+                    if let Some(gate) = own.gate.lock().unwrap().clone() {
+                        let (held, changed) = &*gate;
+                        let mut held = held.lock().unwrap();
+                        while *held {
+                            held = changed.wait(held).unwrap();
+                        }
+                    }
+                    let bytes = dir_bytes(&dir);
+                    {
+                        let mut sample = own
+                            .sample
+                            .lock()
+                            .unwrap_or_else(std::sync::PoisonError::into_inner);
+                        sample.bytes = Some(bytes);
+                        sample.completed = Some(std::time::Instant::now());
+                        sample.running = false;
+                        #[cfg(test)]
+                        {
+                            sample.walks += 1;
+                        }
+                    }
+                    let listeners = own
+                        .listeners
+                        .lock()
+                        .unwrap_or_else(std::sync::PoisonError::into_inner)
+                        .iter()
+                        .filter_map(std::sync::Weak::upgrade)
+                        .collect::<Vec<_>>();
+                    for listener in listeners {
+                        listener();
+                    }
+                })
+                .is_err()
+            {
+                sample.running = false;
+            }
+        }
+        (
+            sample.bytes,
+            sample.running
+                || sample
+                    .completed
+                    .is_none_or(|at| at.elapsed() >= DISK_REFRESH_INTERVAL),
+        )
+    }
+}
+
 /// The data layer's memory for one root's checkout, measured as the
 /// [`aft_store::heap`] module describes (see
 /// [`super::checkout::CheckoutMemory`] for what each part holds). The text
@@ -992,6 +1276,14 @@ pub(crate) fn block_cache_estimate() -> Option<MemoryEstimate> {
 /// old call-graph store's refresh queue (`callgraph_refresh`) are dropped:
 /// neither describes what these planes answer from.
 pub(crate) fn apply_to_status(payload: &mut Value, report: &DataStoreReport) {
+    apply_to_status_inner(payload, report, false)
+}
+
+pub(crate) fn apply_to_status_push(payload: &mut Value, report: &DataStoreReport) {
+    apply_to_status_inner(payload, report, true)
+}
+
+fn apply_to_status_inner(payload: &mut Value, report: &DataStoreReport, push: bool) {
     payload["search_index"] = report.search_index_json();
     if let Some(meaning) = &report.meaning {
         let meaning = meaning.status_json();
@@ -1031,7 +1323,16 @@ pub(crate) fn apply_to_status(payload: &mut Value, report: &DataStoreReport) {
         &report.family_dir,
     ) {
         disk.insert("data_store_dir".into(), json!(dir.display().to_string()));
-        disk.insert("data_store_bytes".into(), json!(dir_bytes(dir)));
+        if push {
+            let (bytes, stale) = report
+                .disk_measurement
+                .as_ref()
+                .map_or((None, true), |measurement| measurement.observe(dir));
+            disk.insert("data_store_bytes".into(), json!(bytes));
+            disk.insert("data_store_bytes_stale".into(), json!(stale));
+        } else {
+            disk.insert("data_store_bytes".into(), json!(dir_bytes(dir)));
+        }
     }
     if let Some(object) = payload.as_object_mut() {
         object.remove("views");
@@ -1347,6 +1648,179 @@ mod tests {
         context_with(root, storage, |_| {})
     }
 
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn unreadable_folders_publish_with_health_and_query_gaps_then_rescan_recovers() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let storage = tempfile::tempdir().unwrap();
+        let root = dir.path().canonicalize().unwrap();
+        let ctx = context_with(&root, storage.path(), |config| {
+            config.indexes.semantic = false
+        });
+        write(&root, "open.txt", "needle open\n");
+        write(&root, "locked/hidden.txt", "needle hidden\n");
+        let locked = root.join("locked");
+        struct Restore(PathBuf);
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+            }
+        }
+        let restore = Restore(locked.clone());
+        std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0)).unwrap();
+        assert_eq!(
+            std::fs::read_dir(&locked)
+                .err()
+                .expect("run without DAC override privileges")
+                .kind(),
+            std::io::ErrorKind::PermissionDenied
+        );
+        serve_text_index_for_test(&ctx);
+        let health = report(&ctx).unwrap().health();
+        assert_eq!(health.skipped_folders, 1);
+        assert_eq!(
+            health.skipped_folder_note,
+            Some(format!(
+                "{}: index skipped 1 unreadable folder",
+                root.display()
+            ))
+        );
+        assert_eq!(health.reason, None);
+        assert!(health.failure.is_none());
+        let request = |command: &str| {
+            serde_json::from_value(serde_json::json!({
+                "id": format!("gap-{command}"), "command": command,
+                "pattern": if command == "glob" { "**/*.txt" } else { "needle" },
+                "query": "needle",
+            }))
+            .unwrap()
+        };
+        let grep = crate::commands::grep::handle_grep(&request("grep"), &ctx);
+        let glob = crate::commands::glob::handle_glob(&request("glob"), &ctx);
+        let search = crate::commands::semantic_search::handle_semantic_search(
+            &request("semantic_search"),
+            &ctx,
+        );
+        let expected = format!("(Index skipped 1 unreadable folder; results may miss files in them:\n{}: permission denied (os error 13)\n)", locked.display());
+        for response in [&grep, &glob, &search] {
+            assert!(response.success, "{:?}", response.data);
+            assert_eq!(response.data["complete"], false, "{:?}", response.data);
+            assert_eq!(response.data["skipped_folders"], 1);
+            assert_eq!(
+                response.data["gaps"][0],
+                serde_json::json!({"kind":"unreadable_folder", "path": locked, "reason":"permission denied (os error 13)"})
+            );
+            assert_eq!(
+                response.data["text"]
+                    .as_str()
+                    .unwrap()
+                    .split("\n\n")
+                    .next()
+                    .unwrap(),
+                expected
+            );
+            assert!(response.data["text"].as_str().unwrap().contains("open.txt"));
+        }
+        assert_eq!(grep.data["index_status"], "Ready");
+        let mut scoped = crate::protocol::Response::success(
+            "scope",
+            serde_json::json!({"text":"unchanged", "complete":true}),
+        );
+        disclose_index_gaps(&ctx, &[root.join("src")], &mut scoped);
+        assert_eq!(scoped.data["text"], "unchanged");
+        drop(restore);
+        ctx.data_checkout().unwrap().checkout().rescan().unwrap();
+        let recovered = crate::commands::grep::handle_grep(&request("grep"), &ctx);
+        assert!(recovered.success, "{:?}", recovered.data);
+        assert!(
+            recovered.data["text"]
+                .as_str()
+                .unwrap()
+                .contains("hidden.txt"),
+            "{:?}",
+            recovered.data
+        );
+        assert!(recovered.data["skipped_folders"].is_null());
+        assert_eq!(report(&ctx).unwrap().health().skipped_folders, 0);
+    }
+
+    #[test]
+    fn unreadable_folder_notes_use_the_approved_plural_wording() {
+        assert_eq!(
+            skipped_folder_health_note(Path::new("/work"), 2),
+            "/work: index skipped 2 unreadable folders"
+        );
+        assert_eq!(INDEX_GAP_NOTE.replace("{folders}", &folder_count(2)).replace("{paths}", "a: permission denied\nb: operation not permitted"), "(Index skipped 2 unreadable folders; results may miss files in them:\na: permission denied\nb: operation not permitted\n)");
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn unreadable_root_publishes_a_named_gap_and_rescan_retries_after_access_returns() {
+        use std::os::unix::fs::PermissionsExt;
+        let dir = tempfile::tempdir().unwrap();
+        let storage = tempfile::tempdir().unwrap();
+        let root = dir.path().canonicalize().unwrap();
+        let ctx = context_with(&root, storage.path(), |config| {
+            config.indexes.semantic = false
+        });
+        write(&root, "readable-later.txt", "needle\n");
+        let hold = super::super::runtime::hold_builds_for_test(&root);
+        bind_for_test(&ctx);
+        struct Restore(PathBuf);
+        impl Drop for Restore {
+            fn drop(&mut self) {
+                let _ = std::fs::set_permissions(&self.0, std::fs::Permissions::from_mode(0o700));
+            }
+        }
+        let restore = Restore(root.clone());
+        std::fs::set_permissions(&root, std::fs::Permissions::from_mode(0)).unwrap();
+        assert_eq!(
+            std::fs::read_dir(&root)
+                .err()
+                .expect("run without DAC override privileges")
+                .kind(),
+            std::io::ErrorKind::PermissionDenied
+        );
+        drop(hold);
+        serve_text_index_for_test(&ctx);
+        let checkout = ctx.data_checkout().unwrap();
+        assert!(checkout.view().unwrap().current_state().paths().is_empty());
+        let health = report(&ctx).unwrap().health();
+        assert_eq!(
+            health.skipped_folder_note,
+            Some(format!(
+                "{}: index skipped 1 unreadable folder",
+                root.display()
+            ))
+        );
+        assert_eq!(health.reason, None);
+        assert!(health.failure.is_none());
+        let req = serde_json::from_value(
+            serde_json::json!({"id":"root-gap", "command":"grep", "pattern":"needle"}),
+        )
+        .unwrap();
+        let response = crate::commands::grep::handle_grep(&req, &ctx);
+        assert!(response.success, "{:?}", response.data);
+        assert_eq!(response.data["complete"], false);
+        assert_eq!(response.data["gaps"][0]["path"], serde_json::json!(root));
+        assert_eq!(response.data["text"].as_str().unwrap().split("\n\n").next().unwrap(), format!("(Index skipped 1 unreadable folder; results may miss files in them:\n{}: permission denied (os error 13)\n)", root.display()));
+        drop(restore);
+        checkout.checkout().rescan().unwrap();
+        let recovered = crate::commands::grep::handle_grep(&req, &ctx);
+        assert!(recovered.success, "{:?}", recovered.data);
+        assert!(
+            recovered.data["text"]
+                .as_str()
+                .unwrap()
+                .contains("readable-later.txt"),
+            "{:?}",
+            recovered.data
+        );
+        assert!(recovered.data["skipped_folders"].is_null());
+        assert_eq!(report(&ctx).unwrap().health().skipped_folders, 0);
+    }
+
     /// As [`context`], with `edit` applied to its configuration.
     fn context_with(
         root: &Path,
@@ -2462,3 +2936,63 @@ mod tests {
         }
     }
 }
+
+#[cfg(test)]
+thread_local! {
+    static STATUS_DISK_WALKS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+pub(crate) fn status_disk_walks_for_test() -> usize {
+    STATUS_DISK_WALKS.with(|count| count.replace(0))
+}
+
+#[cfg(test)]
+mod status_disk_tests {
+    use super::*;
+
+    #[test]
+    fn status_disk_measurement_coalesces_bursts_and_marks_inflight_and_expired_samples() {
+        let dir = tempfile::tempdir().unwrap();
+        let temp = dir.path().join("growing.tmp");
+        std::fs::write(&temp, b"first").unwrap();
+        let sample = DiskMeasurement::for_family(dir.path());
+        assert!(Arc::ptr_eq(
+            &sample,
+            &DiskMeasurement::for_family(dir.path())
+        ));
+        let gate = Arc::new((std::sync::Mutex::new(true), std::sync::Condvar::new()));
+        *sample.gate.lock().unwrap() = Some(Arc::clone(&gate));
+        let (tx, rx) = std::sync::mpsc::channel();
+        let listener: super::super::runtime::StatusListener = Arc::new(move || {
+            let _ = tx.send(());
+        });
+        sample.on_change(&listener);
+        for _ in 0..50 {
+            assert_eq!(sample.observe(dir.path()), (None, true));
+        }
+        *gate.0.lock().unwrap() = false;
+        gate.1.notify_all();
+        rx.recv_timeout(std::time::Duration::from_secs(60)).unwrap();
+        assert_eq!(sample.observe(dir.path()), (Some(5), false));
+        assert_eq!(sample.sample.lock().unwrap().walks, 1);
+        std::fs::write(&temp, b"a substantially larger temporary file").unwrap();
+        for _ in 0..50 {
+            assert_eq!(sample.observe(dir.path()), (Some(5), false));
+        }
+        assert_eq!(sample.sample.lock().unwrap().walks, 1, "60-second throttle");
+        sample.expire_for_test();
+        *gate.0.lock().unwrap() = true;
+        for _ in 0..50 {
+            assert_eq!(sample.observe(dir.path()), (Some(5), true));
+        }
+        *gate.0.lock().unwrap() = false;
+        gate.1.notify_all();
+        rx.recv_timeout(std::time::Duration::from_secs(60)).unwrap();
+        assert_eq!(
+            sample.observe(dir.path()),
+            (Some(dir_bytes(dir.path())), false)
+        );
+        assert_eq!(sample.sample.lock().unwrap().walks, 2);
+    }
+}
diff --git a/crates/aft/src/data_layer/tools/search/meaning.rs b/crates/aft/src/data_layer/tools/search/meaning.rs
index d8b62cf6ce..b92990206f 100644
--- a/crates/aft/src/data_layer/tools/search/meaning.rs
+++ b/crates/aft/src/data_layer/tools/search/meaning.rs
@@ -173,7 +173,7 @@ impl DataSemantic {
         Self::from_state(checkout.meaning_status())
     }
 
-    fn from_state(state: MeaningState) -> Option<Self> {
+    pub(crate) fn from_state(state: MeaningState) -> Option<Self> {
         Some(match state {
             MeaningState::Off => return None,
             MeaningState::Unpublished => Self::NotServing(building(DATA_LAYER_BUILD_STAGE, None)),
diff --git a/crates/aft/src/data_layer/vectors.rs b/crates/aft/src/data_layer/vectors.rs
index c5d722de94..515b08b0c8 100644
--- a/crates/aft/src/data_layer/vectors.rs
+++ b/crates/aft/src/data_layer/vectors.rs
@@ -519,6 +519,8 @@ impl Members {
     }
 
     fn build(view: &CheckoutView, loaded: &Loaded, max_files: usize) -> Result<Self, DataError> {
+        #[cfg(test)]
+        STATUS_MEMBER_BUILDS.with(|count| count.set(count.get() + 1));
         let index = loaded.shared.as_ref().map(SharedVectorIndex::index);
         let surveyed = survey(view.current_state(), loaded, index.as_ref(), max_files)?;
         let absolute = |path: &[u8]| {
@@ -1181,6 +1183,22 @@ impl VectorPlane {
         })
     }
 
+    /// A snapshot only if a producer already surveyed this exact text view and
+    /// vector generation. Status must not rebuild members on the push thread.
+    pub(crate) fn cached_snapshot(&self, view: &CheckoutView) -> Option<MeaningSnapshot> {
+        let loaded = Arc::clone(&*self.loaded.try_lock().ok()?);
+        let cached = self.members.try_lock().ok()?;
+        let members = cached.as_ref().filter(|members| {
+            members.view == view.text_generation() && members.generation == loaded.generation
+        })?;
+        Some(MeaningSnapshot {
+            loaded,
+            members: Arc::clone(members),
+            root: view.root().to_path_buf(),
+            dimensions: self.producer.model.dimensions as usize,
+        })
+    }
+
     /// Reads the family's newest generation, if it is newer than the one
     /// the plane read last. When nothing newer was published this lists the
     /// family's directory and does nothing else (see [`Self::load`]).
@@ -3086,3 +3104,13 @@ mod tests {
         );
     }
 }
+
+#[cfg(test)]
+thread_local! {
+    static STATUS_MEMBER_BUILDS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+pub(crate) fn status_member_builds_for_test() -> usize {
+    STATUS_MEMBER_BUILDS.with(|count| count.replace(0))
+}
diff --git a/crates/aft/src/db/compression_events.rs b/crates/aft/src/db/compression_events.rs
index 6674a9b6d6..5887b60ba6 100644
--- a/crates/aft/src/db/compression_events.rs
+++ b/crates/aft/src/db/compression_events.rs
@@ -94,6 +94,8 @@ struct CompressionAggregateCacheInner {
 #[derive(Debug, Default)]
 pub struct CompressionAggregateCache {
     inner: Mutex<CompressionAggregateCacheInner>,
+    refreshing: Mutex<std::collections::HashSet<(usize, SessionAggregateKey)>>,
+    epoch: std::sync::atomic::AtomicU64,
     #[cfg(test)]
     aggregate_scan_count: AtomicUsize,
 }
@@ -106,48 +108,153 @@ impl CompressionAggregateCache {
         project_key: &str,
         session_id: &str,
     ) -> rusqlite::Result<(CompressionAggregate, CompressionAggregate)> {
+        let epoch = self.epoch.load(std::sync::atomic::Ordering::Acquire);
+        self.aggregates_for_session_at_epoch(conn, harness, project_key, session_id, epoch)
+    }
+
+    fn aggregates_for_session_at_epoch(
+        &self,
+        conn: &Connection,
+        harness: &str,
+        project_key: &str,
+        session_id: &str,
+        epoch: u64,
+    ) -> rusqlite::Result<(CompressionAggregate, CompressionAggregate)> {
+        // Keep the watermark and both aggregates in one SQLite read snapshot:
+        // another process may insert or roll up events between statements.
+        let read = conn
+            .is_autocommit()
+            .then(|| conn.unchecked_transaction())
+            .transpose()?;
         let watermark = compression_event_watermark(conn)?;
         let project_key = ProjectAggregateKey::new(harness, project_key);
         let session_key = SessionAggregateKey::new(harness, &project_key.project_key, session_id);
-        let mut inner = self.inner.lock();
-        reset_for_connection_change(&mut inner, conn);
-
-        let project = match inner.projects.get(&project_key) {
-            Some(cached) if cached.watermark == watermark => cached.aggregate,
-            _ => {
+        let (cached_project, cached_session) = {
+            let mut inner = self.inner.lock();
+            if self.epoch.load(std::sync::atomic::Ordering::Acquire) != epoch {
+                return Err(rusqlite::Error::InvalidQuery);
+            }
+            reset_for_connection_change(&mut inner, conn);
+            (
+                inner
+                    .projects
+                    .get(&project_key)
+                    .filter(|cached| cached.watermark == watermark)
+                    .map(|cached| cached.aggregate),
+                inner
+                    .sessions
+                    .get(&session_key)
+                    .filter(|cached| cached.watermark == watermark)
+                    .map(|cached| cached.aggregate),
+            )
+        };
+        // Do not hold the cache mutex during SQL: a busy-connection status
+        // reader must be able to serve the last exact values immediately.
+        let project = match cached_project {
+            Some(project) => project,
+            None => {
                 self.note_aggregate_scan();
-                let aggregate = aggregate_for_project(conn, harness, &project_key.project_key)?;
-                inner.projects.insert(
-                    project_key.clone(),
-                    CachedAggregate {
-                        aggregate,
-                        watermark,
-                    },
-                );
-                aggregate
+                aggregate_for_project(conn, harness, &project_key.project_key)?
             }
         };
-
-        let session = match inner.sessions.get(&session_key) {
-            Some(cached) if cached.watermark == watermark => cached.aggregate,
-            _ => {
+        let session = match cached_session {
+            Some(session) => session,
+            None => {
                 self.note_aggregate_scan();
-                let aggregate =
-                    aggregate_for_session(conn, harness, &project_key.project_key, session_id)?;
-                inner.sessions.insert(
-                    session_key,
-                    CachedAggregate {
-                        aggregate,
-                        watermark,
-                    },
-                );
-                aggregate
+                aggregate_for_session(conn, harness, &project_key.project_key, session_id)?
             }
         };
-
+        if let Some(read) = read {
+            read.commit()?;
+        }
+        let mut inner = self.inner.lock();
+        if inner.connection_identity == Some(conn as *const Connection as usize)
+            && self.epoch.load(std::sync::atomic::Ordering::Acquire) == epoch
+        {
+            inner.projects.insert(
+                project_key,
+                CachedAggregate {
+                    aggregate: project,
+                    watermark,
+                },
+            );
+            inner.sessions.insert(
+                session_key,
+                CachedAggregate {
+                    aggregate: session,
+                    watermark,
+                },
+            );
+        }
         Ok((project, session))
     }
 
+    /// Validate warm totals with one indexed watermark lookup, never aggregate
+    /// on the push thread. A miss is recomputed by `refresh_for_status`.
+    pub(crate) fn validated_for_status(
+        &self,
+        conn: &Connection,
+        harness: &str,
+        project_key: &str,
+        session_id: &str,
+    ) -> rusqlite::Result<Option<(CompressionAggregate, CompressionAggregate)>> {
+        let watermark = compression_event_watermark(conn)?;
+        let project_key = ProjectAggregateKey::new(harness, project_key);
+        let session_key = SessionAggregateKey::new(harness, &project_key.project_key, session_id);
+        let mut inner = self.inner.lock();
+        reset_for_connection_change(&mut inner, conn);
+        Ok(inner
+            .projects
+            .get(&project_key)
+            .zip(inner.sessions.get(&session_key))
+            .filter(|(project, session)| {
+                project.watermark == watermark && session.watermark == watermark
+            })
+            .map(|(project, session)| (project.aggregate, session.aggregate)))
+    }
+
+    pub(crate) fn refresh_for_status(
+        self: &std::sync::Arc<Self>,
+        db: std::sync::Arc<std::sync::Mutex<crate::db::TrackedConnection>>,
+        harness: String,
+        project_key: String,
+        session_id: String,
+        notify: std::sync::Arc<dyn Fn() + Send + Sync>,
+    ) {
+        let key = (
+            std::sync::Arc::as_ptr(&db) as usize,
+            SessionAggregateKey::new(&harness, &project_key, &session_id),
+        );
+        if !self.refreshing.lock().insert(key.clone()) {
+            return;
+        }
+        let own = std::sync::Arc::clone(self);
+        let epoch = self.epoch.load(std::sync::atomic::Ordering::Acquire);
+        let failure_key = key.clone();
+        if std::thread::Builder::new()
+            .name("aft-status-compression".into())
+            .spawn(move || {
+                let completed = db.lock().ok().is_some_and(|conn| {
+                    own.aggregates_for_session_at_epoch(
+                        &conn,
+                        &harness,
+                        &project_key,
+                        &session_id,
+                        epoch,
+                    )
+                    .is_ok()
+                });
+                own.refreshing.lock().remove(&key);
+                if completed {
+                    notify();
+                }
+            })
+            .is_err()
+        {
+            self.refreshing.lock().remove(&failure_key);
+        }
+    }
+
     /// The aggregates last computed for this key, without revalidating them
     /// against the table. `status` uses this when the shared connection is busy,
     /// because it answers from memory rather than waiting for the database.
@@ -214,6 +321,7 @@ impl CompressionAggregateCache {
     }
 
     pub fn clear(&self) {
+        self.epoch.fetch_add(1, std::sync::atomic::Ordering::AcqRel);
         *self.inner.lock() = CompressionAggregateCacheInner::default();
     }
 
@@ -1718,6 +1826,91 @@ mod tests {
         }
     }
 
+    #[test]
+    fn status_compression_refresh_coalesces_and_matches_full_totals_after_insert_and_retention() {
+        let dir = tempdir().unwrap();
+        let db = std::sync::Arc::new(std::sync::Mutex::new(
+            crate::db::open(&dir.path().join("aft.db")).unwrap(),
+        ));
+        let cache = std::sync::Arc::new(CompressionAggregateCache::default());
+        {
+            let conn = db.lock().unwrap();
+            cache
+                .aggregates_for_session(&conn, "opencode", "project-a", "session-1")
+                .unwrap();
+        }
+        let mut external = crate::db::open(&dir.path().join("aft.db")).unwrap();
+        insert_compression_event(&external, &row("project-a", "old", 100, 40, 1)).unwrap();
+        insert_compression_event(&external, &row("project-a", "new", 200, 80, 2)).unwrap();
+        insert_compression_event(&external, &row("project-b", "watermark", 5, 2, 3)).unwrap();
+        // Rows newer than the cached watermark can be rolled up before status
+        // sees them. A raw id-range delta alone would miss these events.
+        assert_eq!(
+            prune_compression_events(&mut external, RETENTION_AGE_MS + 100).unwrap(),
+            2
+        );
+        let (tx, rx) = std::sync::mpsc::channel();
+        let notify: std::sync::Arc<dyn Fn() + Send + Sync> = std::sync::Arc::new(move || {
+            let _ = tx.send(());
+        });
+        let held = db.lock().unwrap();
+        assert_eq!(
+            cache
+                .validated_for_status(&held, "opencode", "project-a", "session-1")
+                .unwrap(),
+            None
+        );
+        let scans = cache.aggregate_scan_count_for_test();
+        for _ in 0..50 {
+            cache.refresh_for_status(
+                std::sync::Arc::clone(&db),
+                "opencode".into(),
+                "project-a".into(),
+                "session-1".into(),
+                std::sync::Arc::clone(&notify),
+            );
+        }
+        assert_eq!(cache.refreshing.lock().len(), 1);
+        assert_eq!(cache.aggregate_scan_count_for_test(), scans);
+        assert_eq!(
+            cache
+                .cached_for_session("opencode", "project-a", "session-1")
+                .unwrap()
+                .0
+                .events,
+            0
+        );
+        drop(held);
+        rx.recv_timeout(std::time::Duration::from_secs(60)).unwrap();
+        assert!(rx.try_recv().is_err());
+        let conn = db.lock().unwrap();
+        let exact = (
+            aggregate_for_project(&conn, "opencode", "project-a").unwrap(),
+            aggregate_for_session(&conn, "opencode", "project-a", "session-1").unwrap(),
+        );
+        assert_eq!(exact.0.events, 2);
+        assert_eq!(
+            cache
+                .validated_for_status(&conn, "opencode", "project-a", "session-1")
+                .unwrap(),
+            Some(exact)
+        );
+        drop(conn);
+        let warm = cache
+            .cached_for_session("opencode", "project-a", "session-1")
+            .unwrap();
+        assert_eq!(
+            prune_compression_events(&mut external, RETENTION_AGE_MS + 100).unwrap(),
+            0
+        );
+        assert_eq!(
+            cache
+                .validated_for_status(&db.lock().unwrap(), "opencode", "project-a", "session-1")
+                .unwrap(),
+            Some(warm)
+        );
+    }
+
     fn row<'a>(
         project_key: &'a str,
         task_id: &'a str,
diff --git a/crates/aft/src/durability.rs b/crates/aft/src/durability.rs
index 78ffff35d1..0d171a68cd 100644
--- a/crates/aft/src/durability.rs
+++ b/crates/aft/src/durability.rs
@@ -1,6 +1,7 @@
 //! Durable file commits use the platform's full sync, including F_FULLFSYNC on
-//! macOS. Rebuildable and process-lifetime stores deliberately do not call these
-//! sync helpers. Atomic writes select their durability explicitly. The test
+//! macOS, or fsync when the mount does not support it. Rebuildable and
+//! process-lifetime stores deliberately do not call these sync helpers.
+//! Atomic writes select their durability explicitly. The test
 //! ledger observes the real calls, never substitutes for them.
 
 use std::fs::{self, File};
@@ -87,11 +88,9 @@ impl Drop for SyncGroup {
 }
 
 fn full_sync(file: &File, path: &Path) -> io::Result<()> {
-    file.sync_all()?;
+    aft_store::sync::sync_all(file, path)?;
     #[cfg(test)]
     FULL_SYNCS.with(|syncs| syncs.borrow_mut().push(path.to_path_buf()));
-    #[cfg(not(test))]
-    let _ = path;
     Ok(())
 }
 
diff --git a/crates/aft/src/edit.rs b/crates/aft/src/edit.rs
index ecf36c9d22..6109d4c1a2 100644
--- a/crates/aft/src/edit.rs
+++ b/crates/aft/src/edit.rs
@@ -177,7 +177,7 @@ fn atomic_write_source_with(
     }
     drop(write_temp);
     let write_sync = crate::backup::latency::time(crate::backup::latency::Part::WriteSync);
-    file.sync_all()
+    aft_store::sync::sync_all(file, &temporary)
         .map_err(|error| io::Error::new(error.kind(), format!("durability: {error}")))?;
     drop(write_sync);
     cleanup.file.take();
@@ -201,7 +201,7 @@ fn atomic_write_source_with(
     // be reported as a failed edit without implying the original still exists.
     let _dir_sync = crate::backup::latency::time(crate::backup::latency::Part::WriteDirSync);
     if let Ok(directory) = fs::File::open(parent) {
-        let _ = directory.sync_all();
+        let _ = aft_store::sync::sync_all(&directory, parent);
     }
     Ok(SourceWriteOutcome {
         mode: SourceWriteMode::Replaced,
@@ -273,20 +273,21 @@ fn write_source_in_place(
     };
     fn rewrite(
         file: &mut std::fs::File,
+        destination: &Path,
         content: &[u8],
         writer: &mut dyn FnMut(&mut std::fs::File, &[u8]) -> io::Result<()>,
     ) -> io::Result<()> {
         file.set_len(0)?;
         file.seek(SeekFrom::Start(0))?;
         writer(file, content)?;
-        file.sync_all()
+        aft_store::sync::sync_all(file, destination)
             .map_err(|error| io::Error::new(error.kind(), format!("durability: {error}")))
     }
-    if let Err(error) = rewrite(&mut file, bytes, writer) {
+    if let Err(error) = rewrite(&mut file, destination, bytes, writer) {
         let Some(saved) = saved.as_deref() else {
             return Err(error);
         };
-        let restored = rewrite(&mut file, saved, &mut |file, content| {
+        let restored = rewrite(&mut file, destination, saved, &mut |file, content| {
             file.write_all(content)
         });
         return match (restored, copy) {
@@ -956,9 +957,9 @@ mod source_recovery {
         let prepared = (|| {
             make_private(destination, &copy, &file)?;
             file.write_all(bytes)?;
-            file.sync_all()?;
+            aft_store::sync::sync_all(&file, &copy)?;
             if let Ok(directory) = File::open(parent) {
-                let _ = directory.sync_all();
+                let _ = aft_store::sync::sync_all(&directory, parent);
             }
             Ok(())
         })();
diff --git a/crates/aft/src/error.rs b/crates/aft/src/error.rs
index eb257e467b..af2728d9e7 100644
--- a/crates/aft/src/error.rs
+++ b/crates/aft/src/error.rs
@@ -100,7 +100,7 @@ impl fmt::Display for AftError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             AftError::DeniedFloor { path } => {
-                write!(f, "path '{}' is denied by the access policy floor", path)
+                f.write_str(&crate::access_policy::aft_storage_denial_message(path))
             }
             AftError::SymbolNotFound { name, file } => {
                 write!(f, "symbol '{}' not found in {}", name, file)
diff --git a/crates/aft/src/format.rs b/crates/aft/src/format.rs
index 3e79af07e9..340dec3a60 100644
--- a/crates/aft/src/format.rs
+++ b/crates/aft/src/format.rs
@@ -2874,7 +2874,13 @@ mod tests {
             let dir = tempfile::tempdir().unwrap();
             let mut command = Command::new("sh");
             command
-                .args(["-c", "while [ ! -f release ]; do sleep 0.02; done; exit 7"])
+                .args([
+                    "-c",
+                    &format!(
+                        "{}; exit 7",
+                        crate::test_gate::gate("release", "sleep 0.02")
+                    ),
+                ])
                 .current_dir(dir.path())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
diff --git a/crates/aft/src/gh_shim.rs b/crates/aft/src/gh_shim.rs
index f934f4e425..1375b53ff8 100644
--- a/crates/aft/src/gh_shim.rs
+++ b/crates/aft/src/gh_shim.rs
@@ -32,9 +32,12 @@ use subc_protocol::manifest::ProviderRole;
 use crate::db::github_read_cache::{invalidate_github_read_cache_resource, GithubReadResourceKind};
 use subc_protocol::{BindIdentity, RouteTarget};
 
+pub(crate) mod manifest_sync;
+mod manifest_wire;
 mod native_guard;
 pub(crate) mod read_contract;
 mod rename_guard;
+mod ticket_repository;
 mod v22_rows;
 mod v23_queue;
 mod worker_reads;
@@ -3507,44 +3510,7 @@ pub(crate) fn seed_worker_state(root: &Path) -> Result<(), String> {
 }
 
 pub(crate) fn ticket_repository_snapshot(project_root: &Path) -> Option<String> {
-    if !project_root.is_dir() {
-        return None;
-    }
-    let git = which::which("git").ok()?;
-    let command = || {
-        let mut command = Command::new(&git);
-        command.env_clear().env("GIT_CONFIG_NOSYSTEM", "1");
-        #[cfg(windows)]
-        if let Some(root) = std::env::var_os("SystemRoot") {
-            command.env("SystemRoot", root);
-        }
-        command
-    };
-    let output = command()
-        .arg("-C")
-        .arg(project_root)
-        .args(["rev-parse", "--path-format=absolute", "--git-common-dir"])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    let common = PathBuf::from(std::str::from_utf8(&output.stdout).ok()?.trim());
-    if !common.is_absolute() {
-        return None;
-    }
-    // Read the primary repository's config, not a worktree-specific override.
-    // The resulting name is saved in the daemon's ticket registry before exec.
-    let output = command()
-        .args(["config", "--no-includes", "--file"])
-        .arg(common.join("config"))
-        .args(["--get", "remote.origin.url"])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    canonical_repository_key(std::str::from_utf8(&output.stdout).ok()?.trim())
+    ticket_repository::snapshot(project_root)
 }
 
 /// The target's binding, else the checkout's.
@@ -4307,9 +4273,46 @@ fn load_manifest_with_trust_set(
     now: u64,
     trust_set: &[Option<ManifestTrustKey>],
 ) -> Result<VerifiedManifest, ManifestProblem> {
+    if !paths.root.exists() {
+        return Err(ManifestProblem::Missing);
+    }
+    let _acceptance_lock = manifest_acceptance_lock(paths)
+        .map_err(|_| ManifestProblem::Invalid("manifest acceptance lock unavailable".into()))?;
     let bytes = fs::read(&paths.manifest).map_err(|_| ManifestProblem::Missing)?;
     let envelope: SignedManifest = serde_json::from_slice(&bytes)
         .map_err(|error| ManifestProblem::Invalid(error.to_string()))?;
+    let verified = validate_manifest_candidate(paths, &envelope, now, trust_set)?;
+    let manifest = &verified.manifest;
+    if manifest.manifest_version > version_high_water(paths) {
+        write_version_high_water(paths, manifest.manifest_version);
+    }
+    write_last_valid_manifest(paths, manifest, &bytes);
+    retain_manifest(paths, &envelope, manifest.manifest_version);
+    Ok(verified)
+}
+
+// The daemon publisher and short-lived shim processes share this OS lock so a
+// newer acceptance cannot race a publisher's high-water check and rename.
+fn manifest_acceptance_lock(paths: &StatePaths) -> io::Result<crate::fs_lock::AdvisoryLockGuard> {
+    crate::private_storage::open_root(&paths.root)?;
+    let file = crate::private_storage::options()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .open(paths.root.join("manifest-acceptance.lock"))?;
+    file.lock()?;
+    Ok(crate::fs_lock::AdvisoryLockGuard::from_locked_file(file))
+}
+
+// Sync preflights a candidate without changing any accepted state. The shim's
+// status and execution paths use this same verifier before recording acceptance.
+fn validate_manifest_candidate(
+    paths: &StatePaths,
+    envelope: &SignedManifest,
+    now: u64,
+    trust_set: &[Option<ManifestTrustKey>],
+) -> Result<VerifiedManifest, ManifestProblem> {
     if envelope.artifact_id != MANIFEST_ARTIFACT_ID {
         return Err(ManifestProblem::Invalid("artifact id mismatch".to_string()));
     }
@@ -4323,7 +4326,7 @@ fn load_manifest_with_trust_set(
     let VerifiedManifest {
         manifest,
         verified_by_key_id,
-    } = verify_manifest_envelope(&envelope, trust_set)?;
+    } = verify_manifest_envelope(envelope, trust_set)?;
     manifest.validate().map_err(ManifestProblem::Invalid)?;
     if manifest.schema_floor < SCHEMA_FLOOR {
         return Err(ManifestProblem::BelowFloor {
@@ -4347,18 +4350,6 @@ fn load_manifest_with_trust_set(
             ISSUED_AT_FUTURE_SKEW.as_secs()
         )));
     }
-    // Accepted: advance the high-water mark and refresh the last-valid cache
-    // that the regressed-manifest arm classifies from. Both are local state
-    // under the dormancy-valve argument documented above.
-    if manifest.manifest_version > newest_accepted {
-        write_version_high_water(paths, manifest.manifest_version);
-    }
-    write_last_valid_manifest(paths, &manifest, &bytes);
-    // Retain the exact verified bytes for later reproducibility checks. The
-    // signature already verified above; the admission filter re-checks that the
-    // version inside the verified payload matches the filing name. This never
-    // affects activation.
-    retain_manifest(paths, &envelope, manifest.manifest_version);
     Ok(VerifiedManifest {
         manifest,
         verified_by_key_id,
@@ -7493,7 +7484,7 @@ fn write_seam_state(paths: &StatePaths, state: SeamState) -> io::Result<()> {
     // A governed result is visible only after its self-report transition is
     // durable enough to survive a process exit. Failure stays on the seam path
     // and is surfaced as a refusal instead of falling through to real `gh`.
-    file.sync_data()?;
+    aft_store::sync::sync_data(&file, &temporary)?;
     fs::rename(temporary, &paths.seam_state)
 }
 
@@ -7835,7 +7826,7 @@ fn append_bypass_audit_record(paths: &StatePaths, record: &Value) -> io::Result<
     file.write_all(&record)?;
     // An operator bypass is allowed only after the audit record is durable enough
     // to survive a process replacement. If this returns an error we do not exec.
-    file.sync_data()
+    aft_store::sync::sync_data(&file, &paths.bypass_audit)
 }
 
 #[derive(Serialize)]
diff --git a/crates/aft/src/gh_shim/manifest_sync.rs b/crates/aft/src/gh_shim/manifest_sync.rs
new file mode 100644
index 0000000000..1c75042b30
--- /dev/null
+++ b/crates/aft/src/gh_shim/manifest_sync.rs
@@ -0,0 +1,502 @@
+//! Background vault delivery; never runs on a tool or route dispatch thread.
+
+use super::manifest_wire::{self as wire, Recorded, Reply, ResultBody};
+use super::manifest_wire::{Latest, Notice, Report};
+use super::*;
+use crate::secret::transport::ManagementSession;
+use sha2::{Digest, Sha256};
+use std::sync::Mutex;
+
+#[derive(Clone, Default, Serialize)]
+struct Health {
+    active_version: Option<u64>,
+    newest_version_seen: Option<u64>,
+    active_state: Option<&'static str>,
+    last_report: Option<Report>,
+    last_report_outcome: Option<&'static str>,
+    last_refusal_code: Option<&'static str>,
+}
+
+impl Health {
+    fn observe_version(&mut self, version: Option<u64>) {
+        if let Some(version) = version {
+            self.newest_version_seen = Some(self.newest_version_seen.unwrap_or(0).max(version));
+        }
+    }
+}
+
+static HEALTH: Mutex<Health> = Mutex::new(Health {
+    active_version: None,
+    newest_version_seen: None,
+    active_state: None,
+    last_report: None,
+    last_report_outcome: None,
+    last_refusal_code: None,
+});
+
+pub(crate) fn health() -> Value {
+    serde_json::to_value(
+        HEALTH
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .clone(),
+    )
+    .unwrap_or(Value::Null)
+}
+
+fn digest(bytes: &str) -> String {
+    format!("{:x}", Sha256::digest(bytes.as_bytes()))
+}
+
+fn problem_reason(problem: &ManifestProblem) -> &'static str {
+    match problem {
+        ManifestProblem::Missing => "manifest missing",
+        ManifestProblem::RolledBack { .. } => "manifest below high-water version",
+        ManifestProblem::BelowFloor { .. } => "manifest below schema floor",
+        ManifestProblem::Invalid(reason) if reason.starts_with("untrusted manifest key id") => {
+            "untrusted manifest key"
+        }
+        ManifestProblem::Invalid(reason) if reason == "detached signature verification failed" => {
+            "detached signature verification failed"
+        }
+        ManifestProblem::Invalid(reason) if reason == "invalid detached signature encoding" => {
+            "invalid detached signature encoding"
+        }
+        _ => "shim rejected manifest",
+    }
+}
+
+fn local_report(paths: &StatePaths, now: u64) -> Option<Report> {
+    // Use the same status path as gh --status, including its acceptance writes.
+    let status = cached_manifest_report_at(paths, now);
+    let mut health = HEALTH
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    health.active_version = status.version;
+    let envelope = fs::read(&paths.manifest)
+        .ok()
+        .and_then(|bytes| serde_json::from_slice::<SignedManifest>(&bytes).ok());
+    let Some(envelope) = envelope else {
+        health.active_version = None;
+        health.active_state = Some(if paths.manifest.exists() {
+            "no active manifest: malformed"
+        } else {
+            "no active manifest: missing"
+        });
+        return None;
+    };
+    let version = serde_json::from_str::<Value>(&envelope.manifest_bytes)
+        .ok()
+        .and_then(|manifest| manifest["manifest_version"].as_u64())
+        .filter(|version| *version > 0);
+    let Some(version) = version else {
+        health.active_version = None;
+        health.active_state = Some("no active manifest: malformed");
+        return None;
+    };
+    let valid = status.state == Some("valid") && status.version == Some(version);
+    health.active_state = Some(if valid { "valid" } else { "invalid" });
+    Some(Report {
+        version,
+        payload_sha256: digest(&envelope.manifest_bytes),
+        verdict: if valid { "valid" } else { "invalid" }.into(),
+        reason: (!valid).then(|| "shim rejected manifest".into()),
+    })
+}
+
+fn candidate_report(latest: &Latest, reason: &'static str) -> Report {
+    Report {
+        version: latest.version,
+        payload_sha256: digest(&latest.envelope.manifest_bytes),
+        verdict: "invalid".into(),
+        reason: Some(reason.into()),
+    }
+}
+
+fn write_candidate(
+    paths: &StatePaths,
+    envelope: &SignedManifest,
+    before_rename: impl FnOnce() -> io::Result<()>,
+) -> io::Result<()> {
+    crate::private_storage::open_root(&paths.root)?;
+    let stamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_err(io::Error::other)?
+        .as_nanos();
+    let temporary = paths
+        .root
+        .join(format!("manifest-sync-{}-{stamp}.tmp", std::process::id()));
+    let mut file = crate::private_storage::options()
+        .write(true)
+        .create_new(true)
+        .open(&temporary)?;
+    std::io::Write::write_all(&mut file, &serde_json::to_vec(envelope)?)?;
+    aft_store::sync::sync_all(&file, &temporary)?;
+    drop(file);
+    before_rename()?;
+    fs::rename(&temporary, &paths.manifest)
+}
+
+fn activate(paths: &StatePaths, latest: &Latest, now: u64) -> Option<Report> {
+    // Refresh the shim's high-water from its current file before comparing.
+    let current = local_report(paths, now);
+    let acceptance_lock = match manifest_acceptance_lock(paths) {
+        Ok(lock) => lock,
+        Err(_) => {
+            return Some(candidate_report(
+                latest,
+                "manifest acceptance lock unavailable",
+            ))
+        }
+    };
+    if latest.version <= version_high_water(paths) {
+        return current;
+    }
+    let envelope = SignedManifest {
+        artifact_id: MANIFEST_ARTIFACT_ID.into(),
+        envelope_version: ENVELOPE_VERSION,
+        key_id: latest.envelope.key_id.clone(),
+        fetched_at_unix_secs: now,
+        signature: latest.envelope.signature.clone(),
+        manifest_bytes: latest.envelope.manifest_bytes.clone(),
+    };
+    let verified =
+        match validate_manifest_candidate(paths, &envelope, now, compiled_manifest_trust_set()) {
+            Ok(verified) => verified,
+            Err(problem) => return Some(candidate_report(latest, problem_reason(&problem))),
+        };
+    if latest.version == 0 || verified.manifest.manifest_version != latest.version {
+        return Some(candidate_report(
+            latest,
+            "manifest version differs from vault version",
+        ));
+    }
+    if latest.version <= version_high_water(paths) {
+        return current;
+    }
+    if write_candidate(paths, &envelope, || Ok(())).is_err() {
+        return Some(candidate_report(latest, "manifest atomic write failed"));
+    }
+    drop(acceptance_lock);
+    local_report(paths, now)
+}
+
+#[derive(Default)]
+struct Cursor {
+    epoch: Option<String>,
+    seq: u64,
+    read_version: Option<u64>,
+    read_sha256: Option<String>,
+}
+
+impl Cursor {
+    fn observe(&mut self, notice: &Notice) -> bool {
+        let reread = notice.version != self.read_version
+            || self
+                .epoch
+                .as_ref()
+                .is_some_and(|epoch| epoch != &notice.epoch)
+            || notice.seq != self.seq.saturating_add(1);
+        self.epoch = Some(notice.epoch.clone());
+        self.seq = notice.seq;
+        reread
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+struct Failure {
+    code: &'static str,
+    transient: bool,
+}
+
+impl Failure {
+    fn new(code: &str, transient: bool) -> Self {
+        // Never let arbitrary peer text enlarge health or enter daemon logs.
+        let code = match code {
+            "unknown_method" => "unknown_method",
+            "not_found" => "not_found",
+            "home_unavailable" => "home_unavailable",
+            "store_error" => "store_error",
+            "remote_setup_incomplete" => "remote_setup_incomplete",
+            "secret_setup_incomplete" => "secret_setup_incomplete",
+            "invalid_params" => "invalid_params",
+            "transport_unavailable" => "transport_unavailable",
+            _ => "unrecognized_refusal",
+        };
+        Self { code, transient }
+    }
+
+    fn transport(error: subc_client_rs::CallError) -> Self {
+        match error {
+            subc_client_rs::CallError::Module(body) => Self::new(&body.code, false),
+            _ => Self::new("transport_unavailable", true),
+        }
+    }
+
+    fn stop(self) -> bool {
+        matches!(self.code, "unknown_method" | "not_found")
+    }
+
+    fn record(self) {
+        HEALTH
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .last_refusal_code = Some(self.code);
+    }
+}
+
+fn decode<T: serde::de::DeserializeOwned>(bytes: &[u8]) -> Result<T, Failure> {
+    let reply: Reply<T> =
+        serde_json::from_slice(bytes).map_err(|_| Failure::new("transport_unavailable", true))?;
+    match reply.result {
+        ResultBody::Success(value) => Ok(value),
+        ResultBody::Refused { error } => Err(Failure::new(&error.code, error.class == "transient")),
+    }
+}
+
+#[derive(Default)]
+struct Backoff(u32);
+
+impl Backoff {
+    fn delay(&mut self) -> Duration {
+        let seconds = 1u64 << self.0.min(6);
+        self.0 = self.0.saturating_add(1);
+        Duration::from_secs(seconds)
+    }
+}
+
+async fn report(session: &ManagementSession, report: &Report) -> Result<(), Failure> {
+    let mut backoff = Backoff::default();
+    loop {
+        {
+            let mut health = HEALTH
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            health.last_report = Some(report.clone());
+            health.last_report_outcome = Some("sending");
+        }
+        let result = match session
+            .request(serde_json::to_vec(&wire::report_request(report)).expect("report JSON"))
+            .await
+        {
+            Ok(bytes) => decode::<Recorded>(&bytes).and_then(|recorded| {
+                if recorded.status == "recorded" && recorded.version == report.version {
+                    Ok(())
+                } else {
+                    Err(Failure::new("transport_unavailable", true))
+                }
+            }),
+            Err(error) => Err(Failure::transport(error)),
+        };
+        {
+            let mut health = HEALTH
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            health.last_report_outcome = Some(match result {
+                Ok(()) => "recorded",
+                Err(failure)
+                    if failure.code == "home_unavailable"
+                        || failure.code == "transport_unavailable" =>
+                {
+                    "unknown"
+                }
+                Err(_) => "refused",
+            });
+        }
+        match result {
+            Ok(()) => return Ok(()),
+            Err(failure) => {
+                failure.record();
+                if failure.stop() {
+                    return Err(failure);
+                }
+                if !failure.transient {
+                    return Ok(());
+                }
+                // Reports are idempotent. Keep the exact tuple after an unknown
+                // outcome; do not replace it with a newer activation's report.
+                tokio::time::sleep(backoff.delay()).await;
+                if failure.code == "transport_unavailable" {
+                    return Err(failure);
+                }
+            }
+        }
+    }
+}
+
+async fn latest(session: &ManagementSession) -> Result<Latest, Failure> {
+    let bytes = session
+        .request(serde_json::to_vec(&wire::latest_request()).expect("latest JSON"))
+        .await
+        .map_err(Failure::transport)?;
+    let latest: Latest = decode(&bytes)?;
+    if latest.version == 0 {
+        return Err(Failure::new("transport_unavailable", true));
+    }
+    let mut health = HEALTH
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    health.observe_version(Some(latest.version));
+    Ok(latest)
+}
+
+async fn refresh(
+    session: &ManagementSession,
+    paths: &StatePaths,
+    cursor: &mut Cursor,
+    notice: Option<&Notice>,
+) -> Result<Option<Report>, Failure> {
+    let mut fetched = latest(session).await?;
+    let disagrees = |fetched: &Latest| {
+        notice.is_some_and(|notice| {
+            notice.version == Some(fetched.version)
+                && notice.manifest_sha256.as_deref()
+                    != Some(digest(&fetched.envelope.manifest_bytes).as_str())
+        })
+    };
+    if disagrees(&fetched) {
+        fetched = latest(session).await?;
+        if disagrees(&fetched) {
+            cursor.read_version = Some(fetched.version);
+            cursor.read_sha256 = Some(digest(&fetched.envelope.manifest_bytes));
+            return Ok(Some(candidate_report(
+                &fetched,
+                "digest differs from the vault's notice",
+            )));
+        }
+    }
+    cursor.read_version = Some(fetched.version);
+    cursor.read_sha256 = Some(digest(&fetched.envelope.manifest_bytes));
+    Ok(activate(paths, &fetched, unix_seconds()))
+}
+
+async fn run(connection_file: PathBuf, paths: StatePaths) {
+    run_with(paths, || ManagementSession::connect(&connection_file)).await;
+}
+
+async fn run_with<F, Fut>(paths: StatePaths, mut connect: F)
+where
+    F: FnMut() -> Fut,
+    Fut: std::future::Future<Output = Result<ManagementSession, ()>>,
+{
+    let mut backoff = Backoff::default();
+    let mut pending_report = None;
+    loop {
+        let session = match tokio::time::timeout(Duration::from_secs(15), connect()).await {
+            Ok(Ok(session)) => session,
+            _ => {
+                Failure::new("transport_unavailable", true).record();
+                tokio::time::sleep(backoff.delay()).await;
+                continue;
+            }
+        };
+        let mut cursor = Cursor::default();
+        let result: Result<(), Failure> = async {
+            if let Some(pending) = pending_report.as_ref() {
+                report(&session, pending).await?;
+                pending_report = None;
+            }
+            let first = refresh(&session, &paths, &mut cursor, None).await;
+            if let Err(failure) = first {
+                if failure.stop() {
+                    if let Some(current) = local_report(&paths, unix_seconds()) {
+                        let _ = report(&session, &current).await;
+                    }
+                }
+                return Err(failure);
+            }
+            pending_report = first?;
+            if let Some(pending) = pending_report.as_ref() {
+                report(&session, pending).await?;
+                pending_report = None;
+            }
+            let mut subscription = session
+                .watch(serde_json::to_vec(&wire::watch_request()).expect("watch JSON"))
+                .await
+                .map_err(Failure::transport)?;
+            loop {
+                let Some(bytes) = subscription.events().recv().await else {
+                    // The SDK closes this receiver after a normal STREAM_END
+                    // frame or a lost watch. Reconnect always reads latest anew.
+                    return match subscription.closed().await {
+                        Ok(_) => Err(Failure::new("transport_unavailable", true)),
+                        Err(error) => Err(Failure::transport(error)),
+                    };
+                };
+                if let Ok(reply) = serde_json::from_slice::<Reply<Value>>(&bytes) {
+                    if let ResultBody::Refused { error } = reply.result {
+                        return Err(Failure::new(&error.code, error.class == "transient"));
+                    }
+                }
+                let notice: Notice = serde_json::from_slice(&bytes)
+                    .map_err(|_| Failure::new("transport_unavailable", true))?;
+                if notice.kind != "changed"
+                    || notice.seq == 0
+                    || notice.version.is_some() != notice.manifest_sha256.is_some()
+                {
+                    return Err(Failure::new("transport_unavailable", true));
+                }
+                HEALTH
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .observe_version(notice.version);
+                backoff = Backoff::default();
+                let hash_differs = notice.version == cursor.read_version
+                    && notice.manifest_sha256 != cursor.read_sha256;
+                if cursor.observe(&notice) || hash_differs {
+                    pending_report = refresh(&session, &paths, &mut cursor, Some(&notice)).await?;
+                    if let Some(pending) = pending_report.as_ref() {
+                        report(&session, pending).await?;
+                        pending_report = None;
+                    }
+                }
+            }
+        }
+        .await;
+        session.close().await;
+        if let Err(failure) = result {
+            failure.record();
+            if failure.stop() {
+                log::info!("manifest sync stopped: {}", failure.code);
+                return;
+            }
+        }
+        tokio::time::sleep(backoff.delay()).await;
+    }
+}
+
+/// Keeps delivery alive for exactly one attached module session.
+pub(crate) struct Worker {
+    _stop: tokio::sync::oneshot::Sender<()>,
+}
+
+/// Called only by subc startup after registration, never by a standalone shim.
+pub(crate) fn start(connection_file: PathBuf) -> Option<Worker> {
+    crate::launch_nonce::consumer_identity().filter(|identity| identity.module_id == "aft")?;
+    let (stop, stopped) = tokio::sync::oneshot::channel();
+    std::thread::spawn(move || {
+        if gh_shim_enabled_from_config_doc(&read_user_config_doc().unwrap_or_default())
+            == Some(false)
+        {
+            return;
+        }
+        if let Ok(runtime) = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+        {
+            let paths = StatePaths::from_process();
+            let _ = local_report(&paths, unix_seconds());
+            runtime.block_on(async {
+                tokio::select! {
+                    _ = stopped => {},
+                    _ = run(connection_file, paths) => {},
+                }
+            });
+        }
+    });
+    Some(Worker { _stop: stop })
+}
+
+#[cfg(test)]
+#[path = "manifest_sync_tests.rs"]
+mod tests;
diff --git a/crates/aft/src/gh_shim/manifest_sync_tests.rs b/crates/aft/src/gh_shim/manifest_sync_tests.rs
new file mode 100644
index 0000000000..30514749b6
--- /dev/null
+++ b/crates/aft/src/gh_shim/manifest_sync_tests.rs
@@ -0,0 +1,153 @@
+use super::super::manifest_wire::Envelope;
+use super::*;
+
+fn paths(directory: &tempfile::TempDir) -> StatePaths {
+    StatePaths::from_root(directory.path().join("gh-shim"))
+}
+
+fn candidate(version: u64, now: u64) -> Latest {
+    let mut manifest = super::super::tests::fixture_manifest();
+    manifest.manifest_version = version;
+    let signed = super::super::tests::signed(&manifest, now);
+    Latest {
+        version,
+        envelope: Envelope {
+            key_id: signed.key_id,
+            manifest_bytes: signed.manifest_bytes,
+            signature: signed.signature,
+        },
+    }
+}
+
+#[test]
+fn manifest_sync_newer_valid_is_accepted_by_shim_equal_and_older_never_write() {
+    let directory = tempfile::tempdir().unwrap();
+    let paths = paths(&directory);
+    let now = unix_seconds();
+    let latest = candidate(29, now);
+    let report = activate(&paths, &latest, now).unwrap();
+    assert_eq!(report.verdict, "valid");
+    assert_eq!(report.version, 29);
+    assert_eq!(
+        report.payload_sha256,
+        digest(&latest.envelope.manifest_bytes)
+    );
+    assert_eq!(version_high_water(&paths), 29);
+    assert_eq!(cached_manifest_report_at(&paths, now).state, Some("valid"));
+    let original = fs::read(&paths.manifest).unwrap();
+    let mut equal = latest.clone();
+    equal.envelope.signature = "not a signature".into();
+    assert_eq!(activate(&paths, &equal, now + 1).unwrap().verdict, "valid");
+    activate(&paths, &candidate(28, now), now + 2);
+    assert_eq!(fs::read(&paths.manifest).unwrap(), original);
+    fs::remove_file(&paths.manifest).unwrap();
+    assert!(activate(&paths, &latest, now).is_none());
+    assert!(
+        !paths.manifest.exists(),
+        "no hash is persisted, so equal-version restore is forbidden"
+    );
+}
+
+#[test]
+fn manifest_sync_bad_signature_wrong_key_and_version_mismatch_preserve_previous_file() {
+    let directory = tempfile::tempdir().unwrap();
+    let paths = paths(&directory);
+    let now = unix_seconds();
+    activate(&paths, &candidate(28, now), now).unwrap();
+    let original = fs::read(&paths.manifest).unwrap();
+    let good = candidate(29, now);
+    let mut bad_signature = good.clone();
+    bad_signature.envelope.signature = base64::engine::general_purpose::STANDARD.encode([0; 64]);
+    let mut wrong_key = good.clone();
+    wrong_key.envelope.key_id = "0000000000000000".into();
+    let mut wrong_version = good;
+    wrong_version.version = 30;
+    for bad in [bad_signature, wrong_key, wrong_version] {
+        let report = activate(&paths, &bad, now).unwrap();
+        assert_eq!(report.verdict, "invalid");
+        assert!(report.reason.unwrap().len() <= 512);
+        assert_eq!(fs::read(&paths.manifest).unwrap(), original);
+        assert_eq!(version_high_water(&paths), 28);
+    }
+}
+
+#[test]
+fn manifest_sync_crash_before_atomic_rename_keeps_old_manifest_valid() {
+    let directory = tempfile::tempdir().unwrap();
+    let paths = paths(&directory);
+    let now = unix_seconds();
+    activate(&paths, &candidate(28, now), now).unwrap();
+    let original = fs::read(&paths.manifest).unwrap();
+    let next = candidate(29, now);
+    let envelope = SignedManifest {
+        artifact_id: MANIFEST_ARTIFACT_ID.into(),
+        envelope_version: ENVELOPE_VERSION,
+        fetched_at_unix_secs: now,
+        key_id: next.envelope.key_id,
+        signature: next.envelope.signature,
+        manifest_bytes: next.envelope.manifest_bytes,
+    };
+    assert!(write_candidate(&paths, &envelope, || Err(io::Error::other(
+        "crash before rename"
+    )))
+    .is_err());
+    assert_eq!(fs::read(&paths.manifest).unwrap(), original);
+    assert_eq!(cached_manifest_report_at(&paths, now).state, Some("valid"));
+    assert_eq!(version_high_water(&paths), 28);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        for entry in fs::read_dir(&paths.root).unwrap().flatten() {
+            if entry
+                .file_name()
+                .to_string_lossy()
+                .starts_with("manifest-sync-")
+            {
+                assert_eq!(
+                    entry.metadata().unwrap().permissions().mode() & 0o777,
+                    0o600
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn manifest_sync_cursor_detects_version_seq_gap_and_epoch_change() {
+    let mut cursor = Cursor {
+        read_version: Some(29),
+        ..Cursor::default()
+    };
+    let mut notice: Notice = serde_json::from_value(samples()["watch.stored"].clone()).unwrap();
+    assert!(!cursor.observe(&notice));
+    notice.seq = 3;
+    assert!(cursor.observe(&notice));
+    notice.seq = 4;
+    notice.epoch = "ffeeddccbbaa99887766554433221100".into();
+    assert!(cursor.observe(&notice));
+    notice.seq = 5;
+    notice.version = Some(30);
+    assert!(cursor.observe(&notice));
+}
+
+fn samples() -> Value {
+    serde_json::from_slice::<Value>(include_bytes!(
+        "../../../../test-vectors/manifest-binding-v1.json"
+    ))
+    .unwrap()["samples"]
+        .clone()
+}
+
+#[test]
+fn manifest_sync_health_remembers_newest_notice_even_when_latest_is_older() {
+    let mut health = Health::default();
+    health.observe_version(Some(29));
+    health.observe_version(Some(30));
+    health.observe_version(Some(29));
+    health.observe_version(None);
+    assert_eq!(health.newest_version_seen, Some(30));
+}
+
+#[cfg(unix)]
+#[path = "manifest_sync_vault_fake.rs"]
+mod vault;
diff --git a/crates/aft/src/gh_shim/manifest_sync_vault_fake.rs b/crates/aft/src/gh_shim/manifest_sync_vault_fake.rs
new file mode 100644
index 0000000000..6b40b7b4f5
--- /dev/null
+++ b/crates/aft/src/gh_shim/manifest_sync_vault_fake.rs
@@ -0,0 +1,352 @@
+//! Only the three AFT operations, using the pinned vault response shapes.
+
+use super::*;
+use serde_json::json;
+use std::sync::Arc;
+use subc_protocol::{Flags, Frame, FrameType, Priority};
+use subc_transport::connection_file::{self, ConnectionInfo, Endpoint, SCHEMA_VERSION};
+
+#[derive(Default)]
+struct State {
+    methods: Vec<String>,
+    reports: Vec<Value>,
+    watch_rounds: usize,
+    unknown_method: bool,
+    report_unknown_once: bool,
+    digest_mismatch: bool,
+}
+
+struct Vault {
+    _directory: tempfile::TempDir,
+    path: PathBuf,
+    state: Arc<Mutex<State>>,
+    stop: Option<tokio::sync::oneshot::Sender<()>>,
+    thread: Option<std::thread::JoinHandle<()>>,
+}
+
+impl Vault {
+    fn start(state: State) -> Self {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("connection.json");
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let key = vec![0x42; subc_transport::KEY_LEN];
+        let daemon_id = [0x24; subc_transport::DAEMON_ID_LEN];
+        connection_file::write_atomic(
+            &path,
+            &ConnectionInfo {
+                schema: SCHEMA_VERSION,
+                wire_version: Some(subc_protocol::PROTOCOL_VERSION),
+                endpoints: vec![Endpoint {
+                    host: "127.0.0.1".into(),
+                    port: listener.local_addr().unwrap().port(),
+                }],
+                key: key.clone(),
+                daemon_id,
+                pid: std::process::id(),
+                daemon_ver: "0.39.0".into(),
+            },
+        )
+        .unwrap();
+        let state = Arc::new(Mutex::new(state));
+        let served = Arc::clone(&state);
+        let (stop, stopped) = tokio::sync::oneshot::channel();
+        let thread = std::thread::spawn(move || {
+            tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async move {
+                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
+                let mut tasks = tokio::task::JoinSet::new();
+                tokio::pin!(stopped);
+                loop {
+                    tokio::select! {
+                        _ = &mut stopped => break,
+                        Some(result) = tasks.join_next(), if !tasks.is_empty() => result.unwrap(),
+                        accepted = listener.accept() => {
+                            let (stream, _) = accepted.unwrap();
+                            tasks.spawn(serve(stream, key.clone(), daemon_id, Arc::clone(&served)));
+                        }
+                    }
+                }
+                tasks.abort_all();
+            });
+        });
+        Self {
+            _directory: directory,
+            path,
+            state,
+            stop: Some(stop),
+            thread: Some(thread),
+        }
+    }
+}
+
+impl Drop for Vault {
+    fn drop(&mut self) {
+        if let Some(stop) = self.stop.take() {
+            let _ = stop.send(());
+        }
+        if let Some(thread) = self.thread.take() {
+            thread.join().unwrap();
+        }
+    }
+}
+
+async fn serve(
+    mut stream: tokio::net::TcpStream,
+    key: Vec<u8>,
+    daemon_id: [u8; subc_transport::DAEMON_ID_LEN],
+    state: Arc<Mutex<State>>,
+) {
+    if subc_transport::authenticate_server(
+        &mut stream,
+        &key,
+        &daemon_id,
+        "0.39.0",
+        Duration::from_secs(2),
+    )
+    .await
+    .is_err()
+    {
+        return;
+    }
+    let samples = samples();
+    while let Ok(Some(request)) = subc_transport::read_frame(&mut stream).await {
+        if request.header.ty == FrameType::Ping {
+            let pong = Frame::build(
+                FrameType::Pong,
+                Flags::new(false, Priority::Interactive, false),
+                0,
+                0,
+                request.header.corr,
+                Vec::new(),
+            )
+            .unwrap();
+            if subc_transport::write_frame(&mut stream, &pong)
+                .await
+                .is_err()
+            {
+                break;
+            }
+            continue;
+        }
+        if request.header.ty != FrameType::Request {
+            continue;
+        }
+        let value: Value = serde_json::from_slice(&request.body).unwrap();
+        let response = |ty, body: Value| {
+            Frame::build(
+                ty,
+                request.header.flags,
+                request.header.channel,
+                request.header.epoch,
+                request.header.corr,
+                serde_json::to_vec(&body).unwrap(),
+            )
+            .unwrap()
+        };
+        let replies = {
+            let mut state = state.lock().unwrap();
+            if value["op"] == "route.open" {
+                assert_eq!(
+                    value["target"],
+                    json!({"kind":"management_surface","module_id":"claustrum"})
+                );
+                assert_eq!(value["consumer_identity"]["module_id"], "aft");
+                assert_eq!(
+                    value["consumer_identity"]["launch_nonce"],
+                    "manifest-sync-test-nonce"
+                );
+                assert!(value.get("scope").is_none_or(Value::is_null));
+                vec![response(
+                    FrameType::Response,
+                    json!({"op":"route.open","route_channel":7,"route_epoch":1}),
+                )]
+            } else if value["op"] == "route.close" {
+                vec![response(FrameType::Response, json!({"op":"route.close"}))]
+            } else {
+                let method = value["method"].as_str().unwrap();
+                state.methods.push(method.into());
+                if state.unknown_method {
+                    vec![response(
+                        FrameType::Error,
+                        json!({"code":"unknown_method","message":"unknown method"}),
+                    )]
+                } else {
+                    match method {
+                        "manifest.latest" => {
+                            assert_eq!(value["params"], json!({}));
+                            vec![response(
+                                FrameType::Response,
+                                samples["latest.reply"].clone(),
+                            )]
+                        }
+                        "manifest.report_active" => {
+                            let report: Report =
+                                serde_json::from_value(value["params"].clone()).unwrap();
+                            assert_eq!(report.version, 29);
+                            assert_eq!(report.payload_sha256.len(), 64);
+                            assert!(report
+                                .reason
+                                .as_ref()
+                                .is_none_or(|reason| reason.chars().count() <= 512));
+                            state.reports.push(value["params"].clone());
+                            let reply = if state.report_unknown_once && state.reports.len() == 1 {
+                                samples["refusal.home_unavailable"].clone()
+                            } else {
+                                samples["report.reply"].clone()
+                            };
+                            vec![response(FrameType::Response, reply)]
+                        }
+                        "manifest.watch" => {
+                            assert_eq!(value["params"], json!({}));
+                            state.watch_rounds += 1;
+                            let mut notice = samples["watch.stored"].clone();
+                            if state.digest_mismatch {
+                                notice["manifest_sha256"] = json!("0".repeat(64));
+                            }
+                            let mut replies = vec![response(FrameType::StreamData, notice.clone())];
+                            if state.watch_rounds == 1 && !state.digest_mismatch {
+                                notice["seq"] = json!(3);
+                                replies.push(response(FrameType::StreamData, notice.clone()));
+                                notice["seq"] = json!(4);
+                                notice["epoch"] = json!("ffeeddccbbaa99887766554433221100");
+                                replies.push(response(FrameType::StreamData, notice));
+                                replies.push(
+                                    Frame::build(
+                                        FrameType::StreamEnd,
+                                        request.header.flags,
+                                        request.header.channel,
+                                        request.header.epoch,
+                                        request.header.corr,
+                                        vec![],
+                                    )
+                                    .unwrap(),
+                                );
+                            }
+                            replies
+                        }
+                        _ => panic!("fake received operation AFT is not admitted to call"),
+                    }
+                }
+            }
+        };
+        for reply in replies {
+            if subc_transport::write_frame(&mut stream, &reply)
+                .await
+                .is_err()
+            {
+                return;
+            }
+        }
+    }
+}
+
+async fn until(state: &Mutex<State>, predicate: impl Fn(&State) -> bool) {
+    tokio::time::timeout(Duration::from_secs(6), async {
+        loop {
+            if predicate(&state.lock().unwrap()) {
+                return;
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("sync did not reach expected state");
+}
+
+#[tokio::test]
+async fn manifest_sync_watch_seq_gap_epoch_change_and_stream_end_read_latest_again() {
+    let vault = Vault::start(State::default());
+    let directory = tempfile::tempdir().unwrap();
+    let paths = paths(&directory);
+    tokio::select! {
+        _ = run_with(paths, || ManagementSession::for_test(&vault.path)) => panic!("sync stopped"),
+        _ = until(&vault.state, |state| state.watch_rounds == 2) => {}
+    }
+    let state = vault.state.lock().unwrap();
+    assert_eq!(
+        state
+            .methods
+            .iter()
+            .filter(|method| *method == "manifest.latest")
+            .count(),
+        4
+    );
+    assert_eq!(state.watch_rounds, 2);
+    assert!(!state.reports.is_empty());
+}
+
+#[tokio::test]
+async fn manifest_sync_unknown_method_stops_once_without_watch_or_retry_loop() {
+    let vault = Vault::start(State {
+        unknown_method: true,
+        ..State::default()
+    });
+    let directory = tempfile::tempdir().unwrap();
+    tokio::time::timeout(
+        Duration::from_secs(3),
+        run_with(paths(&directory), || {
+            ManagementSession::for_test(&vault.path)
+        }),
+    )
+    .await
+    .expect("unknown method must stop the worker");
+    assert_eq!(vault.state.lock().unwrap().methods, ["manifest.latest"]);
+}
+
+#[tokio::test]
+async fn manifest_sync_report_unknown_outcome_retries_the_same_tuple() {
+    let vault = Vault::start(State {
+        report_unknown_once: true,
+        ..State::default()
+    });
+    let directory = tempfile::tempdir().unwrap();
+    tokio::select! {
+        _ = run_with(paths(&directory), || ManagementSession::for_test(&vault.path)) => panic!("sync stopped"),
+        _ = until(&vault.state, |state| state.watch_rounds >= 1) => {}
+    }
+    let state = vault.state.lock().unwrap();
+    assert!(state.reports.len() >= 2);
+    assert_eq!(state.reports[0], state.reports[1]);
+}
+
+#[tokio::test]
+async fn manifest_sync_notice_digest_disagreement_rereads_once_then_reports_invalid() {
+    let vault = Vault::start(State {
+        digest_mismatch: true,
+        ..State::default()
+    });
+    let directory = tempfile::tempdir().unwrap();
+    let local = paths(&directory);
+    let manifest_path = local.manifest.clone();
+    tokio::select! {
+        _ = run_with(local, || ManagementSession::for_test(&vault.path)) => panic!("sync stopped"),
+        _ = until(&vault.state, |state| state.reports.iter().any(|report| report["reason"] == "digest differs from the vault's notice")) => {}
+    }
+    let state = vault.state.lock().unwrap();
+    assert_eq!(
+        state
+            .methods
+            .iter()
+            .filter(|method| *method == "manifest.latest")
+            .count(),
+        3
+    );
+    assert!(!manifest_path.exists());
+}
+
+#[tokio::test]
+async fn manifest_sync_newer_activation_reports_the_shims_valid_verdict() {
+    let vault = Vault::start(State::default());
+    let directory = tempfile::tempdir().unwrap();
+    let paths = paths(&directory);
+    let now = unix_seconds();
+    let activated = activate(&paths, &candidate(29, now), now).unwrap();
+    let session = ManagementSession::for_test(&vault.path).await.unwrap();
+    report(&session, &activated).await.unwrap();
+    session.close().await;
+    let state = vault.state.lock().unwrap();
+    assert_eq!(state.reports.len(), 1);
+    assert_eq!(state.reports[0]["verdict"], "valid");
+    assert_eq!(state.reports[0]["reason"], Value::Null);
+    assert_eq!(cached_manifest_report_at(&paths, now).version, Some(29));
+}
diff --git a/crates/aft/src/gh_shim/manifest_wire.rs b/crates/aft/src/gh_shim/manifest_wire.rs
new file mode 100644
index 0000000000..2f4a32008e
--- /dev/null
+++ b/crates/aft/src/gh_shim/manifest_wire.rs
@@ -0,0 +1,159 @@
+//! The three management-surface operations admitted to `reserved:aft`.
+
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Envelope {
+    pub key_id: String,
+    pub manifest_bytes: String,
+    pub signature: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Latest {
+    pub envelope: Envelope,
+    pub version: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Report {
+    pub payload_sha256: String,
+    pub reason: Option<String>,
+    pub verdict: String,
+    pub version: u64,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Recorded {
+    pub member_id: String,
+    pub status: String,
+    pub version: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Notice {
+    pub epoch: String,
+    pub kind: String,
+    pub manifest_sha256: Option<String>,
+    pub seq: u64,
+    pub version: Option<u64>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub(super) struct Refusal {
+    pub class: String,
+    pub code: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remedy_member: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+#[serde(untagged)]
+pub(super) enum ResultBody<T> {
+    Refused { error: Refusal },
+    Success(T),
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub(super) struct Reply<T> {
+    pub result: ResultBody<T>,
+}
+
+#[cfg(test)]
+#[derive(Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+struct ModuleError {
+    code: String,
+    message: String,
+}
+
+pub(super) fn latest_request() -> Value {
+    json!({"method": "manifest.latest", "params": {}})
+}
+
+pub(super) fn watch_request() -> Value {
+    json!({"method": "manifest.watch", "params": {}})
+}
+
+pub(super) fn report_request(report: &Report) -> Value {
+    json!({"method": "manifest.report_active", "params": report})
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sha2::{Digest, Sha256};
+
+    #[test]
+    fn manifest_sync_vectors_pin_requests_replies_refusals_and_notices() {
+        let bytes = include_bytes!("../../../../test-vectors/manifest-binding-v1.json");
+        assert_eq!(
+            format!("{:x}", Sha256::digest(bytes)),
+            "8c070db5272be78e6682714a53628453e5bf7fda5a43431d4e73b4d663218433"
+        );
+        let fixture: Value = serde_json::from_slice(bytes).unwrap();
+        let samples = fixture["samples"].as_object().unwrap();
+        assert_eq!(samples.len(), 45);
+        fn round_trip<T: serde::de::DeserializeOwned + Serialize>(value: &Value) {
+            let decoded: T = serde_json::from_value(value.clone()).unwrap();
+            assert_eq!(
+                serde_json::to_vec(&serde_json::to_value(decoded).unwrap()).unwrap(),
+                serde_json::to_vec(value).unwrap()
+            );
+        }
+        round_trip::<Reply<Latest>>(&samples["latest.reply"]);
+        let latest: Reply<Latest> =
+            serde_json::from_value(samples["latest.reply"].clone()).unwrap();
+        let ResultBody::Success(latest) = latest.result else {
+            panic!("latest refused")
+        };
+        assert_eq!(
+            format!(
+                "{:x}",
+                Sha256::digest(latest.envelope.manifest_bytes.as_bytes())
+            ),
+            samples["watch.stored"]["manifest_sha256"].as_str().unwrap()
+        );
+        round_trip::<Reply<Recorded>>(&samples["report.reply"]);
+        let report: Report =
+            serde_json::from_value(samples["report.request"]["params"].clone()).unwrap();
+        assert_eq!(
+            serde_json::to_vec(&report_request(&report)).unwrap(),
+            serde_json::to_vec(&samples["report.request"]).unwrap()
+        );
+        for name in ["watch.empty", "watch.stored"] {
+            round_trip::<Notice>(&samples[name]);
+        }
+        for name in [
+            "refusal.home_unavailable",
+            "refusal.not_found",
+            "refusal.remote_setup_incomplete",
+            "refusal.remote_setup_incomplete.forwarded",
+            "refusal.remote_setup_incomplete.forwarded_with_remedy",
+            "refusal.remote_setup_incomplete.with_remedy",
+            "refusal.secret_setup_incomplete",
+            "refusal.store_error",
+        ] {
+            round_trip::<Reply<Latest>>(&samples[name]);
+            round_trip::<Reply<Recorded>>(&samples[name]);
+            round_trip::<Reply<Value>>(&samples[name]);
+        }
+        round_trip::<ModuleError>(&samples["refusal.invalid_params"]);
+        assert_eq!(samples["refusal.invalid_params"]["code"], "invalid_params");
+        assert!(samples["refusal.invalid_params"].get("class").is_none());
+        assert_eq!(
+            serde_json::to_vec(&latest_request()).unwrap(),
+            br#"{"method":"manifest.latest","params":{}}"#
+        );
+        assert_eq!(
+            serde_json::to_vec(&watch_request()).unwrap(),
+            br#"{"method":"manifest.watch","params":{}}"#
+        );
+    }
+}
diff --git a/crates/aft/src/gh_shim/ticket_repository.rs b/crates/aft/src/gh_shim/ticket_repository.rs
new file mode 100644
index 0000000000..e4f4273219
--- /dev/null
+++ b/crates/aft/src/gh_shim/ticket_repository.rs
@@ -0,0 +1,274 @@
+//! Memoize ticket bindings only while Git's repository inputs are unchanged.
+
+use std::collections::VecDeque;
+use std::ffi::OsString;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+use std::sync::{Mutex, OnceLock};
+
+use super::canonical_repository_key;
+
+const MAX_ROOTS: usize = 256;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct FileStamp {
+    identity: crate::native_stat::FileIdentity,
+    size: u64,
+    modified_ns: i128,
+}
+
+fn stamp(path: &Path) -> Option<FileStamp> {
+    // Symlinks can change their targets without changing the link's metadata.
+    // Leave those uncommon layouts uncached rather than trust a partial stamp.
+    let metadata = fs::symlink_metadata(path).ok()?;
+    if !metadata.is_file() && !metadata.is_dir() {
+        return None;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::MetadataExt;
+        Some(FileStamp {
+            identity: crate::native_stat::FileIdentity::Unix {
+                dev: metadata.dev(),
+                ino: metadata.ino(),
+                birth: None,
+            },
+            size: metadata.len(),
+            modified_ns: i128::from(metadata.mtime()) * 1_000_000_000
+                + i128::from(metadata.mtime_nsec()),
+        })
+    }
+    #[cfg(not(unix))]
+    {
+        let stat = crate::native_stat::NativeStat::read(path).ok()?;
+        Some(FileStamp {
+            identity: stat.identity,
+            size: stat.size,
+            modified_ns: stat.modified_ns,
+        })
+    }
+}
+
+#[derive(Clone, PartialEq, Eq)]
+struct LookupEnv {
+    path: Option<OsString>,
+    // Relative PATH entries also depend on the process's working directory.
+    cwd: PathBuf,
+    #[cfg(windows)]
+    pathext: Option<OsString>,
+    #[cfg(windows)]
+    system_root: Option<OsString>,
+}
+
+impl LookupEnv {
+    fn read() -> Option<Self> {
+        Some(Self {
+            path: std::env::var_os("PATH"),
+            cwd: std::env::current_dir().ok()?,
+            #[cfg(windows)]
+            pathext: std::env::var_os("PATHEXT"),
+            #[cfg(windows)]
+            system_root: std::env::var_os("SystemRoot"),
+        })
+    }
+}
+
+struct Entry {
+    root: PathBuf,
+    dot_git: FileStamp,
+    inputs: Inputs,
+    env: LookupEnv,
+    value: Option<String>,
+}
+
+#[derive(Default)]
+struct Cache(VecDeque<Entry>);
+
+impl Cache {
+    fn get(&mut self, root: &Path, dot_git: &FileStamp, env: &LookupEnv) -> Option<Option<String>> {
+        let index = self.0.iter().position(|entry| entry.root == root)?;
+        let entry = self.0.remove(index)?;
+        if entry.dot_git != *dot_git || entry.env != *env || !entry.inputs.unchanged() {
+            return None;
+        }
+        let value = entry.value.clone();
+        self.0.push_back(entry);
+        Some(value)
+    }
+
+    fn insert(&mut self, entry: Entry) {
+        self.0.retain(|old| old.root != entry.root);
+        if self.0.len() >= MAX_ROOTS {
+            self.0.pop_front();
+        }
+        self.0.push_back(entry);
+    }
+}
+
+pub(super) fn snapshot(project_root: &Path) -> Option<String> {
+    static CACHE: OnceLock<Mutex<Cache>> = OnceLock::new();
+    snapshot_with_cache(project_root, CACHE.get_or_init(Mutex::default))
+}
+
+fn snapshot_with_cache(project_root: &Path, cache: &Mutex<Cache>) -> Option<String> {
+    if !project_root.is_dir() {
+        return None;
+    }
+    let env = LookupEnv::read()?;
+    let root = fs::canonicalize(project_root).ok();
+    let dot_git = stamp(&project_root.join(".git"));
+    if let (Some(root), Some(dot_git)) = (&root, &dot_git) {
+        if let Some(value) = cache
+            .lock()
+            .ok()
+            .and_then(|mut cache| cache.get(root, dot_git, &env))
+        {
+            return value;
+        }
+    }
+
+    // Do not hold the cache lock while resolving Git or waiting on children.
+    let mut inputs = None;
+    let value = uncached(project_root, &env, &mut inputs);
+    if let (Some(root), Some(dot_git), Some(inputs)) = (root, dot_git, inputs) {
+        // A concurrent rewrite must not attach an old answer to new metadata.
+        if stamp(&project_root.join(".git")).as_ref() == Some(&dot_git)
+            && inputs.unchanged()
+            && LookupEnv::read().as_ref() == Some(&env)
+        {
+            if let Ok(mut cache) = cache.lock() {
+                cache.insert(Entry {
+                    root,
+                    dot_git,
+                    inputs,
+                    env,
+                    value: value.clone(),
+                });
+            }
+        }
+    }
+    value
+}
+
+fn uncached(project_root: &Path, env: &LookupEnv, inputs: &mut Option<Inputs>) -> Option<String> {
+    let git = which::which_in("git", env.path.as_ref(), &env.cwd).ok()?;
+    let command = || {
+        let mut command = Command::new(&git);
+        command.env_clear().env("GIT_CONFIG_NOSYSTEM", "1");
+        #[cfg(windows)]
+        if let Some(root) = std::env::var_os("SystemRoot") {
+            command.env("SystemRoot", root);
+        }
+        command
+    };
+    let output = git_output(command().arg("-C").arg(project_root).args([
+        "rev-parse",
+        "--path-format=absolute",
+        "--git-common-dir",
+    ]))
+    .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let common = PathBuf::from(std::str::from_utf8(&output.stdout).ok()?.trim());
+    if !common.is_absolute() {
+        return None;
+    }
+    // Read the primary repository's config, not a worktree-specific override.
+    // The daemon saves the name in its ticket registry before launching the shell.
+    let path = common.join("config");
+    *inputs = Inputs::read(project_root, &common);
+    let output = git_output(
+        command()
+            .args(["config", "--no-includes", "--file"])
+            .arg(path)
+            .args(["--get", "remote.origin.url"]),
+    )
+    .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    canonical_repository_key(std::str::from_utf8(&output.stdout).ok()?.trim())
+}
+
+struct Inputs {
+    config: PathBuf,
+    config_stamp: FileStamp,
+    git_dir: PathBuf,
+    git_dir_stamp: FileStamp,
+    common_dir_pointer: PathBuf,
+    common_dir_pointer_stamp: Option<FileStamp>,
+}
+
+fn optional_stamp(path: &Path) -> std::io::Result<Option<FileStamp>> {
+    match fs::symlink_metadata(path) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(error) => Err(error),
+        Ok(_) => stamp(path)
+            .map(Some)
+            .ok_or_else(|| std::io::Error::other("unavailable file identity")),
+    }
+}
+
+impl Inputs {
+    fn read(root: &Path, common: &Path) -> Option<Self> {
+        let dot_git = root.join(".git");
+        let metadata = fs::symlink_metadata(&dot_git).ok()?;
+        let git_dir = if metadata.is_dir() {
+            dot_git
+        } else if metadata.is_file() {
+            let pointer = fs::read_to_string(&dot_git).ok()?;
+            let path = PathBuf::from(pointer.strip_prefix("gitdir:")?.trim());
+            root.join(path)
+        } else {
+            return None;
+        };
+        let git_dir_stamp = stamp(&git_dir)?;
+        // A linked worktree's gitdir and commondir can be repaired independently
+        // of its .git file. Watch both before trusting the old config path.
+        let common_dir_pointer = git_dir.join("commondir");
+        let common_dir_pointer_stamp = optional_stamp(&common_dir_pointer).ok()?;
+        let resolved_common = if common_dir_pointer_stamp.is_some() {
+            let pointer = fs::read_to_string(&common_dir_pointer).ok()?;
+            git_dir.join(pointer.trim())
+        } else {
+            git_dir.clone()
+        };
+        // Parsing is only a cache-admission check: Git remains the authority.
+        if fs::canonicalize(resolved_common).ok()? != fs::canonicalize(common).ok()? {
+            return None;
+        }
+        let config = common.join("config");
+        Some(Self {
+            config_stamp: stamp(&config)?,
+            config,
+            git_dir,
+            git_dir_stamp,
+            common_dir_pointer,
+            common_dir_pointer_stamp,
+        })
+    }
+
+    fn unchanged(&self) -> bool {
+        stamp(&self.config).as_ref() == Some(&self.config_stamp)
+            && stamp(&self.git_dir).as_ref() == Some(&self.git_dir_stamp)
+            && optional_stamp(&self.common_dir_pointer)
+                .is_ok_and(|stamp| stamp == self.common_dir_pointer_stamp)
+    }
+}
+
+fn git_output(command: &mut Command) -> std::io::Result<Output> {
+    #[cfg(test)]
+    SPAWNS.with(|count| count.set(count.get() + 1));
+    command.output()
+}
+
+#[cfg(test)]
+thread_local! {
+    static SPAWNS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+}
+
+#[cfg(test)]
+#[path = "ticket_repository_tests.rs"]
+mod tests;
diff --git a/crates/aft/src/gh_shim/ticket_repository_tests.rs b/crates/aft/src/gh_shim/ticket_repository_tests.rs
new file mode 100644
index 0000000000..68cb80612a
--- /dev/null
+++ b/crates/aft/src/gh_shim/ticket_repository_tests.rs
@@ -0,0 +1,391 @@
+use super::*;
+#[cfg(unix)]
+use crate::gh_shim::ticket_repository_snapshot;
+
+fn git(root: &Path, args: &[&str]) {
+    let mut command = Command::new("git");
+    crate::test_env::apply_hermetic_git_env(&mut command);
+    let output = command
+        .arg("-C")
+        .arg(root)
+        .args(args)
+        .output()
+        .expect("run fixture git");
+    assert!(
+        output.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+}
+
+fn repository(root: &Path) {
+    fs::create_dir_all(root).unwrap();
+    git(root, &["init", "-q"]);
+    git(
+        root,
+        &[
+            "remote",
+            "add",
+            "origin",
+            "https://github.com/owner/repo.git",
+        ],
+    );
+    git(
+        root,
+        &[
+            "-c",
+            "user.name=Snapshot Test",
+            "-c",
+            "user.email=snapshot@example.com",
+            "-c",
+            "commit.gpgsign=false",
+            "commit",
+            "--allow-empty",
+            "-qm",
+            "fixture",
+        ],
+    );
+}
+
+#[cfg(unix)]
+fn thread_cpu() -> std::time::Duration {
+    let mut time = libc::timespec {
+        tv_sec: 0,
+        tv_nsec: 0,
+    };
+    // The thread clock excludes the CPU used by git children and other threads.
+    assert_eq!(
+        unsafe { libc::clock_gettime(libc::CLOCK_THREAD_CPUTIME_ID, &mut time) },
+        0
+    );
+    std::time::Duration::new(time.tv_sec as u64, time.tv_nsec as u32)
+}
+
+#[cfg(unix)]
+#[test]
+#[ignore = "explicit wall-time and calling-thread CPU measurement"]
+fn ticket_repository_snapshot_cost() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let repo = temp.path().join("repo");
+    let worktree = temp.path().join("linked");
+    repository(&repo);
+    git(
+        &repo,
+        &[
+            "worktree",
+            "add",
+            "-qb",
+            "linked",
+            worktree.to_str().unwrap(),
+        ],
+    );
+    for (label, root) in [("checkout", &repo), ("linked_worktree", &worktree)] {
+        assert_eq!(
+            ticket_repository_snapshot(root).as_deref(),
+            Some("owner/repo")
+        );
+        let count = 100;
+        let cpu = thread_cpu();
+        let wall = std::time::Instant::now();
+        for _ in 0..count {
+            assert_eq!(
+                ticket_repository_snapshot(root).as_deref(),
+                Some("owner/repo")
+            );
+        }
+        let elapsed = wall.elapsed();
+        let cpu = thread_cpu() - cpu;
+        println!(
+            "snapshot_cost os={} kind={label} calls={count} wall_us_per_call={:.3} thread_cpu_us_per_call={:.3}",
+            std::env::consts::OS,
+            elapsed.as_secs_f64() * 1e6 / f64::from(count),
+            cpu.as_secs_f64() * 1e6 / f64::from(count),
+        );
+    }
+}
+
+fn assert_snapshot(cache: &Mutex<Cache>, root: &Path, expected: Option<&str>, spawns: usize) {
+    SPAWNS.with(|count| count.set(0));
+    let actual = snapshot_with_cache(root, cache);
+    assert_eq!(actual.as_deref(), expected);
+    assert_eq!(SPAWNS.with(std::cell::Cell::get), spawns, "git spawn count");
+    let fresh = uncached(root, &LookupEnv::read().unwrap(), &mut None);
+    assert_eq!(actual, fresh, "cached and uncached bindings differ");
+}
+
+#[test]
+fn ticket_repository_snapshot_reuses_first_answer_and_canonical_root_without_spawning() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    repository(temp.path());
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 0);
+    assert_snapshot(&cache, &temp.path().join("."), Some("owner/repo"), 0);
+}
+
+#[test]
+fn ticket_repository_snapshot_invalidates_origin_rewrite_and_caches_no_origin() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    repository(temp.path());
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+    git(
+        temp.path(),
+        &[
+            "remote",
+            "set-url",
+            "origin",
+            "git@github.com:new-owner/new-repo.git",
+        ],
+    );
+    assert_snapshot(&cache, temp.path(), Some("new-owner/new-repo"), 2);
+    assert_snapshot(&cache, temp.path(), Some("new-owner/new-repo"), 0);
+    git(temp.path(), &["remote", "remove", "origin"]);
+    assert_snapshot(&cache, temp.path(), None, 2);
+    assert_snapshot(&cache, temp.path(), None, 0);
+    git(
+        temp.path(),
+        &[
+            "remote",
+            "add",
+            "origin",
+            "https://github.com/restored/repo.git",
+        ],
+    );
+    assert_snapshot(&cache, temp.path(), Some("restored/repo"), 2);
+}
+
+#[test]
+fn ticket_repository_snapshot_invalidates_replaced_dot_git_directory() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let repo = temp.path().join("repo");
+    let other = temp.path().join("other");
+    repository(&repo);
+    repository(&other);
+    git(
+        &other,
+        &[
+            "remote",
+            "set-url",
+            "origin",
+            "https://github.com/other/repo.git",
+        ],
+    );
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, &repo, Some("owner/repo"), 2);
+    fs::rename(repo.join(".git"), temp.path().join("saved-git")).unwrap();
+    fs::rename(other.join(".git"), repo.join(".git")).unwrap();
+    assert_snapshot(&cache, &repo, Some("other/repo"), 2);
+    assert_snapshot(&cache, &repo, Some("other/repo"), 0);
+}
+
+#[test]
+fn ticket_repository_snapshot_worktree_uses_common_config_and_rechecks_git_file() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let repo = temp.path().join("repo");
+    let linked = temp.path().join("linked");
+    let other = temp.path().join("other");
+    repository(&repo);
+    repository(&other);
+    git(
+        &repo,
+        &["worktree", "add", "-qb", "linked", linked.to_str().unwrap()],
+    );
+    git(&repo, &["config", "extensions.worktreeConfig", "true"]);
+    git(
+        &linked,
+        &[
+            "config",
+            "--worktree",
+            "remote.origin.url",
+            "https://github.com/override/repo.git",
+        ],
+    );
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 2);
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 0);
+    git(
+        &repo,
+        &[
+            "remote",
+            "set-url",
+            "origin",
+            "https://github.com/common/changed.git",
+        ],
+    );
+    assert_snapshot(&cache, &linked, Some("common/changed"), 2);
+    assert_snapshot(&cache, &linked, Some("common/changed"), 0);
+
+    let replacement = temp.path().join("replacement-git-file");
+    fs::write(
+        &replacement,
+        format!("gitdir: {}\n", other.join(".git").display()),
+    )
+    .unwrap();
+    fs::remove_file(linked.join(".git")).unwrap();
+    fs::rename(replacement, linked.join(".git")).unwrap();
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 2);
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 0);
+}
+
+#[test]
+fn ticket_repository_snapshot_rechecks_worktree_commondir_and_gitdir() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let repo = temp.path().join("repo");
+    let linked = temp.path().join("linked");
+    let other = temp.path().join("other");
+    repository(&repo);
+    repository(&other);
+    git(
+        &other,
+        &[
+            "remote",
+            "set-url",
+            "origin",
+            "https://github.com/other/repo.git",
+        ],
+    );
+    git(
+        &repo,
+        &["worktree", "add", "-qb", "linked", linked.to_str().unwrap()],
+    );
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 2);
+    let inputs = Inputs::read(&linked, &repo.join(".git")).unwrap();
+    let dot_git_before = stamp(&linked.join(".git"));
+
+    // Preserve the commondir file itself while replacing its parent directory.
+    let saved = inputs.git_dir.with_file_name("saved-gitdir");
+    fs::rename(&inputs.git_dir, &saved).unwrap();
+    fs::create_dir(&inputs.git_dir).unwrap();
+    for entry in fs::read_dir(&saved).unwrap() {
+        let entry = entry.unwrap();
+        fs::rename(entry.path(), inputs.git_dir.join(entry.file_name())).unwrap();
+    }
+    assert_eq!(
+        optional_stamp(&inputs.common_dir_pointer).unwrap(),
+        inputs.common_dir_pointer_stamp
+    );
+    assert_ne!(stamp(&inputs.git_dir).as_ref(), Some(&inputs.git_dir_stamp));
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 2);
+    assert_snapshot(&cache, &linked, Some("owner/repo"), 0);
+
+    fs::write(
+        &inputs.common_dir_pointer,
+        format!("{}\n", other.join(".git").display()),
+    )
+    .unwrap();
+    assert_eq!(stamp(&linked.join(".git")), dot_git_before);
+    assert_snapshot(&cache, &linked, Some("other/repo"), 2);
+    assert_snapshot(&cache, &linked, Some("other/repo"), 0);
+}
+
+#[test]
+fn ticket_repository_snapshot_without_dot_git_never_caches_parent_discovery() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    let repo = temp.path().join("repo");
+    repository(&repo);
+    let child = repo.join("child");
+    fs::create_dir(&child).unwrap();
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, &child, Some("owner/repo"), 2);
+    assert_snapshot(&cache, &child, Some("owner/repo"), 2);
+    git(
+        &repo,
+        &[
+            "remote",
+            "set-url",
+            "origin",
+            "https://github.com/parent/changed.git",
+        ],
+    );
+    assert_snapshot(&cache, &child, Some("parent/changed"), 2);
+    assert_snapshot(&cache, temp.path(), None, 1);
+    assert_snapshot(&cache, temp.path(), None, 1);
+    assert!(cache.lock().unwrap().0.is_empty());
+}
+
+#[test]
+fn ticket_repository_snapshot_rechecks_after_config_stat_error() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    repository(temp.path());
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+    fs::remove_file(temp.path().join(".git/config")).unwrap();
+    assert_snapshot(&cache, temp.path(), None, 2);
+    assert_snapshot(&cache, temp.path(), None, 2);
+    git(
+        temp.path(),
+        &[
+            "config",
+            "remote.origin.url",
+            "https://github.com/restored/repo.git",
+        ],
+    );
+    assert_snapshot(&cache, temp.path(), Some("restored/repo"), 2);
+    assert_snapshot(&cache, temp.path(), Some("restored/repo"), 0);
+}
+
+#[test]
+fn ticket_repository_snapshot_rechecks_exact_path_changes() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    repository(temp.path());
+    let cache = Mutex::new(Cache::default());
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 0);
+    let path = std::env::var_os("PATH").unwrap();
+    let paths =
+        std::iter::once(temp.path().join("no-git-here")).chain(std::env::split_paths(&path));
+    let path = std::env::join_paths(paths).unwrap();
+    {
+        let _path =
+            crate::gh_shim::tests::ScopedTestEnvVar::set("PATH", Some(path.to_str().unwrap()));
+        assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+        assert_snapshot(&cache, temp.path(), Some("owner/repo"), 0);
+    }
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+    {
+        let _path = crate::gh_shim::tests::ScopedTestEnvVar::set("PATH", Some(""));
+        assert_snapshot(&cache, temp.path(), None, 0);
+    }
+    assert_snapshot(&cache, temp.path(), Some("owner/repo"), 2);
+}
+
+#[test]
+fn ticket_repository_snapshot_cache_evicts_least_recently_used_root_at_256() {
+    let _lock = crate::test_env::process_env_lock();
+    let temp = tempfile::tempdir().unwrap();
+    repository(temp.path());
+    let dot_git = stamp(&temp.path().join(".git")).unwrap();
+    let env = LookupEnv::read().unwrap();
+    let entry = |n| Entry {
+        root: PathBuf::from(format!("root-{n}")),
+        dot_git: dot_git.clone(),
+        inputs: Inputs::read(temp.path(), &temp.path().join(".git")).unwrap(),
+        env: env.clone(),
+        value: Some("owner/repo".into()),
+    };
+    let mut cache = Cache::default();
+    for n in 0..256 {
+        cache.insert(entry(n));
+    }
+    assert_eq!(cache.0.len(), 256);
+    assert_eq!(
+        cache.get(Path::new("root-0"), &dot_git, &env),
+        Some(Some("owner/repo".into()))
+    );
+    cache.insert(entry(256));
+    assert_eq!(cache.0.len(), 256);
+    assert!(cache.get(Path::new("root-1"), &dot_git, &env).is_none());
+    assert!(cache.get(Path::new("root-0"), &dot_git, &env).is_some());
+    assert!(cache.get(Path::new("root-256"), &dot_git, &env).is_some());
+}
diff --git a/crates/aft/src/gh_shim_relay/mod.rs b/crates/aft/src/gh_shim_relay/mod.rs
index 008919f996..30c2fd60af 100644
--- a/crates/aft/src/gh_shim_relay/mod.rs
+++ b/crates/aft/src/gh_shim_relay/mod.rs
@@ -1213,6 +1213,7 @@ async fn post_captured_inner(
         &desired,
         &facade_reply(&reply),
         launch.agent()?,
+        &redeemed.session_id,
     )?;
     let expect = current_bindings.get(&repo).ok_or_else(|| {
         crate::gh_shim_speech::service::binding_refusal(
diff --git a/crates/aft/src/gh_shim_speech/service.rs b/crates/aft/src/gh_shim_speech/service.rs
index ef9219ca87..04b7c11d33 100644
--- a/crates/aft/src/gh_shim_speech/service.rs
+++ b/crates/aft/src/gh_shim_speech/service.rs
@@ -30,7 +30,7 @@ type EndNotice = Arc<dyn Fn(ScopeStamp) + Send + Sync>;
 
 pub(crate) fn binding_refusal(code: Code, reason: &str, detail: impl Into<String>) -> Refusal {
     let detail = detail.into();
-    log::warn!(
+    crate::slog_warn!(
         "gh speech binding verification refused: {}",
         serde_json::json!({"reason": reason, "detail": detail})
     );
@@ -43,6 +43,59 @@ fn binding_unverifiable(detail: impl Into<String>) -> Refusal {
     binding_refusal(Code::AuthorityUnavailable, "binding_unverifiable", detail)
 }
 
+static UNCONFIGURED_BINDING_REFUSALS: std::sync::atomic::AtomicU64 =
+    std::sync::atomic::AtomicU64::new(0);
+
+pub(crate) fn unconfigured_binding_refusals_total() -> u64 {
+    UNCONFIGURED_BINDING_REFUSALS.load(std::sync::atomic::Ordering::Relaxed)
+}
+
+const UNCONFIGURED_BINDING_LOG_CAP: usize = 4_096;
+
+fn unconfigured_binding_refusal(session: &str, agent: &str, detail: String) -> Refusal {
+    static LOGGED: std::sync::OnceLock<Mutex<HashSet<(String, String)>>> =
+        std::sync::OnceLock::new();
+    UNCONFIGURED_BINDING_REFUSALS.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    // Ordinary sessions need not bind any repository to the launching agent.
+    // Keep the refusal intact and suppress repeats while the log key is retained.
+    log_unconfigured_binding_refusal(
+        &mut LOGGED
+            .get_or_init(Mutex::default)
+            .lock()
+            .unwrap_or_else(|error| error.into_inner()),
+        session,
+        agent,
+        &detail,
+        UNCONFIGURED_BINDING_LOG_CAP,
+    );
+    let mut refusal = Refusal::new(Code::AuthorityUnavailable, "binding_unverifiable");
+    refusal.detail = Some(detail);
+    refusal
+}
+
+fn log_unconfigured_binding_refusal(
+    logged: &mut HashSet<(String, String)>,
+    session: &str,
+    agent: &str,
+    detail: &str,
+    cap: usize,
+) {
+    let key = (session.to_owned(), agent.to_owned());
+    if logged.contains(&key) {
+        return;
+    }
+    // Bound history to 4,096 session/agent keys in the long-lived daemon.
+    // A new key clears a full set; an older session may log once more after that.
+    if logged.len() >= cap {
+        logged.clear();
+    }
+    logged.insert(key);
+    crate::slog_info!(
+        "gh speech binding verification refused: {}",
+        serde_json::json!({"reason": "binding_unverifiable", "detail": detail, "session": session, "agent": agent})
+    );
+}
+
 #[cfg(test)]
 #[derive(Clone)]
 pub(crate) struct TestPartners {
@@ -600,7 +653,7 @@ impl LaunchContext {
                             )
                         })
                         .await?;
-                    parse_bindings(&desired, &facade_reply(&reply), agent)
+                    parse_bindings(&desired, &facade_reply(&reply), agent, &self.seed.session)
                 },
             )
             .await
@@ -637,6 +690,7 @@ pub(crate) fn parse_bindings(
     desired: &BTreeMap<String, String>,
     reply: &Value,
     agent: &str,
+    session: &str,
 ) -> Result<BTreeMap<String, Binding>, Refusal> {
     let invalid = || binding_unverifiable("invalid_binding");
     let reply = reply
@@ -693,9 +747,12 @@ pub(crate) fn parse_bindings(
             .filter(|(_, owner)| owner.as_str() == agent)
             .map(|(repo, _)| repo.as_str())
             .collect();
-        return Err(binding_unverifiable(format!(
-            "no_binding_row: launch_agent={agent:?} repositories={expected:?}"
-        )));
+        let detail = format!("no_binding_row: launch_agent={agent:?} repositories={expected:?}");
+        return Err(if expected.is_empty() {
+            unconfigured_binding_refusal(session, agent, detail)
+        } else {
+            binding_unverifiable(detail)
+        });
     }
     Ok(found)
 }
diff --git a/crates/aft/src/gh_shim_speech/service/tests.rs b/crates/aft/src/gh_shim_speech/service/tests.rs
index 201a8400e9..be2925e9ed 100644
--- a/crates/aft/src/gh_shim_speech/service/tests.rs
+++ b/crates/aft/src/gh_shim_speech/service/tests.rs
@@ -65,7 +65,7 @@ fn binding_reply_diagnostics_distinguish_missing_generation_missing_rows_and_inv
             "invalid_binding",
         ),
     ] {
-        let refusal = parse_bindings(&desired, &reply, "agent-subc").unwrap_err();
+        let refusal = parse_bindings(&desired, &reply, "agent-subc", "session").unwrap_err();
         assert_eq!(refusal.code, Code::AuthorityUnavailable);
         assert_eq!(refusal.reason, "binding_unverifiable");
         assert!(
@@ -83,6 +83,7 @@ fn no_binding_row_preserves_main_refusal_wording_and_structured_detail() {
         &desired,
         &serde_json::json!({"repo_binding_generation":36,"bindings":[]}),
         "agent-subc",
+        "session",
     )
     .unwrap_err();
     assert_eq!(
@@ -97,6 +98,80 @@ fn no_binding_row_preserves_main_refusal_wording_and_structured_detail() {
         .starts_with("no_binding_row:"));
 }
 
+#[test]
+fn unconfigured_binding_refusal_is_info_once_per_session_and_agent() {
+    let desired = BTreeMap::from([("org/other".into(), "other-agent".into())]);
+    let reply = serde_json::json!({"repo_binding_generation":36,"bindings":[]});
+    let before = unconfigured_binding_refusals_total();
+    let (_, lines) = crate::logging::capture_log_lines(|| {
+        for (session, agent) in [
+            ("unconfigured-session-a", "agent-a"),
+            ("unconfigured-session-a", "agent-a"),
+            ("unconfigured-session-b", "agent-a"),
+            ("unconfigured-session-a", "agent-b"),
+        ] {
+            let refusal = parse_bindings(&desired, &reply, agent, session).unwrap_err();
+            assert_eq!(refusal.code, Code::AuthorityUnavailable);
+            assert_eq!(refusal.reason, "binding_unverifiable");
+            assert_eq!(
+                refusal.detail.unwrap(),
+                format!("no_binding_row: launch_agent={agent:?} repositories=[]")
+            );
+        }
+    });
+    assert_eq!(lines.len(), 3, "{lines:?}");
+    assert!(
+        lines.iter().all(|line| line.starts_with("INFO ")),
+        "{lines:?}"
+    );
+    assert!(
+        unconfigured_binding_refusals_total() >= before + 4,
+        "count suppressed attempts too"
+    );
+
+    let mut logged = HashSet::new();
+    let (_, lines) = crate::logging::capture_log_lines(|| {
+        for (session, expected_keys) in [
+            ("session-a", 1),
+            ("session-a", 1),
+            ("session-b", 2),
+            ("session-b", 2),
+            ("session-c", 1),
+            ("session-a", 2),
+        ] {
+            log_unconfigured_binding_refusal(&mut logged, session, "agent", "no_binding_row", 2);
+            assert_eq!(logged.len(), expected_keys);
+        }
+    });
+    assert_eq!(lines.len(), 4, "a cleared session may log again: {lines:?}");
+    assert!(
+        lines.iter().all(|line| line.starts_with("INFO ")),
+        "{lines:?}"
+    );
+    assert!(lines[0].contains("session-a"), "{lines:?}");
+    assert!(lines[2].contains("session-c"), "{lines:?}");
+    assert!(lines[3].contains("session-a"), "{lines:?}");
+}
+
+#[test]
+fn configured_binding_absence_and_other_refusals_still_warn_each_time() {
+    let desired = BTreeMap::from([("org/repo".into(), "agent".into())]);
+    let reply = serde_json::json!({"repo_binding_generation":36,"bindings":[]});
+    let (_, lines) = crate::logging::capture_log_lines(|| {
+        for _ in 0..2 {
+            parse_bindings(&desired, &reply, "agent", "configured-session").unwrap_err();
+        }
+        binding_unverifiable("binding_read_timeout");
+    });
+    assert_eq!(lines.len(), 3, "{lines:?}");
+    assert!(
+        lines.iter().all(|line| line.starts_with("WARN ")),
+        "{lines:?}"
+    );
+    assert!(lines[0].contains("org/repo"), "{lines:?}");
+    assert!(lines[2].contains("binding_read_timeout"), "{lines:?}");
+}
+
 #[test]
 fn real_plexus_binding_replies_preserve_authority_and_refuse_missing_or_wrong_agents() {
     use crate::gh_shim_relay::bindings_contract::{vector, CASES};
@@ -107,7 +182,7 @@ fn real_plexus_binding_replies_preserve_authority_and_refuse_missing_or_wrong_ag
     ]);
     for name in CASES {
         let (_, reply) = vector(name);
-        let parsed = parse_bindings(&desired, &reply, "agent-x");
+        let parsed = parse_bindings(&desired, &reply, "agent-x", "session");
         match name {
             "agent" | "connection" => {
                 let bindings = parsed.unwrap();
@@ -141,7 +216,8 @@ fn real_plexus_binding_replies_preserve_authority_and_refuse_missing_or_wrong_ag
             }
         }
     }
-    let bindings = parse_bindings(&desired, &vector("other-agent").1, "agent-y").unwrap();
+    let bindings =
+        parse_bindings(&desired, &vector("other-agent").1, "agent-y", "session").unwrap();
     assert_eq!(
         bindings.keys().map(String::as_str).collect::<Vec<_>>(),
         ["o/a", "o/z"]
@@ -158,7 +234,7 @@ fn binding_reply_diagnostics_name_both_agents_without_accepting_mismatches() {
     let reply = json!({"repo_binding_generation":36,"bindings":[{
         "repository":"cortexkit/subconscious","agent_id":"agent-aft","app_handle_id":"aft-alfonso"
     }]});
-    let refusal = parse_bindings(&desired, &reply, "agent-subc").unwrap_err();
+    let refusal = parse_bindings(&desired, &reply, "agent-subc", "session").unwrap_err();
     assert_eq!(refusal.code, Code::IdentityConflict);
     assert_eq!(refusal.reason, "binding_changed");
     let detail = refusal.detail.unwrap();
diff --git a/crates/aft/src/gh_shim_speech/start_view_tests.rs b/crates/aft/src/gh_shim_speech/start_view_tests.rs
index 16638f10c7..55802273a8 100644
--- a/crates/aft/src/gh_shim_speech/start_view_tests.rs
+++ b/crates/aft/src/gh_shim_speech/start_view_tests.rs
@@ -69,11 +69,17 @@ async fn launch(fixture: &Fixture, background: bool, refuse: bool) -> crate::pro
                     crate::bash_background::spawn(
                         "start-view-launch",
                         &session,
-                        "printf '%s' \"$AFT_GH_SPEECH_START_VIEW\" > seen-view; while [ ! -e release-view ]; do sleep 0.02; done",
+                        &format!(
+                            "printf '%s' \"$AFT_GH_SPEECH_START_VIEW\" > seen-view; {}",
+                            crate::test_gate::gate_exists("release-view", "sleep 0.02")
+                        ),
                         crate::bash_background::BashShell::Bash,
                         crate::bash_background::registry::resolve_posix_shell(),
                         Some(project),
-                        Some(HashMap::from([("AFT_GH_SHIM_STATE_DIR".into(), state.display().to_string())])),
+                        Some(HashMap::from([(
+                            "AFT_GH_SHIM_STATE_DIR".into(),
+                            state.display().to_string(),
+                        )])),
                         crate::bash_background::HardKill::After(Duration::from_secs(30)),
                         &ctx,
                         background,
@@ -90,7 +96,9 @@ async fn launch(fixture: &Fixture, background: bool, refuse: bool) -> crate::pro
                 })
             })
         })
-    }).await.unwrap()
+    })
+    .await
+    .unwrap()
 }
 
 async fn view_seen(fixture: &Fixture) -> PathBuf {
diff --git a/crates/aft/src/git_probe.rs b/crates/aft/src/git_probe.rs
index c70c6ee2b0..e62c2cf82d 100644
--- a/crates/aft/src/git_probe.rs
+++ b/crates/aft/src/git_probe.rs
@@ -709,7 +709,10 @@ mod tests {
             let _token = crate::executor::install_job_cancellation(token);
             supervised_output(Command::new("sh").current_dir(root).args([
                 "-c",
-                "while [ ! -f release ]; do sleep 0.02; done; printf out; printf err >&2; exit 7",
+                &format!(
+                    "{}; printf out; printf err >&2; exit 7",
+                    crate::test_gate::gate("release", "sleep 0.02")
+                ),
             ]))
         });
         for at in [30_000, 60_000, 90_000, 120_000] {
diff --git a/crates/aft/src/github_read/cache.rs b/crates/aft/src/github_read/cache.rs
index 8f944265f6..7eb69977af 100644
--- a/crates/aft/src/github_read/cache.rs
+++ b/crates/aft/src/github_read/cache.rs
@@ -215,7 +215,7 @@ pub struct GithubReadDeferred {
 /// [`GithubReadError::Pending`] when there is none. The fetch itself keeps
 /// running and stores its result in the cache.
 pub struct GithubReadLateAnswer {
-    fallback: Option<(GithubReadCacheEntry, GithubReadSelector)>,
+    fallback: Option<(GithubReadCacheEntry, GithubReadSelector, GithubResourceKind)>,
 }
 
 impl GithubReadLateAnswer {
@@ -229,8 +229,8 @@ impl GithubReadLateAnswer {
             waited.as_secs_f64().ceil() as u64
         );
         match &self.fallback {
-            Some((entry, selector)) => Ok(complete(
-                cached_fallback_text(entry, &GithubReadError::FetchFailed(still_running)),
+            Some((entry, selector, kind)) => Ok(complete(
+                cached_fallback_text(entry, &GithubReadError::FetchFailed(still_running), *kind),
                 selector.clone(),
                 GithubReadFreshness::CachedFallback,
                 Vec::new(),
@@ -532,7 +532,9 @@ impl GithubReadEngine {
     ) -> GithubReadStart {
         let slot = self.flight_slot_for_request(&request);
         let fetch_request = request.clone();
-        let timeout_fallback = fallback.clone().map(|entry| (entry, selector.clone()));
+        let timeout_fallback = fallback
+            .clone()
+            .map(|entry| (entry, selector.clone(), request.resource.kind));
         // Every coalesced caller owns its own wake-bound sender. Capturing only
         // the leader's connection would leave followers waiting on idle routes.
         let (sender, receiver) = crate::response_finalize::pending_response_channel();
@@ -593,7 +595,7 @@ impl GithubReadEngine {
                             Some(entry) => complete_with_optional_attachments(
                                 &waiter.request,
                                 waiter.selector,
-                                cached_fallback_text(&entry, error),
+                                cached_fallback_text(&entry, error, waiter.request.resource.kind),
                                 GithubReadFreshness::CachedFallback,
                                 downloader.as_ref(),
                                 waiter.view,
@@ -797,9 +799,18 @@ fn cache_failure(error: String) -> GithubReadError {
     GithubReadError::FetchFailed(format!("GitHub read cache is unavailable: {error}"))
 }
 
-fn cached_fallback_text(entry: &GithubReadCacheEntry, error: &GithubReadError) -> String {
+fn cached_fallback_text(
+    entry: &GithubReadCacheEntry,
+    error: &GithubReadError,
+    kind: GithubResourceKind,
+) -> String {
+    let thread_warning = if kind == GithubResourceKind::PullRequest {
+        super::thread_text::STALE
+    } else {
+        ""
+    };
     format!(
-        "[cached copy from {}; live fetch failed: {}]\n{}",
+        "[cached copy from {}; live fetch failed: {}]\n{thread_warning}{}",
         iso8601_utc(entry.fetched_at_ms),
         short_failure_reason(error),
         entry.canonical_text
@@ -1256,6 +1267,47 @@ mod tests {
         assert!(completion.content.ends_with("# Cached issue\n"));
     }
 
+    #[test]
+    fn github_read_pr_fallback_discloses_stale_threads_without_changing_cache() {
+        let cached = "# Cached pull request\nReview threads: 0 open, 1 resolved\n";
+        let cache = Arc::new(MemoryCache::with_entry(cached, 1_234));
+        let engine = GithubReadEngine::new(
+            cache.clone(),
+            Arc::new(FailingFetcher),
+            Arc::new(CountingDownloader::default()),
+            Arc::new(FixtureClock::new(2_000)),
+        );
+        let deferred = match engine
+            .start(
+                &enabled_gh_read(),
+                GithubReadRequest::parse("pr://owner/repo/1", "/fixture", "identity", None)
+                    .unwrap(),
+                GithubReadSelector::default(),
+            )
+            .unwrap()
+        {
+            GithubReadStart::Deferred(deferred) => deferred,
+            GithubReadStart::Immediate(_) => panic!("fallback requires a live fetch attempt"),
+        };
+        let late = deferred
+            .late
+            .answer(std::time::Duration::from_secs(1))
+            .unwrap();
+        let completion = wait_for(deferred).unwrap();
+        for answer in [late, completion] {
+            assert_eq!(answer.freshness, GithubReadFreshness::CachedFallback);
+            assert_eq!(
+                answer
+                    .content
+                    .matches(super::super::thread_text::STALE)
+                    .count(),
+                1
+            );
+            assert!(answer.content.ends_with(cached));
+        }
+        assert_eq!(cache.0.lock().as_ref().unwrap().canonical_text, cached);
+    }
+
     #[test]
     fn failed_live_fetch_without_a_cached_copy_preserves_its_typed_error() {
         let engine = GithubReadEngine::new(
diff --git a/crates/aft/src/github_read/fetch.rs b/crates/aft/src/github_read/fetch.rs
index 5d9ab4a72a..d21ce5f579 100644
--- a/crates/aft/src/github_read/fetch.rs
+++ b/crates/aft/src/github_read/fetch.rs
@@ -12,7 +12,7 @@ use super::resource::{GithubResource, GithubResourceKind};
 
 const ISSUE_JSON_FIELDS: &str = "number,title,state,author,createdAt,updatedAt,labels,assignees,milestone,body,reactionGroups,comments,url";
 const PR_JSON_FIELDS: &str = "number,title,state,author,createdAt,updatedAt,labels,assignees,milestone,body,reactionGroups,comments,files,reviews,baseRefName,headRefName,reviewDecision,url";
-const PR_REVIEW_COMMENTS_QUERY: &str = "query AftReadPullRequestReviewComments($owner: String!, $name: String!, $number: Int!) { repository(owner: $owner, name: $name) { nameWithOwner pullRequest(number: $number) { number reviews(first: 100) { nodes { author { login } body state submittedAt comments(first: 100) { totalCount nodes { author { login } body createdAt updatedAt isMinimized path line originalLine } } } } } } }";
+const PR_REVIEW_COMMENTS_QUERY: &str = "query AftReadPullRequestReviewComments($owner: String!, $name: String!, $number: Int!) { repository(owner: $owner, name: $name) { nameWithOwner pullRequest(number: $number) { number reviews(first: 100) { nodes { author { login } body state submittedAt comments(first: 100) { totalCount nodes { id author { login } body createdAt updatedAt isMinimized path line originalLine } } } } } } }";
 
 /// Request context passed to a structured GitHub fetcher.
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -302,6 +302,10 @@ impl<R: GhCommandRunner> GithubFetcher for GhCliFetcher<R> {
             )?;
             let review_document = normalize_document(&request.resource, &review_json)?;
             document.review_comment_sections = review_document.review_comment_sections;
+            // Thread lookup is independent: a failed lookup must not hide comments.
+            document.review_threads = self
+                .fetch_review_threads(request, &document.repository)
+                .ok();
         }
         let timeline_json = self.structured_json(
             &request.working_directory,
@@ -320,7 +324,7 @@ impl<R: GhCommandRunner> GithubFetcher for GhCliFetcher<R> {
 }
 
 impl<R: GhCommandRunner> GhCliFetcher<R> {
-    fn structured_json(
+    pub(super) fn structured_json(
         &self,
         working_directory: &std::path::Path,
         args: &[String],
diff --git a/crates/aft/src/github_read/fixtures/pr-thread-state.json b/crates/aft/src/github_read/fixtures/pr-thread-state.json
new file mode 100644
index 0000000000..6259438f80
--- /dev/null
+++ b/crates/aft/src/github_read/fixtures/pr-thread-state.json
@@ -0,0 +1,17 @@
+{
+  "view": {"number":42,"url":"https://github.com/owner/repo/pull/42","title":"Thread fixture","state":"OPEN","body":"Fix review findings."},
+  "reviews": {"data":{"repository":{"nameWithOwner":"owner/repo","pullRequest":{"number":42,"reviews":{"nodes":[{"author":{"login":"reviewer"},"comments":{"totalCount":4,"nodes":[
+    {"id":"C1","author":{"login":"greptile[bot]"},"body":"Check the guard.\n\nHidden bot detail.","createdAt":"2026-01-01T00:00:00Z","path":"src/lib.rs","line":8},
+    {"id":"C2","author":{"login":"cubic[bot]"},"body":"Guard fixed.","createdAt":"2026-01-02T00:00:00Z","path":"src/lib.rs","line":8},
+    {"id":"C3","author":{"login":"reviewer"},"body":"Still open on the old diff.","createdAt":"2026-01-03T00:00:00Z","path":"src/lib.rs","line":8},
+    {"id":"C1_REPLY","author":{"login":"author"},"body":"Working on it.","createdAt":"2026-01-04T00:00:00Z","path":"src/lib.rs","line":8}
+  ]}}]}}}}},
+  "threadsPage1": {"data":{"repository":{"pullRequest":{"reviewThreads":{"totalCount":3,"pageInfo":{"hasNextPage":true,"endCursor":"threads-1"},"nodes":[
+    {"id":"PRRT_open","isResolved":false,"isOutdated":false,"path":"src/lib.rs","line":8,"comments":{"totalCount":2,"pageInfo":{"hasNextPage":true,"endCursor":"comments-1"},"nodes":[{"id":"C1"}]}},
+    {"id":"PRRT_resolved","isResolved":true,"isOutdated":true,"path":"src/lib.rs","line":null,"comments":{"totalCount":1,"pageInfo":{"hasNextPage":false,"endCursor":null},"nodes":[{"id":"C2"}]}}
+  ]}}}}},
+  "threadCommentsPage2": {"data":{"node":{"comments":{"totalCount":2,"pageInfo":{"hasNextPage":false,"endCursor":null},"nodes":[{"id":"C1_REPLY"}]}}}},
+  "threadsPage2": {"data":{"repository":{"pullRequest":{"reviewThreads":{"totalCount":3,"pageInfo":{"hasNextPage":false,"endCursor":null},"nodes":[
+    {"id":"PRRT_outdated_open","isResolved":false,"isOutdated":true,"path":"src/lib.rs","line":null,"comments":{"totalCount":1,"pageInfo":{"hasNextPage":false,"endCursor":null},"nodes":[{"id":"C3"}]}}
+  ]}}}}}
+}
diff --git a/crates/aft/src/github_read/mod.rs b/crates/aft/src/github_read/mod.rs
index 4271a6d55a..6c47af5a9d 100644
--- a/crates/aft/src/github_read/mod.rs
+++ b/crates/aft/src/github_read/mod.rs
@@ -14,6 +14,8 @@ mod model;
 mod normalize;
 mod render;
 mod resource;
+mod thread_text;
+mod threads;
 
 pub use attachments::{
     discover_github_image_urls, download_github_image_attachments, is_allowed_github_image_url,
@@ -35,7 +37,8 @@ pub use fetch::{
 };
 pub use model::{
     GithubComment, GithubDocument, GithubDocumentKind, GithubPullRequestFile, GithubReaction,
-    GithubReview, GithubReviewCommentSection, GithubTimelineEvent,
+    GithubReview, GithubReviewCommentSection, GithubReviewThread, GithubReviewThreads,
+    GithubTimelineEvent,
 };
 pub use normalize::{normalize_structured_document, normalize_timeline_events, NormalizeError};
 pub use render::{
diff --git a/crates/aft/src/github_read/model.rs b/crates/aft/src/github_read/model.rs
index 3ff27d0c00..66414390d0 100644
--- a/crates/aft/src/github_read/model.rs
+++ b/crates/aft/src/github_read/model.rs
@@ -32,6 +32,8 @@ pub struct GithubDocument {
     pub files: Vec<GithubPullRequestFile>,
     pub reviews: Vec<GithubReview>,
     pub review_comment_sections: Vec<GithubReviewCommentSection>,
+    /// None means thread state was unavailable, not that all threads resolved.
+    pub review_threads: Option<GithubReviewThreads>,
     pub base_ref_name: Option<String>,
     pub head_ref_name: Option<String>,
     pub review_decision: Option<String>,
@@ -67,6 +69,7 @@ pub struct GithubReaction {
 #[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct GithubComment {
+    pub id: Option<String>,
     pub author: Option<String>,
     pub body: String,
     /// Stable browser URL used to correlate a just-created comment with its read ordinal.
@@ -78,6 +81,25 @@ pub struct GithubComment {
     pub line: Option<u64>,
 }
 
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct GithubReviewThreads {
+    pub threads: Vec<GithubReviewThread>,
+    pub omitted_threads: usize,
+    pub omitted_comment_ids: usize,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct GithubReviewThread {
+    pub id: String,
+    pub is_resolved: bool,
+    pub is_outdated: bool,
+    pub path: String,
+    pub line: Option<u64>,
+    pub comment_ids: Vec<String>,
+}
+
 #[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct GithubPullRequestFile {
diff --git a/crates/aft/src/github_read/normalize.rs b/crates/aft/src/github_read/normalize.rs
index 6e78af5994..3f312e5958 100644
--- a/crates/aft/src/github_read/normalize.rs
+++ b/crates/aft/src/github_read/normalize.rs
@@ -80,6 +80,7 @@ pub fn normalize_structured_document(
         files: Vec::new(),
         reviews: Vec::new(),
         review_comment_sections: Vec::new(),
+        review_threads: None,
         base_ref_name: None,
         head_ref_name: None,
         review_decision: None,
@@ -219,6 +220,7 @@ fn comments_from(value: Option<&Value>) -> Vec<GithubComment> {
 
 fn comment_from(value: &Value) -> GithubComment {
     GithubComment {
+        id: value_string(value, "id"),
         author: actor_login(value.get("author")).or_else(|| value_string(value, "author")),
         body: value_string(value, "body").unwrap_or_default(),
         url: value_string(value, "url"),
diff --git a/crates/aft/src/github_read/render.rs b/crates/aft/src/github_read/render.rs
index 688c2d0991..c6211df41c 100644
--- a/crates/aft/src/github_read/render.rs
+++ b/crates/aft/src/github_read/render.rs
@@ -4,7 +4,7 @@ use super::bot_compress::{compress_discussion_body, compress_document_body, stru
 use super::fetch::GithubReadError;
 use super::model::{
     GithubComment, GithubDocument, GithubDocumentKind, GithubReaction, GithubReview,
-    GithubReviewCommentSection, GithubTimelineEvent,
+    GithubTimelineEvent,
 };
 use super::resource::{GithubCommentSelector, GithubResource};
 
@@ -49,6 +49,9 @@ pub(super) fn render_document_for_resource(
     ));
     output.push_str(&format!("Repository: {}\n", document.repository));
     output.push_str(&format!("State: {}\n", document.state));
+    if document.kind == GithubDocumentKind::PullRequest {
+        output.push_str(&super::thread_text::summary(document));
+    }
     if let Some(author) = nonempty(&document.author) {
         output.push_str(&format!("Author: {}\n", format_author(author)));
     }
@@ -96,12 +99,7 @@ pub(super) fn render_document_for_resource(
     if document.kind == GithubDocumentKind::PullRequest {
         render_files(&mut output, document);
         render_reviews(&mut output, document, &discussion, resource);
-        render_review_comment_sections(
-            &mut output,
-            &document.review_comment_sections,
-            &discussion,
-            resource,
-        );
+        render_review_comment_sections(&mut output, document, &discussion, resource);
     }
     render_timeline(&mut output, &discussion);
 
@@ -141,7 +139,7 @@ fn render_comments(
                 ordinal,
                 comment.author.as_deref(),
                 comment.created_at.as_deref(),
-                None,
+                "",
                 &comment.body,
                 resource,
             );
@@ -198,7 +196,12 @@ fn render_reviews(
             ordinal,
             review.author.as_deref(),
             review.submitted_at.as_deref(),
-            review.state.as_deref(),
+            &review
+                .state
+                .as_deref()
+                .filter(|state| !state.is_empty())
+                .map(|state| format!("State: {state}\n\n"))
+                .unwrap_or_default(),
             &review.body,
             resource,
         );
@@ -207,10 +210,11 @@ fn render_reviews(
 
 fn render_review_comment_sections(
     output: &mut String,
-    sections: &[GithubReviewCommentSection],
+    document: &GithubDocument,
     discussion: &[DiscussionItem<'_>],
     resource: &GithubResource,
 ) {
+    let sections = &document.review_comment_sections;
     if !sections.iter().any(|section| {
         section.comments.iter().any(comment_is_visible)
             || section.comments_total_count.unwrap_or(0) > section.comments.len()
@@ -243,7 +247,7 @@ fn render_review_comment_sections(
                     ordinal,
                     comment.author.as_deref(),
                     comment.created_at.as_deref(),
-                    None,
+                    &super::thread_text::comment(document, comment),
                     &comment.body,
                     resource,
                 );
@@ -290,7 +294,7 @@ fn render_default_discussion_item(
     ordinal: usize,
     author: Option<&str>,
     date: Option<&str>,
-    state: Option<&str>,
+    metadata: &str,
     body: &str,
     resource: &GithubResource,
 ) {
@@ -299,9 +303,7 @@ fn render_default_discussion_item(
         return;
     }
     render_item_heading(output, ordinal, author, date);
-    if let Some(state) = state.filter(|state| !state.is_empty()) {
-        output.push_str(&format!("State: {state}\n\n"));
-    }
+    output.push_str(metadata);
     append_body(output, &compressed.body);
     if compressed.compressed {
         output.push_str(&format!(
@@ -333,7 +335,12 @@ fn render_selected_discussion(
         if !resolved.contains(ordinal) {
             continue;
         }
+        let first_item = output.is_empty();
         render_item_heading(&mut output, ordinal, item.author(), item.date());
+        if first_item && document.kind == GithubDocumentKind::PullRequest {
+            output.push_str(&super::thread_text::summary(document));
+            output.push('\n');
+        }
         if let Some(event) = item.event() {
             render_timeline_event_body(&mut output, event);
             continue;
@@ -341,6 +348,9 @@ fn render_selected_discussion(
         if let Some(state) = item.state().filter(|state| !state.is_empty()) {
             output.push_str(&format!("State: {state}\n\n"));
         }
+        if let DiscussionItemKind::ReviewComment(comment) = item.kind {
+            output.push_str(&super::thread_text::comment(document, comment));
+        }
         append_body(
             &mut output,
             &structural_strip(item.body().unwrap_or_default()),
diff --git a/crates/aft/src/github_read/thread_text.rs b/crates/aft/src/github_read/thread_text.rs
new file mode 100644
index 0000000000..60a9681193
--- /dev/null
+++ b/crates/aft/src/github_read/thread_text.rs
@@ -0,0 +1,67 @@
+//! Agent-visible review-thread wording is centralized here for review.
+
+use super::model::{GithubComment, GithubDocument};
+
+pub(super) const UNAVAILABLE: &str =
+    "Review thread state couldn't be read; unresolved threads may still block the merge.\n";
+pub(super) const STALE: &str = "Review thread state may be stale in this cached copy.\n";
+
+pub(super) fn summary(document: &GithubDocument) -> String {
+    let Some(state) = &document.review_threads else {
+        return UNAVAILABLE.to_string();
+    };
+    let resolved = state
+        .threads
+        .iter()
+        .filter(|thread| thread.is_resolved)
+        .count();
+    let open = state.threads.len() - resolved;
+    let partial = if state.omitted_threads > 0 {
+        " (partial)"
+    } else {
+        ""
+    };
+    let mut text = format!("Review threads: {open} open, {resolved} resolved{partial}\n");
+    if state.omitted_threads > 0 {
+        text.push_str(&format!(
+            "{} review threads omitted; their state is unknown.\n",
+            state.omitted_threads
+        ));
+    }
+    if state.omitted_comment_ids > 0 {
+        text.push_str(&format!(
+            "{} review-thread comment IDs omitted; some comments' thread state is unknown.\n",
+            state.omitted_comment_ids
+        ));
+    }
+    text
+}
+
+pub(super) fn comment(document: &GithubDocument, comment: &GithubComment) -> String {
+    let thread = document.review_threads.as_ref().and_then(|state| {
+        let id = comment.id.as_ref()?;
+        state
+            .threads
+            .iter()
+            .find(|thread| thread.comment_ids.contains(id))
+    });
+    let Some(thread) = thread else {
+        // A failed lookup already has one document-level warning; retain old comment text.
+        return if document.review_threads.is_none() {
+            String::new()
+        } else {
+            "Review thread: unknown (state and ID unavailable)\n\n".to_string()
+        };
+    };
+    let state = if thread.is_resolved {
+        "resolved"
+    } else {
+        "open"
+    };
+    let outdated = if thread.is_outdated {
+        " (outdated)"
+    } else {
+        ""
+    };
+    format!("Review thread: {} — {state}{outdated}\n\n", thread.id)
+}
diff --git a/crates/aft/src/github_read/threads.rs b/crates/aft/src/github_read/threads.rs
new file mode 100644
index 0000000000..08e2333cdc
--- /dev/null
+++ b/crates/aft/src/github_read/threads.rs
@@ -0,0 +1,387 @@
+use serde_json::Value;
+
+use super::fetch::{
+    gh_pr_review_comments_args, GhCliFetcher, GhCommandRunner, GithubFetchRequest, GithubReadError,
+};
+use super::model::{GithubReviewThread, GithubReviewThreads};
+
+// Bound remote work independently of how many comments the renderer displays.
+const MAX_THREAD_PAGES: usize = 10;
+const MAX_EXTRA_COMMENT_PAGES: usize = 10;
+const THREAD_QUERY: &str = "query AftReadReviewThreads($owner: String!, $name: String!, $number: Int!, $cursor: String) { repository(owner: $owner, name: $name) { pullRequest(number: $number) { reviewThreads(first: 100, after: $cursor) { totalCount pageInfo { hasNextPage endCursor } nodes { id isResolved isOutdated path line comments(first: 100) { totalCount pageInfo { hasNextPage endCursor } nodes { id } } } } } } }";
+const COMMENT_QUERY: &str = "query AftReadThreadCommentIds($id: ID!, $cursor: String!) { node(id: $id) { ... on PullRequestReviewThread { comments(first: 100, after: $cursor) { totalCount pageInfo { hasNextPage endCursor } nodes { id } } } } }";
+
+impl<R: GhCommandRunner> GhCliFetcher<R> {
+    pub(super) fn fetch_review_threads(
+        &self,
+        request: &GithubFetchRequest,
+        repository: &str,
+    ) -> Result<GithubReviewThreads, GithubReadError> {
+        let mut result = GithubReviewThreads::default();
+        let mut cursor = None;
+        let mut extra_comment_pages = 0;
+        for page in 0..MAX_THREAD_PAGES {
+            let mut args = gh_pr_review_comments_args(&request.resource, repository)?;
+            args[3] = format!("query={THREAD_QUERY}");
+            if let Some(cursor) = &cursor {
+                args.extend(["-f".to_string(), format!("cursor={cursor}")]);
+            }
+            let json = self.structured_json(&request.working_directory, &args)?;
+            let connection = json
+                .pointer("/data/repository/pullRequest/reviewThreads")
+                .ok_or_else(invalid_threads)?;
+            let nodes = nodes(connection)?;
+            let next = next_cursor(connection, cursor.as_deref())?;
+            let total = total_count(connection)?;
+            for node in nodes {
+                let mut thread = GithubReviewThread {
+                    id: string(node, "id")?,
+                    is_resolved: node
+                        .get("isResolved")
+                        .and_then(Value::as_bool)
+                        .ok_or_else(invalid_threads)?,
+                    is_outdated: node
+                        .get("isOutdated")
+                        .and_then(Value::as_bool)
+                        .ok_or_else(invalid_threads)?,
+                    path: string(node, "path")?,
+                    line: match node.get("line") {
+                        Some(Value::Null) => None,
+                        Some(value) => Some(value.as_u64().ok_or_else(invalid_threads)?),
+                        None => return Err(invalid_threads()),
+                    },
+                    comment_ids: Vec::new(),
+                };
+                let comments = node.get("comments").ok_or_else(invalid_threads)?;
+                append_ids(&mut thread.comment_ids, comments)?;
+                let mut comment_total = total_count(comments)?;
+                let mut comment_cursor = next_cursor(comments, None)?;
+                while let Some(current) = comment_cursor.as_deref() {
+                    if extra_comment_pages == MAX_EXTRA_COMMENT_PAGES {
+                        break;
+                    }
+                    extra_comment_pages += 1;
+                    let args = vec![
+                        "api".to_string(),
+                        "graphql".to_string(),
+                        "-f".to_string(),
+                        format!("query={COMMENT_QUERY}"),
+                        "-f".to_string(),
+                        format!("id={}", thread.id),
+                        "-f".to_string(),
+                        format!("cursor={current}"),
+                    ];
+                    let json = self.structured_json(&request.working_directory, &args)?;
+                    let comments = json
+                        .pointer("/data/node/comments")
+                        .ok_or_else(invalid_threads)?;
+                    append_ids(&mut thread.comment_ids, comments)?;
+                    comment_total = total_count(comments)?;
+                    comment_cursor = next_cursor(comments, Some(current))?;
+                }
+                if comment_cursor.is_some() {
+                    result.omitted_comment_ids += comment_total
+                        .saturating_sub(thread.comment_ids.len())
+                        .max(1);
+                } else if comment_total != thread.comment_ids.len() {
+                    return Err(invalid_threads());
+                }
+                // Duplicate nodes must not inflate the number of threads collected.
+                if result
+                    .threads
+                    .iter()
+                    .any(|previous| previous.id == thread.id)
+                {
+                    return Err(invalid_threads());
+                }
+                result.threads.push(thread);
+            }
+            if next.is_none() {
+                if total != result.threads.len() {
+                    return Err(invalid_threads());
+                }
+                break;
+            }
+            if page + 1 == MAX_THREAD_PAGES {
+                result.omitted_threads = total.saturating_sub(result.threads.len()).max(1);
+            }
+            cursor = next;
+        }
+        Ok(result)
+    }
+}
+
+fn invalid_threads() -> GithubReadError {
+    GithubReadError::InvalidStructuredResponse(
+        "GitHub returned incomplete review thread state".to_string(),
+    )
+}
+
+fn string(value: &Value, key: &str) -> Result<String, GithubReadError> {
+    value
+        .get(key)
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+        .ok_or_else(invalid_threads)
+}
+
+fn nodes(connection: &Value) -> Result<&Vec<Value>, GithubReadError> {
+    connection
+        .get("nodes")
+        .and_then(Value::as_array)
+        .ok_or_else(invalid_threads)
+}
+
+fn total_count(connection: &Value) -> Result<usize, GithubReadError> {
+    connection
+        .get("totalCount")
+        .and_then(Value::as_u64)
+        .and_then(|count| usize::try_from(count).ok())
+        .ok_or_else(invalid_threads)
+}
+
+fn next_cursor(
+    connection: &Value,
+    current: Option<&str>,
+) -> Result<Option<String>, GithubReadError> {
+    let page = connection.get("pageInfo").ok_or_else(invalid_threads)?;
+    match page.get("hasNextPage").and_then(Value::as_bool) {
+        Some(false) => Ok(None),
+        Some(true) => {
+            let next = string(page, "endCursor")?;
+            if Some(next.as_str()) == current {
+                return Err(invalid_threads());
+            }
+            Ok(Some(next))
+        }
+        None => Err(invalid_threads()),
+    }
+}
+
+fn append_ids(ids: &mut Vec<String>, connection: &Value) -> Result<(), GithubReadError> {
+    for node in nodes(connection)? {
+        let id = string(node, "id")?;
+        if ids.contains(&id) {
+            return Err(invalid_threads());
+        }
+        ids.push(id);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::VecDeque;
+    use std::sync::{Arc, Mutex};
+
+    use serde_json::json;
+
+    use super::*;
+    use crate::github_read::{
+        parse_resource, render_document, GhCommandError, GhCommandOutput, GithubFetcher,
+    };
+
+    #[derive(Clone)]
+    struct FixtureRunner {
+        responses: Arc<Mutex<VecDeque<Value>>>,
+        calls: Arc<Mutex<Vec<Vec<String>>>>,
+    }
+
+    impl GhCommandRunner for FixtureRunner {
+        fn run_bounded(
+            &self,
+            _: &std::path::Path,
+            _: &[String],
+            _: usize,
+        ) -> Result<(GhCommandOutput, bool), GhCommandError> {
+            panic!("thread fixtures do not fetch diffs")
+        }
+
+        fn run(
+            &self,
+            _: &std::path::Path,
+            args: &[String],
+        ) -> Result<GhCommandOutput, GhCommandError> {
+            self.calls.lock().unwrap().push(args.to_vec());
+            let response = self
+                .responses
+                .lock()
+                .unwrap()
+                .pop_front()
+                .expect("unexpected GitHub call");
+            Ok(GhCommandOutput {
+                success: true,
+                stdout: serde_json::to_vec(&response).unwrap(),
+                stderr: Vec::new(),
+            })
+        }
+    }
+
+    fn fixture() -> Value {
+        serde_json::from_str(include_str!("fixtures/pr-thread-state.json")).unwrap()
+    }
+
+    fn request() -> GithubFetchRequest {
+        GithubFetchRequest {
+            resource: parse_resource("pr://owner/repo/42").unwrap(),
+            working_directory: std::path::PathBuf::from("."),
+        }
+    }
+
+    fn runner(responses: Vec<Value>) -> FixtureRunner {
+        FixtureRunner {
+            responses: Arc::new(Mutex::new(responses.into())),
+            calls: Arc::new(Mutex::new(Vec::new())),
+        }
+    }
+
+    #[test]
+    fn github_read_threads_paginate_and_join_open_resolved_outdated_comments_by_id() {
+        let f = fixture();
+        let runner = runner(vec![
+            f["view"].clone(),
+            f["reviews"].clone(),
+            f["threadsPage1"].clone(),
+            f["threadCommentsPage2"].clone(),
+            f["threadsPage2"].clone(),
+            json!([]),
+        ]);
+        let document = GhCliFetcher::new(runner.clone()).fetch(&request()).unwrap();
+        let state = document.review_threads.as_ref().unwrap();
+        assert_eq!(state.threads.len(), 3);
+        assert_eq!(state.threads[0].comment_ids, ["C1", "C1_REPLY"]);
+        assert_eq!(state.threads[1].path, "src/lib.rs");
+        assert_eq!(state.threads[1].line, None);
+        assert_eq!(state.omitted_threads, 0);
+        assert_eq!(state.omitted_comment_ids, 0);
+        let text = render_document(&document);
+        assert!(text.contains("State: OPEN\nReview threads: 2 open, 1 resolved\n"));
+        assert_eq!(text.matches("Review thread: PRRT_open — open\n").count(), 2);
+        assert!(text.contains("Review thread: PRRT_resolved — resolved (outdated)"));
+        assert!(text.contains("Review thread: PRRT_outdated_open — open (outdated)"));
+        assert!(text.contains("[bot comment, compressed]\nCheck the guard."));
+        assert!(!text.contains("Hidden bot detail."));
+        let calls = runner.calls.lock().unwrap();
+        assert!(calls[3].contains(&"id=PRRT_open".to_string()));
+        assert!(calls[3].contains(&"cursor=comments-1".to_string()));
+        assert!(calls[4].contains(&"cursor=threads-1".to_string()));
+        assert!(runner.responses.lock().unwrap().is_empty());
+
+        let mut selected = request().resource;
+        selected.comment_selector =
+            Some(crate::github_read::GithubCommentSelector::parse("2").unwrap());
+        let text =
+            super::super::render::render_document_for_resource(&document, &selected).unwrap();
+        assert!(text.contains("Review thread: PRRT_resolved — resolved (outdated)"));
+        assert!(text.contains("Guard fixed."));
+    }
+
+    #[test]
+    fn github_read_thread_query_failure_preserves_comments_and_warns_once() {
+        let f = fixture();
+        for failure in [
+            json!({"errors":[{"message":"fixture thread lookup denied"}]}),
+            json!({"data":{"repository":{"pullRequest":null}}}),
+        ] {
+            let runner = runner(vec![
+                f["view"].clone(),
+                f["reviews"].clone(),
+                failure,
+                json!([]),
+            ]);
+            let document = GhCliFetcher::new(runner).fetch(&request()).unwrap();
+            assert!(document.review_threads.is_none());
+            let text = render_document(&document);
+            assert_eq!(
+                text.matches("Review thread state couldn't be read;")
+                    .count(),
+                1
+            );
+            assert!(!text.contains("Review threads: 0 open"));
+            assert!(!text.contains("— resolved"));
+            assert!(text.contains("Guard fixed."));
+            assert!(text.contains("[bot comment, compressed]\nCheck the guard."));
+        }
+    }
+
+    #[test]
+    fn github_read_threads_missing_resolution_or_repeating_cursor_fail_closed() {
+        let f = fixture();
+        let mut page = f["threadsPage2"].clone();
+        page["data"]["repository"]["pullRequest"]["reviewThreads"]["nodes"][0]
+            .as_object_mut()
+            .unwrap()
+            .remove("isResolved");
+        let fetcher = GhCliFetcher::new(runner(vec![page]));
+        assert!(fetcher
+            .fetch_review_threads(&request(), "owner/repo")
+            .is_err());
+        let connection = json!({"pageInfo":{"hasNextPage":true,"endCursor":"same"}});
+        assert!(next_cursor(&connection, Some("same")).is_err());
+    }
+
+    #[test]
+    fn github_read_threads_bound_discloses_partial_counts_and_unmatched_comments() {
+        let mut responses = Vec::new();
+        for index in 0..MAX_THREAD_PAGES {
+            responses.push(json!({"data":{"repository":{"pullRequest":{"reviewThreads":{
+                "totalCount": MAX_THREAD_PAGES + 1,
+                "pageInfo":{"hasNextPage":true,"endCursor":format!("page-{index}")},
+                "nodes":[{"id":format!("T{index}"),"isResolved":true,"isOutdated":false,"path":"a.rs","line":1,
+                    "comments":{"totalCount":0,"pageInfo":{"hasNextPage":false},"nodes":[]}}]
+            }}}}}));
+        }
+        let runner = runner(responses);
+        let state = GhCliFetcher::new(runner.clone())
+            .fetch_review_threads(&request(), "owner/repo")
+            .unwrap();
+        assert_eq!(runner.calls.lock().unwrap().len(), MAX_THREAD_PAGES);
+        assert_eq!(state.omitted_threads, 1);
+        let mut document = super::super::normalize::normalize_structured_document(
+            &request().resource,
+            &fixture()["view"],
+        )
+        .unwrap();
+        let reviews = super::super::normalize::normalize_structured_document(
+            &request().resource,
+            &fixture()["reviews"],
+        )
+        .unwrap();
+        document.review_comment_sections = reviews.review_comment_sections;
+        document.review_threads = Some(state);
+        let text = render_document(&document);
+        assert!(text.contains("Review threads: 0 open, 10 resolved (partial)"));
+        assert!(text.contains("1 review threads omitted; their state is unknown."));
+        assert!(text.contains("Review thread: unknown (state and ID unavailable)"));
+    }
+
+    #[test]
+    fn github_read_thread_comment_id_budget_discloses_omissions() {
+        let mut first = fixture()["threadsPage2"].clone();
+        first["data"]["repository"]["pullRequest"]["reviewThreads"]["totalCount"] = json!(1);
+        let comments = &mut first["data"]["repository"]["pullRequest"]["reviewThreads"]["nodes"][0]
+            ["comments"];
+        *comments = json!({"totalCount":12,"pageInfo":{"hasNextPage":true,"endCursor":"c0"},"nodes":[{"id":"C0"}]});
+        let mut responses = vec![first];
+        for index in 1..=MAX_EXTRA_COMMENT_PAGES {
+            responses.push(json!({"data":{"node":{"comments":{"totalCount":12,"pageInfo":{"hasNextPage":true,"endCursor":format!("c{index}")},"nodes":[{"id":format!("C{index}")}]}}}}));
+        }
+        let runner = runner(responses);
+        let state = GhCliFetcher::new(runner.clone())
+            .fetch_review_threads(&request(), "owner/repo")
+            .unwrap();
+        assert_eq!(
+            runner.calls.lock().unwrap().len(),
+            1 + MAX_EXTRA_COMMENT_PAGES
+        );
+        assert_eq!(state.omitted_comment_ids, 1);
+        let document = crate::github_read::GithubDocument {
+            review_threads: Some(state),
+            ..Default::default()
+        };
+        assert!(super::super::thread_text::summary(&document).contains(
+            "1 review-thread comment IDs omitted; some comments' thread state is unknown."
+        ));
+    }
+}
diff --git a/crates/aft/src/inspect/manager.rs b/crates/aft/src/inspect/manager.rs
index 0172c7a73c..3846b71513 100644
--- a/crates/aft/src/inspect/manager.rs
+++ b/crates/aft/src/inspect/manager.rs
@@ -704,8 +704,11 @@ pub struct InspectManager {
     /// When an `aft_inspect` that read the dead-code graph last finished;
     /// `None` once the graph was released, or before any such request.
     last_dead_code_request: Mutex<Option<Instant>>,
-    /// Set while a thread is waiting to release the dead-code graph.
+    /// Set while a deadline or release-pool job is pending.
     dead_code_release_armed: AtomicBool,
+    dead_code_release_timer: Mutex<Option<crate::shared_timer::Timer>>,
+    dead_code_release_generation: AtomicU64,
+    dead_code_release_stopped: AtomicBool,
     /// How many dead-code passes are waiting for their call graph right now:
     /// for it to be published, or to catch up with recorded edits. A pass
     /// that is building but not waiting is working out dead code itself.
@@ -875,6 +878,9 @@ impl InspectManager {
             data_layer_dead_code: crate::data_layer::tools::inspect::DeadCodeSources::default(),
             last_dead_code_request: Mutex::new(None),
             dead_code_release_armed: AtomicBool::new(false),
+            dead_code_release_timer: Mutex::new(None),
+            dead_code_release_generation: AtomicU64::new(0),
+            dead_code_release_stopped: AtomicBool::new(false),
             dead_code_callgraph_waits: AtomicUsize::new(0),
             #[cfg(test)]
             interactive_tier2_acquisitions: AtomicU64::new(0),
@@ -923,6 +929,15 @@ impl InspectManager {
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner)
             .request_cancel();
+        let mut timer = self
+            .dead_code_release_timer
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        self.dead_code_release_stopped.store(true, Ordering::SeqCst);
+        self.dead_code_release_generation
+            .fetch_add(1, Ordering::SeqCst);
+        timer.take();
+        self.dead_code_release_armed.store(false, Ordering::SeqCst);
     }
 
     pub(crate) fn set_root_lifecycle(&self, lifecycle: crate::context::SubcLifecycleAdmission) {
@@ -934,6 +949,8 @@ impl InspectManager {
     }
 
     pub(crate) fn resume_root_work(&self) {
+        self.dead_code_release_stopped
+            .store(false, Ordering::SeqCst);
         let mut token = self
             .root_work_cancellation
             .lock()
@@ -1771,51 +1788,104 @@ impl InspectManager {
     }
 
     /// Note that an `aft_inspect` which read the dead-code graph finished at
-    /// `now`, and make sure a thread will release the graph once it has gone
+    /// `now`, and schedule release of the graph once it has gone
     /// [`DEAD_CODE_GRAPH_IDLE_RELEASE`] without another such request.
     pub(crate) fn note_dead_code_request(self: &Arc<Self>, now: Instant) {
+        if self.dead_code_release_stopped.load(Ordering::SeqCst) {
+            return;
+        }
         self.record_dead_code_request(now);
         if self.dead_code_release_armed.swap(true, Ordering::SeqCst) {
             return;
         }
+        let generation = self.dead_code_release_generation.load(Ordering::SeqCst);
+        self.schedule_dead_code_release(Instant::now(), generation);
+    }
+
+    fn schedule_dead_code_release(self: &Arc<Self>, at: Instant, generation: u64) {
+        // Cache destruction must not block the timer or the interactive inspect
+        // pool. Two release workers bound concurrency across all roots.
+        static POOL: std::sync::OnceLock<Option<rayon::ThreadPool>> = std::sync::OnceLock::new();
+        let pool = POOL.get_or_init(|| {
+            rayon::ThreadPoolBuilder::new()
+                .num_threads(2)
+                .thread_name(|_| "aft-dead-code-release".into())
+                .build()
+                .ok()
+        });
+        let mut timer = self
+            .dead_code_release_timer
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if self.dead_code_release_stopped.load(Ordering::SeqCst) {
+            self.dead_code_release_armed.store(false, Ordering::SeqCst);
+            return;
+        }
+        if self.dead_code_release_generation.load(Ordering::SeqCst) != generation {
+            return;
+        }
+        let Some(pool) = pool else {
+            self.dead_code_release_armed.store(false, Ordering::SeqCst);
+            return;
+        };
         let manager = Arc::downgrade(self);
-        let spawned = std::thread::Builder::new()
-            .name("aft-dead-code-release".into())
-            .spawn(move || loop {
-                // Hold the manager only while checking, so dropping the
-                // manager ends the thread at its next wake-up.
+        *timer = crate::shared_timer::Timer::at(at, move || {
+            let manager = manager.clone();
+            pool.spawn(move || {
                 let Some(current) = manager.upgrade() else {
                     return;
                 };
+                if current.dead_code_release_generation.load(Ordering::SeqCst) != generation {
+                    return;
+                }
                 match current.release_idle_dead_code_graph(Instant::now()) {
                     DeadCodeGraphRelease::KeepFor(wait) => {
-                        drop(current);
-                        std::thread::sleep(wait);
+                        current.schedule_dead_code_release(Instant::now() + wait, generation);
                     }
                     DeadCodeGraphRelease::Released | DeadCodeGraphRelease::NotHeld => {
+                        let timer = current
+                            .dead_code_release_timer
+                            .lock()
+                            .unwrap_or_else(std::sync::PoisonError::into_inner);
+                        if current.dead_code_release_generation.load(Ordering::SeqCst) != generation
+                        {
+                            return;
+                        }
                         current
                             .dead_code_release_armed
                             .store(false, Ordering::SeqCst);
-                        // A request noted while this thread was deciding found
-                        // it armed and started none; keep watching for it.
                         let pending = current
                             .last_dead_code_request
                             .lock()
                             .unwrap_or_else(std::sync::PoisonError::into_inner)
                             .is_some();
-                        if !pending || current.dead_code_release_armed.swap(true, Ordering::SeqCst)
-                        {
-                            return;
+                        let rearm = pending
+                            && !current.dead_code_release_armed.swap(true, Ordering::SeqCst);
+                        drop(timer);
+                        if rearm {
+                            current.schedule_dead_code_release(Instant::now(), generation);
                         }
                     }
                 }
             });
-        if spawned.is_err() {
+            None
+        })
+        .ok();
+        if timer.is_none() {
             self.dead_code_release_armed.store(false, Ordering::SeqCst);
         }
     }
 
-    /// Record a dead-code request at `now` without arming the release thread.
+    #[cfg(test)]
+    pub(crate) fn dead_code_timer_registration_for_test(&self) -> Option<u64> {
+        self.dead_code_release_timer
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(crate::shared_timer::Timer::registration_for_test)
+    }
+
+    /// Record a dead-code request at `now` without arming a release deadline.
     pub(crate) fn record_dead_code_request(&self, now: Instant) {
         *self
             .last_dead_code_request
@@ -6594,6 +6664,31 @@ mod guard_tests {
         );
     }
 
+    #[test]
+    fn dead_code_release_cancellation_removes_deadline_and_resumes() {
+        let manager = Arc::new(InspectManager::new());
+        manager
+            .dead_code_release_armed
+            .store(true, Ordering::SeqCst);
+        manager.schedule_dead_code_release(Instant::now() + DEAD_CODE_GRAPH_IDLE_RELEASE, 0);
+        let id = manager.dead_code_timer_registration_for_test().unwrap();
+        assert!(crate::shared_timer::Timer::registered_for_test(id));
+        manager.cancel_root_work();
+        assert!(!crate::shared_timer::Timer::registered_for_test(id));
+        assert!(!manager.dead_code_release_armed.load(Ordering::SeqCst));
+        // A completion already queued before teardown cannot rearm its deadline.
+        manager.schedule_dead_code_release(Instant::now(), 0);
+        assert!(manager.dead_code_timer_registration_for_test().is_none());
+        manager.resume_root_work();
+        let generation = manager.dead_code_release_generation.load(Ordering::SeqCst);
+        manager
+            .schedule_dead_code_release(Instant::now() + DEAD_CODE_GRAPH_IDLE_RELEASE, generation);
+        let id = manager.dead_code_timer_registration_for_test().unwrap();
+        assert!(crate::shared_timer::Timer::registered_for_test(id));
+        drop(manager);
+        assert!(!crate::shared_timer::Timer::registered_for_test(id));
+    }
+
     /// The dead-code graph a request builds stays in memory for
     /// `DEAD_CODE_GRAPH_IDLE_RELEASE` after the last dead-code request, is
     /// released then, and is built again by the next request. The clock is
diff --git a/crates/aft/src/inspect/scanners/dead_code/kept.rs b/crates/aft/src/inspect/scanners/dead_code/kept.rs
index 03831958cd..8707e566af 100644
--- a/crates/aft/src/inspect/scanners/dead_code/kept.rs
+++ b/crates/aft/src/inspect/scanners/dead_code/kept.rs
@@ -495,12 +495,14 @@ impl BaseWriter {
         if let Some(error) = self.failed.take() {
             return Err(error);
         }
-        self.out
+        let file = self
+            .out
             .take()
             .ok_or_else(|| std::io::Error::other("the kept graph was closed"))?
             .into_inner()
-            .map_err(|error| error.into_error())?
-            .sync_all()?;
+            .map_err(|error| error.into_error())?;
+        aft_store::sync::sync_all(&file, &self.temporary)?;
+        drop(file);
         std::fs::rename(&self.temporary, &self.path)?;
         Ok(self.position)
     }
@@ -852,7 +854,7 @@ pub(super) fn write_overlay(path: &Path, base: &str, overlay: &Overlay) -> std::
         out.write_all(&body)?;
         let file = out.into_inner().map_err(|error| error.into_error())?;
         let size = file.metadata()?.len();
-        file.sync_all()?;
+        aft_store::sync::sync_all(&file, &temporary)?;
         std::fs::rename(&temporary, path)?;
         Ok(size)
     })();
diff --git a/crates/aft/src/jsonc_edit.rs b/crates/aft/src/jsonc_edit.rs
index c15269d9e0..6dede1a4a8 100644
--- a/crates/aft/src/jsonc_edit.rs
+++ b/crates/aft/src/jsonc_edit.rs
@@ -259,7 +259,7 @@ fn write_atomic_to_temp(
         .open(temp)?;
     let result = (|| {
         file.write_all(contents.as_bytes())?;
-        file.sync_all()?;
+        aft_store::sync::sync_all(&file, temp)?;
         drop(file);
         if let Ok(metadata) = std::fs::metadata(path) {
             std::fs::set_permissions(temp, metadata.permissions())?;
diff --git a/crates/aft/src/lib.rs b/crates/aft/src/lib.rs
index c4228830db..c3202bc6ef 100644
--- a/crates/aft/src/lib.rs
+++ b/crates/aft/src/lib.rs
@@ -197,6 +197,7 @@ pub mod secret_proxy;
 pub mod semantic_admission;
 pub mod semantic_index;
 pub mod setup_plan;
+pub(crate) mod shared_timer;
 pub(crate) mod stage_timer;
 pub mod standing_roots;
 pub(crate) mod status_push;
@@ -243,6 +244,8 @@ pub(crate) mod search_hot_path_measurements;
 pub(crate) mod test_allocations;
 #[cfg(test)]
 pub(crate) mod test_env;
+#[cfg(test)]
+pub(crate) mod test_gate;
 #[cfg(all(test, windows))]
 pub(crate) mod test_read_denial;
 #[cfg(test)]
diff --git a/crates/aft/src/list_surfaces.rs b/crates/aft/src/list_surfaces.rs
index 3e197ae4f3..fb229cabde 100644
--- a/crates/aft/src/list_surfaces.rs
+++ b/crates/aft/src/list_surfaces.rs
@@ -364,6 +364,30 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
         location_or_primitive: ".take(1_000)",
         reason: "Internal permission-error scan stops after 1,000 matching lines to select one explanatory note; it never truncates the command output or returns a result list.",
     },
+    ExclusionEntry {
+        file: "gh_shim_speech/service.rs",
+        enclosing_item: "log_unconfigured_binding_refusal",
+        location_or_primitive: "UNCONFIGURED_BINDING_LOG_CAP, cap, clear",
+        reason: "Internal INFO-log deduplication history is cleared at capacity; older sessions may log again, but refusals and agent-visible result lists are unchanged.",
+    },
+    ExclusionEntry {
+        file: "subc/consent.rs",
+        enclosing_item: "DirectoryScopeProbes::note_fallback",
+        location_or_primitive: "DIRECTORY_SCOPE_MISSING_LOG_CAP, clear",
+        reason: "Internal vanished-directory INFO-log history is cleared at capacity; older scopes may log again, without changing the original file grant or any agent-visible result list.",
+    },
+    ExclusionEntry {
+        file: "checkpoint.rs",
+        enclosing_item: "status_count, STATUS_DIRECTORY_ENTRIES, STATUS_MANIFEST_BYTES, STATUS_BLOB_CHECKS",
+        location_or_primitive: "bounded status observation",
+        reason: "The checkpoint status reader caps directory entries, metadata bytes and blob validations; exhaustion returns unknown, never a truncated count or result list. Authoritative list and mutations retain full recovery semantics.",
+    },
+    ExclusionEntry {
+        file: "github_read/threads.rs",
+        enclosing_item: "fetch_review_threads",
+        location_or_primitive: "MAX_THREAD_PAGES, MAX_EXTRA_COMMENT_PAGES",
+        reason: "GitHub read renders a canonical document rather than a ListEnvelope; bounded thread and comment-ID pagination discloses omitted counts, marks partial thread totals, and leaves unmatched comments' thread state unknown.",
+    },
     ExclusionEntry {
         file: "gh_shim_speech/start_view/sweep.rs",
         enclosing_item: "sweep_entries",
@@ -570,10 +594,16 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
     },
     ExclusionEntry {
         file: "backup.rs",
-        enclosing_item: "read_session_disk_index_with_budget, merge_disk_stack_heads, run_operation_discard",
+        enclosing_item: "discovery_limits, merge_disk_stack_heads, run_operation_discard",
         location_or_primitive: "MAX_SESSION_DISCOVERY_ENTRIES, examined >= entry_limit, BackupIoBudget::check, ROLLBACK_CLEANUP_ALLOWANCE",
         reason: "internal durable undo-stack discovery stops at its entry or deadline budget and returns an error, never a partial path list or false no-history result; operation-scoped rollback stops before advancing its path iterator when the independent cleanup allowance expires, queues the remaining paths for retry, and logs one deferred-path count; per-file undo avoids the session scan",
     },
+    ExclusionEntry {
+        file: "status_inventory.rs",
+        enclosing_item: "discover_into",
+        location_or_primitive: "examined >= limits.entry_limit, BackupIoBudget::check",
+        reason: "the shared durable undo-stack discovery pass (also behind status-push tracked-file counts) stops at its entry or deadline budget and returns an error, never a partial path list; the status count then falls back to resident keys exactly as tracked_files does",
+    },
     ExclusionEntry {
         file: "runtime_drain.rs",
         enclosing_item: "drop",
@@ -586,6 +616,12 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
         location_or_primitive: "Option .take()",
         reason: "test-only handoff of the held storage sweep worker's join handle out of its gate, not a list",
     },
+    ExclusionEntry {
+        file: "commands/url_resolution.rs",
+        enclosing_item: "drop",
+        location_or_primitive: "with_secret_fetch_for_test::Restore::drop self.0.take(), self.1.take()",
+        reason: "Option::take restores the previous test fetch vault and options when the scoped helper exits; neither call cuts a list",
+    },
     ExclusionEntry {
         file: "commands/configure.rs",
         enclosing_item: "view_working_tree_refresh_path",
@@ -667,8 +703,8 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
     ExclusionEntry {
         file: "subc/health.rs",
         enclosing_item: "budget_health_metrics, abbreviate_health_root, abbreviated_health_path, abbreviated_health_refusal",
-        location_or_primitive: "root row removal, optional root subfield removal, cache/root path and refusal character caps, storage_retention map removal and v2_family_sweeps pop under HEALTH_METRICS_BUDGET_BYTES",
-        reason: "management health detail, not an agent result list; ancillary telemetry yields before root diagnostics and ordinary ready roots yield before standing, refused or unhealthy roots; the last cache path and root row (including ready roots) are abbreviated with full identity digests and root status instead of omitted; omitted root, sweep, cache and retention rows are counted exactly and aggregate counters remain present",
+        location_or_primitive: "root row removal, optional root subfield removal, cache/root path and refusal character caps, storage_retention map removal, v2_family_sweeps and data_store_failed pop under HEALTH_METRICS_BUDGET_BYTES",
+        reason: "management health detail, not an agent result list; ancillary telemetry yields before root diagnostics and ordinary ready roots yield before standing, refused or unhealthy roots; the last cache path and root row (including ready roots) are abbreviated with full identity digests and root status instead of omitted; omitted root, sweep, cache, retention and failed-store name rows are counted exactly and aggregate counters remain present",
     },
     ExclusionEntry {
         file: "subc/route_census.rs",
@@ -898,6 +934,12 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
         location_or_primitive: "SQL LIMIT and take(max_examined), 64-removal loop and five-second admission deadline",
         reason: "internal LRU database reclamation, not result lists; every deletion rechecks references and live holds and insufficient reclaim preserves the device-space refusal",
     },
+    ExclusionEntry {
+        file: "gh_shim/ticket_repository.rs",
+        enclosing_item: "Cache::insert",
+        location_or_primitive: "MAX_ROOTS",
+        reason: "internal repository snapshot LRU, not a result list; eviction recomputes the binding from Git on the next ticket rather than omitting a repository",
+    },
     ExclusionEntry {
         file: "cache_location.rs",
         enclosing_item: "candidates_and_durable, candidates_and_durable_with_budget, deletion_protections, deletion_protections_with_budget, retention_protections_with_budget, ensure_cache_idle",
@@ -1340,6 +1382,12 @@ pub static EXCLUSIONS: &[ExclusionEntry] = &[
         location_or_primitive: "SNIPPET_LINE_MAX_CHARS",
         reason: "incremental implementation of the existing per-line text window, with exactly the same ellipsis and truncation marker; bounds retained characters, not result rows",
     },
+    ExclusionEntry {
+        file: "data_layer/surfaces.rs",
+        enclosing_item: "disclose_index_gaps",
+        location_or_primitive: "INDEX_GAP_PREVIEW",
+        reason: "coverage-gap preview, not a findings page; skipped_folders counts every relevant unreadable folder and skipped_folders_omitted counts names beyond the preview",
+    },
 ];
 
 /// Look up a surface by command, mode, and list id.
diff --git a/crates/aft/src/log_redact.rs b/crates/aft/src/log_redact.rs
index 5dc405fda7..a0e480524f 100644
--- a/crates/aft/src/log_redact.rs
+++ b/crates/aft/src/log_redact.rs
@@ -18,9 +18,9 @@
 //! - credential query parameters (`token=`, `access_token=`, `api_key=`,
 //!   `…secret=`, `password=`), and `key=` when its value looks like a secret.
 //!
-//! Deliberately NOT masked: bare `key=value` fields outside a URL query. AFT's
-//! own structured lines use `key=` for index keys, and masking them would
-//! destroy the forensic value of the log.
+//! Ordinary `key=value` fields stay readable: AFT's structured lines use them
+//! for index keys and session identifiers. Short password names are masked in
+//! every log line; value-shape assignment masking is limited to shell commands.
 //!
 //! Shell commands quoted in a log line additionally go through
 //! [`redact_command`], which masks credentials typed inline in a command
@@ -94,6 +94,16 @@ static CREDENTIAL_QUERY: LazyLock<Regex> = LazyLock::new(|| {
 });
 /// `key=` is too generic to mask on its name alone; see [`looks_like_secret`].
 static KEY_QUERY: LazyLock<Regex> = LazyLock::new(|| compile(r#"(?i)([?&]key=)([^&\s#"'<>]+)"#));
+// Value-shape checks are restricted to explicit shell command text.
+static INLINE_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
+    compile(r#"\b(([A-Za-z_][A-Za-z0-9_]*)=)("[^"\r\n]+"|'[^'\r\n]+'|[^\s,;&|<>()'"]+)"#)
+});
+// Also protects log lines from older versions that recorded raw commands.
+static SHORT_PASSWORD_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
+    compile(
+        r#"(?i)\b(((?:[A-Za-z_][A-Za-z0-9_]*_)?(?:PW|PASS))=)("[^"\r\n]+"|'[^'\r\n]+'|[^\s,;&|<>()'"]+)"#,
+    )
+});
 
 /// Mask credentials in `text`. Returns the input unchanged (borrowed) when it
 /// contains nothing to mask, so the common case allocates nothing.
@@ -124,6 +134,10 @@ const SHELL_FORMAT_TRIGGERS: &[&str] = &[
     "://",
     "?",
     "&",
+    // Short password assignments (`PW=`, `DB_PASS=`): the name must end in
+    // PW or PASS directly before `=`.
+    "pw=",
+    "pass=",
 ];
 
 /// A conservative prefilter, not a second masker. A complete capture with no
@@ -178,7 +192,7 @@ macro_rules! shell_word {
 /// `GIT_AUTHOR_NAME` and `GH_SHIM_BYPASS` stay.
 static COMMAND_SECRET_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
     compile(concat!(
-        r#"(^|[^A-Za-z0-9_])((?:[A-Z][A-Z0-9_]*?)?(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIALS?|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|AUTH_KEY|_KEY|_PAT|_AUTH)(?:_[A-Z0-9]+)*=)("#,
+        r#"(^|[^A-Za-z0-9_])((?:(?:[A-Z][A-Z0-9_]*?)?(?:TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIALS?|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY|AUTH_KEY|_KEY|_PAT|_AUTH)(?:_[A-Z0-9]+)*|(?:[A-Z_][A-Z0-9_]*_)?(?:PW|PASS))=)("#,
         shell_word!(),
         ")"
     ))
@@ -830,6 +844,19 @@ pub fn redact_command(command: &str) -> Cow<'_, str> {
             },
             mapping,
         );
+        out = replace_in(
+            out,
+            None,
+            &INLINE_ASSIGNMENT,
+            |caps: &Captures<'_>| {
+                if looks_like_assignment_secret(caps[3].trim_matches(['\'', '"'])) {
+                    masked_assignment(caps)
+                } else {
+                    caps[0].to_string()
+                }
+            },
+            mapping,
+        );
     }
     if command.contains("--") {
         out = replace_in(
@@ -1152,9 +1179,41 @@ fn redact_with_range<'a>(
             mapping,
         );
     }
+    if text.contains('=') {
+        out = replace_in(
+            out,
+            range.as_deref_mut(),
+            &SHORT_PASSWORD_ASSIGNMENT,
+            |caps: &Captures<'_>| {
+                let raw = &caps[3];
+                let value = raw.trim_matches(['\'', '"']);
+                if is_short_password_name(&caps[2]) && !value.starts_with(['$', '<']) {
+                    masked_assignment(caps)
+                } else {
+                    caps[0].to_string()
+                }
+            },
+            mapping,
+        );
+    }
     out
 }
 
+fn masked_assignment(caps: &Captures<'_>) -> String {
+    let raw = &caps[3];
+    let quote = if raw.starts_with(['\'', '"']) {
+        &raw[..1]
+    } else {
+        ""
+    };
+    format!("{}{quote}{SECRET_PLACEHOLDER}{quote}", &caps[1])
+}
+
+fn is_short_password_name(key: &str) -> bool {
+    let suffix = key.rsplit('_').next().unwrap_or(key);
+    suffix.eq_ignore_ascii_case("PW") || suffix.eq_ignore_ascii_case("PASS")
+}
+
 /// A command's credential values, retained only with its live in-memory task.
 /// Deliberately has no Debug or serialization implementation.
 #[derive(Default)]
@@ -1182,6 +1241,7 @@ pub fn is_secret_environment_key(key: &str) -> bool {
     ["TOKEN", "SECRET", "KEY", "PASSWORD", "PASSWD", "CREDENTIAL"]
         .iter()
         .any(|part| contains_ignore_ascii_case(key, part))
+        || is_short_password_name(key)
         || names_auth(key)
 }
 
@@ -1475,6 +1535,17 @@ fn looks_like_secret(value: &str) -> bool {
         && value.chars().any(|ch| ch.is_ascii_lowercase())
 }
 
+/// Paths and URLs in command assignments are useful diagnostics, not tokens.
+/// Keep this rule identical to the CLI sanitizer. Query keys instead use
+/// [`looks_like_secret`] without the path-prefix exclusions.
+fn looks_like_assignment_secret(value: &str) -> bool {
+    !["/", "~/", "./", "../"]
+        .iter()
+        .any(|prefix| value.starts_with(prefix))
+        && !value.contains("://")
+        && looks_like_secret(value)
+}
+
 fn contains_ignore_ascii_case(haystack: &str, needle: &str) -> bool {
     haystack
         .as_bytes()
@@ -1599,7 +1670,7 @@ mod tests {
 
     #[test]
     fn only_json_fields_and_private_keys_match_across_a_newline() {
-        let line_anchored: [(&str, &Regex); 12] = [
+        let line_anchored: [(&str, &Regex); 14] = [
             ("AUTHORIZATION_HEADER", &AUTHORIZATION_HEADER),
             ("API_KEY_HEADER", &API_KEY_HEADER),
             ("AWS_SECRET_FIELD", &AWS_SECRET_FIELD),
@@ -1612,6 +1683,8 @@ mod tests {
             ("URL_USERINFO", &URL_USERINFO),
             ("CREDENTIAL_QUERY", &CREDENTIAL_QUERY),
             ("KEY_QUERY", &KEY_QUERY),
+            ("INLINE_ASSIGNMENT", &INLINE_ASSIGNMENT),
+            ("SHORT_PASSWORD_ASSIGNMENT", &SHORT_PASSWORD_ASSIGNMENT),
         ];
         let samples = [
             "Authorization: Bearer opaque-auth-value".to_string(),
@@ -1626,6 +1699,7 @@ mod tests {
             "AKIAABCDEFGHIJKLMNOP".to_string(),
             "https://user:password@example.com/path".to_string(),
             "https://e.com/p?access_token=opaque&key=AbCdEfGh12345678Zz".to_string(),
+            "PW=opaque X=\"AbCdEfGh12345678Zz\"".to_string(),
         ];
         for sample in &samples {
             for (cut, _) in sample.char_indices().skip(1) {
@@ -1733,6 +1807,16 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn short_password_environment_names_do_not_include_pwd_or_bypass() {
+        for key in ["PW", "PASS", "DB_PW", "DB_PASS", "db_pw", "db_pass"] {
+            assert!(is_secret_environment_key(key), "missed {key}");
+        }
+        for key in ["PWD", "BYPASS", "COMPASS"] {
+            assert!(!is_secret_environment_key(key), "mangled {key}");
+        }
+    }
+
     #[test]
     fn completion_non_secret_corpus_stays_borrowed() {
         for text in [
@@ -1785,6 +1869,8 @@ mod tests {
     struct Fixture {
         masked: Vec<MaskedCase>,
         untouched: Vec<String>,
+        command_masked: Vec<MaskedCase>,
+        command_untouched: Vec<String>,
     }
 
     #[derive(serde::Deserialize)]
@@ -2284,6 +2370,12 @@ mod tests {
                 "input: {}",
                 case.input
             );
+            assert_eq!(
+                redact_command(&case.input),
+                case.expected,
+                "command: {}",
+                case.input
+            );
         }
     }
 
@@ -2297,6 +2389,25 @@ mod tests {
         }
     }
 
+    #[test]
+    fn shared_fixture_command_shapes_do_not_redact_structured_fields() {
+        let fixture = fixture();
+        assert!(!fixture.command_masked.is_empty());
+        for case in fixture.command_masked {
+            assert_eq!(aft_redactor(&case.input), case.input);
+            assert_eq!(
+                redact_command(&case.input),
+                case.expected,
+                "command: {}",
+                case.input
+            );
+        }
+        assert!(!fixture.command_untouched.is_empty());
+        for command in fixture.command_untouched {
+            assert_eq!(redact_command(&command), command);
+        }
+    }
+
     #[test]
     fn masks_each_github_token_prefix() {
         let body = "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
diff --git a/crates/aft/src/logging.rs b/crates/aft/src/logging.rs
index 7be61cb322..52bdd2313e 100644
--- a/crates/aft/src/logging.rs
+++ b/crates/aft/src/logging.rs
@@ -981,7 +981,8 @@ fn install_panic_hook(initial_path: PathBuf) {
             .unwrap_or_else(|| initial_path.clone());
         let persisted = open_private_log_file(&path, false).and_then(|mut file| {
             file.write_all(&report)?;
-            file.sync_all()
+            // Panic hooks must not enter the logger or its warning-set lock.
+            aft_store::sync::sync_all_in_panic(&file, &path)
         });
         if persisted.is_err() {
             let _ = io::stderr().write_all(&report);
@@ -1037,7 +1038,7 @@ fn write_preinit_warning_to(path: &Path, message: &str) -> io::Result<()> {
     )?;
     let mut file = open_private_log_file(path, false)?;
     file.write_all(&crate::log_redact::aft_redact_bytes(&line))?;
-    file.sync_all()
+    aft_store::sync::sync_all(&file, path)
 }
 
 fn bounded_panic_text(args: std::fmt::Arguments<'_>, max_bytes: usize) -> String {
@@ -1662,7 +1663,7 @@ fn write_terminal_line(
     let _ = stderr.write_all(&line);
     let mut file = open_private_log_file(&sink.path, false)?;
     file.write_all(&line)?;
-    file.sync_all()?;
+    aft_store::sync::sync_all(&file, &sink.path)?;
     sink.write_counter.credit_logical(line.len() as u64);
     Ok(())
 }
diff --git a/crates/aft/src/lsp/applicability_cache.rs b/crates/aft/src/lsp/applicability_cache.rs
index 5dd01f0379..43dcfdc75c 100644
--- a/crates/aft/src/lsp/applicability_cache.rs
+++ b/crates/aft/src/lsp/applicability_cache.rs
@@ -20,6 +20,7 @@ type Key = (PathBuf, Vec<u8>);
 
 const INITIAL_INCOMPLETE_BACKOFF: Duration = Duration::from_secs(30);
 const MAX_INCOMPLETE_BACKOFF: Duration = Duration::from_secs(10 * 60);
+const WALK_SETTLE: Duration = Duration::from_millis(100);
 
 struct IncompleteWalk {
     error: ApplicabilityResolutionError,
@@ -69,6 +70,7 @@ pub(crate) struct ApplicabilityMetrics {
     pub dependency_count: usize,
     pub full_walks: u64,
     pub full_walk_micros: u64,
+    pub absorbed_triggers: u64,
 }
 
 #[derive(PartialEq, Eq)]
@@ -296,6 +298,7 @@ fn unchanged(paths: &HashMap<PathBuf, PathState>) -> bool {
 #[derive(Default)]
 struct State {
     generation: u64,
+    pending_triggers: u64,
     running: Option<Arc<RunningScan>>,
     result: Option<ApplicabilityWalk>,
     // This is a failed walk, never a partial applicability snapshot. Checks of
@@ -360,6 +363,9 @@ fn input_directories(root: &Path, inputs: &HashSet<PathBuf>) -> HashSet<PathBuf>
 #[derive(Default)]
 struct Flight {
     state: Mutex<State>,
+    /// Different configurations need different answers, but must not walk the
+    /// same physical root concurrently.
+    root_scan: Arc<Mutex<()>>,
     /// Cache-wide use counter of the latest lookup, for capacity eviction.
     last_used: AtomicU64,
 }
@@ -375,7 +381,6 @@ struct Completion {
 
 #[derive(Default)]
 struct RunningScan {
-    generation: u64,
     completion: Mutex<Completion>,
     changed: Condvar,
 }
@@ -409,6 +414,8 @@ pub(super) struct ApplicabilityCache {
     metrics: Mutex<HashMap<PathBuf, ApplicabilityMetrics>>,
     #[cfg(test)]
     waiter_joined: (Mutex<bool>, Condvar),
+    #[cfg(test)]
+    queued: (Mutex<(bool, usize)>, Condvar),
 }
 
 /// Make room for one new key. Only the least recently used idle snapshots go:
@@ -700,6 +707,38 @@ impl ApplicabilityCache {
         self.waiter_joined.1.notify_all();
     }
 
+    #[cfg(test)]
+    pub(super) fn hold_queue_for_test(&self) {
+        self.queued.0.lock().0 = true;
+    }
+
+    #[cfg(test)]
+    pub(super) fn wait_for_queue_for_test(&self, deadline: Instant) -> bool {
+        let mut queued = self.queued.0.lock();
+        while queued.1 == 0 {
+            if self.queued.1.wait_until(&mut queued, deadline).timed_out() {
+                return false;
+            }
+        }
+        true
+    }
+
+    #[cfg(test)]
+    pub(super) fn release_queue_for_test(&self) {
+        self.queued.0.lock().0 = false;
+        self.queued.1.notify_all();
+    }
+
+    #[cfg(test)]
+    fn note_queue_for_test(&self) {
+        let mut queued = self.queued.0.lock();
+        queued.1 += 1;
+        self.queued.1.notify_all();
+        while queued.0 {
+            self.queued.1.wait(&mut queued);
+        }
+    }
+
     pub(super) fn walk(
         &self,
         root: &Path,
@@ -742,7 +781,17 @@ impl ApplicabilityCache {
             if !entries.contains_key(&key) {
                 evict_least_recently_used(&mut entries);
             }
-            let flight = Arc::clone(entries.entry(key).or_default());
+            let root_scan = entries
+                .iter()
+                .find(|((cached_root, _), _)| cached_root == root)
+                .map(|(_, flight)| Arc::clone(&flight.root_scan))
+                .unwrap_or_default();
+            let flight = Arc::clone(entries.entry(key).or_insert_with(|| {
+                Arc::new(Flight {
+                    root_scan,
+                    ..Flight::default()
+                })
+            }));
             flight
                 .last_used
                 .store(self.uses.fetch_add(1, Ordering::Relaxed), Ordering::Relaxed);
@@ -777,10 +826,10 @@ impl ApplicabilityCache {
                 state.result = None;
                 state.cause = Some(InvalidationCause::DependencyValidation);
                 state.generation = state.generation.wrapping_add(1);
+                state.pending_triggers += 1;
             }
             if let Some(running) = &state.running {
                 let running = Arc::clone(running);
-                let joined_generation = running.generation == state.generation;
                 drop(state);
                 let mut completion = running.completion.lock();
                 #[cfg(test)]
@@ -796,103 +845,133 @@ impl ApplicabilityCache {
                         });
                     }
                 }
-                // Retain a per-scan completion for its original waiter cohort.
-                // Later binds must not consume a result invalidated before they
-                // arrived, even if they waited for that scan to release the root.
-                if joined_generation {
-                    if let Some(result) = &completion.result {
-                        self.metrics
-                            .lock()
-                            .entry(root.into())
-                            .or_default()
-                            .coalesced_hits += 1;
-                        return result.clone();
-                    }
+                // A completion is published only after every invalidation that
+                // arrived during scanning has been covered by a follow-up.
+                if let Some(result) = &completion.result {
+                    self.metrics
+                        .lock()
+                        .entry(root.into())
+                        .or_default()
+                        .coalesced_hits += 1;
+                    return result.clone();
                 }
                 continue;
             }
-            let running = Arc::new(RunningScan {
-                generation: state.generation,
-                ..RunningScan::default()
-            });
+            let running = Arc::new(RunningScan::default());
             state.running = Some(Arc::clone(&running));
             state.marker_names = super::registry::applicability_marker_names(config);
-            let cause = state
-                .cause
-                .take()
-                .map_or("cold_or_config", InvalidationCause::label);
+            if state.cause.is_none() {
+                state.pending_triggers += 1;
+            }
             drop(state);
             let guard = ScanGuard {
                 flight: &flight,
                 scan: Arc::clone(&running),
             };
-            let start = Instant::now();
-            let capture = Capture::start(root);
-            observe_ancestor_ignores(root);
-            let root_walk_number = {
-                let mut metrics = self.metrics.lock();
-                let metrics = metrics.entry(root.into()).or_default();
-                metrics.misses += 1;
-                metrics.full_walks += 1;
-                metrics.full_walks
+            let Some(_root_scan) = flight.root_scan.try_lock_until(deadline) else {
+                return Err(ApplicabilityResolutionError::RequestDeadline { root: root.into() });
             };
-            let result = scan();
-            let elapsed = start.elapsed();
-            let (dependencies, inputs, input_identities) = capture.finish();
-            {
-                let mut metrics = self.metrics.lock();
-                let metrics = metrics.entry(root.into()).or_default();
-                metrics.full_walk_micros += elapsed.as_micros() as u64;
-                metrics.dependency_count = inputs.len();
-            }
-            crate::slog_info!(
-                "LSP applicability full walk root={} cause={} root_walk_number={} duration_micros={} dependencies={} success={}",
-                root.display(), cause, root_walk_number, elapsed.as_micros(), inputs.len(), result.is_ok()
+            loop {
+                #[cfg(test)]
+                self.note_queue_for_test();
+                // Reserve the flight before settling. Invalidations in this fixed,
+                // bounded window join the queued scan rather than invalidate it.
+                std::thread::sleep(
+                    WALK_SETTLE.min(deadline.saturating_duration_since(Instant::now())),
+                );
+                let mut state = flight.state.lock();
+                if Instant::now() >= deadline {
+                    return Err(ApplicabilityResolutionError::RequestDeadline {
+                        root: root.into(),
+                    });
+                }
+                let generation = state.generation;
+                let absorbed_triggers = std::mem::take(&mut state.pending_triggers);
+                let cause = state
+                    .cause
+                    .take()
+                    .map_or("cold_or_config", InvalidationCause::label);
+                drop(state);
+                let start = Instant::now();
+                let capture = Capture::start(root);
+                observe_ancestor_ignores(root);
+                let root_walk_number = {
+                    let mut metrics = self.metrics.lock();
+                    let metrics = metrics.entry(root.into()).or_default();
+                    metrics.misses += 1;
+                    metrics.full_walks += 1;
+                    metrics.full_walks
+                };
+                let result = scan();
+                let elapsed = start.elapsed();
+                let (dependencies, inputs, input_identities) = capture.finish();
+                {
+                    let mut metrics = self.metrics.lock();
+                    let metrics = metrics.entry(root.into()).or_default();
+                    metrics.full_walk_micros += elapsed.as_micros() as u64;
+                    metrics.dependency_count = inputs.len();
+                    metrics.absorbed_triggers += absorbed_triggers;
+                }
+                crate::slog_info!(
+                "LSP applicability full walk root={} cause={} root_walk_number={} duration_micros={} dependencies={} success={} absorbed_triggers={}",
+                root.display(), cause, root_walk_number, elapsed.as_micros(), inputs.len(), result.is_ok(), absorbed_triggers
             );
-            let input_dirs = Arc::new(input_directories(
-                &crate::inspect::job::normalize_path(root),
-                &inputs,
-            ));
-            let mut state = flight.state.lock();
-            // Entry-limit failures throttle retries even if watcher events
-            // arrived during the scan. They never certify applicability.
-            if let Err(error @ ApplicabilityResolutionError::EntryLimitReached { entries, .. }) =
-                &result
-            {
-                let backoff = state
-                    .incomplete
-                    .as_ref()
-                    .map_or(INITIAL_INCOMPLETE_BACKOFF, |previous| {
-                        (previous.backoff * 2).min(MAX_INCOMPLETE_BACKOFF)
+                let input_dirs = Arc::new(input_directories(
+                    &crate::inspect::job::normalize_path(root),
+                    &inputs,
+                ));
+                let mut state = flight.state.lock();
+                // Entry-limit failures throttle retries even if watcher events
+                // arrived during the scan. They never certify applicability.
+                if let Err(
+                    error @ ApplicabilityResolutionError::EntryLimitReached { entries, .. },
+                ) = &result
+                {
+                    let backoff = state
+                        .incomplete
+                        .as_ref()
+                        .map_or(INITIAL_INCOMPLETE_BACKOFF, |previous| {
+                            (previous.backoff * 2).min(MAX_INCOMPLETE_BACKOFF)
+                        });
+                    // Frequent log or database writes must not shorten the delay.
+                    // Only a completed walk clears the failure's retry history.
+                    state.incomplete = Some(IncompleteWalk {
+                        error: error.clone(),
+                        retry_at: retry_clock() + backoff,
+                        backoff,
                     });
-                // Frequent log or database writes must not shorten the delay.
-                // Only a completed walk clears the failure's retry history.
-                state.incomplete = Some(IncompleteWalk {
-                    error: error.clone(),
-                    retry_at: retry_clock() + backoff,
-                    backoff,
-                });
-                crate::slog_warn!(
+                    crate::slog_warn!(
                     "language-server applicability walk incomplete: root={} entries={} retry_in_seconds={}",
                     root.display(), entries, backoff.as_secs()
                 );
-            } else if let Ok(walk) = &result {
-                state.incomplete = None;
-                // Only unchanged complete scans become applicability snapshots.
-                if state.generation == running.generation && unchanged(&dependencies) {
-                    state.input_dirs = input_dirs;
-                    state.config = Some(Arc::new(config.clone()));
-                    state.absorbed_entries = 0;
-                    state.result = Some(walk.clone());
-                    state.dependencies = dependencies;
-                    state.inputs = inputs;
-                    state.input_identities = input_identities;
+                } else if let Ok(walk) = &result {
+                    state.incomplete = None;
+                    // Only unchanged complete scans become applicability snapshots.
+                    if state.generation == generation && unchanged(&dependencies) {
+                        state.input_dirs = input_dirs;
+                        state.config = Some(Arc::new(config.clone()));
+                        state.absorbed_entries = 0;
+                        state.result = Some(walk.clone());
+                        state.dependencies = dependencies;
+                        state.inputs = inputs;
+                        state.input_identities = input_identities;
+                    }
+                }
+                if result.is_ok() && state.generation != generation {
+                    // All triggers received during this scan share one next scan.
+                    // Its generation is captured only after settling, so none of
+                    // their filesystem changes can be certified by the old result.
+                    drop(state);
+                    continue;
                 }
+                running.completion.lock().result = Some(result.clone());
+                // Clear the reservation while holding the invalidation lock. A
+                // trigger after this point belongs to a new flight, not this result.
+                state.running = None;
+                drop(state);
+                drop(guard);
+                return result;
             }
-            drop(state);
-            running.completion.lock().result = Some(result.clone());
-            drop(guard);
-            return result;
         }
     }
 
@@ -905,6 +984,7 @@ impl ApplicabilityCache {
             if cached_root.starts_with(root) || root.starts_with(cached_root) {
                 let mut state = flight.state.lock();
                 state.generation = state.generation.wrapping_add(1);
+                state.pending_triggers += 1;
                 state.result = None;
                 state.cause = Some(cause);
                 affected.insert(cached_root.clone());
diff --git a/crates/aft/src/lsp/applicability_walk_tests.rs b/crates/aft/src/lsp/applicability_walk_tests.rs
index b9bb90bf93..e0bd68ba44 100644
--- a/crates/aft/src/lsp/applicability_walk_tests.rs
+++ b/crates/aft/src/lsp/applicability_walk_tests.rs
@@ -778,9 +778,10 @@ fn applicability_walk_replaced_symlinked_input_target_invalidates() {
 }
 
 #[test]
-fn applicability_walk_invalidation_returns_uncached_result_to_parked_callers() {
+fn applicability_walk_running_burst_has_one_follow_up_that_sees_new_marker() {
     let temp = tempfile::tempdir().unwrap();
     let root = crate::inspect::job::canonicalize_normalized(temp.path());
+    std::fs::write(root.join("main.go"), "package main").unwrap();
     let config = config(&root);
     let cache = ApplicabilityCache::default();
     let scans = std::sync::atomic::AtomicUsize::new(0);
@@ -797,6 +798,10 @@ fn applicability_walk_invalidation_returns_uncached_result_to_parked_callers() {
                     let attempt = scans.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
                     let result = scan(&root, &config);
                     if attempt == 0 {
+                        assert!(!result
+                            .candidates
+                            .iter()
+                            .any(|c| c.key.kind == ServerKind::Go));
                         started_tx.send(()).unwrap();
                         release_rx
                             .lock()
@@ -821,18 +826,37 @@ fn applicability_walk_invalidation_returns_uncached_result_to_parked_callers() {
             )
         });
         assert!(cache.wait_for_waiter_for_test(Instant::now() + Duration::from_secs(5)));
-        std::fs::write(root.join("new.py"), "").unwrap();
-        cache.invalidate(&root, InvalidationCause::CreateRemoveRename);
+        std::fs::write(root.join("go.mod"), "module example.test/app\n").unwrap();
+        for _ in 0..32 {
+            cache.invalidate(&root, InvalidationCause::SelectionInput);
+        }
         release_tx.send(()).unwrap();
         (
             caller.join().unwrap().unwrap(),
             waiter.join().unwrap().unwrap(),
         )
     });
-    assert_eq!(scans.load(std::sync::atomic::Ordering::SeqCst), 1);
-    assert!(caller.candidates.is_empty());
+    assert_eq!(scans.load(std::sync::atomic::Ordering::SeqCst), 2);
+    assert!(caller
+        .candidates
+        .iter()
+        .any(|c| c.key.kind == ServerKind::Go));
     assert_eq!(signature(&caller), signature(&waiter));
+    assert_eq!(cache.metrics(&root).absorbed_triggers, 33);
     let next = cache
+        .walk(
+            &root,
+            &config,
+            Instant::now() + Duration::from_secs(5),
+            || panic!("the follow-up must have cached the new marker"),
+        )
+        .unwrap();
+    assert_eq!(scans.load(std::sync::atomic::Ordering::SeqCst), 2);
+    assert_eq!(signature(&next), signature(&caller));
+
+    std::fs::remove_file(root.join("go.mod")).unwrap();
+    cache.invalidate(&root, InvalidationCause::SelectionInput);
+    let after = cache
         .walk(
             &root,
             &config,
@@ -843,11 +867,119 @@ fn applicability_walk_invalidation_returns_uncached_result_to_parked_callers() {
             },
         )
         .unwrap();
-    assert_eq!(scans.load(std::sync::atomic::Ordering::SeqCst), 2);
-    assert!(next
+    assert_eq!(scans.load(std::sync::atomic::Ordering::SeqCst), 3);
+    assert!(!after
         .candidates
         .iter()
-        .any(|c| c.key.kind == ServerKind::Python));
+        .any(|c| c.key.kind == ServerKind::Go));
+}
+
+#[test]
+fn applicability_walk_cold_and_watcher_install_join_queued_in_both_orders() {
+    for watcher_first in [false, true] {
+        let temp = tempfile::tempdir().unwrap();
+        let root = crate::inspect::job::canonicalize_normalized(temp.path());
+        write_mixed_registry_fixture(&root);
+        let config = mixed_registry_config(&root, true);
+        let expected = canonical(&scan(&root, &config));
+        let cache = ApplicabilityCache::default();
+        cache.hold_queue_for_test();
+        if watcher_first {
+            cache.invalidate(&root, InvalidationCause::WatcherInstalled);
+        }
+        std::thread::scope(|scope| {
+            let caller = scope.spawn(|| {
+                cache
+                    .walk(
+                        &root,
+                        &config,
+                        Instant::now() + Duration::from_secs(10),
+                        || Ok(scan(&root, &config)),
+                    )
+                    .unwrap()
+            });
+            assert!(cache.wait_for_queue_for_test(Instant::now() + Duration::from_secs(5)));
+            if !watcher_first {
+                cache.invalidate(&root, InvalidationCause::WatcherInstalled);
+            }
+            for _ in 0..32 {
+                cache.invalidate(&root, InvalidationCause::SelectionInput);
+            }
+            cache.release_queue_for_test();
+            assert_eq!(canonical(&caller.join().unwrap()), expected);
+        });
+        assert_eq!(cache.metrics(&root).full_walks, 1);
+        assert_eq!(
+            cache.metrics(&root).absorbed_triggers,
+            if watcher_first { 33 } else { 34 }
+        );
+    }
+}
+
+#[test]
+fn applicability_walk_watcher_install_during_cold_scan_requires_follow_up() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = crate::inspect::job::canonicalize_normalized(temp.path());
+    std::fs::write(root.join("main.go"), "package main").unwrap();
+    let config = config(&root);
+    let cache = ApplicabilityCache::default();
+    let mut scans = 0;
+    let result = cache
+        .walk(
+            &root,
+            &config,
+            Instant::now() + Duration::from_secs(5),
+            || {
+                scans += 1;
+                let walk = scan(&root, &config);
+                if scans == 1 {
+                    // The watcher gap includes a marker written after the walk read it.
+                    std::fs::write(root.join("go.mod"), "module example.test/app\n").unwrap();
+                    cache.invalidate(&root, InvalidationCause::WatcherInstalled);
+                }
+                Ok(walk)
+            },
+        )
+        .unwrap();
+    assert_eq!(scans, 2);
+    assert!(result
+        .candidates
+        .iter()
+        .any(|c| c.key.kind == ServerKind::Go));
+}
+
+#[test]
+fn applicability_walk_trigger_during_follow_up_is_not_lost() {
+    let temp = tempfile::tempdir().unwrap();
+    let root = crate::inspect::job::canonicalize_normalized(temp.path());
+    std::fs::write(root.join("main.go"), "package main").unwrap();
+    let config = config(&root);
+    let cache = ApplicabilityCache::default();
+    let mut scans = 0;
+    let result = cache
+        .walk(
+            &root,
+            &config,
+            Instant::now() + Duration::from_secs(5),
+            || {
+                scans += 1;
+                let walk = scan(&root, &config);
+                if scans == 1 {
+                    std::fs::write(root.join("go.mod"), "module example.test/app\n").unwrap();
+                    cache.invalidate(&root, InvalidationCause::SelectionInput);
+                } else if scans == 2 {
+                    std::fs::remove_file(root.join("go.mod")).unwrap();
+                    cache.invalidate(&root, InvalidationCause::SelectionInput);
+                }
+                Ok(walk)
+            },
+        )
+        .unwrap();
+    assert_eq!(scans, 3);
+    assert!(!result
+        .candidates
+        .iter()
+        .any(|c| c.key.kind == ServerKind::Go));
 }
 
 #[test]
@@ -1943,6 +2075,73 @@ fn applicability_walk_create_remove_burst_measurement() {
     }
 }
 
+/// Replays marker/ignore bursts through one worker with a replaceable pending
+/// request, as background project refreshes do. Run the identical replay on
+/// each revision; the counters exclude the initial cold walk.
+#[test]
+#[ignore = "before/after marker and ignore burst measurement"]
+fn applicability_walk_marker_ignore_burst_measurement() {
+    let (temp, config) = cost_fixture(20, 50);
+    let root = crate::inspect::job::canonicalize_normalized(temp.path());
+    let cache = ApplicabilityCache::default();
+    let walk = || {
+        cache
+            .walk(
+                &root,
+                &config,
+                Instant::now() + Duration::from_secs(30),
+                || Ok(scan(&root, &config)),
+            )
+            .unwrap()
+    };
+    walk();
+    let before = cache.metrics(&root);
+    let wall = Instant::now();
+    let (tx, rx) = std::sync::mpsc::channel();
+    let last = std::thread::scope(|scope| {
+        let worker = scope.spawn(move || {
+            let mut last = None;
+            while rx.recv().is_ok() {
+                while rx.try_recv().is_ok() {}
+                last = Some(walk());
+            }
+            last.unwrap()
+        });
+        for group in 0..16 {
+            for event in 0..4 {
+                let path = root.join(if event % 2 == 0 {
+                    "go.mod"
+                } else {
+                    ".gitignore"
+                });
+                std::fs::write(
+                    &path,
+                    if event % 2 == 0 {
+                        format!("module example.test/app{group}\n")
+                    } else {
+                        format!("# burst {group}/{event}\n")
+                    },
+                )
+                .unwrap();
+                cache.invalidate_batch(&root, &[path], true);
+                tx.send(()).unwrap();
+                std::thread::sleep(Duration::from_millis(10));
+            }
+            std::thread::sleep(Duration::from_millis(250));
+        }
+        drop(tx);
+        worker.join().unwrap()
+    });
+    let after = cache.metrics(&root);
+    assert_eq!(canonical(&last), canonical(&scan(&root, &config)));
+    println!(
+        "marker_ignore_burst events=64 files=1000 full_walks={} full_walk_micros={} wall_micros={}",
+        after.full_walks - before.full_walks,
+        after.full_walk_micros - before.full_walk_micros,
+        wall.elapsed().as_micros()
+    );
+}
+
 /// A fresh walk counts every directory it enters as well as every file, and
 /// reports an incomplete result past [`APPLICABILITY_WALK_ENTRY_LIMIT`]
 /// entries. A covered file kept without a walk must count its new parent
diff --git a/crates/aft/src/lsp/client.rs b/crates/aft/src/lsp/client.rs
index 0015a91c88..ce1b91f5cb 100644
--- a/crates/aft/src/lsp/client.rs
+++ b/crates/aft/src/lsp/client.rs
@@ -3738,9 +3738,12 @@ mod tests {
     fn dropping_reaped_leader_still_cleans_live_descendant() {
         let tmp = tempfile::tempdir().unwrap();
         let (tx, _rx) = crossbeam_channel::unbounded();
-        let script = "sh -c \"trap '' TERM; echo \\$$ > desc.pid; touch ready; exec sleep 60\" & while [ ! -f ready ]; do sleep 0.02; done; exit 0";
+        let script = format!(
+            "sh -c \"trap '' TERM; echo \\$$ > desc.pid; touch ready; exec sleep 60\" & {}; exit 0",
+            crate::test_gate::gate("ready", "sleep 0.02")
+        );
         let mut client = spawn_long_lived_client(
-            script,
+            &script,
             tx,
             LspChildRegistry::new(),
             tmp.path().to_path_buf(),
diff --git a/crates/aft/src/lsp/completed_rust_check.rs b/crates/aft/src/lsp/completed_rust_check.rs
index a028299077..b267ceb805 100644
--- a/crates/aft/src/lsp/completed_rust_check.rs
+++ b/crates/aft/src/lsp/completed_rust_check.rs
@@ -1,7 +1,7 @@
 //! A completed compiler check, not an idle server, is the authority behind this
 //! cache. Disk validation is fail-closed and never installs cached rows into the
 //! live diagnostics store: a cold server can publish partial results independently.
-use std::collections::{BTreeMap, HashMap};
+use std::collections::{BTreeMap, BTreeSet, HashMap};
 use std::fs;
 use std::io::Read;
 use std::path::{Path, PathBuf};
@@ -13,10 +13,12 @@ use serde::{Deserialize, Serialize};
 
 use super::diagnostics::{DiagnosticSeverity, StoredDiagnostic};
 
+mod inputs;
+use inputs::{CachedFacts, SourceInputs, UnresolvedInput};
+
 pub(crate) const BUDGET: Duration = Duration::from_secs(2);
-// The first completed check has no trusted hash ledger yet. Parsing literal
-// include dependencies is a one-time cost; later requests reuse the ledger and
-// retain the much smaller serving budget.
+// The first completed check has no trusted hash ledger yet. Later requests
+// reuse content hashes and parsed facts, then resolve cross-file macro inputs.
 const INITIAL_CAPTURE_BUDGET: Duration = Duration::from_secs(15);
 // Filesystem timestamps can round a write down to a tick before the wall-clock
 // instant at which it actually happened. Two seconds covers coarse timestamp
@@ -27,9 +29,9 @@ const CHECK_BEGIN_TIMESTAMP_MARGIN: Duration = Duration::from_secs(2);
 // Worktree churn must not turn completed compiler checks into an unbounded disk cache.
 const MAX_RECORDS: usize = 64;
 const RECORD_SCAN_LIMIT: usize = 1024;
-// Schema 2 did not fence filesystem timestamp granularity at check begin, so
-// even matching inputs cannot establish that its saved diagnostics are sound.
-const RECORD_SCHEMA: u32 = 3;
+// Older records have no proof that skipped sources were checked for the set of
+// include-bearing macro names. Rebuild their facts before trusting a check.
+const RECORD_SCHEMA: u32 = 4;
 
 fn canonical(path: &Path) -> Option<PathBuf> {
     fs::canonicalize(path)
@@ -54,7 +56,7 @@ impl Drop for WalkReport<'_> {
             self.last.display(),
             self.started.elapsed().as_millis()
         );
-        #[cfg(test)]
+        #[cfg(any(test, feature = "test-hooks"))]
         if !self.complete {
             eprintln!(
                 "fingerprint refused at {} after {:?}; examined {}",
@@ -148,6 +150,10 @@ pub(crate) struct Fingerprint {
     pub(crate) hashed: usize,
     extra_inputs: Vec<PathBuf>,
     extra_env_keys: Vec<String>,
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    source_facts: BTreeMap<PathBuf, CachedFacts>,
+    #[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
+    macro_names: BTreeSet<String>,
     #[serde(skip)]
     environment_overrides: BTreeMap<String, String>,
 }
@@ -248,92 +254,73 @@ fn workspace_packages(root: &Path, deadline: Instant) -> Option<Vec<PathBuf>> {
     Some(packages)
 }
 
-fn source_inputs(
-    path: &Path,
-    bytes: &[u8],
+#[cfg(any(test, feature = "test-hooks"))]
+pub(crate) fn fingerprint(
+    root: &Path,
+    runtime: String,
+    previous: Option<&Fingerprint>,
     deadline: Instant,
-) -> Option<(Vec<PathBuf>, Vec<String>)> {
-    let text = std::str::from_utf8(bytes).ok()?;
-    if !text.contains("include") && !text.contains("env") {
-        return Some((Vec::new(), Vec::new()));
-    }
-    let mut parser = tree_sitter::Parser::new();
-    parser
-        .set_language(&tree_sitter_rust::LANGUAGE.into())
-        .ok()?;
-    let mut progress = |_: &tree_sitter::ParseState| {
-        if Instant::now() >= deadline {
-            std::ops::ControlFlow::Break(())
-        } else {
-            std::ops::ControlFlow::Continue(())
-        }
-    };
-    let tree = parser.parse_with_options(
-        &mut |offset, _| bytes.get(offset..).unwrap_or_default(),
-        None,
-        Some(tree_sitter::ParseOptions::new().progress_callback(&mut progress)),
-    )?;
-    expired(deadline)?;
-    let mut nodes = vec![tree.root_node()];
-    let mut included = Vec::new();
-    let mut env_keys = Vec::new();
-    while let Some(node) = nodes.pop() {
-        expired(deadline)?;
-        for index in 0..u32::try_from(node.child_count()).ok()? {
-            let child = node.child(index)?;
-            nodes.push(child);
-            if !matches!(child.kind(), "identifier" | "scoped_identifier") {
-                continue;
-            }
-            let name = child.utf8_text(bytes).ok()?.rsplit("::").next()?;
-            if !matches!(
-                name,
-                "include" | "include_str" | "include_bytes" | "env" | "option_env"
-            ) {
-                continue;
-            }
-            if node.child(index + 1).is_none_or(|bang| bang.kind() != "!") {
-                continue;
-            }
-            let tokens = node.child(index + 2)?;
-            let mut cursor = tokens.walk();
-            let values = tokens
-                .named_children(&mut cursor)
-                .filter(|n| !matches!(n.kind(), "line_comment" | "block_comment"))
-                .collect::<Vec<_>>();
-            // A generated/dynamic include path is uncertain. Do not guess what
-            // concat!, env!, or a procedural macro will read from disk.
-            if values.is_empty() || (values.len() != 1 && !matches!(name, "env" | "option_env")) {
-                return None;
-            }
-            let literal = values[0].utf8_text(bytes).ok()?;
-            let relative = match values[0].kind() {
-                "string_literal" => serde_json::from_str::<String>(literal).ok()?,
-                "raw_string_literal" => {
-                    let start = literal.find('"')?;
-                    let end = literal.rfind('"')?;
-                    literal.get(start + 1..end)?.to_string()
-                }
-                _ => return None,
-            };
-            if matches!(name, "env" | "option_env") {
-                env_keys.push(relative);
-            } else {
-                included.push(canonical(&path.parent()?.join(relative))?);
-            }
-        }
+    // When capturing a check's inputs after reading its begin event, no file
+    // or directory may have changed since the reader observed that event.
+    began: Option<SystemTime>,
+) -> Option<Fingerprint> {
+    let mut unresolved = None;
+    let captured =
+        fingerprint_with_reason(root, runtime, previous, deadline, began, &mut unresolved);
+    #[cfg(feature = "test-hooks")]
+    if let Some(unresolved) = unresolved {
+        eprintln!("{}", unresolved.note(root));
+    }
+    captured
+}
+
+/// Test-only access to the production fingerprint for paired release probes.
+#[cfg(feature = "test-hooks")]
+pub struct FingerprintProbe(Fingerprint);
+
+#[cfg(feature = "test-hooks")]
+impl FingerprintProbe {
+    pub fn capture(root: &Path, previous: Option<&Self>) -> Option<Self> {
+        fingerprint(
+            root,
+            "release-probe".into(),
+            previous.map(|previous| &previous.0),
+            Instant::now() + Duration::from_secs(60),
+            None,
+        )
+        .map(Self)
+    }
+
+    pub fn stats(&self) -> (usize, usize, usize, u64, usize) {
+        let (rust_files, rust_bytes) = self
+            .0
+            .files
+            .iter()
+            .filter(|(path, _)| path.extension().is_some_and(|ext| ext == "rs"))
+            .fold((0, 0), |(count, bytes), (_, stamp)| {
+                (count + 1, bytes + stamp.size)
+            });
+        (
+            self.0.examined,
+            self.0.files.len(),
+            rust_files,
+            rust_bytes,
+            self.0.hashed,
+        )
+    }
+
+    pub fn same_digest(&self, other: &Self) -> bool {
+        self.0.digest == other.0.digest
     }
-    Some((included, env_keys))
 }
 
-pub(crate) fn fingerprint(
+fn fingerprint_with_reason(
     root: &Path,
     runtime: String,
     previous: Option<&Fingerprint>,
     deadline: Instant,
-    // When capturing a check's inputs after reading its begin event, no file
-    // or directory may have changed since the reader observed that event.
     began: Option<SystemTime>,
+    unresolved: &mut Option<UnresolvedInput>,
 ) -> Option<Fingerprint> {
     let latest_safe_time = match began {
         Some(begin) => Some(begin.checked_sub(CHECK_BEGIN_TIMESTAMP_MARGIN)?),
@@ -348,6 +335,8 @@ pub(crate) fn fingerprint(
         started: Instant::now(),
     };
     let mut hashed = 0;
+    let mut source_inputs =
+        SourceInputs::new(previous.map_or_else(BTreeSet::new, |p| p.macro_names.clone()));
     let mut pending = workspace_packages(root, deadline)?;
     let mut inputs = vec![root.join("Cargo.toml")];
     let extra_inputs = previous.map_or_else(Vec::new, |p| p.extra_inputs.clone());
@@ -435,10 +424,28 @@ pub(crate) fn fingerprint(
             }
         }
     }
-    while let Some(path) = inputs.pop() {
+    loop {
+        if inputs.is_empty() {
+            source_inputs.scan_pending(root, &files, deadline, unresolved)?;
+            for path in source_inputs.resolve(root, deadline, unresolved)? {
+                expired(deadline)?;
+                if !files.contains_key(&path)
+                    || (!path.extension().is_some_and(|ext| ext == "rs")
+                        && source_inputs.needs_parse(&path))
+                {
+                    inputs.push(path);
+                }
+            }
+        }
+        let Some(path) = inputs.pop() else {
+            break;
+        };
         report.last = path.clone();
         expired(deadline)?;
-        if files.contains_key(&path) {
+        if files.contains_key(&path)
+            && (path.extension().is_some_and(|ext| ext == "rs")
+                || !source_inputs.needs_parse(&path))
+        {
             continue;
         }
         let metadata = fs::symlink_metadata(&path).ok()?;
@@ -479,6 +486,7 @@ pub(crate) fn fingerprint(
             }
         }
         let old = previous.and_then(|p| p.files.get(&path));
+        let mut source_bytes = None;
         // Manifests are always read, because their path dependencies also need
         // validating. Index hashes with no inode-change proof cannot be reused.
         let manifest = path.file_name().is_some_and(|name| name == "Cargo.toml");
@@ -499,11 +507,21 @@ pub(crate) fn fingerprint(
                 return None;
             }
             current.hash = blake3::hash(&bytes).to_hex().to_string();
-            if path.extension().is_some_and(|extension| extension == "rs") {
-                (current.included, current.env_keys) = source_inputs(&path, &bytes, deadline)?;
-            }
+            source_bytes = Some(bytes);
             hashed += 1;
         }
+        if source_inputs.needs_parse(&path) {
+            // Facts are keyed by the same content hash as the file stamp.
+            // Unchanged sources need neither a read nor a tree-sitter parse.
+            let cached = previous
+                .filter(|_| old.is_some_and(|old| old.hash == current.hash))
+                .and_then(|previous| previous.source_facts.get(&path))
+                .cloned();
+            let (included, env_keys) =
+                source_inputs.add(root, &path, source_bytes, cached, deadline, unresolved)?;
+            current.included = included;
+            current.env_keys = env_keys;
+        }
         inputs.extend(current.included.clone());
         files.insert(path, current);
     }
@@ -540,6 +558,7 @@ pub(crate) fn fingerprint(
         hashed
     );
     report.complete = true;
+    let macro_names = source_inputs.macro_names();
     Some(Fingerprint {
         files,
         runtime,
@@ -548,6 +567,8 @@ pub(crate) fn fingerprint(
         hashed,
         extra_inputs,
         extra_env_keys,
+        source_facts: source_inputs.facts,
+        macro_names,
         environment_overrides,
     })
 }
@@ -704,6 +725,17 @@ impl Runtime {
         previous: Option<&Fingerprint>,
         deadline: Instant,
         began: Option<SystemTime>,
+    ) -> Option<Fingerprint> {
+        self.capture_with_reason(root, previous, deadline, began, &mut None)
+    }
+
+    fn capture_with_reason(
+        &self,
+        root: &Path,
+        previous: Option<&Fingerprint>,
+        deadline: Instant,
+        began: Option<SystemTime>,
+        unresolved: &mut Option<UnresolvedInput>,
     ) -> Option<Fingerprint> {
         let runtime = self.hash(root, deadline)?;
         let mut seed = previous.cloned().unwrap_or(Fingerprint {
@@ -714,6 +746,8 @@ impl Runtime {
             hashed: 0,
             extra_inputs: Vec::new(),
             extra_env_keys: Vec::new(),
+            source_facts: BTreeMap::new(),
+            macro_names: BTreeSet::new(),
             environment_overrides: BTreeMap::new(),
         });
         seed.environment_overrides = self
@@ -738,7 +772,8 @@ impl Runtime {
         }
         seed.extra_inputs.sort();
         seed.extra_inputs.dedup();
-        let captured = fingerprint(root, runtime, Some(&seed), deadline, began)?;
+        let captured =
+            fingerprint_with_reason(root, runtime, Some(&seed), deadline, began, unresolved)?;
         for key in captured
             .files
             .values()
@@ -956,8 +991,16 @@ fn map_fingerprint_paths(
     fingerprint.extra_inputs = fingerprint
         .extra_inputs
         .into_iter()
-        .map(map)
+        .map(&mut map)
         .collect::<Result<_, _>>()?;
+    let mut source_facts = BTreeMap::new();
+    for (path, mut facts) in fingerprint.source_facts {
+        facts.map_paths(&mut map)?;
+        if source_facts.insert(map(path)?, facts).is_some() {
+            return Err("duplicate source facts path");
+        }
+    }
+    fingerprint.source_facts = source_facts;
     Ok(fingerprint)
 }
 
@@ -1224,11 +1267,13 @@ impl CompletedRustCheck {
         // Capture before spawning, not after receiving a progress event. This
         // also works on platforms without inode change timestamps.
         self.reports.clear();
-        let before = self.runtime.capture(
+        let mut unresolved = None;
+        let before = self.runtime.capture_with_reason(
             &self.root,
             self.saved.as_ref().map(|saved| &saved.fingerprint),
             deadline,
             None,
+            &mut unresolved,
         );
         let mut args = vec![
             "check".to_string(),
@@ -1265,14 +1310,19 @@ impl CompletedRustCheck {
         self.reports = reports;
         let Some(before) = before else {
             self.abort();
+            if let Some(unresolved) = unresolved {
+                return Err(format!("aft_inspect: {}", unresolved.note(&self.root)));
+            }
             return Err("aft_inspect: cargo check completed, but Rust inputs cannot be fingerprinted; diagnostics are provisional".into());
         };
-        let after = self
-            .runtime
-            .capture(&self.root, Some(&before), deadline, None)
-            .ok_or_else(|| {
-                "aft_inspect: cannot validate Rust inputs after cargo check; retry".to_string()
-            })?;
+        let after =
+            self.runtime
+                .capture_with_reason(&self.root, Some(&before), deadline, None, &mut unresolved)
+                .ok_or_else(|| match unresolved {
+                    Some(unresolved) => format!("aft_inspect: {}", unresolved.note(&self.root)),
+                    None => "aft_inspect: cannot validate Rust inputs after cargo check; retry"
+                        .to_string(),
+                })?;
         if cancelled() || before.files != after.files || before.digest != after.digest {
             self.abort();
             return Err("aft_inspect: Rust inputs changed during cargo check; retry".into());
@@ -2335,10 +2385,22 @@ mod tests {
         write_record(&missed.path, certified).unwrap();
         let disk: serde_json::Value =
             serde_json::from_slice(&fs::read(&missed.path).unwrap()).unwrap();
-        assert_eq!(disk["record"]["schema"], 3);
+        assert_eq!(disk["record"]["schema"], RECORD_SCHEMA);
         assert!(valid(&reload(&missed)).is_some());
     }
 
+    #[test]
+    fn schema_three_record_without_source_facts_is_a_cache_miss() {
+        let (_temp, cache) = fixture();
+        let mut old = (**cache.saved.as_ref().unwrap()).clone();
+        old.schema = 3;
+        write_record(&cache.path, &old).unwrap();
+        assert!(
+            reload(&cache).saved.is_none(),
+            "older records do not prove which macro names skipped sources were checked against"
+        );
+    }
+
     #[test]
     fn fingerprint_deadline_exceeded_refuses_saved_check() {
         let (_temp, cache) = fixture();
@@ -2438,6 +2500,561 @@ mod tests {
         assert!(valid(&cache).is_none());
     }
 
+    fn capture_inputs(cache: &CompletedRustCheck) -> Option<Fingerprint> {
+        fingerprint(
+            &cache.root,
+            "v1".into(),
+            None,
+            Instant::now() + BUDGET,
+            None,
+        )
+    }
+
+    #[test]
+    fn warm_fingerprint_reuses_saved_source_facts_without_parsing() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/src/data/a.txt", "one");
+        write(&cache.root, "member/src/data/b.txt", "two");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($name:literal) => { include_str!(concat!("data/", $name)) }; }
+            const ENV: Option<&str> = option_env!("AFT_TEST_CACHED_SOURCE_FACTS");
+        "#,
+        );
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const DATA: &str = fixture!(\"a.txt\");",
+        );
+        inputs::take_parses();
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert_eq!(
+            inputs::take_parses(),
+            2,
+            "only the definition and its call need parsing"
+        );
+        write_record(&cache.path, cache.saved.as_ref().unwrap()).unwrap();
+        let reloaded = reload(&cache);
+        let original = &cache.saved.as_ref().unwrap().fingerprint;
+        let restored = &reloaded.saved.as_ref().unwrap().fingerprint;
+        assert_eq!(
+            serde_json::to_value(&original.source_facts).unwrap(),
+            serde_json::to_value(&restored.source_facts).unwrap()
+        );
+        assert_eq!(original.macro_names, restored.macro_names);
+        inputs::take_parses();
+        let warm = fingerprint(
+            &cache.root,
+            "v1".into(),
+            Some(restored),
+            Instant::now() + BUDGET,
+            None,
+        )
+        .unwrap();
+        assert_eq!(
+            inputs::take_parses(),
+            0,
+            "unchanged warm sources must not be parsed"
+        );
+        assert_eq!(warm.digest, restored.digest);
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const DATA: &str = fixture!(\"b.txt\");",
+        );
+        let changed = fingerprint(
+            &cache.root,
+            "v1".into(),
+            Some(&warm),
+            Instant::now() + BUDGET,
+            None,
+        )
+        .unwrap();
+        assert_eq!(
+            inputs::take_parses(),
+            1,
+            "only the changed call site needs parsing"
+        );
+        assert!(changed
+            .files
+            .contains_key(&cache.root.join("member/src/data/b.txt")));
+        assert!(!changed
+            .files
+            .contains_key(&cache.root.join("member/src/data/a.txt")));
+    }
+
+    #[test]
+    fn byte_prefilter_skips_irrelevant_sources_and_revisits_new_macro_names() {
+        let (_temp, cache) = fixture();
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const DATA: &str = fixture!(\"a.txt\");",
+        );
+        write(&cache.root, "member/src/data/a.txt", "one");
+        inputs::take_parses();
+        let before = capture_inputs(&cache).unwrap();
+        assert_eq!(
+            inputs::take_parses(),
+            0,
+            "irrelevant bytes must not reach tree-sitter"
+        );
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($name:literal) => { include_str!(concat!("data/", $name)) }; }
+        "#,
+        );
+        let after = fingerprint(
+            &cache.root,
+            "v1".into(),
+            Some(&before),
+            Instant::now() + BUDGET,
+            None,
+        )
+        .unwrap();
+        assert_eq!(
+            inputs::take_parses(),
+            2,
+            "a new definition must discover unchanged callers"
+        );
+        assert!(after
+            .files
+            .contains_key(&cache.root.join("member/src/data/a.txt")));
+    }
+
+    #[test]
+    fn new_macro_names_revisit_previously_cached_primary_files() {
+        let (_temp, cache) = fixture();
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "// env prefilter\nconst DATA: &str = fixture!(\"a.txt\");",
+        );
+        write(&cache.root, "member/src/data/a.txt", "one");
+        inputs::take_parses();
+        let before = capture_inputs(&cache).unwrap();
+        assert_eq!(inputs::take_parses(), 1);
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($name:literal) => { include_str!(concat!("data/", $name)) }; }
+        "#,
+        );
+        let after = fingerprint(
+            &cache.root,
+            "v1".into(),
+            Some(&before),
+            Instant::now() + BUDGET,
+            None,
+        )
+        .unwrap();
+        assert_eq!(inputs::take_parses(), 2);
+        assert!(after
+            .files
+            .contains_key(&cache.root.join("member/src/data/a.txt")));
+    }
+
+    fn unresolved_input(cache: &CompletedRustCheck) -> String {
+        let mut unresolved = None;
+        assert!(fingerprint_with_reason(
+            &cache.root,
+            "v1".into(),
+            None,
+            Instant::now() + BUDGET,
+            None,
+            &mut unresolved,
+        )
+        .is_none());
+        unresolved
+            .expect("the source causing uncertainty must be named")
+            .note(&cache.root)
+    }
+
+    #[test]
+    fn literal_concat_includes_track_exact_files() {
+        for name in ["include", "include_str", "include_bytes"] {
+            let (_temp, mut cache) = fixture();
+            write(&cache.root, "member/src/data/a.txt", "before");
+            write(&cache.root, "member/src/data/unused.txt", "unrelated");
+            write(
+                &cache.root,
+                "member/src/lib.rs",
+                &format!("const DATA: &str = {name}!(concat!(r#\"data/\"#, \"a\", \".txt\",));\n"),
+            );
+            cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+            assert!(valid(&cache).is_some());
+            write(
+                &cache.root,
+                "member/src/data/unused.txt",
+                "changed unrelated",
+            );
+            assert!(
+                valid(&cache).is_some(),
+                "only the exact concat path is an input"
+            );
+            write(&cache.root, "member/src/data/a.txt", "after!");
+            assert!(
+                valid(&cache).is_none(),
+                "{name} input must invalidate the check"
+            );
+        }
+    }
+
+    #[test]
+    fn concat_manifest_dir_uses_nearest_member_manifest() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/data/a.txt", "before");
+        write(
+            &cache.root,
+            "member/src/nested/inputs.rs",
+            concat!(
+                r#"
+            const DATA: &str = include_str!(concat!(env"#,
+                r#"!("CARGO_MANIFEST_DIR"), "/data/", "a.txt"));
+        "#
+            ),
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(cache
+            .saved
+            .as_ref()
+            .unwrap()
+            .fingerprint
+            .files
+            .contains_key(&cache.root.join("member/data/a.txt")));
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/data/a.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn reporter_fixture_macro_tracks_all_literal_invocations_across_files() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "tests/fixtures/a.txt", "one");
+        write(&cache.root, "tests/fixtures/b.txt", "two");
+        write(&cache.root, "tests/fixtures/unread.txt", "not an input");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture {
+                ($fixture:literal) => { include_str!(concat!("../../tests/fixtures/", $fixture)) };
+            }
+            const A: &str = fixture!("a.txt");
+        "#,
+        );
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const B: &str = fixture!(\"b.txt\");\n",
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(
+            &cache.root,
+            "tests/fixtures/unread.txt",
+            "still not an input",
+        );
+        assert!(valid(&cache).is_some());
+        for (file, original) in [("a.txt", "one"), ("b.txt", "two")] {
+            write(&cache.root, &format!("tests/fixtures/{file}"), "changed");
+            assert!(
+                valid(&cache).is_none(),
+                "every resolved invocation is an input"
+            );
+            write(&cache.root, &format!("tests/fixtures/{file}"), original);
+        }
+        write(&cache.root, "tests/fixtures/new.txt", "new input");
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const B: &str = fixture!(\"new.txt\");\n",
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "tests/fixtures/new.txt", "changed new input");
+        assert!(
+            valid(&cache).is_none(),
+            "unchanged definitions must use the current calls"
+        );
+    }
+
+    #[test]
+    fn macro_paths_and_manifest_dir_are_relative_to_the_invocation() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/tests/data/a.txt", "before");
+        write(&cache.root, "member/data/b.txt", "before");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            concat!(
+                r#"
+            macro_rules! relative { ($name:literal) => { include_bytes!(concat!("data/", $name)) }; }
+            macro_rules! absolute { ($name:literal) => { include_str!(concat!(env"#,
+                r#"!("CARGO_MANIFEST_DIR"), "/data/", $name)) }; }
+        "#
+            ),
+        );
+        write(
+            &cache.root,
+            "member/tests/check.rs",
+            r#"
+            const A: &[u8] = relative!("a.txt");
+            const B: &str = absolute!("b.txt");
+        "#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/tests/data/a.txt", "after!");
+        assert!(valid(&cache).is_none());
+        write(&cache.root, "member/tests/data/a.txt", "before");
+        write(&cache.root, "member/data/b.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn unused_fixture_macro_contributes_no_include_input() {
+        let (_temp, cache) = fixture();
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("missing/", $fixture)) }; }
+        "#,
+        );
+        assert!(capture_inputs(&cache).is_some());
+    }
+
+    #[test]
+    fn macro_reexports_without_renaming_keep_exact_invocations() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/data/a.txt", "before");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            concat!(
+                r#"
+            macro_rules! fixture { ($name:literal) => { include_str!(concat!(env"#,
+                r#"!("CARGO_MANIFEST_DIR"), "/data/", $name)) }; }
+            pub(crate) use fixture;
+        "#
+            ),
+        );
+        write(
+            &cache.root,
+            "member/tests/check.rs",
+            r#"
+            use member::fixture;
+            const DATA: &str = member::fixture!("a.txt");
+        "#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/data/a.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn unresolved_include_names_its_source_with_approved_wording() {
+        let (_temp, cache) = fixture();
+        for source in [
+            "const DATA: &str = include_str!(some_macro!());",
+            "const DATA: &str = include_str!(concat!(\"data/\", some_macro!()));",
+            "const DATA: &str = include_str!(concat!(\"data/\", \"missing.txt\"));",
+        ] {
+            write(&cache.root, "member/src/lib.rs", source);
+            assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs includes a file whose path can't be resolved; diagnostics are provisional");
+        }
+    }
+
+    #[test]
+    fn non_literal_environment_keys_name_their_source_with_approved_wording() {
+        let (_temp, cache) = fixture();
+        for source in [
+            "const DATA: &str = env!(key!());",
+            "const DATA: Option<&str> = option_env!(concat!(\"A\", \"B\"));",
+            "const DATA: &str = include_str!(concat!(env!(key!()), \"/data.txt\"));",
+        ] {
+            write(&cache.root, "member/src/lib.rs", source);
+            assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs reads an environment variable whose name can't be resolved; diagnostics are provisional");
+        }
+    }
+
+    #[test]
+    fn unresolved_fixture_invocations_stay_provisional() {
+        for invocation in [
+            "fixture!(name)",
+            "fixture!(concat!(\"a\", \".txt\"))",
+            "forward!(fixture!(\"a.txt\"))",
+            "macro_rules! forward { () => { fixture!(\"a.txt\") }; }",
+            "macro_rules! forward { ($($name:literal),*) => { $(fixture!($name);)* }; } forward!(\"a.txt\");",
+            "forward!(fixture)",
+            "use fixture as alias; alias!(\"a.txt\")",
+        ] {
+            let (_temp, cache) = fixture();
+            write(&cache.root, "member/src/data/a.txt", "input");
+            write(
+                &cache.root,
+                "member/src/lib.rs",
+                r#"
+                macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("data/", $fixture)) }; }
+            "#,
+            );
+            write(&cache.root, "member/src/calls.rs", invocation);
+            assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs includes a file whose path can't be resolved; diagnostics are provisional", "{invocation}");
+        }
+    }
+
+    #[test]
+    fn literal_macro_traversal_is_resolved_exactly_or_refused_outside_workspace() {
+        let (temp, mut cache) = fixture();
+        write(&cache.root, "member/src/data/placeholder.txt", "not read");
+        write(&cache.root, "member/src/outside.txt", "before");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("data/", $fixture)) }; }
+            const DATA: &str = fixture!("../outside.txt");
+        "#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/src/outside.txt", "after!");
+        assert!(valid(&cache).is_none());
+        fs::write(temp.path().join("outside.txt"), "external").unwrap();
+        write(
+            &cache.root,
+            "member/src/calls.rs",
+            "const DATA: &str = fixture!(\"../../../../outside.txt\");\n",
+        );
+        assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs includes a file whose path can't be resolved; diagnostics are provisional");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn computed_include_refuses_symlink_components() {
+        let (temp, cache) = fixture();
+        let input = temp.path().join("external.txt");
+        fs::write(&input, "external").unwrap();
+        fs::create_dir_all(cache.root.join("target")).unwrap();
+        std::os::unix::fs::symlink(input, cache.root.join("target/link.txt")).unwrap();
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            const DATA: &str = include_str!(concat!("../../target/", "link.txt"));
+        "#,
+        );
+        assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs includes a file whose path can't be resolved; diagnostics are provisional");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn warm_fingerprint_rechecks_excluded_include_parent_symlinks() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "target/inputs/a.txt", "input");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"const DATA: &str = include_str!(concat!("../../target/inputs/", "a.txt"));"#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        fs::rename(
+            cache.root.join("target/inputs"),
+            cache.root.join("target/actual"),
+        )
+        .unwrap();
+        std::os::unix::fs::symlink(
+            cache.root.join("target/actual"),
+            cache.root.join("target/inputs"),
+        )
+        .unwrap();
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn complex_fixture_matchers_stay_provisional_when_invoked() {
+        for definition in [
+            r#"macro_rules! fixture { ($($fixture:literal),*) => { include_str!(concat!("data/", $($fixture),*)) }; }"#,
+            r#"macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("data/", $fixture)) }; () => { "empty" }; }"#,
+            r#"macro_rules! fixture { ($fixture:literal) => { macro_rules! generated { () => { include_str!(concat!("data/", $fixture)) }; } generated!() }; }"#,
+        ] {
+            let (_temp, cache) = fixture();
+            write(&cache.root, "member/src/data/a.txt", "input");
+            write(
+                &cache.root,
+                "member/src/lib.rs",
+                &format!("{definition}\nconst DATA: &str = fixture!(\"a.txt\");"),
+            );
+            assert_eq!(unresolved_input(&cache), "cargo check completed, but member/src/lib.rs includes a file whose path can't be resolved; diagnostics are provisional");
+        }
+    }
+
+    #[test]
+    fn macro_calls_in_included_rust_with_non_rust_extension_are_scanned() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/src/data/a.txt", "before");
+        write(
+            &cache.root,
+            "member/src/calls.inc",
+            "const DATA: &str = fixture!(\"a.txt\");",
+        );
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("data/", $fixture)) }; }
+            include!(concat!("calls", ".inc"));
+        "#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/src/data/a.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn concat_paths_decode_rust_string_escapes() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/src/data/a.txt", "before");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r#"
+            const DATA: &str = include_str!(concat!("d\x61ta/", "\u{61}.txt"));
+        "#,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/src/data/a.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
+    #[test]
+    fn unrelated_byte_and_c_string_macro_arguments_do_not_make_inputs_provisional() {
+        let (_temp, mut cache) = fixture();
+        write(&cache.root, "member/src/data.txt", "before");
+        write(
+            &cache.root,
+            "member/src/lib.rs",
+            r##"
+            const DATA: &str = include_str!("data.txt");
+            opaque!(b"\xff", br#"raw bytes"#, c"c string", cr#"raw c string"#, "include");
+        "##,
+        );
+        cache.saved_mut().fingerprint = capture_inputs(&cache).unwrap();
+        assert!(valid(&cache).is_some());
+        write(&cache.root, "member/src/data.txt", "after!");
+        assert!(valid(&cache).is_none());
+    }
+
     #[test]
     fn declared_build_input_directory_addition_invalidates_completed_check() {
         let (_temp, mut cache) = fixture();
diff --git a/crates/aft/src/lsp/completed_rust_check/inputs.rs b/crates/aft/src/lsp/completed_rust_check/inputs.rs
new file mode 100644
index 0000000000..7f6079afa4
--- /dev/null
+++ b/crates/aft/src/lsp/completed_rust_check/inputs.rs
@@ -0,0 +1,922 @@
+//! Resolve compiler inputs only when the source proves every concrete path.
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::Instant;
+
+use super::{canonical, expired};
+use serde::{Deserialize, Serialize};
+
+const INCLUDE_PROVISIONAL: &str = "cargo check completed, but {file} includes a file whose path can't be resolved; diagnostics are provisional";
+const ENV_PROVISIONAL: &str = "cargo check completed, but {file} reads an environment variable whose name can't be resolved; diagnostics are provisional";
+
+pub(super) struct UnresolvedInput {
+    path: PathBuf,
+    environment: bool,
+}
+
+impl UnresolvedInput {
+    pub(super) fn note(&self, root: &Path) -> String {
+        let file = self.path.strip_prefix(root).unwrap_or(&self.path);
+        let template = if self.environment {
+            ENV_PROVISIONAL
+        } else {
+            INCLUDE_PROVISIONAL
+        };
+        template.replace("{file}", &file.to_string_lossy().replace('\\', "/"))
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+enum Token {
+    Literal(String),
+    Text(String),
+    Group(Vec<Token>),
+}
+
+impl Token {
+    fn text(&self, expected: &str) -> bool {
+        matches!(self, Self::Text(text) if text == expected)
+    }
+}
+
+fn tokens(node: tree_sitter::Node<'_>, bytes: &[u8], deadline: Instant) -> Option<Vec<Token>> {
+    let mut result = Vec::new();
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        expired(deadline)?;
+        let text = child.utf8_text(bytes).ok()?;
+        match child.kind() {
+            "line_comment" | "block_comment" | "(" | ")" | "[" | "]" | "{" | "}" => {}
+            "string_literal" => result.push(
+                string_literal(text, deadline)
+                    .map(Token::Literal)
+                    .unwrap_or_else(|| Token::Text(text.into())),
+            ),
+            "raw_string_literal" if text.starts_with('r') => result.push(Token::Literal(
+                text.get(text.find('"')? + 1..text.rfind('"')?)?
+                    .replace("\r\n", "\n"),
+            )),
+            "raw_string_literal" => result.push(Token::Text(text.into())),
+            "token_tree" | "token_tree_pattern" => {
+                result.push(Token::Group(tokens(child, bytes, deadline)?))
+            }
+            "token_binding_pattern" => result.extend(tokens(child, bytes, deadline)?),
+            _ if child.named_child_count() > 0 && child.kind() != "scoped_identifier" => {
+                result.push(Token::Group(tokens(child, bytes, deadline)?));
+            }
+            _ => result.push(Token::Text(text.into())),
+        }
+    }
+    Some(result)
+}
+
+fn arguments(tokens: &[Token], deadline: Instant) -> Option<Vec<&[Token]>> {
+    let mut args = Vec::new();
+    let mut start = 0;
+    for (index, token) in tokens.iter().enumerate() {
+        expired(deadline)?;
+        if token.text(",") {
+            if start == index {
+                return None;
+            }
+            args.push(&tokens[start..index]);
+            start = index + 1;
+        }
+    }
+    if start < tokens.len() {
+        args.push(&tokens[start..]);
+    }
+    Some(args)
+}
+
+fn manifest_dir(path: &Path, deadline: Instant) -> Option<String> {
+    for parent in path.parent()?.ancestors() {
+        expired(deadline)?;
+        match fs::symlink_metadata(parent.join("Cargo.toml")) {
+            Ok(meta) if meta.is_file() => return Some(parent.to_str()?.into()),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            _ => return None,
+        }
+    }
+    None
+}
+
+fn expression(
+    tokens: &[Token],
+    path: &Path,
+    bindings: &BTreeMap<String, String>,
+    deadline: Instant,
+) -> Option<String> {
+    expired(deadline)?;
+    match tokens {
+        [Token::Literal(value)] => Some(value.clone()),
+        [Token::Text(name)] => bindings.get(name).cloned(),
+        [name, bang, Token::Group(args)] if name.text("concat") && bang.text("!") => {
+            let mut value = String::new();
+            for arg in arguments(args, deadline)? {
+                value.push_str(&expression(arg, path, bindings, deadline)?);
+            }
+            Some(value)
+        }
+        [name, bang, Token::Group(args)] if name.text("env") && bang.text("!") => {
+            match arguments(args, deadline)?.as_slice() {
+                [[Token::Literal(key)]] if key == "CARGO_MANIFEST_DIR" => {
+                    manifest_dir(path, deadline)
+                }
+                _ => None,
+            }
+        }
+        _ => None,
+    }
+}
+
+// Canonicalization alone would hide a symlink in an include's parent directory.
+// Check every component first, including components cancelled by `..`.
+fn include_path(
+    root: &Path,
+    source: &Path,
+    relative: &str,
+    deadline: Instant,
+    checked: &mut HashSet<PathBuf>,
+    resolved: &mut HashMap<PathBuf, PathBuf>,
+) -> Option<PathBuf> {
+    expired(deadline)?;
+    let joined = source.parent()?.join(relative);
+    if let Some(path) = resolved.get(&joined) {
+        return Some(path.clone());
+    }
+    let mut current = PathBuf::new();
+    for component in joined.components() {
+        expired(deadline)?;
+        current.push(component);
+        if checked.insert(current.clone()) && fs::symlink_metadata(&current).ok()?.is_symlink() {
+            return None;
+        }
+    }
+    let path = canonical(&joined)?;
+    if !path.starts_with(root) || !path.is_file() {
+        return None;
+    }
+    resolved.insert(joined, path.clone());
+    Some(path)
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct Definition {
+    name: String,
+    path: PathBuf,
+    parameters: Option<Vec<String>>,
+    includes: Vec<(Vec<Token>, bool)>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct Invocation {
+    name: String,
+    path: PathBuf,
+    args: Vec<Token>,
+    nested: bool,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+struct FileFacts {
+    definitions: Vec<Definition>,
+    invocations: Vec<Invocation>,
+    references: BTreeSet<String>,
+    direct: Vec<(Vec<Token>, bool)>,
+    env_keys: Vec<String>,
+    #[serde(default)]
+    scanned_names: BTreeSet<String>,
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct CachedFacts(Arc<FileFacts>);
+
+impl Serialize for CachedFacts {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        self.0.serialize(serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for CachedFacts {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        FileFacts::deserialize(deserializer).map(|facts| Self(Arc::new(facts)))
+    }
+}
+
+impl CachedFacts {
+    pub(super) fn map_paths(
+        &mut self,
+        map: &mut impl FnMut(PathBuf) -> Result<PathBuf, &'static str>,
+    ) -> Result<(), &'static str> {
+        let facts = Arc::make_mut(&mut self.0);
+        for definition in &mut facts.definitions {
+            definition.path = map(definition.path.clone())?;
+        }
+        for invocation in &mut facts.invocations {
+            invocation.path = map(invocation.path.clone())?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Default)]
+pub(super) struct SourceInputs {
+    pub(super) facts: BTreeMap<PathBuf, CachedFacts>,
+    rust_sources: BTreeSet<PathBuf>,
+    parsed: BTreeSet<PathBuf>,
+    pending: BTreeMap<PathBuf, Option<Vec<u8>>>,
+    searched_names: BTreeSet<String>,
+    // Repeated includes share checks only inside this capture, never across
+    // fingerprints where a parent directory could have become a symlink.
+    checked_components: HashSet<PathBuf>,
+    resolved_paths: HashMap<PathBuf, PathBuf>,
+}
+
+impl FileFacts {
+    fn refuse<T>(
+        path: &Path,
+        environment: bool,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<T> {
+        *unresolved = Some(UnresolvedInput {
+            path: path.into(),
+            environment,
+        });
+        None
+    }
+}
+
+impl SourceInputs {
+    pub(super) fn new(searched_names: BTreeSet<String>) -> Self {
+        Self {
+            searched_names,
+            ..Self::default()
+        }
+    }
+    pub(super) fn needs_parse(&self, path: &Path) -> bool {
+        path.extension().is_some_and(|extension| extension == "rs")
+            || (!self.parsed.contains(path) && self.rust_sources.contains(path))
+    }
+}
+
+#[cfg(test)]
+thread_local! { static PARSES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) }; }
+
+#[cfg(test)]
+pub(super) fn take_parses() -> usize {
+    PARSES.with(|count| count.replace(0))
+}
+
+impl FileFacts {
+    fn parse(
+        &mut self,
+        root: &Path,
+        path: &Path,
+        bytes: &[u8],
+        macro_names: &BTreeSet<String>,
+        deadline: Instant,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<(Vec<PathBuf>, Vec<String>)> {
+        std::str::from_utf8(bytes).ok()?;
+        #[cfg(test)]
+        PARSES.with(|count| count.set(count.get() + 1));
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_rust::LANGUAGE.into())
+            .ok()?;
+        let mut progress = |_: &tree_sitter::ParseState| {
+            if Instant::now() >= deadline {
+                std::ops::ControlFlow::Break(())
+            } else {
+                std::ops::ControlFlow::Continue(())
+            }
+        };
+        let tree = parser.parse_with_options(
+            &mut |offset, _| bytes.get(offset..).unwrap_or_default(),
+            None,
+            Some(tree_sitter::ParseOptions::new().progress_callback(&mut progress)),
+        )?;
+        let mut nodes = vec![tree.root_node()];
+        let mut included = Vec::new();
+        let mut env_keys = Vec::new();
+        let mut calls = Vec::new();
+        while let Some(node) = nodes.pop() {
+            expired(deadline)?;
+            if node.kind() == "macro_definition" {
+                let name = node
+                    .child_by_field_name("name")?
+                    .utf8_text(bytes)
+                    .ok()?
+                    .into();
+                let mut cursor = node.walk();
+                let mut rule = None;
+                let mut single = true;
+                for child in node.named_children(&mut cursor) {
+                    expired(deadline)?;
+                    if child.kind() == "macro_rule" {
+                        if rule.is_some() {
+                            single = false;
+                        }
+                        rule = Some(child);
+                    }
+                }
+                let mut definition = Definition {
+                    name,
+                    path: path.into(),
+                    parameters: None,
+                    includes: Vec::new(),
+                };
+                if single {
+                    if let Some(left) = rule.and_then(|rule| rule.child_by_field_name("left")) {
+                        definition.parameters =
+                            parameters(&tokens(left, bytes, deadline)?, deadline);
+                    }
+                }
+                let index = self.definitions.len();
+                self.definitions.push(definition);
+                let mut cursor = node.walk();
+                for child in node.named_children(&mut cursor) {
+                    expired(deadline)?;
+                    if child.kind() == "macro_rule" {
+                        let right = child.child_by_field_name("right")?;
+                        self.scan(
+                            root,
+                            path,
+                            &tokens(right, bytes, deadline)?,
+                            Some(index),
+                            false,
+                            deadline,
+                            &mut included,
+                            &mut env_keys,
+                            unresolved,
+                        )?;
+                    }
+                }
+                continue;
+            }
+            if node.kind() == "macro_invocation" {
+                calls.push(node);
+                continue;
+            }
+            if node.kind() == "use_as_clause" {
+                // Renaming can hide an invocation's original macro name.
+                // Ordinary imports preserve the name used by the resolver.
+                let original = node.child_by_field_name("path")?.utf8_text(bytes).ok()?;
+                self.references.insert(original.rsplit("::").next()?.into());
+            }
+            let mut cursor = node.walk();
+            for child in node.named_children(&mut cursor) {
+                expired(deadline)?;
+                nodes.push(child);
+            }
+        }
+        // Templates reveal local include-bearing names before ordinary calls
+        // are tokenized. Most assert!/format! arguments are irrelevant inputs.
+        self.scanned_names = macro_names.clone();
+        self.scanned_names.extend(
+            self.definitions
+                .iter()
+                .filter(|definition| !definition.includes.is_empty())
+                .map(|definition| definition.name.clone()),
+        );
+        for call in calls {
+            expired(deadline)?;
+            let text = call.utf8_text(bytes).ok()?;
+            let mut relevant = text.contains("include") || text.contains("env");
+            if !relevant {
+                for name in &self.scanned_names {
+                    expired(deadline)?;
+                    if text.contains(name) {
+                        relevant = true;
+                        break;
+                    }
+                }
+            }
+            if relevant {
+                self.scan(
+                    root,
+                    path,
+                    &tokens(call, bytes, deadline)?,
+                    None,
+                    false,
+                    deadline,
+                    &mut included,
+                    &mut env_keys,
+                    unresolved,
+                )?;
+            }
+        }
+        self.env_keys = env_keys.clone();
+        // An include-bearing macro invoked in this file with an unsupported
+        // matcher or a nested call is already uncertain. More files cannot
+        // resolve that call, so refuse before hashing the rest of the tree.
+        for definition in &self.definitions {
+            expired(deadline)?;
+            if definition.includes.is_empty() {
+                continue;
+            }
+            for invocation in &self.invocations {
+                expired(deadline)?;
+                if invocation.name == definition.name
+                    && (definition.parameters.is_none() || invocation.nested)
+                {
+                    return Self::refuse(&definition.path, false, unresolved);
+                }
+            }
+        }
+        Some((included, env_keys))
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn scan(
+        &mut self,
+        root: &Path,
+        path: &Path,
+        tokens: &[Token],
+        definition: Option<usize>,
+        nested: bool,
+        deadline: Instant,
+        included: &mut Vec<PathBuf>,
+        env_keys: &mut Vec<String>,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<()> {
+        let mut index = 0;
+        while index < tokens.len() {
+            expired(deadline)?;
+            if tokens[index].text("macro_rules") {
+                if let Some(definition) = definition {
+                    // A generated macro has its own bindings and expansion
+                    // sites; substituting the outer bindings would be a guess.
+                    self.definitions[definition].parameters = None;
+                }
+            }
+            if let [Token::Text(name), bang, Token::Group(args), ..] = &tokens[index..] {
+                if bang.text("!") {
+                    let name = name.rsplit("::").next()?;
+                    match name {
+                        "include" | "include_str" | "include_bytes" => {
+                            if !environment_inputs(args, env_keys, deadline)? {
+                                return Self::refuse(path, true, unresolved);
+                            }
+                            let arguments = arguments(args, deadline)?;
+                            let [args] = arguments.as_slice() else {
+                                return Self::refuse(path, false, unresolved);
+                            };
+                            // A prefix is not containment: an unknown tail can
+                            // contain `..`. Expand proven literal calls instead.
+                            if let Some(definition) = definition {
+                                if nested {
+                                    self.definitions[definition].parameters = None;
+                                }
+                                self.definitions[definition]
+                                    .includes
+                                    .push((args.to_vec(), name == "include"));
+                            } else {
+                                self.direct.push((args.to_vec(), name == "include"));
+                            }
+                        }
+                        "env" | "option_env" => {
+                            let args = arguments(args, deadline)?;
+                            match args.first().copied() {
+                                Some([Token::Literal(key)]) => env_keys.push(key.clone()),
+                                _ => return Self::refuse(path, true, unresolved),
+                            }
+                        }
+                        _ => {
+                            self.invocations.push(Invocation {
+                                name: name.into(),
+                                path: path.into(),
+                                args: args.clone(),
+                                nested: nested || definition.is_some(),
+                            });
+                            self.scan(
+                                root, path, args, definition, true, deadline, included, env_keys,
+                                unresolved,
+                            )?;
+                        }
+                    }
+                    index += 3;
+                    continue;
+                }
+            }
+            if let Token::Group(group) = &tokens[index] {
+                self.scan(
+                    root, path, group, definition, nested, deadline, included, env_keys, unresolved,
+                )?;
+            } else if let Token::Text(name) = &tokens[index] {
+                self.references.insert(name.rsplit("::").next()?.into());
+            }
+            index += 1;
+        }
+        Some(())
+    }
+}
+
+impl SourceInputs {
+    pub(super) fn macro_names(&self) -> BTreeSet<String> {
+        self.facts
+            .values()
+            .flat_map(|facts| &facts.0.definitions)
+            .filter(|definition| !definition.includes.is_empty())
+            .map(|definition| definition.name.clone())
+            .collect()
+    }
+
+    pub(super) fn add(
+        &mut self,
+        root: &Path,
+        path: &Path,
+        bytes: Option<Vec<u8>>,
+        cached: Option<CachedFacts>,
+        deadline: Instant,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<(Vec<PathBuf>, Vec<String>)> {
+        if !path.extension().is_some_and(|extension| extension == "rs") {
+            self.parsed.insert(path.into());
+        }
+        if let Some(cached) = cached {
+            return self.load(root, path, cached, deadline, unresolved);
+        }
+        if let Some(bytes) = bytes {
+            let text = std::str::from_utf8(&bytes).ok()?;
+            if text.contains("include") || text.contains("env") {
+                let mut facts = FileFacts::default();
+                let mut names = self.macro_names();
+                names.extend(self.searched_names.iter().cloned());
+                facts.parse(root, path, &bytes, &names, deadline, unresolved)?;
+                return self.load(
+                    root,
+                    path,
+                    CachedFacts(Arc::new(facts)),
+                    deadline,
+                    unresolved,
+                );
+            }
+            self.pending.insert(path.into(), Some(bytes));
+        }
+        Some((Vec::new(), Vec::new()))
+    }
+
+    fn load(
+        &mut self,
+        root: &Path,
+        path: &Path,
+        facts: CachedFacts,
+        deadline: Instant,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<(Vec<PathBuf>, Vec<String>)> {
+        let mut included = Vec::new();
+        for (input, rust) in &facts.0.direct {
+            expired(deadline)?;
+            let target = expression(input, path, &BTreeMap::new(), deadline).and_then(|relative| {
+                include_path(
+                    root,
+                    path,
+                    &relative,
+                    deadline,
+                    &mut self.checked_components,
+                    &mut self.resolved_paths,
+                )
+            });
+            let Some(target) = target else {
+                expired(deadline)?;
+                return FileFacts::refuse(path, false, unresolved);
+            };
+            if *rust {
+                self.rust_sources.insert(target.clone());
+            }
+            included.push(target);
+        }
+        let env_keys = facts.0.env_keys.clone();
+        self.facts.insert(path.into(), facts);
+        Some((included, env_keys))
+    }
+
+    pub(super) fn scan_pending(
+        &mut self,
+        root: &Path,
+        files: &BTreeMap<PathBuf, super::Stamp>,
+        deadline: Instant,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<()> {
+        let names = self.macro_names();
+        let added: BTreeSet<_> = names.difference(&self.searched_names).cloned().collect();
+        if !added.is_empty() {
+            for path in files.keys() {
+                expired(deadline)?;
+                if (path.extension().is_some_and(|ext| ext == "rs")
+                    || self.rust_sources.contains(path))
+                    && self
+                        .facts
+                        .get(path)
+                        .is_none_or(|facts| !added.is_subset(&facts.0.scanned_names))
+                {
+                    self.pending.entry(path.clone()).or_insert(None);
+                }
+            }
+        }
+        let pending = std::mem::take(&mut self.pending);
+        for (path, bytes) in pending {
+            expired(deadline)?;
+            let candidates = if bytes.is_some() { &names } else { &added };
+            if candidates.is_empty() {
+                continue;
+            }
+            let bytes = bytes.or_else(|| super::read_bounded(&path, deadline))?;
+            let observed = super::stamp(&std::fs::metadata(&path).ok()?)?;
+            let expected = files.get(&path)?;
+            if (observed.size, observed.modified, observed.changed)
+                != (expected.size, expected.modified, expected.changed)
+            {
+                return None;
+            }
+            let text = std::str::from_utf8(&bytes).ok()?;
+            let mut relevant = false;
+            for name in candidates {
+                expired(deadline)?;
+                // Also match bare names: an import alias or forwarding macro
+                // can hide a call without spelling `name!` in the same file.
+                if text.contains(name) {
+                    relevant = true;
+                    break;
+                }
+            }
+            if relevant {
+                if blake3::hash(&bytes).to_hex().as_str() != expected.hash {
+                    return None;
+                }
+                let mut facts = FileFacts::default();
+                facts.parse(root, &path, &bytes, &names, deadline, unresolved)?;
+                self.load(
+                    root,
+                    &path,
+                    CachedFacts(Arc::new(facts)),
+                    deadline,
+                    unresolved,
+                )?;
+            }
+        }
+        self.searched_names.extend(names);
+        Some(())
+    }
+
+    pub(super) fn resolve(
+        &mut self,
+        root: &Path,
+        deadline: Instant,
+        unresolved: &mut Option<UnresolvedInput>,
+    ) -> Option<Vec<PathBuf>> {
+        let mut included = Vec::new();
+        for definition in self.facts.values().flat_map(|facts| &facts.0.definitions) {
+            expired(deadline)?;
+            if definition.includes.is_empty() {
+                continue;
+            }
+            for facts in self.facts.values() {
+                expired(deadline)?;
+                // Passing a macro by name (including a `use ... as ...`
+                // alias) can hide calls from this deliberately small resolver.
+                if facts.0.references.contains(&definition.name) {
+                    return FileFacts::refuse(&definition.path, false, unresolved);
+                }
+            }
+            for invocation in self.facts.values().flat_map(|facts| &facts.0.invocations) {
+                expired(deadline)?;
+                if invocation.name != definition.name {
+                    continue;
+                }
+                let Some(parameters) = definition
+                    .parameters
+                    .as_ref()
+                    .filter(|_| !invocation.nested)
+                else {
+                    return FileFacts::refuse(&definition.path, false, unresolved);
+                };
+                let Some(args) = arguments(&invocation.args, deadline)
+                    .filter(|args| args.len() == parameters.len())
+                else {
+                    expired(deadline)?;
+                    return FileFacts::refuse(&definition.path, false, unresolved);
+                };
+                let mut bindings = BTreeMap::new();
+                for (parameter, arg) in parameters.iter().zip(args) {
+                    expired(deadline)?;
+                    let [Token::Literal(value)] = arg else {
+                        return FileFacts::refuse(&definition.path, false, unresolved);
+                    };
+                    bindings.insert(parameter.clone(), value.clone());
+                }
+                for (input, rust_source) in &definition.includes {
+                    expired(deadline)?;
+                    let target = expression(input, &invocation.path, &bindings, deadline).and_then(
+                        |relative| {
+                            include_path(
+                                root,
+                                &invocation.path,
+                                &relative,
+                                deadline,
+                                &mut self.checked_components,
+                                &mut self.resolved_paths,
+                            )
+                        },
+                    );
+                    match target {
+                        Some(target) => {
+                            if *rust_source {
+                                self.rust_sources.insert(target.clone());
+                            }
+                            included.push(target);
+                        }
+                        None => {
+                            expired(deadline)?;
+                            return FileFacts::refuse(&definition.path, false, unresolved);
+                        }
+                    }
+                }
+            }
+        }
+        Some(included)
+    }
+}
+
+fn parameters(tokens: &[Token], deadline: Instant) -> Option<Vec<String>> {
+    let mut names = Vec::new();
+    for arg in arguments(tokens, deadline)? {
+        expired(deadline)?;
+        match arg {
+            [Token::Text(name), colon, kind]
+                if name.starts_with('$')
+                    && colon.text(":")
+                    && (kind.text("literal") || kind.text("expr")) =>
+            {
+                if names.contains(name) {
+                    return None;
+                }
+                names.push(name.clone());
+            }
+            _ => return None,
+        }
+    }
+    Some(names)
+}
+
+fn environment_inputs(tokens: &[Token], keys: &mut Vec<String>, deadline: Instant) -> Option<bool> {
+    let mut index = 0;
+    while index < tokens.len() {
+        expired(deadline)?;
+        if let [name, bang, Token::Group(args), ..] = &tokens[index..] {
+            if (name.text("env") || name.text("option_env")) && bang.text("!") {
+                match arguments(args, deadline)?.first().copied() {
+                    Some([Token::Literal(key)]) => keys.push(key.clone()),
+                    _ => return Some(false),
+                }
+                index += 3;
+                continue;
+            }
+        }
+        if let Token::Group(args) = &tokens[index] {
+            if !environment_inputs(args, keys, deadline)? {
+                return Some(false);
+            }
+        }
+        index += 1;
+    }
+    Some(true)
+}
+
+fn string_literal(text: &str, deadline: Instant) -> Option<String> {
+    let normalized = text
+        .strip_prefix('"')?
+        .strip_suffix('"')?
+        .replace("\r\n", "\n");
+    let mut chars = normalized.chars().peekable();
+    let mut value = String::new();
+    while let Some(ch) = chars.next() {
+        expired(deadline)?;
+        if ch != '\\' {
+            value.push(ch);
+            continue;
+        }
+        value.push(match chars.next()? {
+            '\\' => '\\',
+            '\'' => '\'',
+            '"' => '"',
+            'n' => '\n',
+            'r' => '\r',
+            't' => '\t',
+            '0' => '\0',
+            'x' => {
+                let code = chars.next()?.to_digit(16)? * 16 + chars.next()?.to_digit(16)?;
+                if code > 0x7f {
+                    return None;
+                }
+                char::from_u32(code)?
+            }
+            'u' => {
+                if chars.next()? != '{' {
+                    return None;
+                }
+                let mut code = 0u32;
+                let mut digits = 0;
+                loop {
+                    expired(deadline)?;
+                    match chars.next()? {
+                        '}' if digits > 0 => break,
+                        '_' if digits > 0 => {}
+                        ch => {
+                            digits += 1;
+                            if digits > 6 {
+                                return None;
+                            }
+                            code = code.checked_mul(16)?.checked_add(ch.to_digit(16)?)?;
+                        }
+                    }
+                }
+                char::from_u32(code)?
+            }
+            '\n' => {
+                while chars
+                    .peek()
+                    .is_some_and(|ch| matches!(ch, ' ' | '\t' | '\r' | '\n'))
+                {
+                    expired(deadline)?;
+                    chars.next();
+                }
+                continue;
+            }
+            _ => return None,
+        });
+    }
+    Some(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unrelated_macro_arguments_are_not_collected_as_input_facts() {
+        let mut facts = FileFacts::default();
+        let bytes = br#"// include input prefilter
+            fn example() { assert_eq!(b"a", b"b"); opaque!(1, 2); }
+        "#;
+        facts
+            .parse(
+                Path::new("workspace"),
+                Path::new("workspace/lib.rs"),
+                bytes,
+                &BTreeSet::new(),
+                Instant::now() + std::time::Duration::from_secs(2),
+                &mut None,
+            )
+            .unwrap();
+        assert!(facts.invocations.is_empty());
+        assert!(facts.references.is_empty());
+    }
+
+    #[test]
+    fn unsupported_invoked_matcher_refuses_during_file_scan() {
+        let mut inputs = SourceInputs::default();
+        let mut unresolved = None;
+        let bytes = br#"macro_rules! many { ($($name:literal),*) => { $(include_str!(concat!("data/", $name)))* }; } many!("a.txt");"#;
+        assert!(inputs
+            .add(
+                Path::new("workspace"),
+                Path::new("workspace/vectors.rs"),
+                Some(bytes.to_vec()),
+                None,
+                Instant::now() + std::time::Duration::from_secs(2),
+                &mut unresolved
+            )
+            .is_none());
+        assert!(unresolved.is_some());
+        assert!(inputs.facts.is_empty());
+    }
+
+    #[test]
+    fn literal_macro_matcher_binds_its_metavariable() {
+        let bytes = br#"macro_rules! fixture { ($fixture:literal) => { include_str!(concat!("data/", $fixture)) }; }"#;
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_rust::LANGUAGE.into())
+            .unwrap();
+        let tree = parser.parse(bytes, None).unwrap();
+        let definition = tree.root_node().named_child(0).unwrap();
+        let mut cursor = definition.walk();
+        let rule = definition
+            .named_children(&mut cursor)
+            .find(|node| node.kind() == "macro_rule")
+            .unwrap();
+        let left = rule.child_by_field_name("left").unwrap();
+        let deadline = Instant::now() + std::time::Duration::from_secs(2);
+        let tokens = tokens(left, bytes, deadline).unwrap();
+        assert_eq!(
+            parameters(&tokens, deadline),
+            Some(vec!["$fixture".into()]),
+            "{}: {tokens:?}",
+            left.to_sexp()
+        );
+    }
+}
diff --git a/crates/aft/src/lsp/mod.rs b/crates/aft/src/lsp/mod.rs
index 7beafbebcd..173d1755bc 100644
--- a/crates/aft/src/lsp/mod.rs
+++ b/crates/aft/src/lsp/mod.rs
@@ -2,6 +2,8 @@ mod applicability_cache;
 pub mod child_registry;
 pub mod client;
 pub(crate) mod completed_rust_check;
+#[cfg(feature = "test-hooks")]
+pub use completed_rust_check::FingerprintProbe;
 mod diagnostic_registration;
 pub mod diagnostics;
 pub mod document;
diff --git a/crates/aft/src/main.rs b/crates/aft/src/main.rs
index 1ef756dc2e..31409ed8ca 100644
--- a/crates/aft/src/main.rs
+++ b/crates/aft/src/main.rs
@@ -1454,6 +1454,9 @@ thread_local! {
     /// Runs inside `dispatch` after the request pinned its config snapshot.
     static DISPATCH_CONFIG_PROBE: std::cell::RefCell<Option<Box<dyn Fn(&AppContext)>>> =
         const { std::cell::RefCell::new(None) };
+    // Transferred to the next deferred worker on this test thread only.
+    static DEFERRED_DISPATCH_PROBE: std::cell::RefCell<Option<Box<dyn FnOnce(&AppContext) + Send>>> =
+        const { std::cell::RefCell::new(None) };
 }
 
 #[cfg(test)]
@@ -1698,7 +1701,7 @@ fn deferred_tool_call_name(req: &RawRequest) -> Option<&str> {
     let bare_name = name.strip_prefix("aft_").unwrap_or(name);
     (matches!(
         bare_name,
-        "search" | "inspect" | "read" | "bash" | "powershell"
+        "search" | "grep" | "inspect" | "read" | "bash" | "powershell"
     ) || aft::commands::lsp_navigation::is_lsp_navigation_command(bare_name))
     .then_some(name)
 }
@@ -1732,10 +1735,16 @@ fn handle_dispatch_deferred(req: RawRequest, ctx: Arc<AppContext>) -> DispatchOu
     let (tx, rx) = mpsc::sync_channel(1);
     let admitted_config = ctx.config();
     let ask_route = aft::access_policy::capture_ask_route();
+    #[cfg(test)]
+    let probe = DEFERRED_DISPATCH_PROBE.with(|probe| probe.borrow_mut().take());
     thread::spawn(move || {
         let _ask_route = ask_route.install();
         let _cancellation = aft::executor::install_job_cancellation(worker_cancellation);
         let _config_pin = ctx.pin_config_to(admitted_config);
+        #[cfg(test)]
+        if let Some(probe) = probe {
+            probe(&ctx);
+        }
         let command = req.command.clone();
         let id = req.id.clone();
         complete_deferred_dispatch(
@@ -1853,7 +1862,10 @@ fn dispatch_outcome_on_route(req: RawRequest, ctx: &Arc<AppContext>) -> Dispatch
     // snapshot even if a live config reload publishes while it runs.
     let _config_pin = ctx.pin_config();
     aft::commands::tool_call::register_dispatch(dispatch);
-    if is_semantic_search_request(&req) || deferred_tool_call_name(&req).is_some() {
+    if is_semantic_search_request(&req)
+        || req.command == "grep"
+        || deferred_tool_call_name(&req).is_some()
+    {
         return handle_dispatch_deferred(req, Arc::clone(ctx));
     }
     if req.command == "inspect" {
@@ -3456,6 +3468,7 @@ mod deferred_semantic_search_tests {
     fn every_bare_deferred_route_has_a_deferred_tool_call_wrapper() {
         for name in [
             "search",
+            "grep",
             "inspect",
             "read",
             "bash",
@@ -3485,6 +3498,84 @@ mod deferred_semantic_search_tests {
         assert_eq!(deferred_tool_call_name(&prefixed), Some("aft_inspect"));
     }
 
+    #[test]
+    fn deferred_grep_preserves_bytes_and_admission_order_without_blocking_status() {
+        for name in ["grep", "tool_call", "aft_grep"] {
+            let root = tempfile::tempdir().expect("create grep project");
+            let file = root.path().join("fixture.txt");
+            std::fs::write(&file, "before\n").unwrap();
+            let ctx = Arc::new(
+                AppContext::new(
+                    Box::new(TreeSitterProvider::new()),
+                    crate::context_storage::isolate(Config {
+                        project_root: Some(root.path().to_path_buf()),
+                        ..Config::default()
+                    }),
+                )
+                .with_test_checkpoint_store(),
+            );
+            // An inline edit completes before the following grep is admitted.
+            let edited = dispatch(
+                request(
+                    "preceding-edit",
+                    "write",
+                    serde_json::json!({"file": file, "content": "after\n"}),
+                ),
+                &ctx,
+            );
+            assert!(edited.success, "{edited:?}");
+            let args = serde_json::json!({"path": file, "pattern": "after"});
+            let make_request = || {
+                if name == "grep" {
+                    request("parity-grep", "grep", args.clone())
+                } else {
+                    request(
+                        "parity-grep",
+                        "tool_call",
+                        serde_json::json!({
+                            "name": if name == "tool_call" { "grep" } else { name },
+                            "arguments": args
+                        }),
+                    )
+                }
+            };
+            aft::commands::tool_call::register_dispatch(dispatch);
+            let mut expected = dispatch(make_request(), &ctx);
+            assert_eq!(expected.success, name != "aft_grep", "{expected:?}");
+            let (entered_tx, entered_rx) = mpsc::sync_channel(1);
+            let (release_tx, release_rx) = mpsc::sync_channel(1);
+            super::DEFERRED_DISPATCH_PROBE.with(|probe| {
+                *probe.borrow_mut() = Some(Box::new(move |ctx| {
+                    entered_tx.send(()).unwrap();
+                    release_rx.recv_timeout(Duration::from_secs(10)).unwrap();
+                    assert!(!ctx.config().restrict_to_project_root);
+                }));
+            });
+            let mut pending = register_deferred(dispatch_outcome(make_request(), &ctx));
+            entered_rx.recv_timeout(Duration::from_secs(10)).unwrap();
+            let started = Instant::now();
+            let status = dispatch_outcome(
+                request("sibling-status", "status", serde_json::json!({})),
+                &ctx,
+            );
+            assert!(matches!(status, DispatchOutcome::Immediate(response) if response.success));
+            assert!(pending.poll_ready(&ctx).is_empty());
+            eprintln!("deferred {name} sibling status: {:?}", started.elapsed());
+            // A later configuration publication must not change this grep's pin.
+            ctx.update_config(|config| config.restrict_to_project_root = true);
+            release_tx.send(()).unwrap();
+            let mut actual = wait_for_response(&ctx, &mut pending);
+            // Native grep includes elapsed time; tool_call returns rendered text.
+            expected.data.as_object_mut().unwrap().remove("search_ms");
+            actual.data.as_object_mut().unwrap().remove("search_ms");
+            assert_eq!(
+                serde_json::to_vec(&actual).unwrap(),
+                serde_json::to_vec(&expected).unwrap()
+            );
+            assert!(ctx.config().restrict_to_project_root);
+        }
+    }
+
     #[test]
     fn deferred_tool_call_search_preserves_inline_response_bytes() {
         let root = tempfile::tempdir().expect("create search project");
diff --git a/crates/aft/src/migrate_storage.rs b/crates/aft/src/migrate_storage.rs
index 614bd94ff2..3858b97f33 100644
--- a/crates/aft/src/migrate_storage.rs
+++ b/crates/aft/src/migrate_storage.rs
@@ -1053,7 +1053,7 @@ fn atomic_write_json<T: Serialize>(path: &Path, value: &T) -> io::Result<()> {
 
 fn sync_path(path: &Path) {
     if let Ok(file) = File::open(path) {
-        let _ = file.sync_all();
+        let _ = aft_store::sync::sync_all(&file, path);
     }
 }
 
diff --git a/crates/aft/src/page_collect/snapshot.rs b/crates/aft/src/page_collect/snapshot.rs
index 535b804efb..f445fa7de0 100644
--- a/crates/aft/src/page_collect/snapshot.rs
+++ b/crates/aft/src/page_collect/snapshot.rs
@@ -354,7 +354,7 @@ impl SnapshotSink for Builder {
             .create_new(true)
             .open(self.dir.join(&disk_name))?;
         file.write_all(bytes)?;
-        file.sync_all()?;
+        aft_store::sync::sync_all(&file, &self.dir.join(&disk_name))?;
         let record = FileRecord {
             path: path.to_string(),
             size: bytes.len() as u64,
diff --git a/crates/aft/src/path_identity.rs b/crates/aft/src/path_identity.rs
index 622adbf5bf..a2b5107e5a 100644
--- a/crates/aft/src/path_identity.rs
+++ b/crates/aft/src/path_identity.rs
@@ -112,12 +112,33 @@ fn directory_is_system_tree(directory: &Path) -> bool {
 /// directory scopes, which also exclude root-level containers.
 /// Unknown protected-directory identities must not admit background work.
 pub(crate) fn project_root_is_narrow(directory: &Path, home: &Path, volume: &Path) -> Option<bool> {
-    if !project_root_path_is_narrow(directory, home, volume) {
+    if !project_root_path_is_narrow(directory, home, volume)
+        || project_root_is_shared_temp(directory)
+    {
         return Some(false);
     }
     protected_directory_alias(directory, home, volume).map(|protected| !protected)
 }
 
+/// Shared temporary roots hold other applications' files on any mount layout.
+/// Compare canonical paths, not prefixes, so projects below them stay enabled.
+fn project_root_is_shared_temp(directory: &Path) -> bool {
+    let directory = crate::access_policy::policy_path(directory);
+    let platform_temp = std::env::temp_dir();
+    let roots = std::iter::once(platform_temp.as_path());
+    #[cfg(unix)]
+    let roots = roots.chain([
+        Path::new("/tmp"),
+        Path::new("/var/tmp"),
+        Path::new("/private/tmp"),
+        Path::new("/private/var/tmp"),
+    ]);
+    let shared = roots
+        .filter_map(|root| ProjectRootId::from_path(root).ok())
+        .any(|root| crate::access_policy::policy_path(&root.into_path_buf()) == directory);
+    shared
+}
+
 fn project_root_path_is_narrow(directory: &Path, home: &Path, volume: &Path) -> bool {
     directory.is_absolute()
         && directory.parent().is_some()
@@ -434,6 +455,74 @@ pub(crate) fn lexical_normalize(path: &Path) -> PathBuf {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn platform_temp_root_is_broad_but_tempdir_projects_are_narrow() {
+        let root = super::ProjectRootId::from_path(&std::env::temp_dir())
+            .unwrap()
+            .into_path_buf();
+        assert!(super::project_root_is_shared_temp(&root));
+        let project = tempfile::tempdir().unwrap();
+        let project = project.path().canonicalize().unwrap();
+        assert!(!super::project_root_is_shared_temp(&project));
+        assert_eq!(
+            super::project_root_is_narrow(&root, &project, root.ancestors().last().unwrap()),
+            Some(false)
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn named_shared_temp_roots_use_canonical_identities() {
+        for name in ["/tmp", "/var/tmp"] {
+            let root = super::ProjectRootId::from_path(std::path::Path::new(name))
+                .unwrap()
+                .into_path_buf();
+            assert!(super::project_root_is_shared_temp(&root), "{name}");
+            assert!(!super::project_root_is_shared_temp(
+                &root.join("my-scratch-project")
+            ));
+        }
+    }
+
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn macos_private_temp_forms_and_platform_temp_are_broad() {
+        for name in [
+            std::path::PathBuf::from("/private/tmp"),
+            std::path::PathBuf::from("/private/var/tmp"),
+            std::env::temp_dir(),
+        ] {
+            let root = super::ProjectRootId::from_path(&name)
+                .unwrap()
+                .into_path_buf();
+            assert!(
+                super::project_root_is_shared_temp(&root),
+                "{}",
+                name.display()
+            );
+            assert_eq!(
+                super::project_root_is_narrow(&root, &root.join("home"), std::path::Path::new("/")),
+                Some(false)
+            );
+            assert!(!super::project_root_is_shared_temp(
+                &root.join("my-scratch-project")
+            ));
+        }
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn windows_temp_root_uses_the_canonical_platform_identity() {
+        let temp = std::env::temp_dir();
+        let root = super::ProjectRootId::from_path(&temp)
+            .unwrap()
+            .into_path_buf();
+        assert!(super::project_root_is_shared_temp(&root));
+        assert!(!super::project_root_is_shared_temp(
+            &root.join("my-scratch-project")
+        ));
+    }
+
     #[test]
     fn project_root_volume_children_are_not_permission_scopes() {
         let volume = tempfile::tempdir().unwrap();
@@ -576,7 +665,8 @@ mod tests {
     #[cfg(target_os = "linux")]
     mod mount_table {
         use super::super::{
-            mount_root_in, project_root_path_is_narrow, project_root_volume_with, MountRoot,
+            mount_root_in, project_root_is_shared_temp, project_root_path_is_narrow,
+            project_root_volume_with, MountRoot,
         };
         use std::path::{Path, PathBuf};
 
@@ -589,7 +679,25 @@ mod tests {
                 project_root_volume_with(root, root.to_path_buf(), Some(home), read, |_| {
                     Some(PathBuf::from("/"))
                 });
-            volume.is_some_and(|volume| project_root_path_is_narrow(root, home, &volume))
+            volume.is_some_and(|volume| {
+                project_root_path_is_narrow(root, home, &volume)
+                    && !project_root_is_shared_temp(root)
+            })
+        }
+
+        #[test]
+        fn shared_temp_roots_are_broad_on_bind_and_tmpfs_mounts() {
+            for root in ["/tmp", "/var/tmp"] {
+                assert!(!narrow(
+                    root,
+                    &format!("1801 1748 8:1 /tmp {root} rw - ext4 /dev/sda1 rw")
+                ));
+                assert!(!narrow(
+                    root,
+                    &format!("1801 1748 0:45 / {root} rw - tmpfs tmpfs rw")
+                ));
+                assert!(narrow(&format!("{root}/my-scratch-project"), &format!("1801 1748 8:1 /tmp/project {root}/my-scratch-project rw - ext4 /dev/sda1 rw")));
+            }
         }
 
         fn narrow(root: &str, mount: &str) -> bool {
diff --git a/crates/aft/src/persisted_format.rs b/crates/aft/src/persisted_format.rs
index 233a8cbd44..afb1933153 100644
--- a/crates/aft/src/persisted_format.rs
+++ b/crates/aft/src/persisted_format.rs
@@ -756,6 +756,18 @@ pub(crate) fn try_floor_refusal_counts() -> Option<std::collections::BTreeMap<St
     Some(counts)
 }
 
+/// Whether a reader-floor refusal for `store` stands for any storage root.
+/// While none does, [`gate`] can refuse an artifact only for its own version,
+/// so a reader re-checking an artifact it has already gated, unchanged, need
+/// not resolve which storage root owns it.
+pub(crate) fn has_floor_refusal(store: PersistedStore) -> bool {
+    with_registry(|entries| {
+        entries
+            .iter()
+            .any(|entry| entry.refusal.store == store && !entry.refusal.source.is_artifact())
+    })
+}
+
 fn with_registry<T>(f: impl FnOnce(&mut Vec<Entry>) -> T) -> T {
     let mut guard = registry()
         .lock()
diff --git a/crates/aft/src/pinned_executable.rs b/crates/aft/src/pinned_executable.rs
index d829df2dec..94e9d7601b 100644
--- a/crates/aft/src/pinned_executable.rs
+++ b/crates/aft/src/pinned_executable.rs
@@ -472,7 +472,7 @@ fn materialize(
                 output.write_all(&buffer[..count])?;
                 offset += count as u64;
             }
-            output.sync_all()?;
+            aft_store::sync::sync_all(&output, destination)?;
             output.set_permissions(std::fs::Permissions::from_mode(0o500))?;
         }
     }
@@ -797,11 +797,12 @@ mod tests {
                 ),
             ]);
             let command = format!(
-                ": > ready-{mode}; while [ ! -f release ]; do /bin/sleep 0.02; done; \
+                ": > ready-{mode}; {}; \
                  printf '%s\\n' \"$(command -v gh)\" \"$AFT_GH_SHIMS_DIR\" \"$AFT_GH_SHIM_BINARY\" \"$PATH\" > resolved-{mode}; \
                  gh --list pinned_executable_cleanup_preserves_live_owner > output-{mode} 2>&1; \
                  shim_status=$?; \"$AFT_GH_SHIM_BINARY\" --list pinned_executable_cleanup_preserves_live_owner > binary-output-{mode} 2>&1; \
-                 printf '%s:%s' \"$shim_status\" \"$?\" > status-{mode}.tmp; /bin/mv status-{mode}.tmp status-{mode}"
+                 printf '%s:%s' \"$shim_status\" \"$?\" > status-{mode}.tmp; /bin/mv status-{mode}.tmp status-{mode}",
+                crate::test_gate::gate("release", "/bin/sleep 0.02")
             );
             let plan = if mode == "host" {
                 use crate::sandbox_spawn::{
diff --git a/crates/aft/src/process_io.rs b/crates/aft/src/process_io.rs
index b21423542c..b999d454ca 100644
--- a/crates/aft/src/process_io.rs
+++ b/crates/aft/src/process_io.rs
@@ -167,7 +167,7 @@ pub fn assert_darwin_logical_bytes_observe_file_write() {
     let before = Bytes::capture().unwrap();
     let mut file = std::fs::File::create(dir.path().join("bytes")).unwrap();
     file.write_all(&vec![0x5a; 8 * 1024 * 1024]).unwrap();
-    file.sync_all().unwrap();
+    aft_store::sync::sync_all(&file, &dir.path().join("bytes")).unwrap();
     let delta = Bytes::capture().unwrap().delta(before).unwrap();
     assert!(
         delta.logical >= 8 * 1024 * 1024,
diff --git a/crates/aft/src/runtime_drain.rs b/crates/aft/src/runtime_drain.rs
index 15b8c272fa..02c2d6dfe5 100644
--- a/crates/aft/src/runtime_drain.rs
+++ b/crates/aft/src/runtime_drain.rs
@@ -128,7 +128,7 @@ fn note_scoped_ignore_rule_refresh_for_test() {}
 #[cfg(not(test))]
 fn note_ignore_rule_refresh_for_test() {}
 
-fn ignore_rule_refresh_now() -> Instant {
+pub(crate) fn ignore_rule_refresh_now() -> Instant {
     #[cfg(test)]
     if let Some(now) = IGNORE_RULE_REFRESH_TEST_NOW.with(std::cell::Cell::get) {
         return now;
@@ -1578,7 +1578,6 @@ fn rebuild_gitignore_for_drain(
 }
 
 pub fn drain_watcher_events_bounded(ctx: &AppContext, max_paths: usize) -> DrainBatchOutcome {
-    let _in_flight = ctx.watcher_drain_guard();
     let started = watcher_drain_now();
     let configure_generation = ctx.configure_generation();
     let content_generation = ctx.configure_content_generation();
@@ -1598,6 +1597,14 @@ pub fn drain_watcher_events_bounded(ctx: &AppContext, max_paths: usize) -> Drain
         return outcome;
     }
     ctx.record_checkout_pending_watcher_gap();
+    // Off-loop queries run concurrently with maintenance. An empty pass moves
+    // no events, so it must not mark their answer incomplete. Leave later
+    // arrivals in the channel for the next guarded pass.
+    if !ctx.watcher_drain_has_work_snapshot() {
+        ctx.tick_tier2_refresh_scheduler(0);
+        return outcome;
+    }
+    let _in_flight = ctx.watcher_drain_guard();
     let mut state = match ctx.watcher_drain_slice().lock().take() {
         Some(state) if state.configure_generation == configure_generation => state,
         // Lifecycle-only generation change (transient unbind + equivalent
@@ -1615,7 +1622,9 @@ pub fn drain_watcher_events_bounded(ctx: &AppContext, max_paths: usize) -> Drain
     let mut root_deleted = false;
 
     {
-        let rx_ref = ctx.watcher_rx().lock();
+        // The slot protects receiver identity, not event application. Keep it
+        // available to pending-change snapshots while this guarded drain does I/O.
+        let rx_ref = ctx.watcher_rx().lock().clone();
         // Idle verification must also run when no watcher receiver is installed.
         while let Some(rx) = rx_ref.as_ref() {
             match rx.try_recv() {
@@ -2732,6 +2741,8 @@ mod tests {
     #[test]
     fn ignore_rule_refresh_armed_during_unbind_replays_after_rebind() {
         let _reset = begin_ignore_rule_refresh_test();
+        // Keep the injected deadline ahead of wall time even on a slow runner.
+        set_ignore_rule_refresh_now_for_test(Some(Instant::now() + Duration::from_secs(60)));
         let temp = tempfile::tempdir().unwrap();
         let root = std::fs::canonicalize(temp.path()).unwrap();
         let (ctx, tx) = watcher_context(&root);
@@ -2752,6 +2763,27 @@ mod tests {
         assert!(state.ignore_changed_paths.is_empty());
     }
 
+    #[test]
+    fn healthy_root_metadata_probe_does_not_mark_queries_pending() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = std::fs::canonicalize(temp.path()).unwrap();
+        let (ctx, _tx) = watcher_context(&root);
+        assert!(!ctx.watcher_query_has_pending_changes());
+
+        let stopped = ctx.try_cleanup_deleted_root_with_probe(ctx.configure_generation(), |path| {
+            // A filesystem probe can be slow without moving any watcher events.
+            // Capture a query while the probe is running, not after it returns.
+            assert!(
+                !ctx.watcher_query_has_pending_changes(),
+                "checking an existing root must not manufacture pending changes"
+            );
+            std::fs::metadata(path)
+        });
+
+        assert!(!stopped);
+        assert!(!ctx.watcher_query_has_pending_changes());
+    }
+
     #[test]
     fn watcher_semantic_phase_batches_invalidation_into_one_retain_pass() {
         // This checks batching within one slice, not filesystem latency. Keep
diff --git a/crates/aft/src/sandbox_spawn.rs b/crates/aft/src/sandbox_spawn.rs
index 05bea9057b..c425ab91a1 100644
--- a/crates/aft/src/sandbox_spawn.rs
+++ b/crates/aft/src/sandbox_spawn.rs
@@ -433,7 +433,11 @@ pub(crate) fn save_local_launch(
     .map_err(|e| e.to_string())?;
     use std::io::Write;
     file.flush().map_err(|e| e.to_string())?;
-    file.sync_all().map_err(|e| e.to_string())?;
+    aft_store::sync::sync_all(
+        &file,
+        &prepared.0.dirs.control.path().join(REMOTE_LOCAL_LAUNCH),
+    )
+    .map_err(|e| e.to_string())?;
     let mut hash = blake3::Hasher::new();
     hash.update(prepared.0.paths.task_id.as_bytes());
     hash.update(&bytes);
@@ -2253,23 +2257,10 @@ fn build_relaxed_profile(
             }
         }
         stores.read_metadata_allow.extend(metadata);
-        let listing = git_policy_output(root, &["worktree", "list", "--porcelain", "-z"])
-            .map_err(|error| format!("cannot enumerate sibling checkouts: {error}"))?;
-        if listing.status.success() {
-            for field in listing.stdout.split(|byte| *byte == 0) {
-                if let Some(path) = field.strip_prefix(b"worktree ") {
-                    use std::os::unix::ffi::OsStrExt;
-                    let path = PathBuf::from(OsStr::from_bytes(path));
-                    if !roots.contains(&path) {
-                        checkout_denies.push(path);
-                    }
-                }
+        for path in git_worktree_paths(root, git)? {
+            if !roots.contains(&path) {
+                checkout_denies.push(path);
             }
-        } else if !git.read_roots.is_empty() {
-            return Err(format!(
-                "cannot enumerate sibling checkouts: {}",
-                String::from_utf8_lossy(&listing.stderr)
-            ));
         }
     }
     let storage = ctx.storage_dir();
@@ -2452,6 +2443,105 @@ fn macos_account_home() -> Result<PathBuf, String> {
     Ok(path)
 }
 
+/// Every checkout `git worktree list` reports for `root`'s repository.
+///
+/// A listing is reused from the policy's answers while the policy's inputs
+/// (configuration, environment, Git executable, `.git` topology) and the
+/// worktree registrations Git reads are provably unchanged, so registering,
+/// removing or repointing a worktree always reaches the next profile.
+#[cfg(unix)]
+fn git_worktree_paths(root: &Path, git: &GitPolicy) -> Result<Vec<PathBuf>, String> {
+    let answers = git.answers.as_ref().filter(|answers| answers.current(root));
+    if let Some(answers) = answers {
+        let known = answers
+            .worktrees
+            .lock()
+            .unwrap_or_else(|error| error.into_inner());
+        if let Some(known) = known
+            .as_ref()
+            .filter(|known| known.inputs.filesystem_unchanged())
+        {
+            return Ok(known.worktrees.clone());
+        }
+    }
+    // Record the registrations before Git reads them and publish the listing
+    // only if nothing changed while it ran.
+    let registrations =
+        answers.and_then(|answers| git_worktree_registration_inputs(&answers.common_dir));
+    let listing = git_policy_output(root, &["worktree", "list", "--porcelain", "-z"])
+        .map_err(|error| format!("cannot enumerate sibling checkouts: {error}"))?;
+    if !listing.status.success() {
+        if git.read_roots.is_empty() {
+            return Ok(Vec::new());
+        }
+        return Err(format!(
+            "cannot enumerate sibling checkouts: {}",
+            String::from_utf8_lossy(&listing.stderr)
+        ));
+    }
+    let worktrees = listing
+        .stdout
+        .split(|byte| *byte == 0)
+        .filter_map(|field| field.strip_prefix(b"worktree "))
+        .map(|path| {
+            use std::os::unix::ffi::OsStrExt;
+            PathBuf::from(OsStr::from_bytes(path))
+        })
+        .collect::<Vec<_>>();
+    if let (Some(answers), Some(inputs)) = (answers, registrations) {
+        if inputs.filesystem_unchanged() && answers.current(root) {
+            *answers
+                .worktrees
+                .lock()
+                .unwrap_or_else(|error| error.into_inner()) = Some(KnownWorktreeListing {
+                inputs,
+                worktrees: worktrees.clone(),
+            });
+        }
+    }
+    Ok(worktrees)
+}
+
+/// The filesystem state `git worktree list` reads beyond the policy inputs:
+/// the entry names of `<common>/worktrees`, each entry's `gitdir` file, and,
+/// for a relative `gitdir`, the location it resolves to (Git reports that
+/// through `realpath`). The main worktree's path comes from the common
+/// directory, which the policy cache key and inputs already pin. `None` when
+/// any of it cannot be recorded, which keeps the listing uncached.
+#[cfg(unix)]
+fn git_worktree_registration_inputs(common_dir: &Path) -> Option<GitPolicyInputs> {
+    use std::os::unix::ffi::OsStrExt;
+
+    let mut inputs = GitPolicyInputs::filesystem_only();
+    let registrations = common_dir.join("worktrees");
+    inputs.watch(&registrations)?;
+    let names = sorted_dir_names(&registrations)?;
+    for name in names.iter().flatten() {
+        let entry = registrations.join(name);
+        let gitdir = entry.join("gitdir");
+        inputs.watch(&gitdir)?;
+        let contents = match std::fs::read(&gitdir) {
+            Ok(contents) => contents,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => continue,
+            Err(_) => return None,
+        };
+        let mut location = contents.as_slice();
+        // Git trims trailing `isspace` bytes, which include vertical tab.
+        while let [rest @ .., last] = location {
+            if !matches!(last, b' ' | b'\t' | b'\n' | b'\r' | 0x0b | 0x0c) {
+                break;
+            }
+            location = rest;
+        }
+        let location = location.strip_suffix(b"/.git").unwrap_or(location);
+        if !location.is_empty() && !location.starts_with(b"/") {
+            inputs.watch(&entry.join(OsStr::from_bytes(location)))?;
+        }
+    }
+    inputs.listed_dirs.push((registrations, names));
+    Some(inputs)
+}
+
 /// Build the same control-file denies for project and granted write roots,
 /// including a linked worktree's common Git directory. Backends that cannot
 /// enforce nested denies report those paths as unenforced.
@@ -3178,6 +3268,96 @@ struct GitPolicy {
     linked: Option<(PathBuf, PathBuf)>,
     configured_paths: Vec<(String, PathBuf)>,
     metadata_allow: Vec<PathBuf>,
+    /// Git answers the profile builders would otherwise re-query on every
+    /// spawn. Present only when the policy's Git inputs were provable.
+    answers: Option<Arc<GitPolicyAnswers>>,
+}
+
+/// Policy settings whose absence the profile builders re-check on each spawn.
+#[cfg(unix)]
+const REPOSITORY_HOOK_KEYS: [&str; 2] = ["core.hooksPath", "mason.originalHooksPath"];
+
+/// Every path setting a Git policy reads, whose `:(optional)` targets the
+/// cached inputs track.
+#[cfg(unix)]
+const POLICY_PATH_KEYS: [&str; 3] = [
+    "core.hooksPath",
+    "mason.originalHooksPath",
+    "core.excludesFile",
+];
+
+/// Answers Git gave while a policy was resolved, which the sandbox profile
+/// builders reuse instead of starting Git again on every bash spawn.
+///
+/// Sandbox invariant: an answer is reused only while every input Git read to
+/// produce it is provably unchanged. Each consumer re-checks `inputs` (file
+/// identities, environment and Git executable; no subprocess) right before
+/// use, so a configuration edit made after the policy was resolved reaches the
+/// profile exactly as a fresh Git read would. Anything that cannot be proved
+/// falls back to asking Git.
+#[cfg(unix)]
+struct GitPolicyAnswers {
+    /// The input snapshot taken before any of these answers were read.
+    inputs: GitPolicyInputs,
+    common_dir: PathBuf,
+    /// Effective values of `REPOSITORY_HOOK_KEYS`, as the late consumer read
+    /// would return them.
+    hook_values: Option<Vec<(&'static str, Option<String>)>>,
+    /// `git worktree list` paths, filled by the first profile that needs them.
+    worktrees: Mutex<Option<KnownWorktreeListing>>,
+}
+
+#[cfg(unix)]
+impl std::fmt::Debug for GitPolicyAnswers {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("GitPolicyAnswers")
+            .field("common_dir", &self.common_dir)
+            .finish_non_exhaustive()
+    }
+}
+
+#[cfg(all(test, unix))]
+thread_local! {
+    /// Makes the profile builders ignore stored answers and ask Git, as they
+    /// did before answers existed. Only the manual spawn benchmark sets it.
+    static GIT_POLICY_IGNORE_ANSWERS: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
+}
+
+#[cfg(unix)]
+impl GitPolicyAnswers {
+    fn current(&self, project_root: &Path) -> bool {
+        #[cfg(test)]
+        if GIT_POLICY_IGNORE_ANSWERS.with(|value| value.get()) {
+            return false;
+        }
+        self.inputs.unchanged(project_root)
+    }
+
+    /// The stored values of `keys`, if every one of them is still provably
+    /// what Git would return.
+    fn hook_values(&self, project_root: &Path, keys: &[&str]) -> Option<Vec<Option<String>>> {
+        let known = self.hook_values.as_ref()?;
+        let values = keys
+            .iter()
+            .map(|key| {
+                known
+                    .iter()
+                    .find(|(known_key, _)| known_key == key)
+                    .map(|(_, value)| value.clone())
+            })
+            .collect::<Option<Vec<_>>>()?;
+        self.current(project_root).then_some(values)
+    }
+}
+
+#[cfg(unix)]
+struct KnownWorktreeListing {
+    /// The worktree registrations Git read: the `worktrees` directory's entry
+    /// names and each entry's `gitdir` file. Configuration, environment and the
+    /// Git executable are covered by the owning answers' inputs.
+    inputs: GitPolicyInputs,
+    worktrees: Vec<PathBuf>,
 }
 
 #[cfg(unix)]
@@ -3466,10 +3646,56 @@ struct GitPolicyInputs {
     executable: PathBuf,
     files: BTreeMap<PathBuf, Option<GitInputIdentity>>,
     resolved_paths: Vec<(PathBuf, PathBuf)>,
+    /// Directories whose entry names Git enumerates, with the sorted names
+    /// (`None` when the directory was absent).
+    listed_dirs: Vec<(PathBuf, Option<Vec<OsString>>)>,
+    /// Raw values of `POLICY_PATH_KEYS` in every configuration source Git
+    /// listed while these inputs were recorded. Not compared on reuse: the
+    /// watched source files already cover them.
+    policy_path_values: Vec<Vec<u8>>,
+    /// Each `:(optional)` target among `policy_path_values`, with whether it
+    /// existed. `git config --path` drops an optional value whose target is
+    /// missing, so the effective setting changes when such a target appears
+    /// or disappears although no configuration changed. `None` when a value
+    /// uses a form whose expansion cannot be proved unchanged; the policy is
+    /// then cached as before, but its answers are withheld.
+    optional_targets: Option<Vec<(PathBuf, bool)>>,
+}
+
+/// Sorted entry names of `dir`: `Some(None)` when it is absent, `None` when it
+/// cannot be read.
+#[cfg(unix)]
+fn sorted_dir_names(dir: &Path) -> Option<Option<Vec<OsString>>> {
+    match std::fs::read_dir(dir) {
+        Ok(entries) => {
+            let mut names = entries
+                .map(|entry| entry.map(|entry| entry.file_name()))
+                .collect::<std::io::Result<Vec<_>>>()
+                .ok()?;
+            names.sort_unstable();
+            Some(Some(names))
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Some(None),
+        Err(_) => None,
+    }
 }
 
 #[cfg(unix)]
 impl GitPolicyInputs {
+    /// Inputs that record only filesystem state, for answers whose
+    /// environment and executable another snapshot already covers.
+    fn filesystem_only() -> Self {
+        Self {
+            environment: Vec::new(),
+            executable: PathBuf::new(),
+            files: BTreeMap::new(),
+            resolved_paths: Vec::new(),
+            listed_dirs: Vec::new(),
+            policy_path_values: Vec::new(),
+            optional_targets: Some(Vec::new()),
+        }
+    }
+
     fn watch(&mut self, path: &Path) -> Option<()> {
         // Include parent identities: a config symlink or any ancestor can be
         // retargeted without changing the inode of the previously read target.
@@ -3557,13 +3783,23 @@ impl GitPolicyInputs {
     fn unchanged(&self, project_root: &Path) -> bool {
         self.environment == git_policy_environment(project_root)
             && git_policy_executable().as_ref() == Some(&self.executable)
-            && self.files.iter().all(|(path, identity)| {
-                git_input_identity(path).is_ok_and(|current| current == *identity)
-            })
-            && self.resolved_paths.iter().all(|(path, expected)| {
-                canonicalize_policy_path(path.clone(), "cached Git policy")
-                    .is_ok_and(|current| current == *expected)
-            })
+            && self.filesystem_unchanged()
+    }
+
+    fn filesystem_unchanged(&self) -> bool {
+        self.files.iter().all(|(path, identity)| {
+            git_input_identity(path).is_ok_and(|current| current == *identity)
+        }) && self.resolved_paths.iter().all(|(path, expected)| {
+            canonicalize_policy_path(path.clone(), "cached Git policy")
+                .is_ok_and(|current| current == *expected)
+        }) && self
+            .listed_dirs
+            .iter()
+            .all(|(dir, names)| sorted_dir_names(dir).is_some_and(|current| current == *names))
+            && self
+                .optional_targets
+                .as_ref()
+                .is_none_or(|targets| optional_targets_unchanged(targets))
     }
 }
 
@@ -3695,8 +3931,7 @@ fn git_policy_inputs(
     let mut inputs = GitPolicyInputs {
         environment,
         executable: git_policy_executable()?,
-        files: BTreeMap::new(),
-        resolved_paths: Vec::new(),
+        ..GitPolicyInputs::filesystem_only()
     };
     // Git's compiled-in system-config location can change if its executable is
     // replaced, or another git appears earlier on PATH.
@@ -3749,6 +3984,10 @@ fn git_policy_inputs(
         inputs.watch(&config)?;
     }
     let discovered = git_policy_config_inputs(project_root, &mut inputs)?;
+    // Sampled before the policy's `--path` reads and compared again before the
+    // policy is cached, so a target that appears while Git runs is never
+    // recorded as current.
+    inputs.optional_targets = git_optional_path_targets(project_root, &inputs);
     // Includes are discovered after Git reads them. Repeat discovery with every
     // first-pass file already watched so an edit cannot hide a new dependency.
     let mut verified = inputs.clone();
@@ -3756,6 +3995,7 @@ fn git_policy_inputs(
     if discovered != rediscovered
         || inputs.files != verified.files
         || inputs.resolved_paths != verified.resolved_paths
+        || inputs.policy_path_values != verified.policy_path_values
         || !inputs.unchanged(project_root)
     {
         return None;
@@ -3786,6 +4026,7 @@ fn git_policy_config_inputs(
     }
 
     let mut discovered = HashSet::new();
+    inputs.policy_path_values.clear();
     let mut fields = output.stdout.split(|byte| *byte == 0);
     loop {
         let Some(origin) = fields.next() else {
@@ -3801,6 +4042,12 @@ fn git_policy_config_inputs(
             None => (record, &b""[..]),
         };
         let origin_file = git_config_origin_path(project_root, origin);
+        if POLICY_PATH_KEYS
+            .iter()
+            .any(|name| key.eq_ignore_ascii_case(name.as_bytes()))
+        {
+            inputs.policy_path_values.push(value.to_vec());
+        }
         if let Some(path) = &origin_file {
             inputs.watch(path)?;
             discovered.insert(path.clone());
@@ -4082,6 +4329,7 @@ fn resolve_git_policy_uncached(
                     linked: None,
                     configured_paths: Vec::new(),
                     metadata_allow: Vec::new(),
+                    answers: None,
                 },
                 None,
             ));
@@ -4198,28 +4446,76 @@ fn resolve_git_policy_uncached(
     let (hooks_input, hooks) = resolve_hooks_path(project_root, &common_dir)?;
     let mut metadata_allow = Vec::new();
     let mut configured_paths = Vec::new();
-    let keys = if worker {
-        &[
-            "core.hooksPath",
-            "mason.originalHooksPath",
-            "core.excludesFile",
-        ][..]
+    // Workers record these settings in the policy itself. Other roles only
+    // store the hook settings as reusable answers, and only when the inputs
+    // can prove them current later; otherwise the consumer reads them itself.
+    let queried: &[&'static str] = if worker {
+        &POLICY_PATH_KEYS
+    } else if inputs.is_some() {
+        &REPOSITORY_HOOK_KEYS
     } else {
         &[]
     };
-    for (key, input, path) in
-        configured_git_paths_with_inputs(project_root, keys, &mut metadata_allow, &mut inputs)?
+    let values = if queried.is_empty()
+        || !project_root.join(".git").exists()
+        || !crate::developer_tools::git_usable()
     {
-        if let Some(inputs) = &mut inputs {
-            inputs.resolved_paths.push((input, path.clone()));
+        None
+    } else if worker {
+        Some(configured_git_path_values(project_root, queried)?)
+    } else {
+        // A failed read only withholds the answer: the consumer then queries
+        // Git itself and reports its own error.
+        configured_git_path_values(project_root, queried).ok()
+    };
+    if worker {
+        if let Some(values) = &values {
+            for (key, input, path) in configured_git_paths_from_values(
+                project_root,
+                queried,
+                values.clone(),
+                &mut metadata_allow,
+                &mut inputs,
+            )? {
+                if let Some(inputs) = &mut inputs {
+                    inputs.resolved_paths.push((input, path.clone()));
+                }
+                configured_paths.push((key, path));
+            }
         }
-        configured_paths.push((key, path));
     }
     // Re-resolve canonical paths on hits so creation of, or changes to, symlinks
     // in hooks/excludes paths cannot leave a deny pointing at the old target.
     if let Some(inputs) = &mut inputs {
         inputs.resolved_paths.push((hooks_input, hooks.clone()));
     }
+    // The answers stay valid only while the inputs, recorded before these
+    // reads, are unchanged; that includes every optional target's existence.
+    let hook_values = values
+        .filter(|_| {
+            inputs
+                .as_ref()
+                .is_some_and(|inputs| inputs.optional_targets.is_some())
+        })
+        .map(|values| {
+            queried
+                .iter()
+                .copied()
+                .zip(values)
+                .filter(|(key, _)| REPOSITORY_HOOK_KEYS.contains(key))
+                .collect()
+        });
+    let answers = inputs
+        .as_ref()
+        .filter(|inputs| git_config_candidates_exact(inputs))
+        .map(|inputs| {
+            Arc::new(GitPolicyAnswers {
+                inputs: inputs.clone(),
+                common_dir: common_dir.clone(),
+                hook_values,
+                worktrees: Mutex::new(None),
+            })
+        });
     let linked = (git_dir != common_dir).then(|| (git_dir.clone(), common_dir.clone()));
     let read_roots = {
         let mut read_roots = vec![git_dir, common_dir];
@@ -4234,11 +4530,96 @@ fn resolve_git_policy_uncached(
             linked,
             configured_paths,
             metadata_allow,
+            answers,
         },
         inputs,
     ))
 }
 
+/// Whether every candidate configuration file Git may read is watched.
+/// `git var` lists candidates one per line, so a candidate path containing a
+/// newline cannot be split back out of its output and stays unwatched; the
+/// answers would then miss a configuration file created at that path.
+#[cfg(unix)]
+fn git_config_candidates_exact(inputs: &GitPolicyInputs) -> bool {
+    use std::os::unix::ffi::OsStrExt;
+
+    !inputs.executable.as_os_str().as_bytes().contains(&b'\n')
+        && inputs
+            .environment
+            .iter()
+            .filter(|(key, _)| {
+                matches!(
+                    key.to_str(),
+                    Some("HOME" | "XDG_CONFIG_HOME" | "GIT_CONFIG_GLOBAL" | "GIT_CONFIG_SYSTEM")
+                )
+            })
+            .all(|(_, value)| !value.as_bytes().contains(&b'\n'))
+}
+
+/// The `:(optional)` targets among the raw hook-setting values Git listed,
+/// each with whether it exists now. `None` when a value uses a form whose
+/// expansion depends on something not watched (`~user`, `%(prefix)/`, other
+/// path magic) or a target's existence cannot be read.
+#[cfg(unix)]
+fn git_optional_path_targets(
+    project_root: &Path,
+    inputs: &GitPolicyInputs,
+) -> Option<Vec<(PathBuf, bool)>> {
+    use std::os::unix::ffi::OsStrExt;
+
+    let home = inputs
+        .environment
+        .iter()
+        .find(|(key, _)| key == "HOME")
+        .map(|(_, value)| PathBuf::from(value));
+    let mut targets = Vec::new();
+    for value in &inputs.policy_path_values {
+        let home_relative = |path: &[u8]| path == b"~" || path.starts_with(b"~/");
+        let Some(path) = value.strip_prefix(b":(optional)") else {
+            // `~user` expands through the account database, which no input
+            // watches; unknown path magic may depend on anything.
+            if value.starts_with(b":(") || (value.starts_with(b"~") && !home_relative(value)) {
+                return None;
+            }
+            continue;
+        };
+        let target = if path.starts_with(b"/") {
+            PathBuf::from(OsStr::from_bytes(path))
+        } else if home_relative(path) {
+            let suffix = path[1..].strip_prefix(b"/").unwrap_or(&path[1..]);
+            home.as_ref()?.join(OsStr::from_bytes(suffix))
+        } else if path.starts_with(b"~") || path.starts_with(b"%(") || path.starts_with(b":(") {
+            return None;
+        } else {
+            // Git runs with `-C project_root`, so a relative target is
+            // checked from there.
+            project_root.join(OsStr::from_bytes(path))
+        };
+        let exists = git_optional_target_exists(&target)?;
+        targets.push((target, exists));
+    }
+    Some(targets)
+}
+
+/// Git treats an optional target as missing only when `stat` reports that it
+/// does not exist; any other error makes Git fail instead.
+#[cfg(unix)]
+fn git_optional_target_exists(path: &Path) -> Option<bool> {
+    match std::fs::metadata(path) {
+        Ok(_) => Some(true),
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => Some(false),
+        Err(_) => None,
+    }
+}
+
+#[cfg(unix)]
+fn optional_targets_unchanged(targets: &[(PathBuf, bool)]) -> bool {
+    targets
+        .iter()
+        .all(|(path, exists)| git_optional_target_exists(path) == Some(*exists))
+}
+
 #[cfg(unix)]
 fn resolve_hooks_path(
     project_root: &Path,
@@ -4316,14 +4697,16 @@ fn resolve_hooks_path(
 
 /// Read missing keys again at the deny/grant consumer. A cached absence is not
 /// proof that a key remains unset: optional targets or configuration files can
-/// appear, or settings can change, after the earlier policy resolution.
+/// appear, or settings can change, after the earlier policy resolution. The
+/// values Git returned while the policy was resolved are reused only while
+/// those inputs are provably unchanged; otherwise Git is asked again.
 #[cfg(unix)]
 fn resolve_missing_repository_hooks(
     project_root: &Path,
     git: &GitPolicy,
     metadata_allow: &mut Vec<PathBuf>,
 ) -> Result<Vec<PathBuf>, String> {
-    let missing = ["core.hooksPath", "mason.originalHooksPath"]
+    let missing = REPOSITORY_HOOK_KEYS
         .into_iter()
         .filter(|key| {
             !git.configured_paths
@@ -4331,8 +4714,21 @@ fn resolve_missing_repository_hooks(
                 .any(|(existing, _)| existing == *key)
         })
         .collect::<Vec<_>>();
-    configured_git_paths_with_inputs(project_root, &missing, metadata_allow, &mut None)
-        .map(|paths| paths.into_iter().map(|(_, _, path)| path).collect())
+    let known = (!missing.is_empty())
+        .then(|| git.answers.as_ref())
+        .flatten()
+        .and_then(|answers| answers.hook_values(project_root, &missing));
+    let paths = match known {
+        Some(values) => configured_git_paths_from_values(
+            project_root,
+            &missing,
+            values,
+            metadata_allow,
+            &mut None,
+        ),
+        None => configured_git_paths_with_inputs(project_root, &missing, metadata_allow, &mut None),
+    };
+    paths.map(|paths| paths.into_iter().map(|(_, _, path)| path).collect())
 }
 
 /// Resolve operator-owned Git path settings before any command-supplied
@@ -4351,6 +4747,18 @@ fn configured_git_paths_with_inputs(
         return Ok(Vec::new());
     }
     let values = configured_git_path_values(project_root, keys)?;
+    configured_git_paths_from_values(project_root, keys, values, metadata_allow, inputs)
+}
+
+/// Turn the values Git returned for `keys` into watched, resolved paths.
+#[cfg(unix)]
+fn configured_git_paths_from_values(
+    project_root: &Path,
+    keys: &[&str],
+    values: Vec<Option<String>>,
+    metadata_allow: &mut Vec<PathBuf>,
+    inputs: &mut Option<GitPolicyInputs>,
+) -> Result<Vec<(String, PathBuf, PathBuf)>, String> {
     let mut paths = Vec::new();
     for (key, value) in keys.iter().zip(values) {
         let Some(value) = value else {
@@ -8171,13 +8579,9 @@ mod git_policy_cache_tests {
                     linked: None,
                     configured_paths: Vec::new(),
                     metadata_allow: Vec::new(),
+                    answers: None,
                 },
-                inputs: GitPolicyInputs {
-                    environment: Vec::new(),
-                    executable: PathBuf::new(),
-                    files: BTreeMap::new(),
-                    resolved_paths: Vec::new(),
-                },
+                inputs: GitPolicyInputs::filesystem_only(),
             }
         }
 
@@ -8226,20 +8630,28 @@ mod git_policy_cache_tests {
     }
 
     #[test]
-    fn git_policy_cache_worker_denies_keep_late_repository_reads() {
+    fn git_policy_cache_denies_reuse_validated_repository_reads() {
         let fixture = Fixture::new();
         let (policy, _) = fixture.resolve();
         let before = fixture.state(|state| state.calls);
         checkout_control_denies(&fixture.root, &policy).unwrap();
-        assert!(
-            fixture.state(|state| state.calls) > before,
-            "missing worker settings require an authoritative late read"
+        assert_eq!(
+            fixture.state(|state| state.calls),
+            before,
+            "an unset worker setting is answered from the validated resolution"
         );
 
+        // An edit after resolution, consumed with the same policy and no new
+        // resolution, must still reach the denies as a fresh Git read would.
         let config = fixture.root.join(".git/config");
         let mut contents = std::fs::read_to_string(&config).unwrap();
         contents.push_str("[mason]\noriginalHooksPath = new-original\n");
         std::fs::write(config, contents).unwrap();
+        let before = fixture.state(|state| state.calls);
+        let denies = checkout_control_denies(&fixture.root, &policy).unwrap();
+        assert!(denies.contains(&fixture.root.join("new-original")));
+        assert!(fixture.state(|state| state.calls) > before);
+
         let (changed, calls) = fixture.resolve();
         assert!(
             calls > 0,
@@ -8250,15 +8662,295 @@ mod git_policy_cache_tests {
         assert!(denies.contains(&fixture.root.join("new-original")));
         assert_eq!(fixture.state(|state| state.calls), before);
 
-        let head = with_worker_jail(false, || resolve_git_policy(&fixture.root)).unwrap();
-        let before = fixture.state(|state| state.calls);
-        let denies = checkout_control_denies(&fixture.root, &head).unwrap();
-        assert!(denies.contains(&fixture.root.join("new-original")));
+        for _ in 0..2 {
+            let head = with_worker_jail(false, || resolve_git_policy(&fixture.root)).unwrap();
+            let before = fixture.state(|state| state.calls);
+            let denies = checkout_control_denies(&fixture.root, &head).unwrap();
+            assert!(denies.contains(&fixture.root.join("new-original")));
+            assert!(denies.contains(&fixture.root.join("first-hooks")));
+            assert_eq!(
+                fixture.state(|state| state.calls),
+                before,
+                "head-policy hook settings are answered from the validated resolution"
+            );
+        }
+    }
+
+    fn commit(root: &Path) {
+        let commit = git_policy_output(
+            root,
+            &[
+                "-c",
+                "user.name=Cache Test",
+                "-c",
+                "user.email=cache@example.invalid",
+                "commit",
+                "--quiet",
+                "--allow-empty",
+                "-m",
+                "cache fixture",
+            ],
+        )
+        .unwrap();
+        assert!(commit.status.success(), "{commit:?}");
+    }
+
+    fn git_ok(root: &Path, args: &[&str]) {
+        let output = git_policy_output(root, args).unwrap();
+        assert!(output.status.success(), "git {args:?}: {output:?}");
+    }
+
+    /// What `git worktree list` reports right now, read directly from Git.
+    fn fresh_worktrees(root: &Path) -> Vec<PathBuf> {
+        use std::os::unix::ffi::OsStrExt;
+
+        let output = git_policy_output(root, &["worktree", "list", "--porcelain", "-z"]).unwrap();
+        assert!(output.status.success(), "{output:?}");
+        output
+            .stdout
+            .split(|byte| *byte == 0)
+            .filter_map(|field| field.strip_prefix(b"worktree "))
+            .map(|path| PathBuf::from(OsStr::from_bytes(path)))
+            .collect()
+    }
+
+    /// Every Git read a profile builder makes for one control root.
+    fn profile_reads(root: &Path, git: &GitPolicy) -> (Vec<PathBuf>, Vec<PathBuf>) {
+        let denies = checkout_control_denies(root, git).unwrap();
+        resolve_missing_repository_hooks(root, git, &mut Vec::new()).unwrap();
+        (denies, git_worktree_paths(root, git).unwrap())
+    }
+
+    #[test]
+    fn git_policy_cache_hit_profile_reads_start_no_git() {
+        let fixture = Fixture::new();
+        commit(&fixture.root);
+        for worker in [true, false] {
+            let resolve = || with_worker_jail(worker, || resolve_git_policy(&fixture.root));
+            let policy = resolve().unwrap();
+            profile_reads(&fixture.root, &policy);
+            let before = fixture.state(|state| (state.calls, state.hits));
+            let policy = resolve().unwrap();
+            let (denies, worktrees) = profile_reads(&fixture.root, &policy);
+            let after = fixture.state(|state| (state.calls, state.hits));
+            assert_eq!(after.1, before.1 + 1, "worker={worker} must be a cache hit");
+            assert_eq!(after.0, before.0, "worker={worker} hit started Git");
+            assert!(denies.contains(&fixture.root.join("first-hooks")));
+            assert_eq!(worktrees, vec![fixture.root.clone()]);
+            assert_eq!(worktrees, fresh_worktrees(&fixture.root));
+        }
+    }
+
+    #[test]
+    fn git_policy_cache_worktree_listing_follows_registrations() {
+        use std::os::unix::fs::symlink;
+
+        let fixture = Fixture::new();
+        commit(&fixture.root);
+        let root = fixture.root.clone();
+        // Lists through the cached answers, checks the result against Git (and
+        // `expected`, when given) and returns how many Git helpers the cached
+        // listing started.
+        let listed = |expected: Option<&[PathBuf]>| {
+            let (policy, _) = fixture.resolve();
+            let before = fixture.state(|state| state.calls);
+            let worktrees = git_worktree_paths(&root, &policy).unwrap();
+            let calls = fixture.state(|state| state.calls) - before;
+            if let Some(expected) = expected {
+                assert_eq!(worktrees, expected);
+            }
+            assert_eq!(worktrees, fresh_worktrees(&root));
+            calls
+        };
+        let main = [root.clone()];
+        listed(Some(&main));
+        assert_eq!(listed(Some(&main)), 0);
+
+        let first = root.join("first-linked");
+        git_ok(
+            &root,
+            &[
+                "worktree",
+                "add",
+                "--quiet",
+                "--detach",
+                first.to_str().unwrap(),
+                "HEAD",
+            ],
+        );
+        let expected = [root.clone(), first.clone()];
+        assert_eq!(
+            listed(Some(&expected)),
+            1,
+            "a new worktree must invalidate the listing"
+        );
+        assert_eq!(listed(Some(&expected)), 0);
+
+        let moved = root.join("moved-linked-worktree");
+        git_ok(
+            &root,
+            &[
+                "worktree",
+                "move",
+                first.to_str().unwrap(),
+                moved.to_str().unwrap(),
+            ],
+        );
+        let expected = [root.clone(), moved.clone()];
+        assert_eq!(
+            listed(Some(&expected)),
+            1,
+            "a rewritten gitdir must invalidate the listing"
+        );
+        assert_eq!(listed(Some(&expected)), 0);
+
+        // Git resolves a relative gitdir through realpath, so retargeting a
+        // symlink on its path can change the listing without touching the file.
+        // Older Git prints the relative text unresolved; either way the cached
+        // listing must match what Git prints now.
+        let registration = std::fs::read_dir(root.join(".git/worktrees"))
+            .unwrap()
+            .next()
+            .unwrap()
+            .unwrap()
+            .path();
+        for target in ["real-a", "real-b"] {
+            std::fs::create_dir(root.join(target)).unwrap();
+        }
+        symlink("real-a", root.join("alias")).unwrap();
+        std::fs::write(registration.join("gitdir"), "../../../alias/.git\n").unwrap();
+        assert_eq!(listed(None), 1);
+        assert_eq!(listed(None), 0);
+        std::fs::remove_file(root.join("alias")).unwrap();
+        symlink("real-b", root.join("alias")).unwrap();
         assert_eq!(
-            fixture.state(|state| state.calls) - before,
-            2,
-            "both missing head-policy keys share one extension probe and one local scope read"
+            listed(None),
+            1,
+            "a retargeted gitdir symlink must invalidate"
         );
+        assert_eq!(listed(None), 0);
+
+        std::fs::remove_dir_all(&registration).unwrap();
+        assert_eq!(listed(Some(&main)), 1, "a removed worktree must invalidate");
+        assert_eq!(listed(Some(&main)), 0);
+    }
+
+    #[test]
+    fn git_policy_cache_linked_listing_follows_replaced_git_pointer() {
+        let fixture = Fixture::new();
+        commit(&fixture.root);
+        let linked = fixture.root.join("linked");
+        git_ok(
+            &fixture.root,
+            &[
+                "worktree",
+                "add",
+                "--quiet",
+                "--detach",
+                linked.to_str().unwrap(),
+                "HEAD",
+            ],
+        );
+        let (policy, _) = fixture.resolve_at(&linked);
+        // Git helpers run for `linked` are counted in its own test state.
+        let calls = || with_git_policy_test_state(&linked, |state| state.calls).unwrap();
+        git_worktree_paths(&linked, &policy).unwrap();
+        let before = calls();
+        let worktrees = git_worktree_paths(&linked, &policy).unwrap();
+        assert_eq!(calls(), before);
+        assert_eq!(worktrees, fresh_worktrees(&linked));
+
+        // A replaced `.git` pointer file may name another repository; the
+        // stored answers must not be trusted until it is resolved again.
+        let pointer = std::fs::read_to_string(linked.join(".git")).unwrap();
+        std::fs::remove_file(linked.join(".git")).unwrap();
+        // The same repository through a longer spelling: the length change
+        // makes the replacement visible regardless of timestamp granularity.
+        assert!(pointer.contains("/worktrees/"), "{pointer}");
+        std::fs::write(
+            linked.join(".git"),
+            pointer.replacen("/worktrees/", "/./worktrees/", 1),
+        )
+        .unwrap();
+        let before = calls();
+        let missing = resolve_missing_repository_hooks(&linked, &policy, &mut Vec::new()).unwrap();
+        assert!(
+            calls() > before,
+            "hook answers must not survive the pointer"
+        );
+        let before = calls();
+        let worktrees = git_worktree_paths(&linked, &policy).unwrap();
+        assert!(calls() > before, "the listing must not survive the pointer");
+        assert_eq!(worktrees, fresh_worktrees(&linked));
+        let fresh = configured_git_paths_with_inputs(
+            &linked,
+            &REPOSITORY_HOOK_KEYS
+                .into_iter()
+                .filter(|key| !policy.configured_paths.iter().any(|(set, _)| set == key))
+                .collect::<Vec<_>>(),
+            &mut Vec::new(),
+            &mut None,
+        )
+        .unwrap()
+        .into_iter()
+        .map(|(_, _, path)| path)
+        .collect::<Vec<_>>();
+        assert_eq!(missing, fresh);
+    }
+
+    #[test]
+    fn git_policy_cache_hook_answers_follow_global_config_and_optional_targets() {
+        let fixture = Fixture::new();
+        let head = || with_worker_jail(false, || resolve_git_policy(&fixture.root)).unwrap();
+        let missing = |policy: &GitPolicy| {
+            let before = fixture.state(|state| state.calls);
+            let paths =
+                resolve_missing_repository_hooks(&fixture.root, policy, &mut Vec::new()).unwrap();
+            (paths, fixture.state(|state| state.calls) - before)
+        };
+        let fresh = || {
+            configured_git_paths_with_inputs(
+                &fixture.root,
+                &REPOSITORY_HOOK_KEYS,
+                &mut Vec::new(),
+                &mut None,
+            )
+            .unwrap()
+            .into_iter()
+            .map(|(_, _, path)| path)
+            .collect::<Vec<_>>()
+        };
+        let policy = head();
+        assert_eq!(missing(&policy), (fresh(), 0));
+
+        let target = fixture.root.join("optional-original");
+        std::fs::write(
+            fixture.root.join("global"),
+            format!(
+                "[mason]\noriginalHooksPath = :(optional){}\n",
+                target.display()
+            ),
+        )
+        .unwrap();
+        let (paths, calls) = missing(&policy);
+        assert!(
+            calls > 0,
+            "a created global config must invalidate the answers"
+        );
+        assert_eq!(paths, fresh());
+        let policy = head();
+        assert_eq!(missing(&policy), (fresh(), 0));
+
+        std::fs::create_dir(&target).unwrap();
+        let (paths, calls) = missing(&policy);
+        assert!(
+            calls > 0,
+            "a created optional target must invalidate the answers"
+        );
+        assert_eq!(paths, fresh());
+        assert!(paths.contains(&target));
+        let policy = head();
+        assert_eq!(missing(&policy), (fresh(), 0));
     }
 
     #[test]
@@ -8280,11 +8972,6 @@ mod git_policy_cache_tests {
         assert_eq!(fixture.resolve().1, 0);
 
         std::fs::create_dir(&target).unwrap();
-        let (cached, calls) = fixture.resolve();
-        assert_eq!(
-            calls, 0,
-            "optional-target existence is not tracked by the existing cache"
-        );
         let fresh = configured_git_paths_with_inputs(
             &fixture.root,
             &["mason.originalHooksPath"],
@@ -8293,11 +8980,23 @@ mod git_policy_cache_tests {
         )
         .unwrap();
         assert!(fresh.iter().any(|(_, _, path)| path == &target));
-        let denies = checkout_control_denies(&fixture.root, &cached).unwrap();
+        let denies = checkout_control_denies(&fixture.root, &policy).unwrap();
         assert!(
             denies.contains(&target),
-            "a late read must protect a newly present optional target"
+            "a policy resolved before the target appeared must not hide it"
         );
+        let (resolved, calls) = fixture.resolve();
+        assert!(
+            calls > 0,
+            "optional-target existence is a cached input: creating it must invalidate"
+        );
+        assert!(resolved
+            .configured_paths
+            .iter()
+            .any(|(key, path)| key == "mason.originalHooksPath" && path == &target));
+        let denies = checkout_control_denies(&fixture.root, &resolved).unwrap();
+        assert!(denies.contains(&target));
+        assert_eq!(fixture.resolve().1, 0);
     }
 
     #[test]
@@ -8445,6 +9144,103 @@ mod git_policy_cache_tests {
         );
     }
 
+    /// Measures worker bash start latency under the default relaxed worker
+    /// profile, alternating spawns that reuse the policy's stored Git answers
+    /// with spawns that ignore them and query Git as the builders did before.
+    /// Needs a separately built aft binary as the sandbox launcher.
+    #[test]
+    #[ignore = "manual Linux measurement; AFT_GIT_POLICY_BENCH_LAUNCHER names the aft binary"]
+    #[cfg(target_os = "linux")]
+    fn relaxed_worker_bash_spawn_latency() {
+        crate::effective_path::initialize_process_path();
+        let launcher = PathBuf::from(std::env::var_os("AFT_GIT_POLICY_BENCH_LAUNCHER").unwrap())
+            .canonicalize()
+            .unwrap();
+        let spawns = std::env::var("AFT_GIT_POLICY_BENCH_SPAWNS")
+            .ok()
+            .and_then(|value| value.parse::<usize>().ok())
+            .unwrap_or(200);
+        let fixture = Fixture::new();
+        let storage = tempfile::tempdir().unwrap();
+        let hooks = tempfile::tempdir().unwrap();
+        fixture.hooks(hooks.path().to_str().unwrap());
+        commit(&fixture.root);
+        let linked = tempfile::tempdir().unwrap();
+        let mut worktrees = Vec::new();
+        for index in 0..4 {
+            let root = linked.path().join(format!("worker-{index}"));
+            git_ok(
+                &fixture.root,
+                &[
+                    "worktree",
+                    "add",
+                    "--quiet",
+                    "--detach",
+                    root.to_str().unwrap(),
+                    "HEAD",
+                ],
+            );
+            worktrees.push(root);
+        }
+        let root = worktrees[0].clone();
+        fixture.register_root(&root);
+        let mut config = crate::config::Config::default();
+        config.project_root = Some(root.clone());
+        config.storage_dir = Some(storage.path().join("store"));
+        config.github.shim = false;
+        config.git.co_author = "off".into();
+        config.bash.linux_scope = false;
+        config.sandbox.profile.worker = SandboxMode::Relaxed;
+        let ctx = AppContext::new(Box::new(crate::parser::TreeSitterProvider::new()), config);
+        let _launcher = install_sandbox_launcher_for_test(&root, launcher);
+        let mut samples: [Vec<(f64, usize)>; 2] = [Vec::new(), Vec::new()];
+        // Two warm-up spawns fill the cache in both modes before sampling.
+        for index in 0..spawns * 2 + 2 {
+            let ignore_answers = index % 2 == 0;
+            GIT_POLICY_IGNORE_ANSWERS.with(|value| value.set(ignore_answers));
+            let before = with_git_policy_test_state(&root, |state| state.calls).unwrap();
+            let request: crate::protocol::RawRequest = serde_json::from_value(serde_json::json!({
+                "id": "spawn-latency", "command": "bash", "session_id": "spawn-latency",
+                "params": {"command": "true", "compressed": false}
+            }))
+            .unwrap();
+            let began = Instant::now();
+            // Unlike the strict benchmark, the relaxed Linux profile writes no
+            // marker files into account home directories, so no fixture home
+            // is needed.
+            let response = with_worker_jail(true, || crate::commands::bash::handle(&request, &ctx));
+            let elapsed = began.elapsed().as_secs_f64() * 1000.0;
+            let calls = with_git_policy_test_state(&root, |state| state.calls).unwrap() - before;
+            assert!(response.success, "{response:?}");
+            let id = response.data["task_id"].as_str().unwrap().to_string();
+            while !ctx.bash_background().is_task_terminal(&id) {
+                ctx.bash_background()
+                    .status(&id, "spawn-latency", None, None, 1024)
+                    .unwrap();
+                assert!(began.elapsed() < Duration::from_secs(15));
+                std::thread::sleep(Duration::from_millis(1));
+            }
+            if index >= 2 {
+                samples[usize::from(!ignore_answers)].push((elapsed, calls));
+            }
+        }
+        GIT_POLICY_IGNORE_ANSWERS.with(|value| value.set(false));
+        for (label, samples) in [("base", &samples[0]), ("answers", &samples[1])] {
+            let mut times = samples.iter().map(|(ms, _)| *ms).collect::<Vec<_>>();
+            times.sort_by(f64::total_cmp);
+            let percentile = |p: usize| times[(times.len() * p / 100).min(times.len() - 1)];
+            let helpers = samples.iter().map(|(_, calls)| *calls).sum::<usize>();
+            eprintln!(
+                "relaxed_spawn mode={label} spawns={} p50_ms={:.3} p90_ms={:.3} git_helpers_per_spawn={:.2}",
+                times.len(),
+                percentile(50),
+                percentile(90),
+                helpers as f64 / times.len() as f64
+            );
+        }
+        assert!(samples[1].iter().all(|(_, calls)| *calls == 0));
+    }
+
     /// Measures real worker bash starts under the strict sandbox profile. That
     /// profile launches each command through the aft binary, so the test needs
     /// a separately built one. All repositories, linked worktrees and task
@@ -10923,6 +11719,7 @@ mod policy_tests {
             linked: Some((own.clone(), common.clone())),
             configured_paths: Vec::new(),
             metadata_allow: Vec::new(),
+            answers: None,
         };
         let main = GitPolicy {
             read_roots: Vec::new(),
@@ -10930,6 +11727,7 @@ mod policy_tests {
             linked: None,
             configured_paths: Vec::new(),
             metadata_allow: Vec::new(),
+            answers: None,
         };
         let grants = linked_git_grants(&[linked, main]);
         assert_eq!(
@@ -10975,6 +11773,7 @@ mod policy_tests {
             linked: Some((own, common.clone())),
             configured_paths: Vec::new(),
             metadata_allow: Vec::new(),
+            answers: None,
         };
         let grants = worker_jail_grants(&home, &[worktree], &[git], &policy);
         let files = [
diff --git a/crates/aft/src/search_index.rs b/crates/aft/src/search_index.rs
index e326d25896..97144204b9 100644
--- a/crates/aft/src/search_index.rs
+++ b/crates/aft/src/search_index.rs
@@ -1,3 +1,10 @@
+//! Shared file-search helpers and the bounded unpublished-pattern corpus.
+//!
+//! Published roots are queried through the data layer's index store. The mutable
+//! trigram corpus remains only for explicit patterns against an unpublished
+//! external repository; grep/glob also reuse the snapshot's file scanner over
+//! candidates selected by the store. Unbounded index construction is test-only.
+
 // Only the debug-build trigram counter and test hooks use `Cell`.
 #[cfg(any(debug_assertions, test))]
 use std::cell::Cell;
@@ -124,9 +131,7 @@ pub struct SearchIndex {
     pub path_to_id: Arc<HashMap<PathBuf, u32>>,
     pub ready: bool,
     project_root: PathBuf,
-    git_head: Option<String>,
     max_file_size: u64,
-    ignore_rules_fingerprint: String,
     pub file_trigram_count: Arc<Vec<u32>>,
     unindexed_files: Arc<HashSet<u32>>,
 }
@@ -166,94 +171,6 @@ impl SearchIndex {
         self.delta.postings.len()
     }
 
-    /// Estimate resident postings and file-table bytes.
-    pub fn estimated_memory(&self) -> crate::memory::MemoryEstimate {
-        if self.delta.postings.is_empty()
-            && self.delta_file_trigrams.is_empty()
-            && self.files.is_empty()
-            && self.path_to_id.is_empty()
-            && self.file_trigram_count.is_empty()
-            && self.unindexed_files.is_empty()
-        {
-            return crate::memory::MemoryEstimate::estimated(0)
-                .count("files", 0)
-                .count("delta_trigrams", 0)
-                .count("delta_postings", 0)
-                .count("superseded_files", 0)
-                .count("unindexed_files", 0)
-                .count("base_lookup_entries", 0)
-                .count_u64("delta_packed_bytes", 0)
-                .count_u64("base_postings_resident_bytes", 0);
-        }
-        let delta_posting_count = self
-            .delta
-            .postings
-            .values()
-            .map(Vec::len)
-            .fold(0usize, usize::saturating_add);
-        let delta_postings_bytes = crate::memory::usize_to_u64(delta_posting_count)
-            .saturating_mul(std::mem::size_of::<Posting>() as u64)
-            .saturating_add(
-                crate::memory::usize_to_u64(self.delta.postings.len())
-                    .saturating_mul(std::mem::size_of::<u32>() as u64),
-            );
-        let delta_file_trigram_count = self
-            .delta_file_trigrams
-            .values()
-            .map(Vec::len)
-            .fold(0usize, usize::saturating_add);
-        let delta_file_table_bytes = crate::memory::usize_to_u64(delta_file_trigram_count)
-            .saturating_mul(std::mem::size_of::<u32>() as u64)
-            .saturating_add(
-                crate::memory::usize_to_u64(self.delta_file_trigrams.len())
-                    .saturating_mul(std::mem::size_of::<u32>() as u64),
-            );
-        let files_bytes = crate::memory::usize_to_u64(self.files.len())
-            .saturating_mul(std::mem::size_of::<FileEntry>() as u64)
-            .saturating_add(
-                self.files
-                    .iter()
-                    .map(|entry| crate::memory::path_bytes(&entry.path))
-                    .fold(0u64, u64::saturating_add),
-            );
-        let path_table_bytes = self.path_to_id.iter().fold(0u64, |bytes, (path, _)| {
-            bytes
-                .saturating_add(std::mem::size_of::<u32>() as u64)
-                .saturating_add(std::mem::size_of::<PathBuf>() as u64)
-                .saturating_add(crate::memory::path_bytes(path))
-        });
-        let file_count_table_bytes = crate::memory::usize_to_u64(self.file_trigram_count.len())
-            .saturating_mul(std::mem::size_of::<u32>() as u64);
-        let masks_bytes = crate::memory::usize_to_u64(self.unindexed_files.len())
-            .saturating_mul(std::mem::size_of::<u32>() as u64);
-        let metadata_bytes = crate::memory::path_bytes(&self.project_root)
-            .saturating_add(
-                self.git_head
-                    .as_ref()
-                    .map(|head| crate::memory::usize_to_u64(head.len()))
-                    .unwrap_or(0),
-            )
-            .saturating_add(crate::memory::usize_to_u64(
-                self.ignore_rules_fingerprint.len(),
-            ));
-        let estimated_bytes = delta_postings_bytes
-            .saturating_add(delta_file_table_bytes)
-            .saturating_add(files_bytes)
-            .saturating_add(path_table_bytes)
-            .saturating_add(file_count_table_bytes)
-            .saturating_add(masks_bytes)
-            .saturating_add(metadata_bytes);
-        crate::memory::MemoryEstimate::estimated(estimated_bytes)
-            .count("files", self.files.len())
-            .count("delta_trigrams", self.delta.postings.len())
-            .count("delta_postings", delta_posting_count)
-            .count("superseded_files", 0)
-            .count("unindexed_files", self.unindexed_files.len())
-            .count("base_lookup_entries", 0)
-            .count_u64("delta_packed_bytes", 0)
-            .count_u64("base_postings_resident_bytes", 0)
-    }
-
     /// Returns an immutable snapshot for queries. Callers must obtain the
     /// snapshot while holding the RwLock that protects the SearchIndex, then
     /// drop the guard before running expensive operations such as grep, glob, or
@@ -276,44 +193,10 @@ impl SearchIndex {
         query_trigrams_from_tokens(tokens)
     }
 
-    /// Score-rank file candidates by lexical relevance to query trigrams.
-    pub fn lexical_rank(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        max_files: usize,
-    ) -> std::io::Result<Vec<(PathBuf, f32)>> {
-        self.snapshot()
-            .lexical_rank_with_stats(query_trigrams, candidate_filter, max_files)
-            .map(|result| result.files)
-    }
-
     pub fn is_ready(&self) -> bool {
         self.ready
     }
 
-    /// Evaluates lexical candidates and scores them up to the specified depth limit, applying an optional candidate filter.
-    pub fn lexical_rank_at_depth(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        depth: usize,
-    ) -> std::io::Result<LexicalRankResult> {
-        self.snapshot()
-            .lexical_rank_at_depth(query_trigrams, candidate_filter, depth)
-    }
-
-    /// Discovers and ranks lexical candidates up to the specified depth limit, applying an optional candidate filter.
-    pub fn lexical_discovery_and_rank_at_depth(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        depth: usize,
-    ) -> std::io::Result<LexicalRankResult> {
-        self.snapshot()
-            .lexical_rank_at_depth(query_trigrams, candidate_filter, depth)
-    }
-
     /// Whole-corpus exact pass over the trigram index in ready mode.
     pub fn whole_corpus_exact_pass(
         &self,
@@ -324,18 +207,6 @@ impl SearchIndex {
         self.snapshot()
             .whole_corpus_exact_pass(query, search_root, candidate_filter)
     }
-
-    /// Score-rank file candidates and report whether the pre-filter step that
-    /// collects candidates reached its internal size limit before ranking.
-    pub fn lexical_rank_with_stats(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        max_files: usize,
-    ) -> std::io::Result<LexicalRankResult> {
-        self.snapshot()
-            .lexical_rank_with_stats(query_trigrams, candidate_filter, max_files)
-    }
 }
 
 impl SearchIndexSnapshot {
@@ -346,18 +217,6 @@ impl SearchIndexSnapshot {
         &self.files
     }
 
-    pub(crate) fn content_generation(&self) -> String {
-        let mut digest = blake3::Hasher::new();
-        digest.update(&self.max_file_size.to_be_bytes());
-        for file in self.files.iter() {
-            let path = file.path.as_os_str().as_encoded_bytes();
-            digest.update(&(path.len() as u64).to_be_bytes());
-            digest.update(path);
-            digest.update(file.content_hash.as_bytes());
-        }
-        digest.finalize().to_hex().to_string()
-    }
-
     /// Reuses the query engine over already verified, in-memory posting rows.
     /// This is a read projection, not a mutable index: it has no cache file or
     /// persistence path. Missing postings require direct verification by grep.
@@ -427,6 +286,7 @@ impl SearchIndexSnapshot {
         }
     }
 
+    #[cfg(test)]
     pub(crate) fn has_file_in_scope(&self, search_root: &Path) -> bool {
         let search_root = canonicalize_for_search_membership(search_root);
         self.files.iter().any(|file| {
@@ -434,83 +294,6 @@ impl SearchIndexSnapshot {
         })
     }
 
-    /// Score-rank file candidates and report whether the pre-filter step that
-    /// collects candidates reached its internal size limit before ranking.
-    pub fn lexical_rank_with_stats(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        max_files: usize,
-    ) -> std::io::Result<LexicalRankResult> {
-        if query_trigrams.is_empty() || max_files == 0 {
-            return Ok(LexicalRankResult::default());
-        }
-
-        let mut non_zero: Vec<(u32, usize)> = query_trigrams
-            .iter()
-            .filter_map(|trigram| {
-                let posting_count = self.posting_count(*trigram);
-                (posting_count > 0).then_some((*trigram, posting_count))
-            })
-            .collect();
-        if non_zero.is_empty() {
-            return Ok(LexicalRankResult::default());
-        }
-
-        non_zero.sort_unstable_by_key(|(_, posting_count)| *posting_count);
-        let selected_count = non_zero.len().min(3);
-        let candidate_cap = if selected_count == 3 { 200 } else { 500 };
-
-        // Candidate discovery needs only the three rarest trigrams, while scoring
-        // needs every query trigram. Materialize all lists once per query so both
-        // phases reuse the same disk-backed postings instead of rereading them for
-        // every candidate. Memory remains bounded by the query's posting lists.
-        let postings_by_trigram = materialize_query_postings(self, query_trigrams)?;
-        let mut candidate_ids = BTreeSet::new();
-        for (trigram, _) in non_zero.iter().take(selected_count) {
-            if let Some(postings) = postings_by_trigram.get(trigram) {
-                candidate_ids.extend(postings.iter().copied());
-            }
-        }
-        let pre_filter_candidate_count = candidate_ids.len();
-        let engine_capped = pre_filter_candidate_count > candidate_cap;
-        let filtered_candidates = candidate_ids
-            .into_iter()
-            .filter_map(|file_id| {
-                self.files
-                    .get(file_id as usize)
-                    .map(|entry| (file_id, entry))
-            })
-            .filter(|(_, entry)| {
-                if let Some(filter) = candidate_filter {
-                    filter(&entry.path)
-                } else {
-                    true
-                }
-            })
-            .collect::<Vec<_>>();
-
-        let mut ranked = Vec::new();
-        for (file_id, entry) in filtered_candidates.into_iter().take(candidate_cap) {
-            let score =
-                lexical_score_from_postings(self, query_trigrams, &postings_by_trigram, file_id);
-            if score > 0.0 {
-                ranked.push((entry.path.clone(), score));
-            }
-        }
-
-        #[cfg(test)]
-        crate::search_hot_path_measurements::record(|counts| {
-            counts.candidates_sorted += ranked.len()
-        });
-        ranked.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-        ranked.truncate(max_files);
-        Ok(LexicalRankResult {
-            files: ranked,
-            engine_capped,
-        })
-    }
-
     /// Evaluates lexical candidates and scores them up to the specified depth limit, applying an optional candidate filter.
     pub fn lexical_rank_at_depth(
         &self,
@@ -639,16 +422,6 @@ impl SearchIndexSnapshot {
         Ok(ranked)
     }
 
-    /// Discovers and ranks lexical candidates up to the specified depth limit, applying an optional candidate filter.
-    pub fn lexical_discovery_and_rank_at_depth(
-        &self,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        depth: usize,
-    ) -> std::io::Result<LexicalRankResult> {
-        self.lexical_rank_at_depth(query_trigrams, candidate_filter, depth)
-    }
-
     /// Indexed files under `search_root` that may hold `phrase`, compared
     /// ASCII case-insensitively with runs of whitespace treated alike. A file
     /// holding the phrase holds each of its whitespace-separated pieces, so
@@ -1374,14 +1147,13 @@ impl SearchIndex {
             path_to_id: Arc::new(HashMap::new()),
             ready: false,
             project_root: PathBuf::new(),
-            git_head: None,
             max_file_size: DEFAULT_MAX_FILE_SIZE,
-            ignore_rules_fingerprint: String::new(),
             file_trigram_count: Arc::new(Vec::new()),
             unindexed_files: Arc::new(HashSet::new()),
         }
     }
 
+    #[cfg(any(test, feature = "test-hooks"))]
     pub fn build(root: &Path) -> Self {
         Self::build_with_limit(root, DEFAULT_MAX_FILE_SIZE)
     }
@@ -1397,118 +1169,19 @@ impl SearchIndex {
         }
     }
 
+    /// Builds a fixture for tests of the bounded external-pattern engine.
+    /// Production queries may only populate a corpus through its bounded walk.
+    #[cfg(any(test, feature = "test-hooks"))]
     pub fn build_with_limit(root: &Path, max_file_size: u64) -> Self {
-        Self::build_in_memory(root, max_file_size, Instant::now())
-    }
-
-    fn build_in_memory(root: &Path, max_file_size: u64, started: Instant) -> Self {
-        Self::build_in_memory_cancellable(root, max_file_size, started, &|| true)
-            .expect("uncancellable in-memory search build")
-    }
-
-    fn build_in_memory_cancellable(
-        root: &Path,
-        max_file_size: u64,
-        started: Instant,
-        keep_going: &(dyn Fn() -> bool + Sync),
-    ) -> Option<Self> {
-        let _progress = crate::cold_build_limiter::progress::start(
-            root,
-            "trigram build",
-            None,
-            crate::cold_build_limiter::progress::StartLog::Info,
-        );
-        crate::cold_build_limiter::progress::phase("enumerating", None);
-        let project_root = fs::canonicalize(root).unwrap_or_else(|_| root.to_path_buf());
-        let mut index = SearchIndex {
-            project_root: project_root.clone(),
-            max_file_size,
-            ignore_rules_fingerprint: ignore_rules_fingerprint_cancellable(
-                &project_root,
-                keep_going,
-            )?,
-            ..SearchIndex::new()
-        };
-        let filters = PathFilters::default();
-        let paths = walk_build_files_cancellable(&index.project_root, &filters, keep_going)?;
-        crate::cold_build_limiter::progress::phase("indexing", Some(paths.len()));
-        let indexed = index.ingest_paths_parallel_cancellable(&paths, keep_going);
-        if !keep_going() {
-            return None;
-        }
-        index.git_head = current_git_head(&index.project_root);
-        index.ready = true;
-        crate::slog_info!(
-            "search index fallback build: {} files, {} trigrams, {} ms (pool={})",
-            indexed,
-            index.trigram_count(),
-            started.elapsed().as_millis(),
-            search_index_build_pool_size()
-        );
-        Some(index)
-    }
-
-    fn ingest_paths_parallel_cancellable(
-        &mut self,
-        paths: &[PathBuf],
-        keep_going: &(dyn Fn() -> bool + Sync),
-    ) -> usize {
-        let max_file_size = self.max_file_size;
-        let pool_size = search_index_build_pool_size();
-        let chunk_size = pool_size.saturating_mul(4).clamp(1, 32);
-        let pool = match rayon::ThreadPoolBuilder::new()
-            .num_threads(pool_size)
-            .thread_name(|index| format!("aft-rayon-search-build-{index}"))
-            .stack_size(8 * 1024 * 1024)
-            .build()
-        {
-            Ok(pool) => Some(pool),
-            Err(error) => {
-                log::warn!(
-                    "search index: bounded build pool unavailable ({error}); using global pool"
-                );
-                None
-            }
-        };
-
-        let mut indexed = 0usize;
-        for chunk in paths.chunks(chunk_size) {
-            if !keep_going() {
-                break;
-            }
-            let prepare_chunk = || -> Vec<PreparedSearchPath> {
-                chunk
-                    .par_iter()
-                    .map(|path| {
-                        if keep_going() {
-                            prepare_search_path(path, max_file_size)
-                        } else {
-                            PreparedSearchPath::Skipped
-                        }
-                    })
-                    .collect()
-            };
-            let prepared = match &pool {
-                Some(pool) => pool.install(prepare_chunk),
-                None => prepare_chunk(),
-            };
-
-            for (path, prepared) in chunk.iter().zip(prepared) {
-                let inserted = match prepared {
-                    PreparedSearchPath::Indexed(file) => self.index_prepared_new_file(path, file),
-                    PreparedSearchPath::Unindexed(metadata) => {
-                        self.track_unindexed_file_with_metadata(path, metadata)
-                    }
-                    PreparedSearchPath::Skipped => false,
-                };
-                if inserted {
-                    indexed += 1;
-                }
+        let root = fs::canonicalize(root).unwrap_or_else(|_| root.to_path_buf());
+        let mut index = Self::empty_ready_for_root(&root);
+        index.max_file_size = max_file_size;
+        for entry in project_walk_builder(&root).build().flatten() {
+            if entry.file_type().is_some_and(|kind| kind.is_file()) {
+                index.update_file(entry.path());
             }
-            crate::cold_build_limiter::progress::advance(chunk.len());
         }
-
-        indexed
+        index
     }
 
     pub fn index_file(&mut self, path: &Path, content: &[u8]) {
@@ -3226,16 +2899,6 @@ fn read_search_corpus_file_with_metadata(
     })
 }
 
-/// Returns the worker pool size for cold search-index builds: half of available
-/// cores, capped at 8 to keep the same limit used by the callgraph store.
-fn search_index_build_pool_size() -> usize {
-    std::thread::available_parallelism()
-        .map(|parallelism| parallelism.get())
-        .unwrap_or(1)
-        .div_ceil(2)
-        .clamp(1, 8)
-}
-
 fn ensure_count_slot(counts: &mut Vec<u32>, file_id: u32) {
     let len = file_id as usize + 1;
     if counts.len() < len {
@@ -3486,100 +3149,6 @@ fn lexical_score_from_postings(
     (hits as f32) / (1.0 + file_trigram_count.ln())
 }
 
-#[cfg(test)]
-fn lexical_rank_with_stats_reference(
-    index: &SearchIndexSnapshot,
-    query_trigrams: &[u32],
-    candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-    max_files: usize,
-) -> LexicalRankResult {
-    if query_trigrams.is_empty() || max_files == 0 {
-        return LexicalRankResult::default();
-    }
-
-    let mut non_zero: Vec<(u32, usize)> = query_trigrams
-        .iter()
-        .filter_map(|trigram| {
-            let posting_count = index.posting_count(*trigram);
-            (posting_count > 0).then_some((*trigram, posting_count))
-        })
-        .collect();
-    if non_zero.is_empty() {
-        return LexicalRankResult::default();
-    }
-
-    non_zero.sort_unstable_by_key(|(_, posting_count)| *posting_count);
-    let selected_count = non_zero.len().min(3);
-    let candidate_cap = if selected_count == 3 { 200 } else { 500 };
-
-    let mut candidate_ids = BTreeSet::new();
-    for (trigram, _) in non_zero.iter().take(selected_count) {
-        candidate_ids.extend(index.postings_for_trigram(*trigram, None).unwrap());
-    }
-    let pre_filter_candidate_count = candidate_ids.len();
-    let engine_capped = pre_filter_candidate_count > candidate_cap;
-    let filtered_candidates = candidate_ids
-        .into_iter()
-        .filter_map(|file_id| {
-            index
-                .files
-                .get(file_id as usize)
-                .map(|entry| (file_id, entry))
-        })
-        .filter(|(_, entry)| {
-            candidate_filter
-                .map(|filter| filter(&entry.path))
-                .unwrap_or(true)
-        })
-        .collect::<Vec<_>>();
-
-    let mut ranked = Vec::new();
-    for (file_id, entry) in filtered_candidates.into_iter().take(candidate_cap) {
-        let score = lexical_score_snapshot_reference(index, query_trigrams, file_id);
-        if score > 0.0 {
-            ranked.push((entry.path.clone(), score));
-        }
-    }
-
-    ranked.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
-    ranked.truncate(max_files);
-    LexicalRankResult {
-        files: ranked,
-        engine_capped,
-    }
-}
-
-#[cfg(test)]
-fn lexical_score_snapshot_reference(
-    index: &SearchIndexSnapshot,
-    query_trigrams: &[u32],
-    file_id: u32,
-) -> f32 {
-    if query_trigrams.is_empty() {
-        return 0.0;
-    }
-
-    let mut hits = 0u32;
-    for &trigram in query_trigrams {
-        let postings = index.postings_for_trigram(trigram, None).unwrap();
-        if postings.binary_search(&file_id).is_ok() {
-            hits += 1;
-        }
-    }
-
-    if hits == 0 {
-        return 0.0;
-    }
-
-    let file_trigram_count = index
-        .file_trigram_count
-        .get(file_id as usize)
-        .copied()
-        .unwrap_or(1)
-        .max(1) as f32;
-    (hits as f32) / (1.0 + file_trigram_count.ln())
-}
-
 /// Resolve a cache directory using configure's registered key when available.
 /// Persistent writers should pass their chosen key to `resolve_cache_dir_with_key`
 /// directly; callers without a configured project fall back to a Git probe.
@@ -3597,62 +3166,6 @@ pub(crate) fn build_path_filters(
     })
 }
 
-/// The in-memory corpus builder's cancellable file walk, read in chunks.
-struct BuildFileWalk<'a> {
-    root: &'a Path,
-    filters: &'a PathFilters,
-    walker: ignore::Walk,
-    finished: bool,
-}
-
-impl<'a> BuildFileWalk<'a> {
-    fn new(root: &'a Path, filters: &'a PathFilters) -> Self {
-        Self {
-            root,
-            filters,
-            walker: project_walk_builder(root).build(),
-            finished: false,
-        }
-    }
-
-    #[cfg(test)]
-    fn is_finished(&self) -> bool {
-        self.finished
-    }
-
-    /// The next `max` admitted files, or fewer when the walk ends first.
-    /// `keep_going` is checked before every walk entry; cancellation returns `None`.
-    fn next_chunk(&mut self, max: usize, keep_going: &dyn Fn() -> bool) -> Option<Vec<PathBuf>> {
-        let mut paths = Vec::new();
-        while paths.len() < max && !self.finished {
-            if !keep_going() {
-                return None;
-            }
-            let Some(entry) = self.walker.next() else {
-                self.finished = true;
-                break;
-            };
-            let Ok(entry) = entry else {
-                continue;
-            };
-            if entry.file_type().is_some_and(|kind| kind.is_file())
-                && self.filters.matches(self.root, entry.path())
-            {
-                paths.push(entry.into_path());
-            }
-        }
-        Some(paths)
-    }
-}
-
-fn walk_build_files_cancellable(
-    root: &Path,
-    filters: &PathFilters,
-    keep_going: &dyn Fn() -> bool,
-) -> Option<Vec<PathBuf>> {
-    BuildFileWalk::new(root, filters).next_chunk(usize::MAX, keep_going)
-}
-
 pub fn walk_project_files_bounded_default(
     root: &Path,
     max_files: usize,
@@ -4445,10 +3958,6 @@ pub(crate) fn is_binary_bytes(content: &[u8]) -> bool {
     content_inspector::inspect(content).is_binary()
 }
 
-pub(crate) fn current_git_head(root: &Path) -> Option<String> {
-    run_git(root, &["rev-parse", "HEAD"])
-}
-
 /// `storage_dir` is the root for rebuildable cache artifacts (see
 /// [`crate::bash_background::cache_artifact_root`]), not AFT's storage root
 /// for data that must survive (aft.db, backups).
@@ -5206,55 +4715,6 @@ mod tests {
         assert_eq!(sent.load(Ordering::SeqCst), 6);
     }
 
-    /// A tree that spans several walk chunks and has every kind of file the
-    /// build records: indexed, binary (unindexed) and over the size limit.
-    fn chunked_build_fixture(root: &Path) {
-        for dir in 0..5 {
-            let dir_path = root.join(format!("dir_{dir}")).join("nested");
-            fs::create_dir_all(&dir_path).unwrap();
-            for file in 0..30 {
-                fs::write(
-                    dir_path.join(format!("file_{file:02}.rs")),
-                    format!("fn marker_{dir}_{file}() {{ let shared_token = {file}; }}\n"),
-                )
-                .unwrap();
-            }
-        }
-        fs::write(root.join("binary.bin"), [0u8, 159, 146, 150, 0, 1, 2]).unwrap();
-        fs::write(root.join("large.txt"), "shared_token ".repeat(200)).unwrap();
-    }
-
-    #[test]
-    fn issue1007_chunked_build_walk_matches_collected_walk_and_cancels() {
-        let temp = tempfile::tempdir().unwrap();
-        let root = temp.path().canonicalize().unwrap();
-        chunked_build_fixture(&root);
-        let filters = PathFilters::default();
-        let collected = walk_build_files_cancellable(&root, &filters, &|| true).unwrap();
-        assert!(collected.len() > 100, "fixture must span several chunks");
-
-        let mut walk = BuildFileWalk::new(&root, &filters);
-        let mut chunked = Vec::new();
-        while !walk.is_finished() {
-            let chunk = walk.next_chunk(7, &|| true).unwrap();
-            assert!(chunk.len() <= 7);
-            chunked.extend(chunk);
-        }
-        assert_eq!(chunked, collected, "chunks must keep the walk's order");
-
-        let calls = AtomicUsize::new(0);
-        let mut walk = BuildFileWalk::new(&root, &filters);
-        assert!(walk.next_chunk(5, &|| true).is_some());
-        assert!(walk
-            .next_chunk(usize::MAX, &|| calls.fetch_add(1, Ordering::SeqCst) < 3)
-            .is_none());
-        assert_eq!(
-            calls.load(Ordering::SeqCst),
-            4,
-            "checked before every entry"
-        );
-    }
-
     #[test]
     fn semantic_namespaces_share_type_identity() {
         use std::any::TypeId;
@@ -5480,56 +4940,6 @@ mod tests {
         );
     }
 
-    fn lexical_rank_mixed_storage_fixture() -> (tempfile::TempDir, SearchIndex) {
-        let dir = tempfile::tempdir().expect("create temp dir");
-        let project = dir.path().join("project");
-        fs::create_dir_all(&project).expect("create project dir");
-        for index in 0..205 {
-            fs::write(
-                project.join(format!("file_{index:03}.txt")),
-                format!("abcdefghij sharedalpha marker_{index}"),
-            )
-            .expect("write base fixture file");
-        }
-
-        let mut index = SearchIndex::build(&project);
-
-        let replaced = project.join("file_000.txt");
-        index.remove_file(&replaced);
-        index.index_file(&replaced, b"abcdefghij sharedalpha replacement_delta");
-
-        let removed = project.join("file_001.txt");
-        index.remove_file(&removed);
-
-        let added = project.join("added_delta.txt");
-        fs::write(&added, "abcdefghij sharedalpha added_delta").expect("write delta file");
-        index.index_file(&added, b"abcdefghij sharedalpha added_delta");
-
-        assert!(!index.delta.postings.is_empty());
-        (dir, index)
-    }
-
-    fn assert_rank_matches_reference(
-        index: &SearchIndex,
-        query_trigrams: &[u32],
-        candidate_filter: Option<&dyn Fn(&Path) -> bool>,
-        max_files: usize,
-    ) -> LexicalRankResult {
-        let snapshot = index.snapshot();
-        let expected = lexical_rank_with_stats_reference(
-            &snapshot,
-            query_trigrams,
-            candidate_filter,
-            max_files,
-        );
-        let actual = snapshot
-            .lexical_rank_with_stats(query_trigrams, candidate_filter, max_files)
-            .unwrap();
-        assert_eq!(actual.files, expected.files);
-        assert_eq!(actual.engine_capped, expected.engine_capped);
-        actual
-    }
-
     #[test]
     fn cached_path_under_root_allows_missing_lexical_child() {
         let dir = tempfile::tempdir().expect("create temp dir");
@@ -5760,17 +5170,6 @@ mod tests {
         assert!(cached_path_under_root(&root, Path::new("link/secret.txt")).is_none());
     }
 
-    #[test]
-    fn trigram_memory_estimate_is_zero_when_empty_and_nonzero_when_populated() {
-        let mut index = SearchIndex::new();
-        assert_eq!(index.estimated_memory().estimated_bytes, Some(0));
-        index.index_file(Path::new("memory-estimate.rs"), b"fn memory_estimate() {}");
-        let estimate = index.estimated_memory();
-        assert!(estimate.estimated_bytes.unwrap() > 0);
-        assert!(estimate.counts["delta_postings"] > 0);
-        assert_eq!(estimate.counts["base_postings_resident_bytes"], 0);
-    }
-
     #[test]
     fn extract_trigrams_tracks_next_char_and_position() {
         let trigrams = extract_trigrams(b"Rust");
@@ -5946,49 +5345,6 @@ mod tests {
         assert_eq!(dirty_result.total_matches, reference_result.total_matches);
     }
 
-    #[test]
-    fn lexical_rank_cached_postings_match_reference_for_base_delta_and_superseded_files() {
-        let (_dir, index) = lexical_rank_mixed_storage_fixture();
-        let long_query = query_trigrams_from_tokens(&["abcdefghij"]);
-        assert!(long_query.len() > 3);
-        let long_result = assert_rank_matches_reference(&index, &long_query, None, 1_000);
-        assert!(long_result.engine_capped);
-
-        let short_query = query_trigrams_from_tokens(&["abc"]);
-        assert_eq!(short_query.len(), 1);
-        assert_rank_matches_reference(&index, &short_query, None, 100);
-
-        let mixed_query = query_trigrams_from_tokens(&["sharedalpha", "absentzzz"]);
-        let production_only = |path: &Path| !path.ends_with("file_002.txt");
-        assert_rank_matches_reference(&index, &mixed_query, Some(&production_only), 25);
-
-        let mut duplicate_query = query_trigrams_from_tokens(&["abcdefghij"]);
-        duplicate_query.push(duplicate_query[0]);
-        assert_rank_matches_reference(&index, &duplicate_query, None, 40);
-    }
-
-    #[cfg(debug_assertions)]
-    #[test]
-    fn lexical_rank_reads_each_distinct_query_posting_list_once() {
-        let (_dir, index) = lexical_rank_mixed_storage_fixture();
-        let mut query = query_trigrams_from_tokens(&["abcdefghij", "sharedalpha"]);
-        query.push(query[0]);
-        let distinct_trigrams = query.iter().copied().collect::<HashSet<_>>().len();
-
-        reset_postings_for_trigram_count_for_debug();
-        let result = index
-            .snapshot()
-            .lexical_rank_with_stats(&query, None, 1_000)
-            .unwrap();
-
-        assert!(result.files.len() > 1);
-        assert_eq!(
-            postings_for_trigram_count_for_debug(),
-            distinct_trigrams,
-            "candidate discovery and scoring must share query-local posting lists"
-        );
-    }
-
     #[test]
     fn cache_path_helpers_reject_absolute_and_parent_paths() {
         let root = PathBuf::from("/tmp/aft-project");
diff --git a/crates/aft/src/secret/consent.rs b/crates/aft/src/secret/consent.rs
index 233e1bfd58..bf52bf9dfd 100644
--- a/crates/aft/src/secret/consent.rs
+++ b/crates/aft/src/secret/consent.rs
@@ -13,6 +13,9 @@
 
 use crate::secret::SecretScope;
 
+#[cfg(test)]
+pub(crate) static TEST_TRANSPORT_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
 /// The consent kind a secret ask files under.
 pub const SECRET_CONSENT_KIND: &str = "secret_use";
 
@@ -31,6 +34,8 @@ pub struct SecretConsentRequest {
     pub request_id: String,
     /// The vault's statement bytes, base64url without padding.
     pub statement_b64url: String,
+    /// Bound the card by the HTTP request as well as the vault statement.
+    pub expires_at_ms: Option<u64>,
 }
 
 impl std::fmt::Debug for SecretConsentRequest {
@@ -47,9 +52,19 @@ impl std::fmt::Debug for SecretConsentRequest {
 /// What happened to a filed secret consent.
 #[derive(Clone, PartialEq, Eq)]
 pub enum ConsentOutcome {
-    /// Cingulate answered. Whatever it said, the caller must resolve again;
-    /// the answer alone grants nothing.
+    /// Cingulate allowed this request. Retry the vault once; only its release
+    /// authorizes substitution.
     Answered,
+    /// One-use approval. Preserve this distinction so a later card can be
+    /// announced as replacing a consumed one-use approval.
+    AnsweredOnce,
+    Declined,
+    Expired,
+    /// The caller left or the card was withdrawn; this is not a phone answer.
+    Cancelled,
+    /// The card was answered, but no trustworthy decision could be read.
+    /// This must not be retained as a person's answer or a filing failure.
+    Indeterminate,
     /// Still pending when the call's hold ended: the call ends
     /// `access_pending` and the retried call asks again.
     Pending,
@@ -65,6 +80,11 @@ impl std::fmt::Debug for ConsentOutcome {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
             ConsentOutcome::Answered => f.write_str("Answered"),
+            ConsentOutcome::AnsweredOnce => f.write_str("AnsweredOnce"),
+            ConsentOutcome::Declined => f.write_str("Declined"),
+            ConsentOutcome::Expired => f.write_str("Expired"),
+            ConsentOutcome::Cancelled => f.write_str("Cancelled"),
+            ConsentOutcome::Indeterminate => f.write_str("Indeterminate"),
             ConsentOutcome::Pending => f.write_str("Pending"),
             ConsentOutcome::Unavailable { detail } => f
                 .debug_struct("Unavailable")
@@ -80,10 +100,58 @@ impl std::fmt::Debug for ConsentOutcome {
 /// the ask through the daemon's Cingulate client and reports what happened.
 /// The trait exists so the outcome table can be tested without a daemon, and
 /// so a later transport shape changes only the installed dispatcher.
-pub trait SecretConsentTransport: Send + Sync {
+pub trait SecretConsentTransport: Send + Sync + 'static {
+    /// Keep cleanup on the daemon runtime, not a command's short-lived proxy.
+    fn runtime(&self) -> Option<tokio::runtime::Handle> {
+        None
+    }
+    /// Await one shared card. Production observes cancellation while awaiting
+    /// the Cingulate consent service and withdraws while the route is still
+    /// bound to the card's authorization scope.
+    fn wait(
+        self: std::sync::Arc<Self>,
+        request: SecretConsentRequest,
+        cancel: Cancellation,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ConsentOutcome> + Send>> {
+        Box::pin(async move {
+            let worker = self.clone();
+            let ask = request.clone();
+            let held_cancel = cancel.clone();
+            let held = tokio::task::spawn_blocking(move || {
+                if held_cancel.is_cancelled() {
+                    ConsentOutcome::Cancelled
+                } else {
+                    worker.hold(&ask, &held_cancel)
+                }
+            });
+            let outcome = tokio::select! {
+                biased;
+                () = cancel.cancelled() => ConsentOutcome::Cancelled,
+                result = held => result.unwrap_or(ConsentOutcome::Unavailable { detail: "Cingulate could not settle the secret-use card".into() }),
+            };
+            if matches!(
+                outcome,
+                ConsentOutcome::Cancelled
+                    | ConsentOutcome::Unavailable { .. }
+                    | ConsentOutcome::Indeterminate
+            ) {
+                let _ = tokio::task::spawn_blocking(move || self.withhold(&request)).await;
+            }
+            outcome
+        })
+    }
     /// File `request` and wait for the answer, or for the hold to end.
     fn file(&self, request: &SecretConsentRequest) -> ConsentOutcome;
 
+    /// File once and hold a proxy request for the full approval window.
+    fn hold(&self, request: &SecretConsentRequest, cancel: &Cancellation) -> ConsentOutcome {
+        if cancel.is_cancelled() {
+            ConsentOutcome::Cancelled
+        } else {
+            self.file(request)
+        }
+    }
+
     /// Settle a pending ask the call left behind.
     fn withhold(&self, request: &SecretConsentRequest) -> ConsentOutcome;
 }
@@ -98,6 +166,10 @@ static TRANSPORT: std::sync::LazyLock<
 
 /// Install the secret consent transport.
 pub fn install_transport(transport: Option<std::sync::Arc<dyn SecretConsentTransport>>) {
+    CARDS
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .clear();
     *TRANSPORT
         .lock()
         .unwrap_or_else(std::sync::PoisonError::into_inner) = transport;
@@ -123,6 +195,192 @@ pub fn file_consent(request: &SecretConsentRequest) -> ConsentOutcome {
     }
 }
 
+/// Cancellation shared by a request's labels and its approval worker.
+#[derive(Clone)]
+pub struct Cancellation(tokio::sync::watch::Sender<bool>);
+impl Default for Cancellation {
+    fn default() -> Self {
+        Self(tokio::sync::watch::channel(false).0)
+    }
+}
+impl Cancellation {
+    pub fn cancel(&self) {
+        self.0.send_replace(true);
+    }
+    pub fn is_cancelled(&self) -> bool {
+        *self.0.borrow()
+    }
+    pub async fn cancelled(&self) {
+        let mut receiver = self.0.subscribe();
+        loop {
+            if *receiver.borrow_and_update() {
+                return;
+            }
+            if receiver.changed().await.is_err() {
+                return;
+            }
+        }
+    }
+}
+
+type CardKey = (SecretScope, String);
+struct SharedCard {
+    created: std::time::Instant,
+    statement: String,
+    expires: u64,
+    outcome: tokio::sync::watch::Sender<Option<ConsentOutcome>>,
+    cancel: Cancellation,
+    waiters: std::sync::atomic::AtomicUsize,
+}
+static CARDS: std::sync::LazyLock<
+    std::sync::Mutex<std::collections::HashMap<CardKey, std::sync::Arc<SharedCard>>>,
+> = std::sync::LazyLock::new(Default::default);
+
+struct Waiter(std::sync::Arc<SharedCard>);
+impl Drop for Waiter {
+    fn drop(&mut self) {
+        // Join increments use this same lock: a joining waiter must be counted
+        // before the last departure can cancel the shared phone card.
+        let _cards = CARDS
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        if self
+            .0
+            .waiters
+            .fetch_sub(1, std::sync::atomic::Ordering::AcqRel)
+            == 1
+            && self.0.outcome.borrow().is_none()
+        {
+            self.0.cancel.cancel();
+        }
+    }
+}
+
+#[cfg(test)]
+mod waiter_tests {
+    use super::*;
+    use std::sync::{
+        atomic::{AtomicUsize, Ordering},
+        Arc,
+    };
+    use std::time::{Duration, Instant};
+
+    #[test]
+    fn a_last_waiter_cannot_decrement_or_cancel_while_a_join_holds_the_cards_lock() {
+        let card = Arc::new(SharedCard {
+            created: Instant::now(),
+            statement: "statement".into(),
+            expires: u64::MAX,
+            outcome: tokio::sync::watch::channel(None).0,
+            cancel: Default::default(),
+            waiters: AtomicUsize::new(1),
+        });
+        let cards = CARDS
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let leaving = card.clone();
+        let (started, start) = std::sync::mpsc::channel();
+        let (finished, finish) = std::sync::mpsc::channel();
+        let worker = std::thread::spawn(move || {
+            started.send(()).unwrap();
+            drop(Waiter(leaving));
+            finished.send(()).unwrap();
+        });
+        start.recv_timeout(Duration::from_secs(2)).unwrap();
+        assert!(
+            matches!(
+                finish.recv_timeout(Duration::from_millis(100)),
+                Err(std::sync::mpsc::RecvTimeoutError::Timeout)
+            ),
+            "the decrement/cancel decision must wait for the joining critical section"
+        );
+        assert_eq!(card.waiters.load(Ordering::Acquire), 1);
+        assert!(!card.cancel.is_cancelled());
+        card.waiters.fetch_add(1, Ordering::AcqRel);
+        drop(cards);
+        finish.recv_timeout(Duration::from_secs(2)).unwrap();
+        worker.join().unwrap();
+        assert_eq!(card.waiters.load(Ordering::Acquire), 1);
+        assert!(
+            !card.cancel.is_cancelled(),
+            "the already-counted join still owns the card"
+        );
+        drop(Waiter(card.clone()));
+        assert!(card.cancel.is_cancelled());
+    }
+}
+
+/// Every HTTP request joins the same recorded card outcome without locking
+/// another request's vault lookup or charging it another waiter's queue time.
+pub(crate) async fn wait_consent(request: SecretConsentRequest) -> ConsentOutcome {
+    let Some(transport) = transport() else {
+        return ConsentOutcome::Unavailable {
+            detail: "no secret consent transport is connected".into(),
+        };
+    };
+    let card = {
+        let mut cards = CARDS
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        cards.retain(|_, card| {
+            if card.waiters.load(std::sync::atomic::Ordering::Acquire) == 0
+                && matches!(
+                    &*card.outcome.borrow(),
+                    Some(ConsentOutcome::Unavailable { .. } | ConsentOutcome::Indeterminate)
+                )
+            {
+                return false;
+            }
+            card.created.elapsed() < std::time::Duration::from_secs(600)
+                || card.expires > super::vault::now_ms()
+                || card.waiters.load(std::sync::atomic::Ordering::Acquire) > 0
+        });
+        let card = cards
+            .entry((request.scope.clone(), request.request_id.clone()))
+            .or_insert_with(|| {
+                let card = std::sync::Arc::new(SharedCard {
+                    created: std::time::Instant::now(),
+                    statement: request.statement_b64url.clone(),
+                    expires: request.expires_at_ms.unwrap_or(u64::MAX),
+                    outcome: tokio::sync::watch::channel(None).0,
+                    cancel: Default::default(),
+                    waiters: Default::default(),
+                });
+                let worker = card.clone();
+                let request = request.clone();
+                transport
+                    .runtime()
+                    .unwrap_or_else(tokio::runtime::Handle::current)
+                    .spawn(async move {
+                        let answer = transport.wait(request, worker.cancel.clone()).await;
+                        worker.outcome.send_replace(Some(answer));
+                    });
+                card
+            })
+            .clone();
+        card.waiters
+            .fetch_add(1, std::sync::atomic::Ordering::AcqRel);
+        card
+    };
+    let _waiter = Waiter(card.clone());
+    if card.statement != request.statement_b64url {
+        return ConsentOutcome::Unavailable {
+            detail: "Cingulate could not file the secret-use card".into(),
+        };
+    }
+    let mut receiver = card.outcome.subscribe();
+    loop {
+        if let Some(answer) = receiver.borrow_and_update().clone() {
+            return answer;
+        }
+        if receiver.changed().await.is_err() {
+            return ConsentOutcome::Unavailable {
+                detail: "Cingulate could not settle the secret-use card".into(),
+            };
+        }
+    }
+}
+
 /// Settle a pending secret ask.
 pub fn withhold_consent(request: &SecretConsentRequest) -> ConsentOutcome {
     match transport() {
@@ -139,7 +397,7 @@ pub fn withhold_consent(request: &SecretConsentRequest) -> ConsentOutcome {
 /// exactly one item without decoding or re-encoding the statement; the daemon
 /// carries the authorization stamp outside this body.
 pub fn request_params(request: &SecretConsentRequest) -> serde_json::Value {
-    serde_json::json!({
+    let mut params = serde_json::json!({
         "kind": SECRET_CONSENT_KIND,
         "secret_use": {
             "items": [{
@@ -147,5 +405,13 @@ pub fn request_params(request: &SecretConsentRequest) -> serde_json::Value {
                 "statement_b64url": request.statement_b64url,
             }],
         },
-    })
+    });
+    if let Some(expires) = request.expires_at_ms {
+        params["expires_at_ms"] = serde_json::json!(expires);
+    }
+    params
 }
+
+#[cfg(test)]
+#[path = "consent_cancel_tests.rs"]
+mod cancellation_cache_tests;
diff --git a/crates/aft/src/secret/consent_cancel_tests.rs b/crates/aft/src/secret/consent_cancel_tests.rs
new file mode 100644
index 0000000000..1153dc6bea
--- /dev/null
+++ b/crates/aft/src/secret/consent_cancel_tests.rs
@@ -0,0 +1,174 @@
+use super::*;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn the_default_wait_passes_cancellation_to_hold_and_withdraws_a_failed_await() {
+    struct Transport {
+        entered: tokio::sync::Notify,
+        observed: std::sync::atomic::AtomicBool,
+        withdrawals: std::sync::atomic::AtomicUsize,
+        fail: bool,
+    }
+    impl SecretConsentTransport for Transport {
+        fn file(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+            panic!("the explicit hold must receive cancellation")
+        }
+        fn hold(&self, _: &SecretConsentRequest, cancel: &Cancellation) -> ConsentOutcome {
+            self.entered.notify_one();
+            if self.fail {
+                return ConsentOutcome::Unavailable {
+                    detail: "await failed".into(),
+                };
+            }
+            while !cancel.is_cancelled() {
+                std::thread::park_timeout(std::time::Duration::from_millis(1));
+            }
+            self.observed
+                .store(true, std::sync::atomic::Ordering::Release);
+            ConsentOutcome::Cancelled
+        }
+        fn withhold(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+            self.withdrawals
+                .fetch_add(1, std::sync::atomic::Ordering::AcqRel);
+            ConsentOutcome::Cancelled
+        }
+    }
+    for fail in [false, true] {
+        let transport = std::sync::Arc::new(Transport {
+            entered: Default::default(),
+            observed: Default::default(),
+            withdrawals: Default::default(),
+            fail,
+        });
+        let cancel = Cancellation::default();
+        let stamp = serde_json::from_value(serde_json::json!({"owner":{"kind":"reserved","module_id":"prefrontal-core"},"kind":"head","ref":"default-hold","scope_epoch":1,"owner_authorized":true})).unwrap();
+        let request = SecretConsentRequest {
+            scope: crate::secret::SecretScope::from_stamp(&stamp),
+            project_root: "scope".into(),
+            session: "hold".into(),
+            label: "test".into(),
+            request_id: "id".into(),
+            statement_b64url: "statement".into(),
+            expires_at_ms: None,
+        };
+        let waiter = tokio::spawn(transport.clone().wait(request, cancel.clone()));
+        transport.entered.notified().await;
+        if !fail {
+            cancel.cancel();
+        }
+        let outcome = tokio::time::timeout(std::time::Duration::from_secs(2), waiter)
+            .await
+            .unwrap()
+            .unwrap();
+        if fail {
+            assert!(matches!(outcome, ConsentOutcome::Unavailable { .. }));
+        } else {
+            assert_eq!(outcome, ConsentOutcome::Cancelled);
+            tokio::time::timeout(std::time::Duration::from_secs(2), async {
+                while !transport
+                    .observed
+                    .load(std::sync::atomic::Ordering::Acquire)
+                {
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await
+            .unwrap();
+        }
+        assert_eq!(
+            transport
+                .withdrawals
+                .load(std::sync::atomic::Ordering::Acquire),
+            1
+        );
+    }
+}
+use std::sync::{
+    atomic::{AtomicUsize, Ordering},
+    Arc, Condvar, Mutex,
+};
+use std::time::Duration;
+
+#[derive(Default)]
+struct Held {
+    filed: AtomicUsize,
+    withdrawn: Mutex<bool>,
+    changed: Condvar,
+}
+impl SecretConsentTransport for Held {
+    fn file(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+        self.filed.fetch_add(1, Ordering::SeqCst);
+        let mut withdrawn = self.withdrawn.lock().unwrap();
+        while !*withdrawn {
+            withdrawn = self.changed.wait(withdrawn).unwrap();
+        }
+        // A compatibility transport can report withdrawal as Expired. The
+        // coordinator still knows its own cancellation was not a phone answer.
+        ConsentOutcome::Expired
+    }
+    fn withhold(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+        *self.withdrawn.lock().unwrap() = true;
+        self.changed.notify_all();
+        ConsentOutcome::Expired
+    }
+}
+struct Restore(Arc<Held>);
+impl Drop for Restore {
+    fn drop(&mut self) {
+        *self.0.withdrawn.lock().unwrap() = true;
+        self.0.changed.notify_all();
+        install_transport(None);
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_cancelled_shared_card_is_cached_as_cancelled_not_a_user_decline_or_expiry() {
+    let _lock = TEST_TRANSPORT_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let service = Arc::new(Held::default());
+    let _restore = Restore(service.clone());
+    install_transport(Some(service.clone()));
+    let stamp: subc_protocol::scope::ScopeStamp = serde_json::from_value(serde_json::json!({
+        "owner":{"kind":"reserved","module_id":"prefrontal-core"},
+        "kind":"head", "ref":"cancel-cache", "scope_epoch":1, "owner_authorized":true
+    }))
+    .unwrap();
+    let request = SecretConsentRequest {
+        scope: super::super::SecretScope::from_stamp(&stamp),
+        project_root: "project".into(),
+        session: "session".into(),
+        label: "key".into(),
+        request_id: "01HF7YAT000000000000000001".into(),
+        statement_b64url: "c3RhdGVtZW50".into(),
+        expires_at_ms: Some(super::super::vault::now_ms() + 600_000),
+    };
+    let caller = tokio::spawn(wait_consent(request.clone()));
+    tokio::time::timeout(Duration::from_secs(2), async {
+        while service.filed.load(Ordering::SeqCst) == 0 {
+            tokio::time::sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+    caller.abort();
+    let _ = caller.await;
+    let key = (request.scope.clone(), request.request_id.clone());
+    let card = CARDS.lock().unwrap().get(&key).unwrap().clone();
+    tokio::time::timeout(Duration::from_secs(2), async {
+        loop {
+            if card.outcome.borrow().is_some() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(1)).await;
+        }
+    })
+    .await
+    .unwrap();
+    assert_eq!(*card.outcome.borrow(), Some(ConsentOutcome::Cancelled));
+    assert_eq!(wait_consent(request).await, ConsentOutcome::Cancelled);
+    assert_eq!(
+        service.filed.load(Ordering::SeqCst),
+        1,
+        "a withdrawn card is not silently refiled as a fresh phone request"
+    );
+}
diff --git a/crates/aft/src/secret/mod.rs b/crates/aft/src/secret/mod.rs
index c3cccb58cd..f0747995d4 100644
--- a/crates/aft/src/secret/mod.rs
+++ b/crates/aft/src/secret/mod.rs
@@ -1,25 +1,25 @@
 //! The secret vault seam and its consent adapter.
 //!
-//! [`SecretVault`] is the only way AFT asks for a label's rule or key bytes:
-//! `resolve` says whether and where a label may be used, `material` releases the
-//! bytes for one request, and `audit` collects one record per decided label.
+//! [`SecretVault`] asks for material using each outgoing request's real target.
 //! [`wire`] holds the `secret.use` contract's request and reply shapes (v1 §15);
-//! production wires [`UnavailableVault`], which resolves nothing because the
-//! live vault is not deployed and AFT holds no use grant yet. The fake
+//! Standalone processes use [`UnavailableVault`]. The fake
 //! lives behind `cfg(test)` or the `secret-test-fake` feature, which no release
 //! profile enables.
 //!
 //! An eligible call's two scopes ([`eligibility::CallScopes`]) are stamped by
-//! the daemon: the authorization scope reaches `resolve`, `material`, the
+//! the daemon: the authorization scope reaches `use_secret`, the
 //! consent ask and the audit record, while the lifetime scope decides when a
 //! proxy and its matchers stop.
 
 pub mod consent;
 pub mod eligibility;
 pub mod outcome;
+pub(crate) mod requests;
 pub mod scope;
+pub mod transport;
 pub mod vault;
 pub mod wire;
+mod wire_owned;
 
 pub use consent::{
     file_consent, request_params, withhold_consent, ConsentOutcome, SecretConsentRequest,
@@ -27,23 +27,23 @@ pub use consent::{
 };
 pub use eligibility::{CallScopes, EligibilityForm, Ineligibility};
 pub use outcome::{
-    first_failure, outcome_for, outcome_for_material, outcome_for_second_resolve, refuse,
-    refuse_ineligible, LabelOutcome, SECRETS_UNAVAILABLE, SECRET_ACCESS_PENDING,
-    SECRET_ACCESS_PENDING_MESSAGE, SECRET_ACCESS_UNAVAILABLE, SECRET_REFUSED,
+    first_failure, outcome_for, outcome_for_second_use, refuse, refuse_ineligible, LabelOutcome,
+    SECRETS_UNAVAILABLE, SECRET_ACCESS_PENDING, SECRET_ACCESS_PENDING_MESSAGE,
+    SECRET_ACCESS_UNAVAILABLE, SECRET_REFUSED,
 };
 pub use scope::SecretScope;
 pub use vault::{
-    now_ms, unrecorded_audit_records, zeroize, AuditError, Material, MaterialError, Resolution,
-    SecretUseTransport, SecretVault, SubcSecretVault, UnavailableVault,
+    now_ms, unrecorded_audit_records, zeroize, AuditError, Material, SecretUseTransport,
+    SecretVault, SubcSecretVault, UnavailableVault, UseAnswer,
 };
 pub use wire::{
     parse_answer, parse_reply, ApiKeyTarget, ApprovalRequest, Coverage, LoginTarget,
-    ReleasedApiKey, ReleasedLogin, ReplyError, SecretUseAnswer, SecretUseReply, SecretUseRequest,
-    Target, VaultError, VaultTransportError,
+    ReleasedApiKey, ReleasedLogin, ReplyError, SecretUseAnswer, SecretUseRefusal, SecretUseReply,
+    SecretUseRequest, Target, VaultError, VaultTransportError,
 };
 
 #[cfg(any(test, feature = "secret-test-fake"))]
-pub(crate) use vault::fake::{approval, granted, FakeVault, FakeVaultScript};
+pub(crate) use vault::fake::{approval, granted, FakeReply, FakeVault, FakeVaultScript};
 
 #[cfg(test)]
 #[path = "tests.rs"]
diff --git a/crates/aft/src/secret/outcome.rs b/crates/aft/src/secret/outcome.rs
index f6256ba0c6..3f1757647a 100644
--- a/crates/aft/src/secret/outcome.rs
+++ b/crates/aft/src/secret/outcome.rs
@@ -8,7 +8,7 @@
 //! already return for a held or refused call, plus two of its own.
 
 use super::eligibility::Ineligibility;
-use super::vault::{MaterialError, Resolution};
+use super::vault::UseAnswer;
 
 /// The reply code for a launch refused because its scope is not eligible
 /// . It outranks every vault answer, because an ineligible call never
@@ -98,15 +98,14 @@ pub fn refuse_ineligible(label: &str, reason: Ineligibility) -> LabelOutcome {
 }
 
 /// The outcome for one `resolve` answer.
-pub fn outcome_for(label: &str, resolution: &Resolution) -> LabelOutcome {
+pub fn outcome_for(label: &str, resolution: &UseAnswer) -> LabelOutcome {
     match resolution {
-        Resolution::Granted { .. } => LabelOutcome::Proceed,
-        Resolution::ApprovalRequired(request) => LabelOutcome::FileConsent {
+        UseAnswer::Released(_) | UseAnswer::NotFound => LabelOutcome::Proceed,
+        UseAnswer::ApprovalRequired(request) => LabelOutcome::FileConsent {
             request_id: request.request_id.clone(),
             statement_b64url: request.statement_b64url.clone(),
         },
-        Resolution::Denied { reason } => refuse(SECRET_REFUSED, label, reason),
-        Resolution::Unavailable => refuse(
+        UseAnswer::Unavailable => refuse(
             SECRETS_UNAVAILABLE,
             label,
             "no vault is connected in this build",
@@ -117,13 +116,13 @@ pub fn outcome_for(label: &str, resolution: &Resolution) -> LabelOutcome {
 /// The outcome after Cingulate answered but the vault still has not granted
 /// . Cingulate's answer alone never grants: the caller resolves again, and
 /// this is what a second pending or refused answer leaves.
-pub fn outcome_for_second_resolve(label: &str, resolution: &Resolution) -> LabelOutcome {
+pub fn outcome_for_second_use(label: &str, resolution: &UseAnswer) -> LabelOutcome {
     match resolution {
         // The vault answered at resolution time, which a re-resolve turns into
         // either a grant or a refusal, never a second pending ask: a second
         // `ApprovalRequired` means the vault is still waiting and nothing may
         // be substituted this run.
-        Resolution::ApprovalRequired(_) => refuse(
+        UseAnswer::ApprovalRequired(_) => refuse(
             SECRETS_UNAVAILABLE,
             label,
             "the vault is still waiting after the consent answer",
@@ -132,22 +131,6 @@ pub fn outcome_for_second_resolve(label: &str, resolution: &Resolution) -> Label
     }
 }
 
-/// The outcome for a `material` call that failed at request time.
-///
-/// A lapsed grant is a refusal with no consent filed, because the proxy is
-/// already live and a fresh consent would not make this request legal.
-pub fn outcome_for_material(label: &str, error: &MaterialError) -> LabelOutcome {
-    match error {
-        MaterialError::GrantLapsed => refuse(
-            SECRET_REFUSED,
-            label,
-            "the grant expired or its scope ended",
-        ),
-        MaterialError::Unavailable { detail } => refuse(SECRETS_UNAVAILABLE, label, detail),
-        MaterialError::Refused { reason } => refuse(SECRET_REFUSED, label, reason),
-    }
-}
-
 /// The first failing outcome across every scanned label, in scan order.
 ///
 /// `None` means every label may proceed. A pending label is a failure like any
diff --git a/crates/aft/src/secret/requests.rs b/crates/aft/src/secret/requests.rs
new file mode 100644
index 0000000000..f65ae0c715
--- /dev/null
+++ b/crates/aft/src/secret/requests.rs
@@ -0,0 +1,304 @@
+//! Request-addressed vault use and shared, cancellable approval cards.
+
+use super::{
+    ApiKeyTarget, ApprovalRequest, ConsentOutcome, SecretConsentRequest, SecretScope, SecretVault,
+    UseAnswer,
+};
+use std::collections::BTreeMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+/// The phone's approval window is independent of upstream network deadlines.
+pub(crate) trait ApprovalClock: Send + Sync {
+    fn now_ms(&self) -> u64;
+    fn deadline(&self) -> Pin<Box<dyn Future<Output = ()> + Send>>;
+}
+struct WallClock;
+impl ApprovalClock for WallClock {
+    fn now_ms(&self) -> u64 {
+        super::vault::now_ms()
+    }
+    fn deadline(&self) -> Pin<Box<dyn Future<Output = ()> + Send>> {
+        Box::pin(tokio::time::sleep(Duration::from_secs(600)))
+    }
+}
+
+/// One absolute person-wait limit, shared by every label in an HTTP request.
+pub(crate) struct RequestBudget {
+    pub(crate) expires_at_ms: u64,
+    deadline: Pin<Box<dyn Future<Output = ()> + Send>>,
+}
+impl RequestBudget {
+    pub(crate) async fn expired(&mut self) {
+        self.deadline.as_mut().await;
+    }
+}
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum UseError {
+    Declined,
+    Expired,
+    Cancelled,
+    Unavailable,
+    Indeterminate,
+    InvalidPlan(&'static str),
+}
+
+/// The approved local refusal text, shared by fetches and proxy requests.
+pub(crate) fn consent_failure_message(label: &str, host: &str, reason: UseError) -> String {
+    match reason {
+        UseError::Declined => format!("secret {label}: approval was declined for {host}; the request was not sent"),
+        UseError::Expired => format!("secret {label}: approval expired for {host}; the request was not sent"),
+        UseError::Cancelled => format!("secret {label}: the request for {host} was cancelled; the request was not sent"),
+        _ => format!("secret {label}: the approval request for {host} could not be filed; the request was not sent"),
+    }
+}
+
+pub(crate) struct RequestSecrets {
+    vault: Arc<dyn SecretVault>,
+    scope: SecretScope,
+    context: Option<(std::path::PathBuf, String)>,
+    status: Mutex<BTreeMap<u64, Vec<String>>>,
+    sequence: AtomicU64,
+    clock: Arc<dyn ApprovalClock>,
+    active: Arc<std::sync::atomic::AtomicUsize>,
+    once: Mutex<BTreeMap<String, bool>>,
+    request_cancelled: Option<Arc<dyn Fn() -> bool + Send + Sync>>,
+}
+struct Waiting<'a> {
+    owner: &'a RequestSecrets,
+    sequence: u64,
+}
+impl Drop for Waiting<'_> {
+    fn drop(&mut self) {
+        self.owner
+            .status
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .remove(&self.sequence);
+        self.owner.active.fetch_sub(1, Ordering::AcqRel);
+    }
+}
+impl RequestSecrets {
+    pub(crate) fn new(
+        vault: Arc<dyn SecretVault>,
+        scope: SecretScope,
+        context: Option<(std::path::PathBuf, String)>,
+    ) -> Self {
+        Self {
+            vault,
+            scope,
+            context,
+            status: Mutex::default(),
+            sequence: AtomicU64::new(1),
+            clock: Arc::new(WallClock),
+            active: Arc::default(),
+            once: Mutex::default(),
+            request_cancelled: None,
+        }
+    }
+    pub(crate) fn with_request_cancellation(
+        mut self,
+        cancelled: impl Fn() -> bool + Send + Sync + 'static,
+    ) -> Self {
+        self.request_cancelled = Some(Arc::new(cancelled));
+        self
+    }
+
+    fn cancelled(&self) -> bool {
+        self.request_cancelled.as_ref().is_some_and(|check| check())
+    }
+    pub(crate) fn budget(&self) -> RequestBudget {
+        RequestBudget {
+            expires_at_ms: self.clock.now_ms().saturating_add(600_000),
+            deadline: self.clock.deadline(),
+        }
+    }
+    #[cfg(unix)]
+    pub(crate) fn status(&self) -> Vec<String> {
+        self.status
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .values()
+            .flatten()
+            .cloned()
+            .collect()
+    }
+    pub(crate) fn activity(&self) -> Arc<std::sync::atomic::AtomicUsize> {
+        self.active.clone()
+    }
+    #[cfg(test)]
+    pub(crate) fn with_clock(mut self, clock: Option<Arc<dyn ApprovalClock>>) -> Self {
+        if let Some(clock) = clock {
+            self.clock = clock;
+        }
+        self
+    }
+
+    pub(crate) async fn ask(&self, label: &str, target: &ApiKeyTarget) -> UseAnswer {
+        let (vault, scope, label, target) = (
+            self.vault.clone(),
+            self.scope.clone(),
+            label.to_owned(),
+            target.clone(),
+        );
+        let cancelled = self.request_cancelled.clone();
+        tokio::task::spawn_blocking(move || {
+            if cancelled.as_ref().is_some_and(|check| check()) {
+                UseAnswer::Unavailable
+            } else {
+                vault.use_secret(&scope, &label, &target)
+            }
+        })
+        .await
+        .unwrap_or(UseAnswer::Unavailable)
+    }
+
+    pub(crate) async fn approve(
+        &self,
+        label: &str,
+        target: &ApiKeyTarget,
+        pending: ApprovalRequest,
+        expires_at_ms: u64,
+    ) -> Result<ConsentOutcome, UseError> {
+        let Some((project_root, session)) = &self.context else {
+            return Err(UseError::Unavailable);
+        };
+        let sequence = self.sequence.fetch_add(1, Ordering::Relaxed);
+        self.active.fetch_add(1, Ordering::AcqRel);
+        // Drop also runs when a client cancels, the command stops, or another
+        // label refuses; none of those paths may leave a waiting status behind.
+        let _waiting = Waiting {
+            owner: self,
+            sequence,
+        };
+        let mut lines = vec![format!("secret {label}: waiting for approval on the phone for {} (requests wait up to 10 minutes)", target.host)];
+        if self
+            .once
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(label)
+            == Some(&true)
+        {
+            lines.push(format!(
+                "secret {label}: the approval covered one request; another card was sent"
+            ));
+        }
+        self.status
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .insert(sequence, lines);
+        let answer = super::consent::wait_consent(SecretConsentRequest {
+            scope: self.scope.clone(),
+            project_root: project_root.clone(),
+            session: session.clone(),
+            label: label.into(),
+            request_id: pending.request_id,
+            statement_b64url: pending.statement_b64url,
+            expires_at_ms: Some(expires_at_ms.min(pending.expires_at_ms)),
+        })
+        .await;
+        match answer {
+            ConsentOutcome::Answered | ConsentOutcome::AnsweredOnce => Ok(answer),
+            ConsentOutcome::Declined => Err(UseError::Declined),
+            ConsentOutcome::Expired => Err(UseError::Expired),
+            ConsentOutcome::Cancelled => Err(UseError::Cancelled),
+            ConsentOutcome::Indeterminate => Err(UseError::Indeterminate),
+            _ => Err(UseError::Unavailable),
+        }
+    }
+
+    /// The caller supplies a fresh verified connection before a releasing retry.
+    /// No mutex is held while asking the vault or waiting for a person's answer.
+    #[cfg(all(test, unix))]
+    pub(crate) async fn use_in_request<F, Fut>(
+        &self,
+        label: &str,
+        target: &ApiKeyTarget,
+        expires_at_ms: u64,
+        before_retry: F,
+    ) -> Result<UseAnswer, UseError>
+    where
+        F: FnMut() -> Fut,
+        Fut: Future<Output = Result<(), UseError>>,
+    {
+        self.use_planned_in_request(
+            label,
+            target,
+            expires_at_ms,
+            |_| Ok(()),
+            |_| Ok(()),
+            before_retry,
+        )
+        .await
+    }
+
+    pub(crate) async fn use_planned_in_request<F, Fut, P, O>(
+        &self,
+        label: &str,
+        target: &ApiKeyTarget,
+        expires_at_ms: u64,
+        plan: P,
+        observe: O,
+        mut before_retry: F,
+    ) -> Result<UseAnswer, UseError>
+    where
+        F: FnMut() -> Fut,
+        Fut: Future<Output = Result<(), UseError>>,
+        P: Fn(&str) -> Result<(), UseError>,
+        O: Fn(&[u8]) -> Result<(), UseError>,
+    {
+        let mut answered = std::collections::HashSet::new();
+        let mut once = false;
+        loop {
+            if self.cancelled() {
+                return Err(UseError::Unavailable);
+            }
+            let answer = self.ask(label, target).await;
+            if self.cancelled() {
+                return Err(UseError::Unavailable);
+            }
+            let UseAnswer::ApprovalRequired(pending) = answer else {
+                if let UseAnswer::Released(released) = &answer {
+                    observe(released.material())?;
+                    plan(&released.location)?;
+                }
+                if matches!(answer, UseAnswer::Released(_)) {
+                    self.once
+                        .lock()
+                        .unwrap_or_else(std::sync::PoisonError::into_inner)
+                        .insert(label.into(), once);
+                }
+                return Ok(answer);
+            };
+            // An allowed card that still cannot release fails closed, but only
+            // recorded decline/expiry (or the request deadline) means denial.
+            if !answered.insert(pending.request_id.clone()) {
+                return Err(UseError::Unavailable);
+            }
+            // A pending statement already names the location. Check its plan
+            // before asking the person or consuming a subsequent release.
+            use base64::Engine;
+            if let Ok(bytes) =
+                base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(&pending.statement_b64url)
+            {
+                if let Ok(statement) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                    if let Some(location) = statement["use"]["location"].as_str() {
+                        plan(location)?;
+                    }
+                }
+            }
+            if once {
+                self.once
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .insert(label.into(), true);
+            }
+            once = self.approve(label, target, pending, expires_at_ms).await?
+                == ConsentOutcome::AnsweredOnce;
+            before_retry().await?;
+        }
+    }
+}
diff --git a/crates/aft/src/secret/scope.rs b/crates/aft/src/secret/scope.rs
index 41335a5477..1bf3b1a0dc 100644
--- a/crates/aft/src/secret/scope.rs
+++ b/crates/aft/src/secret/scope.rs
@@ -9,10 +9,9 @@
 use std::sync::Arc;
 
 use secret_rules::audit::ScopeRef;
-use secret_rules::location::{LabelRule, Location};
 use subc_protocol::scope::ScopeStamp;
 
-use super::wire::{ApiKeyTarget, Coverage, Target};
+use super::wire::Coverage;
 
 /// The `(owner, kind, ref)` identity of one stamped scope, plus the stamp the
 /// vault is given.
@@ -72,48 +71,6 @@ impl SecretScope {
         }
     }
 
-    /// The target a resolution call names.
-    ///
-    /// The vault matches a target against the record's sealed scope and returns
-    /// `not_found` on a mismatch, so a resolution has to name the rule's own
-    /// host. Until a grant exists, that host is unknown: the root path on the
-    /// default port is the least specific target the contract allows, and a
-    /// resolution therefore only ever establishes that the label exists and
-    /// whether it is approved.
-    pub fn root_target(&self) -> Target {
-        Target::ApiKey(ApiKeyTarget {
-            scheme: "https".into(),
-            host: String::new(),
-            port: None,
-            path: "/".into(),
-        })
-    }
-
-    /// The rule a released key's `location` describes, for `label`.
-    ///
-    /// The vault's release says where to put the key but not the host or path
-    /// prefix it was sealed for; those arrive with the grant. A rule built here
-    /// therefore records the location only, which is what the reply proves.
-    pub fn rule_for(&self, label: &str, location: &str) -> LabelRule {
-        secret_rules::location::parse_vault_location(location)
-            .map(|location| LabelRule {
-                label: label.to_string(),
-                host: String::new(),
-                port: 443,
-                path_prefix: "/".into(),
-                location,
-                grant_id: String::new(),
-            })
-            .unwrap_or(LabelRule {
-                label: label.to_string(),
-                host: String::new(),
-                port: 443,
-                path_prefix: "/".into(),
-                location: Location::Bearer,
-                grant_id: String::new(),
-            })
-    }
-
     /// The coverage a call asks the vault for. A head or worker call asks for
     /// its own scope; a bound codemode run's authorization scope is its head's,
     /// so it asks as that head.
diff --git a/crates/aft/src/secret/tests.rs b/crates/aft/src/secret/tests.rs
index 12e8412c08..f8d54cc94b 100644
--- a/crates/aft/src/secret/tests.rs
+++ b/crates/aft/src/secret/tests.rs
@@ -25,7 +25,6 @@ fn rule(label: &str) -> secret_rules::location::LabelRule {
         port: 443,
         path_prefix: "/v1".into(),
         location: Location::Bearer,
-        grant_id: "grant-1".into(),
     }
 }
 
@@ -34,21 +33,27 @@ fn rule(label: &str) -> secret_rules::location::LabelRule {
 // ---------------------------------------------------------------------------
 
 #[test]
-fn production_resolve_is_unavailable_for_every_label_and_scope() {
-    let vault = UnavailableVault;
-    let scope = production_scope();
+fn standalone_use_is_unavailable_for_every_label_and_scope() {
     for label in ["prod", "test", "repo"] {
-        assert_eq!(vault.resolve(&scope, label), Resolution::Unavailable);
+        assert!(matches!(
+            UnavailableVault.use_secret(&production_scope(), label, &target()),
+            UseAnswer::Unavailable
+        ));
+    }
+}
+
+fn target() -> ApiKeyTarget {
+    ApiKeyTarget {
+        scheme: "https".into(),
+        host: "api.example.com".into(),
+        port: Some(443),
+        path: "/v1".into(),
     }
-    assert!(matches!(
-        vault.material(&scope, "prod", "grant-1"),
-        Err(MaterialError::Unavailable { .. })
-    ));
 }
 
 #[test]
 fn an_unavailable_resolution_ends_the_launch_with_secrets_unavailable() {
-    let outcome = outcome_for("prod", &Resolution::Unavailable);
+    let outcome = outcome_for("prod", &UseAnswer::Unavailable);
     assert_eq!(outcome.code(), Some(SECRETS_UNAVAILABLE));
     assert!(!outcome.proceeds());
     // The message names the label it refused and never a key.
@@ -63,15 +68,17 @@ fn an_unavailable_resolution_ends_the_launch_with_secrets_unavailable() {
 // ---------------------------------------------------------------------------
 
 #[test]
-fn a_granted_resolution_proceeds() {
-    let outcome = outcome_for("repo", &granted(rule("repo"), "grant-1"));
-    assert_eq!(outcome, LabelOutcome::Proceed);
-    assert_eq!(outcome.code(), None);
+fn a_released_request_proceeds() {
+    let answer = UseAnswer::Released(ReleasedApiKey::new(
+        "authorization_bearer".into(),
+        Material::new(b"test-secret".to_vec()),
+    ));
+    assert_eq!(outcome_for("repo", &answer), LabelOutcome::Proceed);
 }
 
 #[test]
 fn an_approval_required_resolution_files_a_consent_and_holds_the_call() {
-    let outcome = outcome_for("repo", &Resolution::ApprovalRequired(approval("req-1")));
+    let outcome = outcome_for("repo", &UseAnswer::ApprovalRequired(approval("req-1")));
     let LabelOutcome::FileConsent {
         request_id,
         statement_b64url,
@@ -87,46 +94,22 @@ fn an_approval_required_resolution_files_a_consent_and_holds_the_call() {
 }
 
 #[test]
-fn a_denied_resolution_refuses_naming_the_label() {
-    let outcome = outcome_for(
-        "repo",
-        &Resolution::Denied {
-            reason: "this device may not use repo".into(),
-        },
-    );
-    assert_eq!(outcome.code(), Some(SECRET_REFUSED));
-    let LabelOutcome::Refuse { message, .. } = &outcome else {
-        panic!("a denial refuses the launch");
-    };
-    assert!(message.contains("repo"), "{message}");
-    assert!(
-        message.contains("this device may not use repo"),
-        "{message}"
+fn uniform_not_found_keeps_the_literal_request() {
+    assert_eq!(
+        outcome_for("repo", &UseAnswer::NotFound),
+        LabelOutcome::Proceed
     );
 }
 
 #[test]
-fn a_second_resolve_is_the_only_thing_that_can_grant() {
-    // Cingulate's answer alone never grants: a resolve that still asks again
-    // substitutes nothing, while a grant after the answer proceeds and a
-    // denial refuses.
+fn a_phone_answer_never_grants_material_without_a_vault_release() {
     assert_eq!(
-        outcome_for_second_resolve("repo", &Resolution::ApprovalRequired(approval("req-1"))).code(),
+        outcome_for_second_use("repo", &UseAnswer::ApprovalRequired(approval("req-1"))).code(),
         Some(SECRETS_UNAVAILABLE)
     );
-    assert!(outcome_for_second_resolve("repo", &granted(rule("repo"), "grant-1")).proceeds());
+    assert!(outcome_for_second_use("repo", &UseAnswer::NotFound).proceeds());
     assert_eq!(
-        outcome_for_second_resolve(
-            "repo",
-            &Resolution::Denied {
-                reason: "no".into()
-            }
-        )
-        .code(),
-        Some(SECRET_REFUSED)
-    );
-    assert_eq!(
-        outcome_for_second_resolve("repo", &Resolution::Unavailable).code(),
+        outcome_for_second_use("repo", &UseAnswer::Unavailable).code(),
         Some(SECRETS_UNAVAILABLE)
     );
 }
@@ -157,11 +140,14 @@ fn the_first_failing_label_decides_a_multi_label_launch() {
 }
 
 #[test]
-fn a_material_lapse_refuses_without_filing_a_consent() {
-    let outcome = outcome_for_material("repo", &MaterialError::GrantLapsed);
-    assert_eq!(outcome.code(), Some(SECRET_REFUSED));
-    // A lapse never asks for a new consent: the proxy is already live.
-    assert!(!matches!(outcome, LabelOutcome::FileConsent { .. }));
+fn a_new_request_may_ask_for_a_fresh_approval() {
+    assert!(matches!(
+        outcome_for(
+            "repo",
+            &UseAnswer::ApprovalRequired(approval("next-request"))
+        ),
+        LabelOutcome::FileConsent { .. }
+    ));
 }
 
 // ---------------------------------------------------------------------------
@@ -169,11 +155,9 @@ fn a_material_lapse_refuses_without_filing_a_consent() {
 // ---------------------------------------------------------------------------
 
 #[test]
-fn the_fake_counts_resolve_and_material_calls_and_rotates_material() {
+fn the_fake_counts_addressed_uses_and_rotates_material() {
     let mut script = FakeVaultScript::default();
-    script
-        .resolutions
-        .insert("repo".into(), granted(rule("repo"), "grant-1"));
+    script.answers.insert("repo".into(), granted(rule("repo")));
     script.material.insert(
         "repo".into(),
         vec![
@@ -183,22 +167,24 @@ fn the_fake_counts_resolve_and_material_calls_and_rotates_material() {
     );
     let vault = FakeVault::with_script(script);
     let scope = production_scope();
+    let UseAnswer::Released(first) = vault.use_secret(&scope, "repo", &target()) else {
+        panic!("release");
+    };
+    let UseAnswer::Released(second) = vault.use_secret(&scope, "repo", &target()) else {
+        panic!("release");
+    };
+    assert_eq!(first.material(), b"first-key-material-1");
+    assert_eq!(second.material(), b"second-key-material");
+    assert_eq!(vault.use_calls(), 2);
+    assert_eq!(vault.material_calls(), 2);
+    assert_eq!(vault.materials(), vec!["repo", "repo"]);
+    let mut other = target();
+    other.host = "other.example.com".into();
     assert!(matches!(
-        vault.resolve(&scope, "repo"),
-        Resolution::Granted { .. }
+        vault.use_secret(&scope, "repo", &other),
+        UseAnswer::NotFound
     ));
-    let first = vault.material(&scope, "repo", "grant-1").unwrap();
-    let second = vault.material(&scope, "repo", "grant-1").unwrap();
-    // One grant, two different values: the seam never assumes a grant returns
-    // the same bytes.
-    assert_eq!(first.expose(), b"first-key-material-1");
-    assert_eq!(second.expose(), b"second-key-material");
-    assert_eq!(vault.resolve_calls(), 1);
     assert_eq!(vault.material_calls(), 2);
-    assert_eq!(
-        vault.materials(),
-        vec!["repo".to_string(), "repo".to_string()]
-    );
 }
 
 #[test]
@@ -255,6 +241,7 @@ fn a_secret_consent_files_exactly_the_single_phone_item() {
     let request_id = item["request_id"].as_str().unwrap();
     let statement = item["statement_b64url"].as_str().unwrap();
     let request = SecretConsentRequest {
+        expires_at_ms: None,
         scope: production_scope(),
         project_root: "project".into(),
         session: "session".into(),
diff --git a/crates/aft/src/secret/transport.rs b/crates/aft/src/secret/transport.rs
new file mode 100644
index 0000000000..8e6b04f667
--- /dev/null
+++ b/crates/aft/src/secret/transport.rs
@@ -0,0 +1,371 @@
+//! Bounded `secret.use` calls over the daemon's attested consumer routes.
+
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+use std::time::Duration;
+
+use serde_json::{json, Value};
+use subc_client_rs::{
+    CallError, CallOptions, CloseRouteOptions, ConsumerIdentity, ConsumerOptions, RouteHandle,
+    SubcConsumer, SubscribeOptions, Subscription,
+};
+use subc_protocol::scope::{ScopeSelector, ScopeStamp};
+use subc_protocol::{BindIdentity, RouteTarget};
+use zeroize::Zeroizing;
+
+use super::vault::SecretUseTransport;
+
+const UNAVAILABLE: &str = "secret.use transport unavailable";
+static CONNECTION_FILE: std::sync::RwLock<Option<PathBuf>> = std::sync::RwLock::new(None);
+
+pub(crate) fn install_connection_file(path: &std::path::Path) {
+    *CONNECTION_FILE
+        .write()
+        .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(path.to_owned());
+}
+
+pub(crate) fn for_current_command() -> Option<SubcSecretUseTransport> {
+    let path = CONNECTION_FILE.read().ok()?.clone()?;
+    if !path.is_file() {
+        return None;
+    }
+    let (_, session) = crate::subc::current_secret_consent_context()?;
+    SubcSecretUseTransport::new(
+        path,
+        BindIdentity::new("aft-secret-use", session),
+        Duration::from_secs(15),
+    )
+}
+
+/// A request-addressed vault transport. Construct it at call time: a standalone
+/// process has no attested AFT module identity. Never open its vault route under
+/// the daemon's unprivileged `direct` principal instead.
+/// One command owns one consumer connection; failed connections are discarded so
+/// a later request can reconnect after the daemon returns.
+#[derive(Clone)]
+pub struct SubcSecretUseTransport {
+    connection_file: PathBuf,
+    identity: BindIdentity,
+    timeout: Duration,
+    worker: Arc<OnceLock<tokio::sync::mpsc::UnboundedSender<Work>>>,
+    #[cfg(test)]
+    test_principal: Option<ConsumerIdentity>,
+}
+
+struct Work {
+    params: Value,
+    principal: ConsumerIdentity,
+    deadline: tokio::time::Instant,
+    reply: std::sync::mpsc::Sender<Result<Zeroizing<Vec<u8>>, String>>,
+}
+
+struct ConnectionConfig {
+    connection_file: PathBuf,
+    identity: BindIdentity,
+    timeout: Duration,
+}
+
+// Both scoped secret use and daemon-owned manifest delivery use the attested
+// claustrum management surface. A manifest watch deliberately has no agent scope.
+async fn open_vault_route(
+    consumer: &SubcConsumer,
+    identity: BindIdentity,
+    principal: ConsumerIdentity,
+    scope: Option<ScopeSelector>,
+    timeout: Duration,
+) -> Result<RouteHandle, CallError> {
+    let target = RouteTarget::ManagementSurface {
+        module_id: "claustrum".into(),
+    };
+    let options = CallOptions {
+        consumer_identity: Some(principal),
+        timeout,
+        route_retry_deadline: timeout,
+        ..CallOptions::default()
+    };
+    match scope {
+        Some(scope) => {
+            consumer
+                .open_route_scoped(target, identity, scope, options)
+                .await
+        }
+        None => consumer.open_route(target, identity, options).await,
+    }
+}
+
+/// A held daemon-owned route on the existing vault transport. Closing it also
+/// closes its consumer so reconnects never leave an old watch subscribed.
+pub(crate) struct ManagementSession {
+    consumer: SubcConsumer,
+    route: RouteHandle,
+}
+
+impl ManagementSession {
+    pub(crate) async fn connect(connection_file: &std::path::Path) -> Result<Self, ()> {
+        let principal = aft_identity().ok_or(())?;
+        Self::connect_as(connection_file, principal).await
+    }
+
+    async fn connect_as(
+        connection_file: &std::path::Path,
+        principal: ConsumerIdentity,
+    ) -> Result<Self, ()> {
+        let consumer =
+            crate::fleet_status::connect_subc_consumer(connection_file, ConsumerOptions::default())
+                .await
+                .map_err(|_| ())?;
+        let route = match open_vault_route(
+            &consumer,
+            BindIdentity::new("aft-manifest-sync", "daemon"),
+            principal,
+            None,
+            Duration::from_secs(15),
+        )
+        .await
+        {
+            Ok(route) => route,
+            Err(_) => {
+                let _ = consumer.close().await;
+                return Err(());
+            }
+        };
+        Ok(Self { consumer, route })
+    }
+
+    #[cfg(all(test, unix))]
+    pub(crate) async fn for_test(connection_file: &std::path::Path) -> Result<Self, ()> {
+        Self::connect_as(
+            connection_file,
+            ConsumerIdentity {
+                module_id: "aft".into(),
+                launch_nonce: "manifest-sync-test-nonce".into(),
+            },
+        )
+        .await
+    }
+
+    pub(crate) async fn request(&self, body: Vec<u8>) -> Result<Vec<u8>, CallError> {
+        self.consumer
+            .request(
+                &self.route,
+                body,
+                CallOptions {
+                    timeout: Duration::from_secs(15),
+                    ..CallOptions::default()
+                },
+            )
+            .await
+    }
+
+    pub(crate) async fn watch(&self, body: Vec<u8>) -> Result<Subscription, CallError> {
+        self.consumer
+            .subscribe_route(&self.route, body, SubscribeOptions::default())
+            .await
+    }
+
+    pub(crate) async fn close(self) {
+        let _ = self
+            .consumer
+            .close_handle(&self.route, CloseRouteOptions::default())
+            .await;
+        let _ = self.consumer.close().await;
+    }
+}
+
+impl SubcSecretUseTransport {
+    /// Use AFT's captured launch-nonce identity, never an agent-supplied principal.
+    /// The deadline includes connection, scoped open, request, and cleanup.
+    pub fn new(
+        connection_file: PathBuf,
+        identity: BindIdentity,
+        timeout: Duration,
+    ) -> Option<Self> {
+        aft_identity()?;
+        Some(Self {
+            connection_file,
+            identity,
+            timeout,
+            worker: Arc::default(),
+            #[cfg(test)]
+            test_principal: None,
+        })
+    }
+
+    #[cfg(all(test, unix))]
+    pub(crate) fn for_test(
+        connection_file: PathBuf,
+        identity: BindIdentity,
+        timeout: Duration,
+        principal: ConsumerIdentity,
+    ) -> Self {
+        Self {
+            connection_file,
+            identity,
+            timeout,
+            worker: Arc::default(),
+            test_principal: Some(principal),
+        }
+    }
+
+    async fn send(
+        config: &ConnectionConfig,
+        consumer: &subc_client_rs::SubcConsumer,
+        params: Value,
+        principal: ConsumerIdentity,
+    ) -> Result<Zeroizing<Vec<u8>>, String> {
+        let target = &params["target"];
+        if target["scheme"] != "https"
+            || target
+                .get("port")
+                .is_some_and(|port| port.as_u64() != Some(443))
+        {
+            return Err(UNAVAILABLE.to_owned());
+        }
+        let stamp: ScopeStamp =
+            serde_json::from_value(params.get("stamp").cloned().unwrap_or_default())
+                .map_err(|_| UNAVAILABLE.to_owned())?;
+        let scope = ScopeSelector::new(stamp.owner, stamp.scope_ref, Some(stamp.scope_epoch));
+        let body = serde_json::to_vec(&json!({"method": "secret.use", "params": params}))
+            .map_err(|_| UNAVAILABLE.to_owned())?;
+        let route = open_vault_route(
+            consumer,
+            config.identity.clone(),
+            principal,
+            Some(scope),
+            config.timeout,
+        )
+        .await
+        .map_err(|_| UNAVAILABLE.to_owned())?;
+        let reply = consumer
+            .request(
+                &route,
+                body,
+                CallOptions {
+                    timeout: config.timeout,
+                    ..CallOptions::default()
+                },
+            )
+            .await;
+        match reply {
+            Ok(bytes) => {
+                let bytes = Zeroizing::new(bytes);
+                Ok(bytes)
+            }
+            // Preserve the distinction between a module Error frame and a
+            // result refusal. Do not include SDK errors or reply bytes in
+            // transport diagnostics: either could carry released material.
+            Err(CallError::Module(error)) => {
+                let code = Zeroizing::new(error.code);
+                let _message = Zeroizing::new(error.message);
+                // Retain only the classified sender error. Peer detail may
+                // contain a credential and must never enter a second buffer.
+                if code.as_str() == "invalid_params" {
+                    Ok(Zeroizing::new(
+                        br#"{"code":"invalid_params","message":""}"#.to_vec(),
+                    ))
+                } else {
+                    Err(UNAVAILABLE.to_owned())
+                }
+            }
+            Err(_) => Err(UNAVAILABLE.to_owned()),
+        }
+    }
+
+    fn dispatch(
+        &self,
+        params: Value,
+        principal: ConsumerIdentity,
+    ) -> Result<Zeroizing<Vec<u8>>, String> {
+        let sender = self.worker.get_or_init(|| {
+            let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
+            let config = ConnectionConfig {
+                connection_file: self.connection_file.clone(),
+                identity: self.identity.clone(),
+                timeout: self.timeout,
+            };
+            std::thread::spawn(move || {
+                if let Ok(runtime) = tokio::runtime::Builder::new_current_thread()
+                    .enable_all()
+                    .build()
+                {
+                    runtime.block_on(Self::serve(config, receiver));
+                }
+            });
+            sender
+        });
+        let (reply, answer) = std::sync::mpsc::channel();
+        sender
+            .send(Work {
+                params,
+                principal,
+                deadline: tokio::time::Instant::now() + self.timeout,
+                reply,
+            })
+            .map_err(|_| UNAVAILABLE.to_owned())?;
+        answer
+            .recv_timeout(self.timeout)
+            .map_err(|_| UNAVAILABLE.to_owned())?
+    }
+
+    async fn serve(
+        config: ConnectionConfig,
+        mut receiver: tokio::sync::mpsc::UnboundedReceiver<Work>,
+    ) {
+        let mut consumer = None;
+        while let Some(work) = receiver.recv().await {
+            let result = tokio::time::timeout_at(work.deadline, async {
+                if consumer.is_none() {
+                    consumer = Some(
+                        crate::fleet_status::connect_subc_consumer(
+                            &config.connection_file,
+                            ConsumerOptions::default(),
+                        )
+                        .await
+                        .map_err(|_| UNAVAILABLE.to_owned())?,
+                    );
+                }
+                Self::send(
+                    &config,
+                    consumer.as_ref().expect("connected consumer"),
+                    work.params,
+                    work.principal,
+                )
+                .await
+            })
+            .await
+            .unwrap_or_else(|_| Err(UNAVAILABLE.to_owned()));
+            if result.is_err() {
+                if let Some(failed) = consumer.take() {
+                    let _ = tokio::time::timeout(Duration::from_secs(1), failed.close()).await;
+                }
+            }
+            let _ = work.reply.send(result);
+        }
+        if let Some(consumer) = consumer {
+            let _ = tokio::time::timeout(Duration::from_secs(1), consumer.close()).await;
+        }
+    }
+}
+
+fn aft_identity() -> Option<ConsumerIdentity> {
+    crate::launch_nonce::consumer_identity().filter(|identity| identity.module_id == "aft")
+}
+
+impl SecretUseTransport for SubcSecretUseTransport {
+    fn secret_use(&self, params: Value) -> Result<Zeroizing<Vec<u8>>, String> {
+        #[cfg(test)]
+        if let Some(principal) = &self.test_principal {
+            return self.dispatch(params, principal.clone());
+        }
+        let principal = aft_identity().ok_or_else(|| UNAVAILABLE.to_owned())?;
+        self.dispatch(params, principal)
+    }
+}
+
+#[cfg(test)]
+#[path = "transport_tests.rs"]
+mod tests;
+
+#[cfg(test)]
+#[path = "transport_fake.rs"]
+pub(crate) mod fake;
diff --git a/crates/aft/src/secret/transport_fake.rs b/crates/aft/src/secret/transport_fake.rs
new file mode 100644
index 0000000000..e4474ca5c4
--- /dev/null
+++ b/crates/aft/src/secret/transport_fake.rs
@@ -0,0 +1,453 @@
+//! A single-record claustrum fixture over authenticated subc route plumbing.
+//! Approval is an explicit test action representing a verified phone signature;
+//! neither retrying a request nor opening another route grants access.
+
+use std::collections::{HashMap, HashSet};
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use base64::Engine;
+use serde::Deserialize;
+use serde_json::{json, Value};
+use subc_protocol::scope::{ParentState, ScopeKind, ScopeStamp};
+use subc_protocol::{Flags, Frame, FrameType, Priority};
+use subc_transport::connection_file::{self, ConnectionInfo, Endpoint, SCHEMA_VERSION};
+
+use super::super::wire::{Coverage, Target};
+
+const GOLDENS: &str = include_str!("../../tests/fixtures/secret/secret-use-v1.jsonl");
+pub(crate) const NONCE: &str = "fake-aft-launch-nonce";
+
+type PendingKey = (String, String, String, String, String);
+
+pub(crate) fn golden(index: usize) -> Value {
+    serde_json::from_str(GOLDENS.lines().nth(index).unwrap()).unwrap()
+}
+
+pub(crate) fn refusal(code: &str, class: &str) -> Value {
+    json!({"result":{"error":{"code":code,"class":class}}})
+}
+
+fn invalid() -> Value {
+    json!({"code":"invalid_params","message":"invalid params"})
+}
+
+#[derive(Default)]
+pub(crate) struct State {
+    pub opens: Vec<Value>,
+    pub calls: usize,
+    pub params: Vec<Value>,
+    pub connections: usize,
+    pub hold_open: bool,
+    pub hold_reply: bool,
+    pub disconnect: bool,
+    pub store_error: bool,
+    pub setup_incomplete: bool,
+    pub other_pending_in_scope: usize,
+    pub other_pending_total: usize,
+    pub record: Option<Record>,
+    pub records: Vec<Record>,
+    pub once: bool,
+    pub next_request: usize,
+    pub pending_expires_at_ms: Option<u64>,
+    pub module_error_message: Option<String>,
+    approved: HashSet<PendingKey>,
+    pub(super) pending: HashMap<PendingKey, Value>,
+}
+
+#[derive(Clone)]
+pub(crate) struct Record {
+    pub name: String,
+    pub host: String,
+    pub path: String,
+    pub location: String,
+    pub key: Vec<u8>,
+}
+
+impl State {
+    /// Stand in for the vault verifying the phone's signature over these bytes.
+    pub fn approve(&mut self, statement_b64url: &str) {
+        let keys: Vec<_> = self
+            .pending
+            .iter()
+            .filter(|(_, reply)| reply["statement_b64url"] == statement_b64url)
+            .map(|(key, _)| key.clone())
+            .collect();
+        assert!(!keys.is_empty());
+        self.approved.extend(keys);
+    }
+
+    fn serve(&mut self, principal: &str, params: Value) -> Value {
+        let not_found = || refusal("not_found", "permanent");
+        if !matches!(principal, "aft" | "cerebellum") {
+            return not_found();
+        }
+        let Ok(params) = serde_json::from_value::<Params>(params) else {
+            return invalid();
+        };
+        if params.name.is_empty()
+            || !params.name.as_bytes()[0].is_ascii_alphanumeric()
+            || !params
+                .name
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || b"._-".contains(&b))
+        {
+            return invalid();
+        }
+        if params.name.len() > 64 {
+            return refusal("limit_exceeded", "context_overflow");
+        }
+        if let Err(error) = valid_target(&params.target) {
+            return match error {
+                secret_rules::scope::ScopeRefusal::LimitExceeded => {
+                    refusal("limit_exceeded", "context_overflow")
+                }
+                _ => invalid(),
+            };
+        }
+        let stamp: ScopeStamp = match serde_json::from_value(params.stamp) {
+            Ok(stamp) => stamp,
+            Err(error) if error.to_string().starts_with("missing field ") => return not_found(),
+            Err(_) => return invalid(),
+        };
+        if stamp.scope_epoch > (1 << 53) - 1
+            || stamp
+                .parent
+                .as_ref()
+                .is_some_and(|p| p.scope_epoch > (1 << 53) - 1)
+        {
+            return invalid();
+        }
+        if stamp.attributes.flow_id.is_some() {
+            return not_found();
+        }
+        let worker_head = stamp
+            .parent
+            .as_ref()
+            .filter(|parent| {
+                stamp.parent_state == Some(ParentState::Linked)
+                    && parent.scope_epoch == stamp.scope_epoch
+            })
+            .map(|parent| (render_owner(&parent.owner), parent.scope_ref.clone()));
+        let (owner, kind, reference, epoch) = match stamp.kind {
+            ScopeKind::Head => (stamp.owner, "head", stamp.scope_ref, stamp.scope_epoch),
+            ScopeKind::Worker => (stamp.owner, "worker", stamp.scope_ref, stamp.scope_epoch),
+            ScopeKind::Ephemeral => {
+                let Some(parent) = stamp.parent.filter(|parent| {
+                    stamp.parent_state == Some(ParentState::Linked)
+                        && parent.scope_epoch == stamp.scope_epoch
+                        && parent.owner
+                            == (subc_protocol::Principal::Reserved {
+                                module_id: "prefrontal-core".into(),
+                            })
+                }) else {
+                    return not_found();
+                };
+                (parent.owner, "head", parent.scope_ref, parent.scope_epoch)
+            }
+        };
+        let coverage = params.coverage;
+        let record = self
+            .records
+            .iter()
+            .find(|record| record.name == params.name)
+            .or(self.record.as_ref())
+            .cloned();
+        if coverage == Coverage::AgentAndWorkers && kind != "head" {
+            return invalid();
+        }
+        if self.store_error {
+            return refusal("store_error", "transient");
+        }
+        let matches = match &params.target {
+            Target::ApiKey(target) => {
+                principal == "aft"
+                    && params.name == record.as_ref().map_or("key", |r| r.name.as_str())
+                    && target.scheme == "https"
+                    && target.port.unwrap_or(443) == 443
+                    && target.host == record.as_ref().map_or("x.test", |r| r.host.as_str())
+                    && {
+                        let prefix = record.as_ref().map_or("/repos/a", |r| r.path.as_str());
+                        target.path == prefix || target.path.starts_with(&format!("{prefix}/"))
+                    }
+            }
+            Target::Login(_) => false,
+        };
+        if !matches {
+            return not_found();
+        }
+        let owner = render_owner(&owner);
+        let key = (
+            params.name.clone(),
+            owner.clone(),
+            kind.into(),
+            reference.clone(),
+            coverage.as_str().into(),
+        );
+        let covered = self.approved.iter().any(
+            |(name, grant_owner, grant_kind, grant_ref, grant_coverage)| {
+                name == &params.name
+                    && ((grant_owner == &owner && grant_kind == kind && grant_ref == &reference)
+                        || (kind == "worker"
+                            && grant_kind == "head"
+                            && grant_coverage == "agent_and_workers"
+                            && worker_head.as_ref().is_some_and(|(owner, reference)| {
+                                owner == grant_owner && reference == grant_ref
+                            })))
+            },
+        );
+        if covered {
+            if self.once {
+                self.approved.remove(&key);
+                self.pending.remove(&key);
+            }
+            let mut released = golden(3);
+            if let Some(record) = &record {
+                released["location"] = json!(record.location);
+                released["key_b64url"] =
+                    json!(base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(&record.key));
+            }
+            return json!({"result":released});
+        }
+        if self.setup_incomplete {
+            return refusal("secret_setup_incomplete", "permanent");
+        }
+        if let Some(pending) = self.pending.get(&key) {
+            return json!({"result":pending});
+        }
+        let scope_pending = self
+            .pending
+            .keys()
+            .filter(|(_, pending_owner, pending_kind, pending_ref, _)| {
+                pending_owner == &owner && pending_kind == kind && pending_ref == &reference
+            })
+            .count();
+        if self.other_pending_in_scope + scope_pending >= 8
+            || self.other_pending_total + self.pending.len() >= 64
+        {
+            return refusal("pending_limit", "transient");
+        }
+        let mut pending = golden(5);
+        self.next_request += 1;
+        pending["request_id"] = json!(format!("01HF7YAT{:018}", self.next_request));
+        let engine = base64::engine::general_purpose::URL_SAFE_NO_PAD;
+        let mut statement: Value = serde_json::from_slice(
+            &engine
+                .decode(pending["statement_b64url"].as_str().unwrap())
+                .unwrap(),
+        )
+        .unwrap();
+        statement["request_id"] = pending["request_id"].clone();
+        statement["scope"] = json!({"epoch":epoch,"kind":kind,"owner":owner,"ref":reference});
+        statement["coverage"] = json!(coverage.as_str());
+        if coverage == Coverage::AgentAndWorkers {
+            statement["durations"] = json!(["permanent"]);
+        }
+        statement["agent_id"] = json!(stamp.attributes.agent_id);
+        if let Some(expires) = self.pending_expires_at_ms {
+            pending["expires_at_ms"] = json!(expires);
+            statement["request_expires_at_ms"] = json!(expires);
+        }
+        if let Some(record) = &record {
+            statement["secret"]["name"] = json!(record.name);
+            statement["use"] =
+                json!({"host":record.host, "path_prefix":record.path, "location":record.location});
+        }
+        pending["statement_b64url"] = json!(engine.encode(serde_json::to_vec(&statement).unwrap()));
+        self.pending.insert(key, pending.clone());
+        json!({"result":pending})
+    }
+}
+
+fn render_owner(owner: &subc_protocol::Principal) -> String {
+    match owner {
+        subc_protocol::Principal::Reserved { module_id } => format!("reserved:{module_id}"),
+        subc_protocol::Principal::Direct => "direct".into(),
+        subc_protocol::Principal::Unverified => "unverified".into(),
+    }
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Params {
+    name: String,
+    #[serde(default = "default_coverage")]
+    coverage: Coverage,
+    stamp: Value,
+    target: Target,
+}
+
+fn default_coverage() -> Coverage {
+    Coverage::Scope
+}
+
+fn valid_target(target: &Target) -> Result<(), secret_rules::scope::ScopeRefusal> {
+    use secret_rules::scope::{ScopeRefusal, SecretScope};
+    match target {
+        Target::ApiKey(target) => {
+            if target.scheme.is_empty()
+                || !target
+                    .scheme
+                    .bytes()
+                    .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b"+-.".contains(&b))
+            {
+                return Err(ScopeRefusal::InvalidParams);
+            }
+            SecretScope::parse_input("agent_api_key", &json!({"host":target.host}))?;
+            if !valid_path(&target.path) {
+                return Err(ScopeRefusal::InvalidParams);
+            }
+            Ok(())
+        }
+        Target::Login(target) => secret_rules::scope::canonical_origin(&target.origin).map(|_| ()),
+    }
+}
+
+fn valid_path(path: &str) -> bool {
+    if !path.starts_with('/') {
+        return false;
+    }
+    let mut bytes = path.bytes();
+    while let Some(byte) = bytes.next() {
+        if byte == b'%' {
+            let Some(a) = bytes.next().and_then(|b| (b as char).to_digit(16)) else {
+                return false;
+            };
+            let Some(b) = bytes.next().and_then(|b| (b as char).to_digit(16)) else {
+                return false;
+            };
+            let decoded = (a * 16 + b) as u8;
+            if !(0x21..0x7f).contains(&decoded) || b"/.%\\;".contains(&decoded) {
+                return false;
+            }
+        } else if !(byte.is_ascii_alphanumeric() || b"-._~!$&'()*+,;=:@/".contains(&byte)) {
+            return false;
+        }
+    }
+    let segments: Vec<_> = path[1..].split('/').collect();
+    segments.iter().enumerate().all(|(i, segment)| {
+        (!segment.is_empty() || i == segments.len() - 1)
+            && !matches!(segment.split(';').next(), Some("." | ".."))
+    })
+}
+
+pub(crate) struct FakeClaustrum {
+    _directory: tempfile::TempDir,
+    pub path: PathBuf,
+    pub state: Arc<Mutex<State>>,
+    stop: Option<tokio::sync::oneshot::Sender<()>>,
+    server: Option<std::thread::JoinHandle<()>>,
+}
+
+impl FakeClaustrum {
+    pub fn start() -> Self {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("connection.json");
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let key = vec![0x42; subc_transport::KEY_LEN];
+        let daemon_id = [0x24; subc_transport::DAEMON_ID_LEN];
+        connection_file::write_atomic(
+            &path,
+            &ConnectionInfo {
+                schema: SCHEMA_VERSION,
+                wire_version: Some(subc_protocol::PROTOCOL_VERSION),
+                endpoints: vec![Endpoint {
+                    host: "127.0.0.1".into(),
+                    port: listener.local_addr().unwrap().port(),
+                }],
+                key: key.clone(),
+                daemon_id,
+                pid: std::process::id(),
+                daemon_ver: "0.39.0".into(),
+            },
+        )
+        .unwrap();
+        let state = Arc::new(Mutex::new(State::default()));
+        let served = Arc::clone(&state);
+        let (stop, stopped) = tokio::sync::oneshot::channel();
+        let server = std::thread::spawn(move || {
+            tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap().block_on(async move {
+                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
+                let mut tasks = tokio::task::JoinSet::new();
+                tokio::pin!(stopped);
+                loop {
+                    tokio::select! {
+                        _ = &mut stopped => break,
+                        accepted = listener.accept() => {
+                            let (mut stream, _) = accepted.unwrap();
+                            let state = Arc::clone(&served);
+                            let key = key.clone();
+                            tasks.spawn(async move {
+                                if subc_transport::authenticate_server(&mut stream, &key, &daemon_id, "0.39.0", Duration::from_secs(2)).await.is_err() { return; }
+                                state.lock().unwrap().connections += 1;
+                                let mut principal = String::new();
+                                while let Ok(Some(request)) = subc_transport::read_frame(&mut stream).await {
+                                    if request.header.ty == FrameType::Ping {
+                                        let pong = Frame::build(FrameType::Pong, flags(), 0, 0, request.header.corr, Vec::new()).unwrap();
+                                        if subc_transport::write_frame(&mut stream, &pong).await.is_err() { break; }
+                                        continue;
+                                    }
+                                    if request.header.ty != FrameType::Request { continue; }
+                                    let value: Value = serde_json::from_slice(&request.body).unwrap();
+                                    let (reply, error) = if value["op"] == "route.open" {
+                                        assert_eq!(value["target"], json!({"kind":"management_surface","module_id":"claustrum"}));
+                                        assert!(value.get("scope").is_some());
+                                        let hold = {
+                                            let mut state = state.lock().unwrap();
+                                            state.opens.push(value.clone());
+                                            state.hold_open
+                                        };
+                                        if hold { continue; }
+                                        if value["consumer_identity"]["launch_nonce"] == NONCE {
+                                            principal = value["consumer_identity"]["module_id"].as_str().unwrap().into();
+                                        }
+                                        (json!({"op":"route.open","route_channel":7,"route_epoch":1}), false)
+                                    } else {
+                                        assert_eq!(value["method"], "secret.use");
+                                        let mut state = state.lock().unwrap();
+                                         state.calls += 1;
+                                         state.params.push(value["params"].clone());
+                                        if state.disconnect { break; }
+                                        if state.hold_reply { continue; }
+                                        let mut reply = state.serve(&principal, value["params"].clone());
+                                        let error = reply.get("code").is_some();
+                                        if error {
+                                            if let Some(message) = &state.module_error_message {
+                                                reply["message"] = json!(message);
+                                            }
+                                        }
+                                        (reply, error)
+                                    };
+                                    let frame = Frame::build(if error { FrameType::Error } else { FrameType::Response }, flags(), request.header.channel, request.header.epoch, request.header.corr, serde_json::to_vec(&reply).unwrap()).unwrap();
+                                    if subc_transport::write_frame(&mut stream, &frame).await.is_err() { break; }
+                                }
+                            });
+                        }
+                        Some(result) = tasks.join_next(), if !tasks.is_empty() => result.unwrap(),
+                    }
+                }
+                tasks.abort_all();
+            });
+        });
+        Self {
+            _directory: directory,
+            path,
+            state,
+            stop: Some(stop),
+            server: Some(server),
+        }
+    }
+}
+
+impl Drop for FakeClaustrum {
+    fn drop(&mut self) {
+        let _ = self.stop.take().unwrap().send(());
+        self.server.take().unwrap().join().unwrap();
+    }
+}
+
+fn flags() -> Flags {
+    Flags::new(false, Priority::Interactive, false)
+}
diff --git a/crates/aft/src/secret/transport_tests.rs b/crates/aft/src/secret/transport_tests.rs
new file mode 100644
index 0000000000..2e79983794
--- /dev/null
+++ b/crates/aft/src/secret/transport_tests.rs
@@ -0,0 +1,350 @@
+use super::fake::{golden, refusal, FakeClaustrum, NONCE};
+use super::*;
+use crate::secret::{parse_answer, SecretUseAnswer, SecretUseRefusal, SecretUseReply};
+
+fn principal(module_id: &str) -> ConsumerIdentity {
+    ConsumerIdentity {
+        module_id: module_id.into(),
+        launch_nonce: NONCE.into(),
+    }
+}
+
+fn transport(daemon: &FakeClaustrum) -> SubcSecretUseTransport {
+    SubcSecretUseTransport {
+        connection_file: daemon.path.clone(),
+        identity: BindIdentity::new("aft-secret-use", "secret-call"),
+        timeout: Duration::from_secs(2),
+        worker: Arc::default(),
+        test_principal: None,
+    }
+}
+
+fn call(transport: &SubcSecretUseTransport, params: Value) -> Value {
+    serde_json::from_slice(&transport.dispatch(params, principal("aft")).unwrap()).unwrap()
+}
+
+#[test]
+fn secret_use_route_preserves_the_stamp_and_releases_only_after_phone_approval() {
+    let daemon = FakeClaustrum::start();
+    let transport = transport(&daemon);
+    let pending = call(&transport, golden(0));
+    assert_eq!(pending, json!({"result":golden(5)}));
+    assert_eq!(
+        call(&transport, golden(1)),
+        pending,
+        "defaults recover the same statement bytes"
+    );
+    daemon
+        .state
+        .lock()
+        .unwrap()
+        .approve(pending["result"]["statement_b64url"].as_str().unwrap());
+    let released = call(&transport, golden(0));
+    assert_eq!(released, json!({"result":golden(3)}));
+    let SecretUseAnswer::Reply(SecretUseReply::ReleasedApiKey(key)) =
+        parse_answer(&released).unwrap()
+    else {
+        panic!("the approved API key must be released");
+    };
+    assert_eq!(key.material(), b"sk-example");
+    assert!(!format!("{key:?}").contains("sk-example"));
+    assert!(!format!("{key:?}").contains("c2stZXhhbXBsZQ"));
+    let state = daemon.state.lock().unwrap();
+    assert_eq!(state.calls, 3);
+    assert_eq!(state.connections, 1);
+    assert_eq!(state.opens.len(), 1);
+    for open in &state.opens {
+        assert_eq!(
+            open["consumer_identity"],
+            json!({"module_id":"aft","launch_nonce":NONCE})
+        );
+        let stamp: ScopeStamp = serde_json::from_value(golden(0)["stamp"].clone()).unwrap();
+        assert_eq!(
+            open["scope"],
+            json!(ScopeSelector::new(
+                stamp.owner,
+                stamp.scope_ref,
+                Some(stamp.scope_epoch)
+            ))
+        );
+    }
+}
+
+#[test]
+fn secret_use_route_keeps_module_errors_distinct_from_uniform_not_found() {
+    let daemon = FakeClaustrum::start();
+    let transport = transport(&daemon);
+    let mut extra_name = golden(0);
+    extra_name["display_name"] = json!("not trusted");
+    let rejected = call(&transport, extra_name);
+    assert_eq!(
+        parse_answer(&rejected).unwrap().refusal(),
+        Some(SecretUseRefusal::InvalidParams)
+    );
+
+    let mut unknown = golden(0);
+    unknown["name"] = json!("unknown");
+    let not_found = call(&transport, unknown);
+    assert_eq!(not_found, refusal("not_found", "permanent"));
+    let mut mismatch = golden(0);
+    mismatch["target"]["host"] = json!("other.test");
+    assert_eq!(call(&transport, mismatch), not_found);
+    let mut mismatch = golden(0);
+    mismatch["target"]["path"] = json!("/repos/another");
+    assert_eq!(call(&transport, mismatch), not_found);
+    assert!(daemon.state.lock().unwrap().pending.is_empty());
+}
+
+#[test]
+fn secret_use_route_maps_all_sender_refusals_without_releasing_material() {
+    use SecretUseRefusal::*;
+    let daemon = FakeClaustrum::start();
+    let transport = transport(&daemon);
+    let mut oversized = golden(0);
+    oversized["name"] = json!("a".repeat(65));
+    let limit = call(&transport, oversized);
+    assert_eq!(limit, refusal("limit_exceeded", "context_overflow"));
+    assert_eq!(parse_answer(&limit).unwrap().refusal(), Some(LimitExceeded));
+    for expected in [SetupIncomplete, PendingLimit, StoreError] {
+        {
+            let mut state = daemon.state.lock().unwrap();
+            state.setup_incomplete = expected == SetupIncomplete;
+            state.other_pending_in_scope = if expected == PendingLimit { 8 } else { 0 };
+            state.store_error = expected == StoreError;
+        }
+        let answer = parse_answer(&call(&transport, golden(0))).unwrap();
+        assert_eq!(answer.refusal(), Some(expected));
+    }
+}
+
+#[test]
+fn secret_use_fake_grant_lookup_is_independent_of_requested_coverage_and_covers_linked_workers() {
+    let daemon = FakeClaustrum::start();
+    let head_transport = transport(&daemon);
+    let mut head = golden(0);
+    head["coverage"] = json!("agent_and_workers");
+    let pending = call(&head_transport, head);
+    daemon
+        .state
+        .lock()
+        .unwrap()
+        .approve(pending["result"]["statement_b64url"].as_str().unwrap());
+    assert_eq!(
+        call(&head_transport, golden(1)),
+        json!({"result":golden(3)})
+    );
+    let transport = transport(&daemon);
+    let mut worker = golden(0);
+    worker["stamp"] = golden(2)["stamp"].clone();
+    assert_eq!(
+        call(&transport, worker.clone()),
+        json!({"result":golden(3)})
+    );
+    worker["stamp"]["parent_state"] = json!("ended");
+    assert!(matches!(
+        parse_answer(&call(&transport, worker)).unwrap(),
+        SecretUseAnswer::Reply(SecretUseReply::ApprovalRequired(_))
+    ));
+}
+
+#[test]
+fn secret_use_deadline_covers_scoped_open_reply_and_disconnect_without_secret_errors() {
+    for phase in ["open", "reply", "disconnect", "no-daemon"] {
+        let daemon = FakeClaustrum::start();
+        let mut transport = transport(&daemon);
+        transport.timeout = Duration::from_millis(150);
+        {
+            let mut state = daemon.state.lock().unwrap();
+            state.hold_open = phase == "open";
+            state.hold_reply = phase == "reply";
+            state.disconnect = phase == "disconnect";
+        }
+        if phase == "no-daemon" {
+            transport.connection_file = daemon.path.with_extension("absent");
+        }
+        let started = std::time::Instant::now();
+        let error = transport.dispatch(golden(0), principal("aft")).unwrap_err();
+        assert_eq!(error, UNAVAILABLE, "{phase}");
+        assert!(
+            started.elapsed() < Duration::from_secs(2),
+            "{phase} exceeded the call deadline"
+        );
+        assert!(!error.contains("sk-example"));
+        assert!(!error.contains("c2stZXhhbXBsZQ"));
+    }
+}
+
+#[test]
+fn secret_use_sender_never_sends_a_non_https_or_non_443_target() {
+    let daemon = FakeClaustrum::start();
+    let transport = transport(&daemon);
+    for (scheme, port) in [("http", 443), ("https", 8443)] {
+        let mut params = golden(0);
+        params["target"]["scheme"] = json!(scheme);
+        params["target"]["port"] = json!(port);
+        assert_eq!(
+            transport.dispatch(params, principal("aft")).unwrap_err(),
+            UNAVAILABLE
+        );
+    }
+    assert_eq!(daemon.state.lock().unwrap().opens.len(), 0);
+}
+
+#[test]
+fn secret_use_standalone_cannot_construct_a_module_transport_and_keeps_unavailable_vault() {
+    let _nonce = crate::launch_nonce::install_for_tests(None);
+    assert!(SubcSecretUseTransport::new(
+        PathBuf::from("absent-connection.json"),
+        BindIdentity::new("standalone", "standalone"),
+        Duration::from_millis(150),
+    )
+    .is_none());
+    let stamp: ScopeStamp = serde_json::from_value(golden(0)["stamp"].clone()).unwrap();
+    let vault = crate::bash_background::secrets::vault();
+    assert!(matches!(
+        vault.use_secret(
+            &crate::secret::SecretScope::from_stamp(&stamp),
+            "key",
+            &crate::secret::ApiKeyTarget {
+                scheme: "https".into(),
+                host: "x.test".into(),
+                port: Some(443),
+                path: "/repos/a".into()
+            }
+        ),
+        crate::secret::UseAnswer::Unavailable
+    ));
+}
+
+// Negative contract inputs deliberately bypass the sender's typed construction.
+// They still travel through the SDK's authenticated connection, scoped open, and
+// request path, rather than calling the fake endpoint's handler directly.
+fn raw_call(daemon: &FakeClaustrum, identity: Option<ConsumerIdentity>, params: Value) -> Value {
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap()
+        .block_on(async {
+            let consumer = crate::fleet_status::connect_subc_consumer(
+                &daemon.path,
+                ConsumerOptions::default(),
+            )
+            .await
+            .unwrap();
+            let stamp: ScopeStamp = serde_json::from_value(golden(0)["stamp"].clone()).unwrap();
+            let route = consumer
+                .open_route_scoped(
+                    RouteTarget::ManagementSurface {
+                        module_id: "claustrum".into(),
+                    },
+                    BindIdentity::new("secret-contract", "negative"),
+                    ScopeSelector::new(stamp.owner, stamp.scope_ref, Some(stamp.scope_epoch)),
+                    CallOptions {
+                        consumer_identity: identity,
+                        timeout: Duration::from_secs(1),
+                        ..CallOptions::default()
+                    },
+                )
+                .await
+                .unwrap();
+            let reply = consumer
+                .request(
+                    &route,
+                    serde_json::to_vec(&json!({"method":"secret.use","params":params})).unwrap(),
+                    CallOptions {
+                        timeout: Duration::from_secs(1),
+                        ..CallOptions::default()
+                    },
+                )
+                .await;
+            let reply = match reply {
+                Ok(bytes) => serde_json::from_slice(&bytes).unwrap(),
+                Err(CallError::Module(error)) => json!({"code":error.code,"message":error.message}),
+                Err(error) => panic!("fake route failed: {error}"),
+            };
+            let _ = consumer.close().await;
+            reply
+        })
+}
+
+#[test]
+fn fake_claustrum_orders_caller_grammar_scope_and_target_checks() {
+    let daemon = FakeClaustrum::start();
+    let missing = refusal("not_found", "permanent");
+    assert_eq!(
+        raw_call(&daemon, Some(principal("other")), json!(null)),
+        missing
+    );
+    assert_eq!(
+        raw_call(&daemon, None, golden(0)),
+        missing,
+        "direct callers are not AFT"
+    );
+    let mut unstamped = golden(0);
+    unstamped["stamp"]
+        .as_object_mut()
+        .unwrap()
+        .remove("owner_authorized");
+    assert_eq!(
+        raw_call(&daemon, Some(principal("aft")), unstamped),
+        missing
+    );
+    for (field, value) in [("scheme", json!("http")), ("port", json!(8443))] {
+        let mut mismatched = golden(0);
+        mismatched["target"][field] = value;
+        assert_eq!(
+            raw_call(&daemon, Some(principal("aft")), mismatched),
+            missing
+        );
+    }
+    for target in [
+        json!({"scheme":"HTTP","host":"x.test","path":"/repos/a"}),
+        json!({"scheme":"https","host":"x.test","path":"/repos/a/%2e"}),
+        json!({"scheme":"https","host":"x.test","path":"/repos/a/..;x"}),
+        json!({"scheme":"https","host":"x.test","path":"/repos/a?secret"}),
+    ] {
+        let mut bad = golden(0);
+        bad["target"] = target;
+        let answer = raw_call(&daemon, Some(principal("aft")), bad);
+        assert_eq!(
+            parse_answer(&answer).unwrap().refusal(),
+            Some(SecretUseRefusal::InvalidParams)
+        );
+    }
+}
+
+#[test]
+fn secret_use_module_error_discards_peer_detail_before_returning_the_classification() {
+    let daemon = FakeClaustrum::start();
+    const KEY: &str = "module-error-credential-0123456789";
+    daemon.state.lock().unwrap().module_error_message = Some(KEY.into());
+    let transport = transport(&daemon);
+    let mut params = golden(0);
+    params["display_name"] = json!("invalid sender field");
+    let rejected = call(&transport, params);
+    assert_eq!(rejected, json!({"code":"invalid_params", "message":""}));
+    assert!(!serde_json::to_string(&rejected).unwrap().contains(KEY));
+    assert_eq!(
+        parse_answer(&rejected).unwrap().refusal(),
+        Some(SecretUseRefusal::InvalidParams)
+    );
+}
+
+#[test]
+fn fake_live_expiry_uses_the_documented_statement_field_and_matches_the_pending_reply() {
+    use base64::Engine;
+    let daemon = FakeClaustrum::start();
+    let expires = crate::secret::vault::now_ms() + 600_000;
+    daemon.state.lock().unwrap().pending_expires_at_ms = Some(expires);
+    let transport = transport(&daemon);
+    let reply = call(&transport, golden(0));
+    let statement: Value = serde_json::from_slice(
+        &base64::engine::general_purpose::URL_SAFE_NO_PAD
+            .decode(reply["result"]["statement_b64url"].as_str().unwrap())
+            .unwrap(),
+    )
+    .unwrap();
+    assert_eq!(reply["result"]["expires_at_ms"], expires);
+    assert_eq!(statement["request_expires_at_ms"], expires);
+    assert!(statement.get("expires_at_ms").is_none());
+}
diff --git a/crates/aft/src/secret/vault.rs b/crates/aft/src/secret/vault.rs
index 49b251ae4c..b07cd9e505 100644
--- a/crates/aft/src/secret/vault.rs
+++ b/crates/aft/src/secret/vault.rs
@@ -1,30 +1,14 @@
-//! The vault seam: the one way AFT asks for a label's rule and key material.
-//!
-//! AFT never reads a key itself. The vault maps a label to a rule in a
-//! `secret.use` reply ([`crate::secret::wire`]), hands over the bytes for one
-//! request or fetch hop, and collects one audit record per decided label.
-//!
-//! `material` exists because a grant is a permission, not a promise of the same
-//! bytes: the vault releases material per request, and AFT must not cache it.
-//! Key bytes live in a zeroizing buffer whose `Debug` prints a length, so no log
-//! line or panic message carries a key.
-//!
-//! The live vault is not deployed and AFT holds no `secret.use` grant yet, so
-//! production wires [`UnavailableVault`], which resolves nothing and releases
-//! nothing. [`SubcSecretVault`] is the real client, built and tested
-//! against the contract's golden examples; it becomes the production stand-in's
-//! replacement once the daemon can carry the call. The fake for tests compiles
-//! only under `cfg(test)` or the `secret-test-fake` feature, which no release
-//! profile enables (`scripts/check-secret-test-fake.sh` checks that in CI).
+//! Request-addressed vault access. Every outgoing use names its real target;
+//! material is zeroized after that request and is never cached between uses.
 
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use secret_rules::audit::AuditRecordV1;
-use secret_rules::location::LabelRule;
 
 use super::wire::{
-    self, ApprovalRequest, SecretUseAnswer, SecretUseReply, SecretUseRequest, VaultError,
+    self, ApiKeyTarget, ApprovalRequest, ReleasedApiKey, SecretUseAnswer, SecretUseReply,
+    SecretUseRequest,
 };
 
 /// Key bytes for one request or fetch hop.
@@ -83,47 +67,19 @@ pub fn zeroize(bytes: &mut [u8]) {
     std::sync::atomic::compiler_fence(Ordering::SeqCst);
 }
 
-/// What the vault says about one label.
-#[derive(Clone, PartialEq, Eq, Debug)]
-pub enum Resolution {
-    /// A rule to follow and the grant that allows material for it.
-    Granted {
-        /// Where and how the placeholder may be replaced.
-        rule: LabelRule,
-        /// Opaque grant identifier passed back to `material`.
-        grant_id: String,
-        /// When the grant lapses, in milliseconds since the epoch.
-        expires_at_ms: u64,
-    },
+/// What the vault says about one concrete outgoing request.
+#[derive(Debug)]
+pub enum UseAnswer {
+    /// Key and location for this request only.
+    Released(ReleasedApiKey),
     /// The vault is waiting for the user's answer.
     ApprovalRequired(ApprovalRequest),
-    /// The vault refused the label.
-    Denied {
-        /// The vault's reason, plain text with no key material.
-        reason: String,
-    },
-    /// No vault answers. Production answers this until the vault ships and AFT
-    /// holds a grant, which keeps the seam fail-closed.
+    /// Uniform refusal: forwarding the literal placeholder reveals no key.
+    NotFound,
+    /// Transport, grammar, setup, and store failures never permit substitution.
     Unavailable,
 }
 
-/// Why `material` handed out no bytes.
-#[derive(Clone, PartialEq, Eq, Debug)]
-pub enum MaterialError {
-    /// The grant lapsed: its expiry passed, it was revoked, or its scope ended.
-    GrantLapsed,
-    /// The vault could not be reached, or answered transiently.
-    Unavailable {
-        /// Plain-text detail with no key material.
-        detail: String,
-    },
-    /// The vault refused to release material for the grant.
-    Refused {
-        /// The vault's reason, plain text with no key material.
-        reason: String,
-    },
-}
-
 /// Why `audit` did not take a record.
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub enum AuditError {
@@ -140,23 +96,19 @@ pub enum AuditError {
     },
 }
 
-/// The three calls AFT makes on the vault.
+/// Request-addressed release and local audit reporting.
 ///
 /// Both scopes are [`crate::secret::SecretScope`] values the daemon stamped,
 /// never tool arguments or session ids.
 pub trait SecretVault: Send + Sync {
-    /// Ask which rule a label follows, without asking for the key bytes.
-    fn resolve(&self, scope: &crate::secret::SecretScope, label: &str) -> Resolution;
-
-    /// Fetch the bytes for one request or fetch hop whose target matched the
-    /// rule that `grant_id` belongs to. Called once per matching request; the
-    /// same grant may release different bytes after a rotation.
-    fn material(
+    /// Ask once for every outgoing request, including repeated requests after
+    /// approval. The vault audits uses and may rotate material between calls.
+    fn use_secret(
         &self,
         scope: &crate::secret::SecretScope,
         label: &str,
-        grant_id: &str,
-    ) -> Result<Material, MaterialError>;
+        target: &ApiKeyTarget,
+    ) -> UseAnswer;
 
     /// Hand one record to the vault's audit sink.
     fn audit(&self, record: &AuditRecordV1) -> Result<(), AuditError>;
@@ -170,30 +122,18 @@ pub trait SecretVault: Send + Sync {
     }
 }
 
-/// The vault production uses while the live vault is undeployed and AFT holds
-/// no `secret.use` grant.
-///
-/// Every resolution is `Unavailable` and `material` refuses, so nothing is ever
-/// substituted without a real grant, whatever the configuration says. No config
-/// file, environment variable or project setting selects another production
-/// vault, so this cannot be switched on by mistake.
+/// Standalone processes have no attested AFT identity and cannot ask the vault.
 #[derive(Debug, Default, Clone, Copy)]
 pub struct UnavailableVault;
 
 impl SecretVault for UnavailableVault {
-    fn resolve(&self, _scope: &crate::secret::SecretScope, _label: &str) -> Resolution {
-        Resolution::Unavailable
-    }
-
-    fn material(
+    fn use_secret(
         &self,
         _scope: &crate::secret::SecretScope,
         _label: &str,
-        _grant_id: &str,
-    ) -> Result<Material, MaterialError> {
-        Err(MaterialError::Unavailable {
-            detail: "no vault is connected".into(),
-        })
+        _target: &ApiKeyTarget,
+    ) -> UseAnswer {
+        UseAnswer::Unavailable
     }
 
     fn audit(&self, _record: &AuditRecordV1) -> Result<(), AuditError> {
@@ -232,15 +172,13 @@ pub fn now_ms() -> u64 {
 pub trait SecretUseTransport: Send + Sync {
     /// Send `params` as a `secret.use` call and return the reply body: either
     /// `{"result": …}` or an error object (§15, §1a).
-    fn secret_use(&self, params: serde_json::Value) -> Result<serde_json::Value, String>;
+    fn secret_use(&self, params: serde_json::Value) -> Result<zeroize::Zeroizing<Vec<u8>>, String>;
 }
 
 /// The real client: `secret.use` over the daemon's transport (§15).
 ///
 /// AFT is one of only two senders the vault admits, and it receives only API
-/// keys. `resolve` reads the reply's rule without keeping any bytes the vault
-/// may have released; a released key at resolution time is zeroized
-/// immediately, exactly as the contract's material rule requires.
+/// keys. Each reply belongs to the real target supplied with that call.
 pub struct SubcSecretVault {
     transport: std::sync::Arc<dyn SecretUseTransport>,
 }
@@ -269,71 +207,26 @@ impl SubcSecretVault {
             .transport
             .secret_use(request.to_params())
             .map_err(|detail| wire::ReplyError::Malformed { detail })?;
-        wire::parse_answer(&body)
+        super::wire_owned::parse(&body)
     }
 }
 
 impl SecretVault for SubcSecretVault {
-    fn resolve(&self, scope: &crate::secret::SecretScope, label: &str) -> Resolution {
-        // A resolution asks about every path, so it names the root path: the
-        // contract matches the target against the record's sealed scope, and a
-        // released key here is dropped, never kept.
-        let target = scope.root_target();
-        match self.call(scope, label, target) {
-            Ok(SecretUseAnswer::Reply(SecretUseReply::ReleasedApiKey(key))) => {
-                let rule = scope.rule_for(label, &key.location);
-                // The released bytes are not what this call asked for; drop them
-                // so they are zeroized here rather than retained.
-                drop(key);
-                Resolution::Granted {
-                    rule,
-                    grant_id: String::new(),
-                    expires_at_ms: 0,
-                }
-            }
-            Ok(SecretUseAnswer::Reply(SecretUseReply::ReleasedLogin(_))) => Resolution::Denied {
-                reason: "the vault released a login to a sender that only takes API keys".into(),
-            },
-            Ok(SecretUseAnswer::Reply(SecretUseReply::ApprovalRequired(request))) => {
-                Resolution::ApprovalRequired(request)
-            }
-            Ok(SecretUseAnswer::Refused(error)) => resolution_for_error(&error),
-            Ok(SecretUseAnswer::Rejected(error)) => {
-                if error.code == "invalid_params" {
-                    Resolution::Denied {
-                        reason: format!("the vault refused the request: {}", error.code),
-                    }
-                } else {
-                    Resolution::Unavailable
-                }
-            }
-            Err(_) => Resolution::Unavailable,
-        }
-    }
-
-    fn material(
+    fn use_secret(
         &self,
         scope: &crate::secret::SecretScope,
         label: &str,
-        _grant_id: &str,
-    ) -> Result<Material, MaterialError> {
-        let target = scope.root_target();
-        match self.call(scope, label, target) {
+        target: &ApiKeyTarget,
+    ) -> UseAnswer {
+        match self.call(scope, label, wire::Target::ApiKey(target.clone())) {
             Ok(SecretUseAnswer::Reply(SecretUseReply::ReleasedApiKey(key))) => {
-                Ok(Material::new(key.material().to_vec()))
-            }
-            Ok(SecretUseAnswer::Reply(SecretUseReply::ReleasedLogin(_))) => {
-                Err(MaterialError::Refused {
-                    reason: "the vault released a login, not an API key".into(),
-                })
+                UseAnswer::Released(key)
             }
-            Ok(SecretUseAnswer::Reply(SecretUseReply::ApprovalRequired(_))) => {
-                Err(MaterialError::GrantLapsed)
+            Ok(SecretUseAnswer::Reply(SecretUseReply::ApprovalRequired(request))) => {
+                UseAnswer::ApprovalRequired(request)
             }
-            Ok(SecretUseAnswer::Refused(error)) => Err(error_for_material(&error)),
-            Ok(SecretUseAnswer::Rejected(_)) | Err(_) => Err(MaterialError::Unavailable {
-                detail: "the vault did not answer".into(),
-            }),
+            Ok(SecretUseAnswer::Refused(error)) if error.code == "not_found" => UseAnswer::NotFound,
+            _ => UseAnswer::Unavailable,
         }
     }
 
@@ -345,26 +238,6 @@ impl SecretVault for SubcSecretVault {
     }
 }
 
-/// Map a result error onto a resolution (the outcome table).
-fn resolution_for_error(error: &VaultError) -> Resolution {
-    match error.code.as_str() {
-        "not_found" | "invalid_params" => Resolution::Denied {
-            reason: "the vault does not know this secret or target".into(),
-        },
-        _ => Resolution::Unavailable,
-    }
-}
-
-/// Map a result error onto a material refusal.
-fn error_for_material(error: &VaultError) -> MaterialError {
-    match error.code.as_str() {
-        "not_found" => MaterialError::GrantLapsed,
-        code => MaterialError::Refused {
-            reason: format!("the vault refused to release the secret: {code}"),
-        },
-    }
-}
-
 /// The fake vault, compiled only for tests or an explicitly feature-enabled
 /// build.
 #[cfg(any(test, feature = "secret-test-fake"))]
diff --git a/crates/aft/src/secret/vault/fake.rs b/crates/aft/src/secret/vault/fake.rs
index b13baed12b..8ef9e83173 100644
--- a/crates/aft/src/secret/vault/fake.rs
+++ b/crates/aft/src/secret/vault/fake.rs
@@ -12,27 +12,34 @@ use std::sync::{Arc, Mutex, MutexGuard};
 use secret_rules::audit::AuditRecordV1;
 use secret_rules::location::LabelRule;
 
-use super::{AuditError, Material, MaterialError, Resolution, SecretVault};
+use super::{AuditError, Material, SecretVault, UseAnswer};
 use crate::secret::wire::ApprovalRequest;
 use crate::secret::SecretScope;
+use crate::secret::{ApiKeyTarget, ReleasedApiKey};
 
 /// Everything a test makes the fake say, plus the record of what it was asked.
 #[derive(Default)]
 pub struct FakeVaultScript {
-    /// The answer `resolve` gives, per label. A label with no entry answers
-    /// `Unavailable`, which is also what an unconfigured vault says.
-    pub resolutions: HashMap<String, Resolution>,
-    /// Bytes `material` hands out, per label, taking one entry per call so a
-    /// test can rotate a key under one grant. A label runs out of bytes and
-    /// then repeats the last one.
+    /// The reply to a secret-use request for this label. Missing entries are unavailable.
+    pub answers: HashMap<String, FakeReply>,
+    /// Released bytes per label, advancing once per matching request to exercise
+    /// key rotation. After the list runs out, repeat its last value.
     pub material: HashMap<String, Vec<Vec<u8>>>,
 }
 
+#[derive(Clone, Debug)]
+pub enum FakeReply {
+    Rule(LabelRule),
+    ApprovalRequired(ApprovalRequest),
+    NotFound,
+    Unavailable,
+}
+
 struct FakeVaultState {
     script: FakeVaultScript,
-    /// One line per `resolve`, in call order.
+    /// One label per secret-use request, in call order.
     resolves: Vec<String>,
-    /// One line per `material`, in call order.
+    /// One label per request matching a stored host/path rule, in call order.
     materials: Vec<String>,
     /// Material calls already served per label, so rotation advances.
     served: HashMap<String, usize>,
@@ -93,15 +100,12 @@ impl FakeVault {
             .unwrap_or_else(std::sync::PoisonError::into_inner)
     }
 
-    /// Make `resolve` answer `label` with `resolution`.
-    pub fn set_resolution(&self, label: &str, resolution: Resolution) {
-        self.lock()
-            .script
-            .resolutions
-            .insert(label.to_string(), resolution);
+    /// Choose the reply for `label`.
+    pub fn set_answer(&self, label: &str, answer: FakeReply) {
+        self.lock().script.answers.insert(label.to_string(), answer);
     }
 
-    /// The bytes `material` hands out for `label`, in call order.
+    /// The bytes released for `label`, in call order.
     pub fn set_material(&self, label: &str, values: Vec<Vec<u8>>) {
         self.lock()
             .script
@@ -109,17 +113,17 @@ impl FakeVault {
             .insert(label.to_string(), values);
     }
 
-    /// The labels `material` was asked about, in order.
+    /// Labels that reached material release, in order.
     pub fn materials(&self) -> Vec<String> {
         self.lock().materials.clone()
     }
 
-    /// How many times `resolve` was called.
-    pub fn resolve_calls(&self) -> u64 {
+    /// How many secret-use requests were made.
+    pub fn use_calls(&self) -> u64 {
         self.resolve_count.load(Ordering::SeqCst)
     }
 
-    /// How many times `material` was called.
+    /// How many requests matched a stored host/path rule and asked for material.
     pub fn material_calls(&self) -> u64 {
         self.material_count.load(Ordering::SeqCst)
     }
@@ -145,53 +149,71 @@ impl FakeVault {
     }
 
     /// The next bytes for `label`, honouring rotation.
-    fn next_material(&self, label: &str) -> Result<Material, MaterialError> {
+    fn next_material(&self, label: &str) -> Option<Material> {
         let mut state = self.lock();
         state.materials.push(label.to_string());
         let Some(count) = state.script.material.get(label).map(Vec::len) else {
-            return Err(MaterialError::Refused {
-                reason: "the fake vault has no material for this label".into(),
-            });
+            return None;
         };
         if count == 0 {
-            return Err(MaterialError::Refused {
-                reason: "the fake vault's material list is empty".into(),
-            });
+            return None;
         }
         let index = {
-            // Rotation advances per label, so a second request under the same
-            // grant can see different bytes.
+            // Repeated requests may receive rotated bytes even with the same rule.
             let served = state.served.entry(label.to_string()).or_insert(0);
             let index = (*served).min(count - 1);
             *served += 1;
             index
         };
         let bytes = state.script.material[label][index].clone();
-        Ok(Material::new(bytes))
+        Some(Material::new(bytes))
     }
 }
 
 impl SecretVault for FakeVault {
-    fn resolve(&self, _scope: &SecretScope, label: &str) -> Resolution {
+    fn use_secret(&self, _scope: &SecretScope, label: &str, target: &ApiKeyTarget) -> UseAnswer {
         self.resolve_count.fetch_add(1, Ordering::SeqCst);
-        let mut state = self.lock();
-        state.resolves.push(label.to_string());
-        state
-            .script
-            .resolutions
-            .get(label)
-            .cloned()
-            .unwrap_or(Resolution::Unavailable)
-    }
-
-    fn material(
-        &self,
-        _scope: &SecretScope,
-        label: &str,
-        _grant_id: &str,
-    ) -> Result<Material, MaterialError> {
-        self.material_count.fetch_add(1, Ordering::SeqCst);
-        self.next_material(label)
+        let answer = {
+            let mut state = self.lock();
+            state.resolves.push(label.to_string());
+            state
+                .script
+                .answers
+                .get(label)
+                .cloned()
+                .unwrap_or(FakeReply::Unavailable)
+        };
+        match answer {
+            FakeReply::Rule(rule) => {
+                let request = secret_rules::target::RequestTarget {
+                    host: target.host.clone(),
+                    port: target.port.unwrap_or(443),
+                    scheme: &target.scheme,
+                    target: &target.path,
+                };
+                if request
+                    .matches(&secret_rules::target::RuleTarget {
+                        host: &rule.host,
+                        port: rule.port,
+                        path_prefix: &rule.path_prefix,
+                    })
+                    .is_err()
+                {
+                    return UseAnswer::NotFound;
+                }
+                self.material_count.fetch_add(1, Ordering::SeqCst);
+                match self.next_material(label) {
+                    Some(material) => UseAnswer::Released(ReleasedApiKey::new(
+                        location_text(&rule.location),
+                        material,
+                    )),
+                    None => UseAnswer::Unavailable,
+                }
+            }
+            FakeReply::ApprovalRequired(pending) => UseAnswer::ApprovalRequired(pending),
+            FakeReply::NotFound => UseAnswer::NotFound,
+            FakeReply::Unavailable => UseAnswer::Unavailable,
+        }
     }
 
     fn audit(&self, record: &AuditRecordV1) -> Result<(), AuditError> {
@@ -208,12 +230,19 @@ impl SecretVault for FakeVault {
     }
 }
 
-/// A granted resolution for tests.
-pub fn granted(rule: LabelRule, grant_id: &str) -> Resolution {
-    Resolution::Granted {
-        rule,
-        grant_id: grant_id.to_string(),
-        expires_at_ms: 0,
+/// A matching record for an addressed test call.
+pub fn granted(mut rule: LabelRule) -> FakeReply {
+    rule.port = 443;
+    FakeReply::Rule(rule)
+}
+
+pub(crate) fn location_text(location: &secret_rules::location::Location) -> String {
+    use secret_rules::location::Location;
+    match location {
+        Location::Bearer => "authorization_bearer".into(),
+        Location::Header(name) => format!("header:{name}"),
+        Location::Query(name) => format!("query:{name}"),
+        Location::Json(pointer) => format!("json_pointer:{pointer}"),
     }
 }
 
diff --git a/crates/aft/src/secret/wire.rs b/crates/aft/src/secret/wire.rs
index 3106822293..628fdf6521 100644
--- a/crates/aft/src/secret/wire.rs
+++ b/crates/aft/src/secret/wire.rs
@@ -30,7 +30,7 @@ pub const COVERAGE_SCOPE: &str = "scope";
 pub const COVERAGE_AGENT_AND_WORKERS: &str = "agent_and_workers";
 
 /// Which approval coverage a request asks for.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum Coverage {
     /// One secret use for the asking scope (the default when omitted).
@@ -53,28 +53,35 @@ impl Coverage {
 ///
 /// Senders strip the query and fragment before calling, so a `?` or `#` in
 /// `path` is a grammar fault on the vault's side; AFT refuses to send one.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ApiKeyTarget {
     /// `https`, the only scheme the vault accepts.
     pub scheme: String,
     /// Lowercase ASCII host.
     pub host: String,
     /// The port; omitted on the wire when it is the default 443.
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "present_option"
+    )]
     pub port: Option<u16>,
     /// The request path, starting with `/` and carrying no query or fragment.
     pub path: String,
 }
 
 /// The target a login was asked for: `{origin}`, canonical `https://host`.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct LoginTarget {
     /// The canonical origin, with port 443 omitted.
     pub origin: String,
 }
 
 /// The `target` member of a `secret.use` request.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
+#[serde(untagged)]
 pub enum Target {
     /// An API key for one host, port and path.
     ApiKey(ApiKeyTarget),
@@ -96,12 +103,17 @@ impl Serialize for Target {
 /// The `stamp` is the daemon's `ScopeStamp` value, relayed byte for byte. AFT
 /// never rewrites it, because the vault trusts the sender to pass it through
 /// unchanged and takes the asking scope from nowhere else.
-#[derive(Debug, Clone, PartialEq, Serialize)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct SecretUseRequest {
     /// The secret name (`[A-Za-z0-9][A-Za-z0-9._-]*`, 1–64 bytes).
     pub name: String,
     /// The coverage; `scope` when omitted.
-    #[serde(skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "present_option"
+    )]
     pub coverage: Option<Coverage>,
     /// The asking call's daemon stamp, unchanged.
     pub stamp: ScopeStamp,
@@ -109,6 +121,12 @@ pub struct SecretUseRequest {
     pub target: Target,
 }
 
+fn present_option<'de, D: serde::Deserializer<'de>, T: Deserialize<'de>>(
+    deserializer: D,
+) -> Result<Option<T>, D::Error> {
+    T::deserialize(deserializer).map(Some)
+}
+
 impl SecretUseRequest {
     /// Build a request for the scope `stamp` names.
     ///
@@ -169,6 +187,13 @@ pub struct ReleasedApiKey {
 }
 
 impl ReleasedApiKey {
+    pub fn new(location: String, bytes: crate::secret::vault::Material) -> Self {
+        Self { location, bytes }
+    }
+
+    pub fn into_parts(self) -> (String, crate::secret::vault::Material) {
+        (self.location, self.bytes)
+    }
     /// The key bytes for the one request that may carry them.
     pub fn material(&self) -> &[u8] {
         self.bytes.expose()
@@ -189,10 +214,10 @@ pub struct ReleasedLogin {
     /// The account name.
     pub username: String,
     /// The password.
-    password: crate::secret::vault::Material,
+    pub(super) password: crate::secret::vault::Material,
     /// The current TOTP code, when the record holds a seed. The seed itself
     /// never leaves the vault.
-    pub totp: Option<String>,
+    pub totp: Option<zeroize::Zeroizing<String>>,
 }
 
 impl ReleasedLogin {
@@ -227,7 +252,7 @@ pub enum SecretUseReply {
 }
 
 /// The vault's pending approval (§15 "Signed statement and envelope").
-#[derive(Clone, PartialEq, Eq)]
+#[derive(Clone, PartialEq, Eq, Serialize)]
 pub struct ApprovalRequest {
     /// The vault's identifier for the pending request, a 26-character ULID.
     pub request_id: String,
@@ -284,6 +309,72 @@ pub enum SecretUseAnswer {
     Rejected(VaultTransportError),
 }
 
+/// Refusals in the sender contract's ordered checks. A `not_found` never
+/// distinguishes caller admission, scope mapping, record, kind, or target.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SecretUseRefusal {
+    NotFound,
+    InvalidParams,
+    LimitExceeded,
+    SetupIncomplete,
+    PendingLimit,
+    StoreError,
+}
+
+impl SecretUseAnswer {
+    /// Classify known sender refusals without discarding the original wire
+    /// code/class. Unknown future refusals remain refusals, not success.
+    pub fn refusal(&self) -> Option<SecretUseRefusal> {
+        use SecretUseRefusal::*;
+        match self {
+            Self::Rejected(error) if error.code == "invalid_params" => Some(InvalidParams),
+            Self::Refused(error) => match error.code.as_str() {
+                "not_found" => Some(NotFound),
+                "limit_exceeded" => Some(LimitExceeded),
+                "secret_setup_incomplete" => Some(SetupIncomplete),
+                "pending_limit" => Some(PendingLimit),
+                "store_error" => Some(StoreError),
+                _ => None,
+            },
+            _ => None,
+        }
+    }
+}
+
+impl Serialize for SecretUseReply {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        use serde::ser::SerializeMap;
+        let mut map = serializer.serialize_map(None)?;
+        match self {
+            Self::ReleasedApiKey(key) => {
+                let encoded = zeroize::Zeroizing::new(b64url().encode(key.material()));
+                map.serialize_entry("status", "released")?;
+                map.serialize_entry("kind", "agent_api_key")?;
+                map.serialize_entry("key_b64url", encoded.as_str())?;
+                map.serialize_entry("location", &key.location)?;
+            }
+            Self::ReleasedLogin(login) => {
+                let password = std::str::from_utf8(login.password())
+                    .map_err(|_| serde::ser::Error::custom("login password is not UTF-8"))?;
+                map.serialize_entry("status", "released")?;
+                map.serialize_entry("kind", "site_login")?;
+                map.serialize_entry("username", &login.username)?;
+                map.serialize_entry("password", password)?;
+                if let Some(totp) = &login.totp {
+                    map.serialize_entry("totp", totp.as_str())?;
+                }
+            }
+            Self::ApprovalRequired(request) => {
+                map.serialize_entry("status", "approval_required")?;
+                map.serialize_entry("request_id", &request.request_id)?;
+                map.serialize_entry("statement_b64url", &request.statement_b64url)?;
+                map.serialize_entry("expires_at_ms", &request.expires_at_ms)?;
+            }
+        }
+        map.end()
+    }
+}
+
 /// The base64url engine the contract uses: strict and unpadded.
 fn b64url() -> base64::engine::general_purpose::GeneralPurpose {
     base64::engine::general_purpose::URL_SAFE_NO_PAD
@@ -291,17 +382,21 @@ fn b64url() -> base64::engine::general_purpose::GeneralPurpose {
 
 /// Read `key_b64url`, which is strict unpadded base64url (nonzero trailing
 /// bits included).
-fn decode_key(text: &str) -> Result<Vec<u8>, ReplyError> {
-    b64url()
-        .decode(text)
-        .map_err(|_| ReplyError::BadKeyEncoding)
+pub(super) fn decode_key(text: &str) -> Result<Vec<u8>, ReplyError> {
+    let mut decoded = zeroize::Zeroizing::new(vec![0u8; base64::decoded_len_estimate(text.len())]);
+    let length = b64url()
+        .decode_slice(text, &mut decoded)
+        .map_err(|_| ReplyError::BadKeyEncoding)?;
+    crate::secret::vault::zeroize(&mut decoded[length..]);
+    decoded.truncate(length);
+    Ok(std::mem::take(&mut *decoded))
 }
 
 /// The canonical 26-character Crockford ULID the vault's ids use: 26 base32
 /// characters from the 32-symbol Crockford alphabet, uppercase, with no
 /// padding. The first character is bounded to `0..=7` because the leading
 /// 128-bit timestamp field may not overflow.
-fn is_ulid(text: &str) -> bool {
+pub(super) fn is_ulid(text: &str) -> bool {
     const CROCKFORD: &[u8] = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ";
     let bytes = text.as_bytes();
     bytes.len() == 26
@@ -431,7 +526,7 @@ fn parse_released(object: &serde_json::Map<String, Value>) -> Result<SecretUseRe
                 })?;
             let totp = match totp {
                 None | Some(Value::Null) => None,
-                Some(Value::String(code)) => Some(code),
+                Some(Value::String(code)) => Some(zeroize::Zeroizing::new(code)),
                 Some(_) => {
                     return Err(ReplyError::Malformed {
                         detail: "totp is not a string".into(),
@@ -480,6 +575,12 @@ struct TransportError {
 /// tests read replies by the same rules.
 pub fn parse_answer(body: &Value) -> Result<SecretUseAnswer, ReplyError> {
     if let Some(result) = body.get("result") {
+        expect_keys(
+            body.as_object().ok_or_else(|| ReplyError::Malformed {
+                detail: "the reply is not an object".into(),
+            })?,
+            &["result"],
+        )?;
         if result.get("error").is_some() {
             let error: ResultError =
                 serde_json::from_value(result.clone()).map_err(|_| ReplyError::Malformed {
diff --git a/crates/aft/src/secret/wire_owned.rs b/crates/aft/src/secret/wire_owned.rs
new file mode 100644
index 0000000000..f5b4655b2b
--- /dev/null
+++ b/crates/aft/src/secret/wire_owned.rs
@@ -0,0 +1,351 @@
+//! Owned daemon reply parsing: encoded credentials are wiped even on refusals.
+
+use super::wire::*;
+use serde::{Deserialize, Deserializer};
+use zeroize::{Zeroize, Zeroizing};
+
+// Borrowing while deserializing from the zeroizing wire buffer avoids a second
+// ordinary String owner before the credential enters its zeroizing owner.
+struct Text(Zeroizing<String>);
+impl<'de> Deserialize<'de> for Text {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        // RawValue borrows the wire bytes without serde_json's ordinary decoded
+        // string scratch buffer, including when the peer uses JSON escapes.
+        let raw = <&serde_json::value::RawValue>::deserialize(d)?;
+        let raw = raw.get();
+        if !raw.starts_with('"') || !raw.ends_with('"') {
+            return Err(serde::de::Error::custom("expected a string"));
+        }
+        let mut text = Zeroizing::new(String::with_capacity(raw.len() - 2));
+        let mut chars = raw[1..raw.len() - 1].chars();
+        fn hex(chars: &mut std::str::Chars<'_>) -> Option<u32> {
+            (0..4).try_fold(0, |value, _| Some(value * 16 + chars.next()?.to_digit(16)?))
+        }
+        while let Some(ch) = chars.next() {
+            if ch != '\\' {
+                text.push(ch);
+                continue;
+            }
+            let decoded = match chars.next() {
+                Some('"') => '"',
+                Some('\\') => '\\',
+                Some('/') => '/',
+                Some('b') => '\u{0008}',
+                Some('f') => '\u{000c}',
+                Some('n') => '\n',
+                Some('r') => '\r',
+                Some('t') => '\t',
+                Some('u') => {
+                    let mut code = hex(&mut chars)
+                        .ok_or_else(|| serde::de::Error::custom("invalid escape"))?;
+                    if (0xd800..=0xdbff).contains(&code) {
+                        if chars.next() != Some('\\') || chars.next() != Some('u') {
+                            return Err(serde::de::Error::custom("invalid surrogate"));
+                        }
+                        let low = hex(&mut chars)
+                            .filter(|low| (0xdc00..=0xdfff).contains(low))
+                            .ok_or_else(|| serde::de::Error::custom("invalid surrogate"))?;
+                        code = 0x10000 + ((code - 0xd800) << 10) + (low - 0xdc00);
+                    }
+                    char::from_u32(code)
+                        .ok_or_else(|| serde::de::Error::custom("invalid character"))?
+                }
+                _ => return Err(serde::de::Error::custom("invalid escape")),
+            };
+            text.push(decoded);
+        }
+        Ok(Text(text))
+    }
+}
+impl Text {
+    fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+impl Drop for Text {
+    fn drop(&mut self) {
+        self.0.zeroize();
+        #[cfg(test)]
+        WIPES.with(|n| n.set(n.get() + 1));
+    }
+}
+#[cfg(test)]
+thread_local! { static WIPES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) }; }
+
+fn present<'de, D: Deserializer<'de>, T: Deserialize<'de>>(d: D) -> Result<Option<T>, D::Error> {
+    T::deserialize(d).map(Some)
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Envelope {
+    #[serde(default, deserialize_with = "present")]
+    result: Option<ResultBody>,
+    #[serde(default, deserialize_with = "present")]
+    code: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    message: Option<Text>,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Failure {
+    code: Text,
+    class: Option<Text>,
+}
+#[derive(Deserialize, Default)]
+#[serde(deny_unknown_fields)]
+struct ResultBody {
+    #[serde(default, deserialize_with = "present")]
+    status: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    kind: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    key_b64url: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    location: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    username: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    password: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    totp: Option<Option<Text>>,
+    #[serde(default, deserialize_with = "present")]
+    request_id: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    statement_b64url: Option<Text>,
+    #[serde(default, deserialize_with = "present")]
+    expires_at_ms: Option<u64>,
+    #[serde(default, deserialize_with = "present")]
+    error: Option<Failure>,
+}
+fn malformed() -> ReplyError {
+    ReplyError::Malformed {
+        detail: "the reply does not match the contract".into(),
+    }
+}
+impl ResultBody {
+    fn count(&self) -> usize {
+        [
+            self.status.is_some(),
+            self.kind.is_some(),
+            self.key_b64url.is_some(),
+            self.location.is_some(),
+            self.username.is_some(),
+            self.password.is_some(),
+            self.totp.is_some(),
+            self.request_id.is_some(),
+            self.statement_b64url.is_some(),
+            self.expires_at_ms.is_some(),
+            self.error.is_some(),
+        ]
+        .into_iter()
+        .filter(|v| *v)
+        .count()
+    }
+    fn reply(self) -> Result<SecretUseAnswer, ReplyError> {
+        let count = self.count();
+        if let Some(error) = &self.error {
+            if count != 1 {
+                return Err(malformed());
+            }
+            return Ok(SecretUseAnswer::Refused(VaultError {
+                code: match error.code.as_str() {
+                    "not_found" => "not_found",
+                    "limit_exceeded" => "limit_exceeded",
+                    "secret_setup_incomplete" => "secret_setup_incomplete",
+                    "pending_limit" => "pending_limit",
+                    "store_error" => "store_error",
+                    _ => return Err(malformed()),
+                }
+                .into(),
+                class: match error.class.as_ref().map(Text::as_str) {
+                    None => None,
+                    Some("permanent") => Some("permanent".into()),
+                    Some("transient") => Some("transient".into()),
+                    Some("context_overflow") => Some("context_overflow".into()),
+                    _ => return Err(malformed()),
+                },
+            }));
+        }
+        fn text(v: &Option<Text>) -> Result<&str, ReplyError> {
+            v.as_ref().map(Text::as_str).ok_or_else(malformed)
+        }
+        let reply = match text(&self.status)? {
+            "released" => match text(&self.kind)? {
+                "agent_api_key" if count == 4 => {
+                    SecretUseReply::ReleasedApiKey(ReleasedApiKey::new(
+                        text(&self.location)?.into(),
+                        super::vault::Material::new(super::wire::decode_key(text(
+                            &self.key_b64url,
+                        )?)?),
+                    ))
+                }
+                "site_login" if count == 4 + usize::from(self.totp.is_some()) => {
+                    SecretUseReply::ReleasedLogin(ReleasedLogin {
+                        username: text(&self.username)?.into(),
+                        password: super::vault::Material::new(
+                            text(&self.password)?.as_bytes().to_vec(),
+                        ),
+                        totp: self
+                            .totp
+                            .as_ref()
+                            .and_then(|v| v.as_ref())
+                            .map(|v| Zeroizing::new(v.as_str().into())),
+                    })
+                }
+                _ => return Err(malformed()),
+            },
+            "approval_required" if count == 4 => {
+                let request_id = text(&self.request_id)?;
+                let statement = text(&self.statement_b64url)?;
+                if !super::wire::is_ulid(request_id) || super::wire::decode_key(statement).is_err()
+                {
+                    return Err(malformed());
+                }
+                SecretUseReply::ApprovalRequired(ApprovalRequest {
+                    request_id: request_id.into(),
+                    statement_b64url: statement.into(),
+                    expires_at_ms: self.expires_at_ms.ok_or_else(malformed)?,
+                })
+            }
+            _ => return Err(malformed()),
+        };
+        Ok(SecretUseAnswer::Reply(reply))
+    }
+}
+
+pub(super) fn parse(bytes: &[u8]) -> Result<SecretUseAnswer, ReplyError> {
+    let envelope: Envelope = serde_json::from_slice(bytes).map_err(|_| malformed())?;
+    match (envelope.result, envelope.code, envelope.message) {
+        (Some(result), None, None) => result.reply(),
+        (None, Some(code), Some(_message)) if code.as_str() == "invalid_params" => {
+            Ok(SecretUseAnswer::Rejected(VaultTransportError {
+                code: "invalid_params".into(),
+                message: String::new(),
+            }))
+        }
+        _ => Err(malformed()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn encoded_credentials_are_wiped_on_success_and_every_decode_failure() {
+        for suffix in [
+            "",
+            ",\"unknown\":true",
+            ",\"code\":\"not_found\",\"message\":\"no\"",
+        ] {
+            let bytes = Zeroizing::new(format!("{{\"result\":{{\"status\":\"released\",\"kind\":\"agent_api_key\",\"key_b64url\":\"c2stZXhhbXBsZQ\",\"location\":\"authorization_bearer\"}}{suffix}}}"));
+            WIPES.with(|n| n.set(0));
+            let answer = parse(bytes.as_bytes());
+            assert_eq!(answer.is_ok(), suffix.is_empty());
+            assert!(WIPES.with(|n| n.get()) >= 4);
+        }
+        let bytes = br#"{"result":{"status":"released","kind":"agent_api_key","key_b64url":"not valid!","location":"authorization_bearer"}}"#;
+        WIPES.with(|n| n.set(0));
+        assert!(matches!(parse(bytes), Err(ReplyError::BadKeyEncoding)));
+        assert!(WIPES.with(|n| n.get()) >= 4);
+    }
+}
+
+#[cfg(test)]
+mod contract_tests {
+    use super::*;
+    #[test]
+    fn owned_decoder_reads_every_sender_reply_golden_and_refuses_contradictory_outer_envelopes() {
+        for golden in super::super::wire_tests::USE_GOLDENS.lines().skip(3) {
+            let bytes = Zeroizing::new(format!("{{\"result\":{golden}}}"));
+            let SecretUseAnswer::Reply(reply) = parse(bytes.as_bytes()).unwrap() else {
+                panic!("a documented sender reply must decode");
+            };
+            assert_eq!(serde_json::to_string(&reply).unwrap(), golden);
+            for extra in [
+                ",\"unexpected\":null",
+                ",\"code\":\"invalid_params\",\"message\":\"invalid params\"",
+                ",\"error\":{}",
+            ] {
+                let body = format!("{{\"result\":{golden}{extra}}}");
+                assert!(parse(body.as_bytes()).is_err());
+                assert!(
+                    super::super::wire::parse_answer(&serde_json::from_str(&body).unwrap())
+                        .is_err()
+                );
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod escaped_tests {
+    use super::*;
+    #[test]
+    fn escaped_credential_text_decodes_directly_into_its_zeroizing_owner() {
+        let bytes = Zeroizing::new(br#"{"result":{"status":"released","kind":"agent_api_key","key_b64url":"\u00632stZXhhbXBsZQ","location":"authorization_bearer"}}"#.to_vec());
+        let SecretUseAnswer::Reply(SecretUseReply::ReleasedApiKey(key)) = parse(&bytes).unwrap()
+        else {
+            panic!("escaped JSON credential is still strict base64url");
+        };
+        assert_eq!(key.material(), b"sk-example");
+        let text: Text = serde_json::from_slice(br#""\ud83d\ude00\u002f\t""#).unwrap();
+        assert_eq!(text.as_str(), "😀/\t");
+        WIPES.with(|n| n.set(0));
+        assert!(parse(br#"{"result":{"key_b64url":"c2stZXhhbXBsZQ","status":"released","kind":"agent_api_key","location":42}}"#).is_err());
+        assert!(
+            WIPES.with(|n| n.get()) >= 3,
+            "earlier parsed credential fields are wiped when a later field is malformed"
+        );
+    }
+}
+
+#[cfg(test)]
+mod classified_error_tests {
+    use super::*;
+    #[test]
+    fn owned_error_decode_retains_only_a_static_classification_and_wipes_peer_detail() {
+        const KEY: &str = "peer-error-credential-0123456789";
+        WIPES.with(|count| count.set(0));
+        let payload = Zeroizing::new(format!(r#"{{"code":"invalid_params","message":"{KEY}"}}"#));
+        let answer = parse(payload.as_bytes()).unwrap();
+        let SecretUseAnswer::Rejected(error) = answer else {
+            panic!("classified module error")
+        };
+        assert_eq!(error.code, "invalid_params");
+        assert!(
+            error.message.is_empty(),
+            "peer detail is discarded rather than copied into an ordinary String"
+        );
+        assert!(!format!("{error:?}").contains(KEY));
+        assert!(WIPES.with(|count| count.get()) >= 2);
+        for payload in [
+            format!(r#"{{"result":{{"error":{{"code":"{KEY}","class":"permanent"}}}}}}"#),
+            format!(r#"{{"result":{{"error":{{"code":"not_found","class":"{KEY}"}}}}}}"#),
+            format!(r#"{{"code":"{KEY}","message":"detail"}}"#),
+        ] {
+            let payload = Zeroizing::new(payload);
+            let failure = parse(payload.as_bytes()).unwrap_err();
+            assert!(!format!("{failure:?}").contains(KEY));
+        }
+    }
+
+    #[test]
+    fn owned_error_decode_preserves_every_documented_sender_refusal_classification() {
+        for (code, class) in [
+            ("not_found", "permanent"),
+            ("limit_exceeded", "context_overflow"),
+            ("secret_setup_incomplete", "permanent"),
+            ("pending_limit", "transient"),
+            ("store_error", "transient"),
+        ] {
+            let payload =
+                format!(r#"{{"result":{{"error":{{"code":"{code}","class":"{class}"}}}}}}"#);
+            let SecretUseAnswer::Refused(error) = parse(payload.as_bytes()).unwrap() else {
+                panic!("sender refusal")
+            };
+            assert_eq!(error.code, code);
+            assert_eq!(error.class.as_deref(), Some(class));
+        }
+    }
+}
diff --git a/crates/aft/src/secret/wire_tests.rs b/crates/aft/src/secret/wire_tests.rs
index dc4915237d..12ac8690ed 100644
--- a/crates/aft/src/secret/wire_tests.rs
+++ b/crates/aft/src/secret/wire_tests.rs
@@ -18,6 +18,54 @@ const VECTORS: &str = include_str!("../../tests/fixtures/secret/secret-approval-
 /// The sha256 the campaign pinned for the vector file.
 const VECTORS_SHA256: &str = "efd4ba60641586e143bce81087e4f9f5aaf8a99ffede74190303da7d4495cc27";
 
+// The six agent-sender request/result examples in claustrum's
+// docs/wire-contract-v1.md, §15 "secret.use: the sender contract", in document
+// order. Keep their literal JSON bytes, including statement bytes.
+pub(super) const USE_GOLDENS: &str =
+    include_str!("../../tests/fixtures/secret/secret-use-v1.jsonl");
+
+#[test]
+fn every_sender_golden_round_trips_through_the_wire_types() {
+    let examples: Vec<_> = USE_GOLDENS.lines().collect();
+    assert_eq!(examples.len(), 6);
+    for (index, example) in examples.into_iter().enumerate() {
+        let value: Value = serde_json::from_str(example).unwrap();
+        let encoded = if index < 3 {
+            let request: SecretUseRequest = serde_json::from_value(value).unwrap();
+            serde_json::to_string(&request).unwrap()
+        } else {
+            let reply = parse_reply(&value).unwrap();
+            serde_json::to_string(&reply).unwrap()
+        };
+        assert_eq!(encoded, example, "sender golden {index}");
+    }
+}
+
+#[test]
+fn sender_refusals_preserve_the_contract_code_class_and_error_frame() {
+    use SecretUseRefusal::*;
+    for (code, class, refusal) in [
+        ("not_found", "permanent", NotFound),
+        ("limit_exceeded", "context_overflow", LimitExceeded),
+        ("secret_setup_incomplete", "permanent", SetupIncomplete),
+        ("pending_limit", "transient", PendingLimit),
+        ("store_error", "transient", StoreError),
+    ] {
+        let answer =
+            parse_answer(&json!({"result":{"error":{"code":code,"class":class}}})).unwrap();
+        assert_eq!(answer.refusal(), Some(refusal));
+        let SecretUseAnswer::Refused(error) = answer else {
+            panic!("result refusal")
+        };
+        assert_eq!(error.code, code);
+        assert_eq!(error.class.as_deref(), Some(class));
+    }
+    let answer =
+        parse_answer(&json!({"code":"invalid_params","message":"invalid params"})).unwrap();
+    assert_eq!(answer.refusal(), Some(InvalidParams));
+    assert!(matches!(answer, SecretUseAnswer::Rejected(_)));
+}
+
 fn vectors() -> Value {
     serde_json::from_str(VECTORS).expect("the pinned vector file is JSON")
 }
@@ -153,7 +201,10 @@ fn a_golden_released_login_reply_parses_with_and_without_totp() {
     };
     assert_eq!(login.username, "alice");
     assert_eq!(login.password(), b"correct horse");
-    assert_eq!(login.totp.as_deref(), Some("123456"));
+    assert_eq!(
+        login.totp.as_ref().map(|code| code.as_str()),
+        Some("123456")
+    );
 
     let without = parse_reply(&json!({
         "status": "released",
@@ -368,30 +419,37 @@ fn a_result_error_and_a_transport_error_read_as_the_contract_spells_them() {
 fn the_secret_use_client_sends_the_pinned_params_and_reads_a_release() {
     struct Recording(std::sync::Mutex<Vec<Value>>);
     impl SecretUseTransport for Recording {
-        fn secret_use(&self, params: Value) -> Result<Value, String> {
+        fn secret_use(&self, params: Value) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
             self.0.lock().unwrap().push(params);
-            Ok(json!({"result":{
-                "status": "released",
-                "kind": "agent_api_key",
-                "key_b64url": "c2stZXhhbXBsZQ",
-                "location": "header:X-Api-Key"
-            }}))
+            Ok(zeroize::Zeroizing::new(
+                serde_json::to_vec(&json!({"result":{
+                    "status": "released",
+                    "kind": "agent_api_key",
+                    "key_b64url": "c2stZXhhbXBsZQ",
+                    "location": "header:X-Api-Key"
+                }}))
+                .unwrap(),
+            ))
         }
     }
     let transport = std::sync::Arc::new(Recording(std::sync::Mutex::new(Vec::new())));
     let vault = SubcSecretVault::new(transport.clone());
     let scope = SecretScope::from_stamp(&golden_stamp());
-    let resolution = vault.resolve(&scope, "key");
-    // A released key at resolution time is reported as a granted rule and the
-    // bytes themselves are dropped (zeroized), per the contract's material rule.
-    let Resolution::Granted { rule, .. } = resolution else {
-        panic!("a release at resolution time is a grant");
+    let answer = vault.use_secret(
+        &scope,
+        "key",
+        &ApiKeyTarget {
+            scheme: "https".into(),
+            host: "x.test".into(),
+            port: Some(443),
+            path: "/repos/a".into(),
+        },
+    );
+    let UseAnswer::Released(released) = answer else {
+        panic!("a release keeps material for this request only");
     };
-    assert_eq!(rule.label, "key");
-    assert!(matches!(
-        rule.location,
-        secret_rules::location::Location::Header(ref name) if name == "X-Api-Key"
-    ));
+    assert_eq!(released.location, "header:X-Api-Key");
+    assert_eq!(released.material(), b"sk-example");
     let sent = transport.0.lock().unwrap();
     assert_eq!(sent.len(), 1);
     assert_eq!(keys(&sent[0]), set(&["name", "stamp", "target"]));
@@ -403,19 +461,31 @@ fn the_secret_use_client_sends_the_pinned_params_and_reads_a_release() {
 fn the_secret_use_client_reports_an_approval_as_pending() {
     struct Pending;
     impl SecretUseTransport for Pending {
-        fn secret_use(&self, _params: Value) -> Result<Value, String> {
+        fn secret_use(&self, _params: Value) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
             let file = vectors();
-            Ok(json!({"result":{
-                "status": "approval_required",
-                "request_id": file["vectors"][0]["statements"][0]["request_id"],
-                "statement_b64url": file["vectors"][0]["statements"][0]["statement_b64url"],
-                "expires_at_ms": 1700000600000u64,
-            }}))
+            Ok(zeroize::Zeroizing::new(
+                serde_json::to_vec(&json!({"result":{
+                    "status": "approval_required",
+                    "request_id": file["vectors"][0]["statements"][0]["request_id"],
+                    "statement_b64url": file["vectors"][0]["statements"][0]["statement_b64url"],
+                    "expires_at_ms": 1700000600000u64,
+                }}))
+                .unwrap(),
+            ))
         }
     }
     let vault = SubcSecretVault::new(std::sync::Arc::new(Pending));
     let scope = SecretScope::from_stamp(&golden_stamp());
-    let Resolution::ApprovalRequired(request) = vault.resolve(&scope, "key") else {
+    let UseAnswer::ApprovalRequired(request) = vault.use_secret(
+        &scope,
+        "key",
+        &ApiKeyTarget {
+            scheme: "https".into(),
+            host: "x.test".into(),
+            port: Some(443),
+            path: "/repos/a".into(),
+        },
+    ) else {
         panic!("an approval_required answer is a pending resolution");
     };
     assert_eq!(request.request_id, "01HF7YAT000000000000000001");
@@ -423,18 +493,32 @@ fn the_secret_use_client_reports_an_approval_as_pending() {
 }
 
 #[test]
-fn the_secret_use_client_maps_the_uniform_not_found_to_a_refusal() {
+fn the_secret_use_client_preserves_uniform_not_found_for_literal_forwarding() {
     struct NotFound;
     impl SecretUseTransport for NotFound {
-        fn secret_use(&self, _params: Value) -> Result<Value, String> {
-            Ok(json!({"result":{"error":{"code":"not_found","class":"permanent"}}}))
+        fn secret_use(&self, _params: Value) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
+            Ok(zeroize::Zeroizing::new(
+                serde_json::to_vec(
+                    &json!({"result":{"error":{"code":"not_found","class":"permanent"}}}),
+                )
+                .unwrap(),
+            ))
         }
     }
     let vault = SubcSecretVault::new(std::sync::Arc::new(NotFound));
     let scope = SecretScope::from_stamp(&golden_stamp());
     assert!(matches!(
-        vault.resolve(&scope, "key"),
-        Resolution::Denied { .. }
+        vault.use_secret(
+            &scope,
+            "key",
+            &ApiKeyTarget {
+                scheme: "https".into(),
+                host: "x.test".into(),
+                port: Some(443),
+                path: "/repos/a".into()
+            }
+        ),
+        UseAnswer::NotFound
     ));
 }
 
diff --git a/crates/aft/src/secret_proxy/audit.rs b/crates/aft/src/secret_proxy/audit.rs
index 24c4b2c82d..7b41a07de2 100644
--- a/crates/aft/src/secret_proxy/audit.rs
+++ b/crates/aft/src/secret_proxy/audit.rs
@@ -5,8 +5,8 @@ use super::State;
 use hyper::body::Incoming;
 use hyper::Request;
 use secret_rules::audit::{AuditReason, AuditRecordV1, Decision};
-use secret_rules::location::{location_kind_token, LabelOutcome};
-use secret_rules::target::{ConnectAuthority, RequestTarget, RuleTarget};
+use secret_rules::location::{location_kind_token, LabelOutcome, LabelRule};
+use secret_rules::target::ConnectAuthority;
 use std::sync::atomic::{AtomicU64, Ordering};
 
 static REQUEST_ID: AtomicU64 = AtomicU64::new(1);
@@ -16,6 +16,7 @@ pub(super) struct RequestAudit<'a> {
     authority: ConnectAuthority,
     request_id: String,
     labels: Vec<(Option<usize>, String)>,
+    rules: Vec<LabelRule>,
     done: bool,
 }
 
@@ -30,35 +31,15 @@ impl<'a> RequestAudit<'a> {
             .path_and_query()
             .map(|p| p.as_str())
             .unwrap_or("/");
-        let view = RequestTarget {
-            host: authority.host.clone(),
-            port: authority.port,
-            scheme: "https",
-            target,
-        };
         let mut labels = Vec::new();
-        for (index, grant) in state.config.grants.iter().enumerate() {
-            let rule = &grant.rule;
-            let matched = view
-                .matches(&RuleTarget {
-                    host: &rule.host,
-                    port: rule.port,
-                    path_prefix: &rule.path_prefix,
-                })
-                .is_ok();
-            if matched
-                || mentions(target.as_bytes(), &rule.label)
+        for label in &state.config.scanned_labels {
+            if mentions(target.as_bytes(), label)
                 || request
                     .headers()
                     .values()
-                    .any(|v| mentions(v.as_bytes(), &rule.label))
+                    .any(|v| mentions(v.as_bytes(), label))
             {
-                labels.push((Some(index), rule.label.clone()));
-            }
-        }
-        if labels.is_empty() {
-            if let Some(grant) = state.config.grants.first() {
-                labels.push((Some(0), grant.rule.label.clone()));
+                labels.push((None, label.clone()));
             }
         }
         Self {
@@ -66,23 +47,38 @@ impl<'a> RequestAudit<'a> {
             authority: authority.clone(),
             request_id: REQUEST_ID.fetch_add(1, Ordering::Relaxed).to_string(),
             labels,
+            rules: Vec::new(),
             done: false,
         }
     }
 
-    pub(super) fn decide(&mut self, outcomes: &[LabelOutcome]) -> Result<(), String> {
+    pub(super) fn decide(
+        &mut self,
+        rules: &[LabelRule],
+        outcomes: &[LabelOutcome],
+    ) -> Result<(), String> {
+        self.rules = rules.to_vec();
+        for (index, label) in &mut self.labels {
+            *index = rules.iter().position(|rule| &rule.label == label);
+        }
         self.emit(Some(outcomes))
     }
 
+    pub(super) fn mention(&mut self, label: &str) {
+        if !self.labels.iter().any(|(_, known)| known == label) {
+            self.labels.push((None, label.to_owned()));
+        }
+    }
+
     pub(super) fn refused_for(&mut self, label: &str) {
         if !self.done
             && !label.is_empty()
             && !self
                 .state
                 .config
-                .grants
+                .scanned_labels
                 .iter()
-                .any(|g| g.rule.label == label)
+                .any(|known| known == label)
         {
             self.labels.clear();
             self.labels.push((None, label.to_owned()));
@@ -107,6 +103,7 @@ impl<'a> RequestAudit<'a> {
                     (Decision::Literal, AuditReason::NotWholeValue)
                 }
                 Some(_) => (Decision::Literal, AuditReason::OutOfScope),
+                None if outcomes.is_some() => (Decision::Literal, AuditReason::OutOfScope),
                 None => (Decision::Refused, AuditReason::Refused),
             };
             let mut record = AuditRecordV1::new(
@@ -119,7 +116,7 @@ impl<'a> RequestAudit<'a> {
             )
             .with_scope(Some(self.state.config.authorization_scope.to_scope_ref()));
             if let Some(index) = index {
-                let rule = &self.state.config.grants[*index].rule;
+                let rule = &self.rules[*index];
                 record = record.with_rule(
                     &self.authority.host,
                     self.authority.port,
@@ -157,7 +154,7 @@ impl Drop for RequestAudit<'_> {
     }
 }
 
-fn mentions(bytes: &[u8], label: &str) -> bool {
+pub(super) fn mentions(bytes: &[u8], label: &str) -> bool {
     let needle = secret_rules::placeholder::placeholder_text(label);
     for start in 0..bytes.len() {
         if bytes[start] != b'{' && bytes[start] != b'%' {
diff --git a/crates/aft/src/secret_proxy/audit_tests.rs b/crates/aft/src/secret_proxy/audit_tests.rs
index cb4d2572fd..a562b77a5e 100644
--- a/crates/aft/src/secret_proxy/audit_tests.rs
+++ b/crates/aft/src/secret_proxy/audit_tests.rs
@@ -63,53 +63,55 @@ async fn audit_transfer_coding() {
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn audit_expiry_revocation_at_send() {
-    for revoke in [false, true] {
-        let server = Server::new("delay-h1").await;
-        let vault = Vault::new();
-        let mut cfg = config(
-            vault.clone(),
-            server.address.port(),
-            &[("test", Location::Bearer)],
-        );
-        let expiry = crate::secret::vault::now_ms() + 2000;
-        if !revoke {
-            cfg.grants[0].expires_at_ms = expiry;
-        }
-        let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
-        let mut client = Client::spawn(&proxy, &server);
-        proxy.arm_command(client.process.id()).unwrap();
-        client.connect(false);
-        let worker = std::thread::spawn(move || {
-            let reply = client.request(
-                "/approved",
-                json!({"authorization":format!("Bearer {MARKER}")}),
-                "",
-            );
-            (reply, client)
-        });
-        tokio::time::timeout(Duration::from_secs(5), server.handshake_seen.notified())
-            .await
-            .unwrap();
-        if revoke {
-            vault.denied.store(true, Ordering::SeqCst);
-        } else {
-            tokio::time::sleep(Duration::from_millis(
-                expiry.saturating_sub(crate::secret::vault::now_ms()) + 20,
-            ))
-            .await;
-        }
-        server.tls_release.notify_one();
-        let (reply, _client) = worker.join().unwrap();
-        assert_eq!(
-            reply["status"], 403,
-            "authorization lapsed during upstream TLS: {reply}"
-        );
-        assert!(server.seen.lock().is_empty());
-        assert_eq!(
-            vault.calls.load(Ordering::SeqCst),
-            if revoke { 1 } else { 0 }
+    let server = Server::new("delay-h1").await;
+    let vault = Vault::new();
+    let cfg = config(
+        vault.clone(),
+        server.address.port(),
+        &[("test", Location::Bearer)],
+    );
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = std::thread::spawn(move || {
+        let reply = client.request(
+            "/approved",
+            json!({"authorization":format!("Bearer {MARKER}")}),
+            "",
         );
-    }
+        (reply, client)
+    });
+    tokio::time::timeout(Duration::from_secs(5), server.handshake_seen.notified())
+        .await
+        .unwrap();
+    assert_eq!(
+        vault.calls.load(Ordering::SeqCst),
+        0,
+        "do not release material before the verified handshake finishes"
+    );
+    vault.denied.store(true, Ordering::SeqCst);
+    server.tls_release.notify_one();
+    let (reply, mut client) = worker.join().unwrap();
+    assert_eq!(
+        reply["status"], 403,
+        "a denial during the handshake must prevent credential dispatch"
+    );
+    server.tls_release.notify_one();
+    assert_eq!(
+        client.request(
+            "/approved",
+            json!({"authorization":format!("Bearer {MARKER}")}),
+            ""
+        )["status"],
+        403
+    );
+    assert_eq!(server.seen.lock().len(), 0);
+    assert_eq!(
+        vault.calls.load(Ordering::SeqCst),
+        2,
+        "a later request must reach the vault again"
+    );
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -330,12 +332,12 @@ async fn audit_unscanned_header_refusal() {
 async fn audit_ipv6_literal() {
     let server = Server::new("ipv6-h1").await;
     let vault = Vault::new();
-    let mut cfg = config(
+    let cfg = config(
         vault.clone(),
         server.address.port(),
         &[("test", Location::Bearer)],
     );
-    cfg.grants[0].rule.host = "[::1]".into();
+    vault.rules.lock().get_mut("test").unwrap().host = "[::1]".into();
     let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
     let mut client = Client::spawn(&proxy, &server);
     proxy.arm_command(client.process.id()).unwrap();
diff --git a/crates/aft/src/secret_proxy/limits.rs b/crates/aft/src/secret_proxy/limits.rs
index 2ea148497c..abc1e6f230 100644
--- a/crates/aft/src/secret_proxy/limits.rs
+++ b/crates/aft/src/secret_proxy/limits.rs
@@ -18,6 +18,7 @@ pub(super) struct IdleIo<T> {
     inner: T,
     timeout: Duration,
     timer: Pin<Box<Sleep>>,
+    approval_waits: Option<std::sync::Arc<std::sync::atomic::AtomicUsize>>,
 }
 
 impl<T> IdleIo<T> {
@@ -26,9 +27,28 @@ impl<T> IdleIo<T> {
             inner,
             timeout,
             timer: Box::pin(tokio::time::sleep(timeout)),
+            approval_waits: None,
         }
     }
+    pub(super) fn with_approval_waits(
+        mut self,
+        waits: std::sync::Arc<std::sync::atomic::AtomicUsize>,
+    ) -> Self {
+        self.approval_waits = Some(waits);
+        self
+    }
     fn expired(&mut self, cx: &mut Context<'_>) -> bool {
+        // A held approval has its own ten-minute deadline. Quiet sockets must
+        // remain usable long enough to return the card's result to the client.
+        if self
+            .approval_waits
+            .as_ref()
+            .is_some_and(|waits| waits.load(std::sync::atomic::Ordering::Acquire) != 0)
+        {
+            let _ = self.timer.as_mut().poll(cx);
+            self.touch();
+            return false;
+        }
         self.timer.as_mut().poll(cx).is_ready()
     }
     fn touch(&mut self) {
diff --git a/crates/aft/src/secret_proxy/mod.rs b/crates/aft/src/secret_proxy/mod.rs
index ed86d30dff..46466dacf3 100644
--- a/crates/aft/src/secret_proxy/mod.rs
+++ b/crates/aft/src/secret_proxy/mod.rs
@@ -75,9 +75,8 @@ use hyper::{Method, Request, Response, StatusCode};
 use hyper_util::rt::{TokioExecutor, TokioIo};
 use parking_lot::Mutex;
 use rcgen::{BasicConstraints, CertificateParams, IsCa, KeyPair};
-use secret_rules::location::{validate_header_name, LabelRule, Location};
 use secret_rules::scrub::{MatcherSet, Scrubber};
-use secret_rules::target::{canonical_host, ConnectAuthority};
+use secret_rules::target::ConnectAuthority;
 use tokio::net::{TcpListener, TcpStream};
 use tokio::sync::watch;
 use zeroize::Zeroizing;
@@ -90,19 +89,16 @@ pub(crate) type Body = http_body_util::combinators::UnsyncBoxBody<Bytes, std::io
 /// Constant agent-visible wording; labels and hosts are appended as data.
 pub const PROXY_REFUSAL: &str = "Secret proxy refused the request";
 
-/// A launch-time resolution, not a request-time material cache.
-#[derive(Clone, Debug)]
-pub struct GrantedLabel {
-    pub rule: LabelRule,
-    pub expires_at_ms: u64,
-}
-
 pub struct ProxyConfig {
     pub vault: Arc<dyn SecretVault>,
     pub authorization_scope: SecretScope,
     pub lifetime_scope: SecretScope,
     pub scanned_labels: Vec<String>,
-    pub grants: Vec<GrantedLabel>,
+    pub consent_context: Option<(std::path::PathBuf, String)>,
+    #[cfg(test)]
+    pub test_https_port: Option<u16>,
+    #[cfg(test)]
+    pub(crate) approval_clock: Option<Arc<dyn crate::secret::requests::ApprovalClock>>,
     pub origin: String,
 }
 
@@ -175,10 +171,11 @@ pub(crate) mod test_hardening {
 }
 
 pub(crate) struct State {
+    approvals: crate::secret::requests::RequestSecrets,
     config: ProxyConfig,
     session: AtomicI32,
     session_birth: std::sync::atomic::AtomicU64,
-    stopped: AtomicBool,
+    stopped: Arc<AtomicBool>,
     token: Zeroizing<String>,
     expected_auth: Zeroizing<Vec<u8>>,
     ca: rcgen::Certificate,
@@ -189,6 +186,8 @@ pub(crate) struct State {
     requests: Arc<tokio::sync::Semaphore>,
     // Keep each installed key as an exact-byte matcher for response scrubbers.
     // Rotation adds a matcher instead of replacing earlier key values.
+    // Retain these zeroizing patterns until the command ends solely to scrub
+    // echoed keys; they never authorize or supply another upstream request.
     patterns: Mutex<Vec<(String, Zeroizing<Vec<u8>>)>>,
     #[cfg(test)]
     headers_sensitive: AtomicBool,
@@ -196,9 +195,18 @@ pub(crate) struct State {
     test_identity_generation: std::sync::atomic::AtomicU64,
     #[cfg(test)]
     test_idle_timeout_ms: std::sync::atomic::AtomicU64,
+    #[cfg(test)]
+    test_upstream: Mutex<std::collections::HashMap<String, SocketAddr>>,
 }
 
 impl State {
+    fn is_https_port(&self, port: u16) -> bool {
+        #[cfg(test)]
+        if self.config.test_https_port == Some(port) {
+            return true;
+        }
+        port == 443
+    }
     fn idle_timeout(&self) -> Duration {
         #[cfg(test)]
         {
@@ -347,17 +355,11 @@ impl SecretProxy {
             return Err(ProxyError::UnsupportedPlatform);
         }
         let scanned: BTreeSet<_> = config.scanned_labels.iter().collect();
-        let resolved: BTreeSet<_> = config.grants.iter().map(|g| &g.rule.label).collect();
         if scanned.is_empty()
-            || scanned != resolved
-            || resolved.len() != config.grants.len()
-            || config.grants.iter().any(|g| {
-                let r = &g.rule;
-                !secret_rules::placeholder::is_label(&r.label)
-                    || canonical_host(&r.host).is_err()
-                    || secret_rules::target::normalize_path_prefix(&r.path_prefix).map_or(true, |p| p != r.path_prefix)
-                    || matches!(&r.location, Location::Header(name) if validate_header_name(name).is_err())
-            })
+            || scanned.len() != config.scanned_labels.len()
+            || scanned
+                .iter()
+                .any(|label| !secret_rules::placeholder::is_label(label))
         {
             return Err(ProxyError::InvalidRules);
         }
@@ -383,11 +385,22 @@ impl SecretProxy {
         let token =
             Zeroizing::new(base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(&random[..]));
         let expected_auth = basic_credentials(&token)?;
+        let stopped = Arc::new(AtomicBool::new(false));
+        let cancelled = stopped.clone();
+        let approvals = crate::secret::requests::RequestSecrets::new(
+            config.vault.clone(),
+            config.authorization_scope.clone(),
+            config.consent_context.clone(),
+        )
+        .with_request_cancellation(move || cancelled.load(Ordering::Acquire));
+        #[cfg(test)]
+        let approvals = approvals.with_clock(config.approval_clock.clone());
         let state = Arc::new(State {
+            approvals,
             config,
             session: AtomicI32::new(0),
             session_birth: std::sync::atomic::AtomicU64::new(0),
-            stopped: AtomicBool::new(false),
+            stopped,
             token,
             expected_auth,
             ca,
@@ -403,6 +416,8 @@ impl SecretProxy {
             test_identity_generation: std::sync::atomic::AtomicU64::new(0),
             #[cfg(test)]
             test_idle_timeout_ms: std::sync::atomic::AtomicU64::new(0),
+            #[cfg(test)]
+            test_upstream: Mutex::default(),
         });
         let listener = std::net::TcpListener::bind((Ipv4Addr::LOCALHOST, 0))
             .map_err(|_| ProxyError::Initialization)?;
@@ -441,6 +456,21 @@ impl SecretProxy {
         self.address
     }
 
+    #[cfg(unix)]
+    pub(crate) fn approval_status(&self) -> Vec<String> {
+        self.state
+            .approvals
+            .status()
+            .into_iter()
+            .filter_map(|line| {
+                self.state
+                    .scrub(line.as_bytes())
+                    .ok()
+                    .and_then(|bytes| String::from_utf8(bytes).ok())
+            })
+            .collect()
+    }
+
     /// Exec-time only: never persist the returned credential with a task request.
     pub fn proxy_url(&self) -> Zeroizing<String> {
         let address = self.address.to_string();
@@ -530,7 +560,7 @@ async fn serve(
                 connections.spawn(async move {
                     let session = state.session.load(Ordering::Acquire);
                     if session <= 0 || !state.generation_valid() || !peer::authorized(&socket, session) || !state.generation_valid() { return; }
-                    let socket = limits::IdleIo::new(socket, state.idle_timeout());
+                    let socket = limits::IdleIo::new(socket, state.idle_timeout()).with_approval_waits(state.approvals.activity());
                     let service = service_fn(move |request| connect(request, state.clone(), lease.clone()));
                     let _ = hyper::server::conn::http1::Builder::new()
                         .serve_connection(TokioIo::new(socket), service).with_upgrades().await;
@@ -572,11 +602,7 @@ async fn connect(
     }) {
         return Ok(refused());
     }
-    let intercepted = state
-        .config
-        .grants
-        .iter()
-        .any(|g| canonical_host(&g.rule.host).ok().as_ref() == Some(&authority.host));
+    let intercepted = state.is_https_port(authority.port);
     let tls = if intercepted {
         match state.tls_for(&authority.host) {
             Ok(tls) => Some(tls),
diff --git a/crates/aft/src/secret_proxy/request.rs b/crates/aft/src/secret_proxy/request.rs
index 92d60e1bda..c914eed32c 100644
--- a/crates/aft/src/secret_proxy/request.rs
+++ b/crates/aft/src/secret_proxy/request.rs
@@ -10,10 +10,7 @@ use secret_rules::location::{
     evaluate_request_with_connect, HeaderField, LabelOutcome, Location, RequestView,
 };
 use secret_rules::material::{check_admissible, encode_for_location};
-use secret_rules::target::{
-    authority_matches_connect, normalize_request_target, ConnectAuthority, RequestTarget,
-    RuleTarget,
-};
+use secret_rules::target::{authority_matches_connect, normalize_request_target, ConnectAuthority};
 use zeroize::Zeroizing;
 
 use super::{full, refusal, Body, State};
@@ -36,9 +33,9 @@ pub(super) async fn forward(
         .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"websocket"));
     let fallback = state
         .config
-        .grants
+        .scanned_labels
         .first()
-        .map(|g| g.rule.label.as_str())
+        .map(String::as_str)
         .unwrap_or("");
     let result = if let Some(lease) = &lease {
         prepare_and_send(request, &authority, &state, lease.clone(), &mut audit).await
@@ -120,28 +117,8 @@ async fn prepare_and_send(
         .is_some_and(|v| v.as_bytes().eq_ignore_ascii_case(b"websocket"));
     let client_upgrade = ws.then(|| hyper::upgrade::on(&mut request));
     let (mut parts, mut incoming) = request.into_parts();
-    let rules: Vec<_> = state.config.grants.iter().map(|g| g.rule.clone()).collect();
-    let target_view = RequestTarget {
-        host: authority.host.clone(),
-        port: authority.port,
-        scheme: "https",
-        target: &target,
-    };
-    let matches: Vec<_> = rules
-        .iter()
-        .map(|r| {
-            target_view
-                .matches(&RuleTarget {
-                    host: &r.host,
-                    port: r.port,
-                    path_prefix: &r.path_prefix,
-                })
-                .is_ok()
-        })
-        .collect();
-    // A runtime-built header label is not a launch grant. Refuse it before
-    // contacting the vault; other destinations and non-header text are literal.
-    if matches.iter().any(|matched| *matched) {
+    // Runtime-built labels cannot widen the labels scanned at launch.
+    {
         for value in parts.headers.values() {
             for (offset, byte) in value.as_bytes().iter().enumerate() {
                 if *byte != b'{' {
@@ -150,19 +127,25 @@ async fn prepare_and_send(
                 if let Some(placeholder) =
                     secret_rules::placeholder::parse_at(value.as_bytes(), offset)
                 {
-                    if !rules.iter().any(|rule| rule.label == placeholder.label) {
+                    if !state
+                        .config
+                        .scanned_labels
+                        .iter()
+                        .any(|label| label == placeholder.label)
+                    {
                         return Err(placeholder.label.to_owned());
                     }
                 }
             }
         }
     }
-    let has_json = rules
-        .iter()
-        .zip(&matches)
-        .any(|(r, m)| *m && matches!(r.location, Location::Json(_)));
-    // Only JSON substitution needs a buffered body. Other uploads remain
-    // streaming; they are never searched for placeholders outside their rule.
+    // The vault names the substitution location only when it releases a key.
+    // Buffer bounded JSON bodies to discover placeholders before asking it.
+    let has_json = parts
+        .headers
+        .get("content-type")
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(secret_rules::location::is_json_content_type);
     let mut body = body_buffer(has_json);
     if has_json {
         while let Some(frame) = incoming.frame().await {
@@ -185,6 +168,155 @@ async fn prepare_and_send(
             }
         }
     }
+    let path = target.split(['?', '#']).next().unwrap_or("/");
+    let path = normalize_request_target(path).map_err(|_| fail())?;
+    let addressed = crate::secret::ApiKeyTarget {
+        scheme: "https".into(),
+        host: authority.host.clone(),
+        port: Some(443),
+        path: String::from_utf8(path.wire).map_err(|_| fail())?,
+    };
+    let labels: Vec<_> = state
+        .config
+        .scanned_labels
+        .iter()
+        .filter(|label| {
+            super::audit::mentions(target.as_bytes(), label)
+                || parts
+                    .headers
+                    .values()
+                    .any(|value| super::audit::mentions(value.as_bytes(), label))
+                || super::audit::mentions(&body, label)
+        })
+        .cloned()
+        .collect();
+    let headers = parts
+        .headers
+        .iter()
+        .map(|(n, v)| HeaderField::value(n.as_str(), v.as_bytes()))
+        .collect();
+    let structure = RequestView::new(&target, headers).with_body(&body);
+    if has_json && !labels.is_empty() {
+        secret_rules::location::validate_json_request(&structure).map_err(|_| fail())?;
+    }
+    if evaluate_request_with_connect(&structure, authority, &[], &[])
+        .refusal
+        .is_some()
+    {
+        return Err(fail());
+    }
+    drop(structure);
+    let mut budget = state.approvals.budget();
+    // Finish verified TLS before any releasing call. Approval waits reconnect
+    // before their retry; no socket held across a phone wait authorizes a send.
+    let initial = connect_upstream(authority, state, ws).await?;
+    let reconnected = tokio::sync::Mutex::new(Vec::new());
+    use futures_util::StreamExt;
+    let mut pending = futures_util::stream::FuturesUnordered::new();
+    for label in &labels {
+        audit.mention(label);
+        let addressed = &addressed;
+        let reconnected = &reconnected;
+        let expires = budget.expires_at_ms;
+        let (target, headers, body) = (&target, &parts.headers, &body);
+        pending.push(async move {
+            let answer = if state.is_https_port(authority.port) {
+                state
+                    .approvals
+                    .use_planned_in_request(
+                        label,
+                        addressed,
+                        expires,
+                        |location| {
+                            plan_location(
+                                label, location, addressed, authority, target, headers, body,
+                            )
+                            .map_err(|_| crate::secret::requests::UseError::Unavailable)
+                        },
+                        |key| {
+                            state
+                                .install(label, key)
+                                .map_err(|_| crate::secret::requests::UseError::Unavailable)
+                        },
+                        || async {
+                            let connection = connect_upstream(authority, state, ws)
+                                .await
+                                .map_err(|_| crate::secret::requests::UseError::Unavailable)?;
+                            reconnected.lock().await.push(connection);
+                            Ok(())
+                        },
+                    )
+                    .await
+            } else {
+                Ok(crate::secret::UseAnswer::NotFound)
+            };
+            (label, answer)
+        });
+    }
+    let mut rules = Vec::new();
+    let mut materials = Vec::new();
+    let mut unsettled = labels.clone();
+    while !pending.is_empty() {
+        let (label, answer) = tokio::select! {
+            biased;
+            () = budget.expired() => return Ok(not_approved(unsettled.first().map(String::as_str).unwrap_or(""), &authority.host, state, crate::secret::requests::UseError::Expired)),
+            result = pending.next() => result.ok_or_else(fail)?,
+        };
+        unsettled.retain(|name| name != label);
+        let answer = match answer {
+            Ok(answer) => answer,
+            Err(
+                reason @ (crate::secret::requests::UseError::Declined
+                | crate::secret::requests::UseError::Expired
+                | crate::secret::requests::UseError::Cancelled
+                | crate::secret::requests::UseError::Unavailable),
+            ) => return Ok(not_approved(label, &authority.host, state, reason)),
+            Err(_) => return Err(label.clone()),
+        };
+        match answer {
+            crate::secret::UseAnswer::NotFound => continue,
+            crate::secret::UseAnswer::Released(released) => {
+                let (location, material) = released.into_parts();
+                let location = secret_rules::location::parse_vault_location(&location)
+                    .ok_or_else(|| label.clone())?;
+                // Without a pending card, the vault reveals a deposit location only
+                // when releasing its key, so location-dependent refusals can follow that release.
+                let rule = secret_rules::location::LabelRule {
+                    label: label.clone(),
+                    host: addressed.host.clone(),
+                    port: authority.port,
+                    path_prefix: addressed.path.clone(),
+                    location,
+                };
+                let headers = parts
+                    .headers
+                    .iter()
+                    .map(|(n, v)| HeaderField::value(n.as_str(), v.as_bytes()))
+                    .collect();
+                let view = RequestView::new(&target, headers).with_body(&body);
+                let dummy = [(label.clone(), b"proxy-planning-value-0000".to_vec())];
+                if evaluate_request_with_connect(
+                    &view,
+                    authority,
+                    std::slice::from_ref(&rule),
+                    &dummy,
+                )
+                .refusal
+                .is_some()
+                {
+                    return Err(label.clone());
+                }
+                check_admissible(material.expose(), label, &rule.location)
+                    .map_err(|_| label.clone())?;
+                state
+                    .install(label, material.expose())
+                    .map_err(|_| label.clone())?;
+                rules.push(rule);
+                materials.push(Some(material));
+            }
+            _ => return Err(label.clone()),
+        }
+    }
     let headers = parts
         .headers
         .iter()
@@ -203,53 +335,21 @@ async fn prepare_and_send(
     }
     if has_json {
         let json: serde_json::Value = serde_json::from_slice(&body).map_err(|_| fail())?;
-        for (rule, matched) in rules.iter().zip(&matches) {
+        for rule in &rules {
             if let Location::Json(pointer) = &rule.location {
-                if *matched && json.pointer(pointer).is_some_and(|v| !v.is_string()) {
+                if json.pointer(pointer).is_some_and(|v| !v.is_string()) {
                     return Err(rule.label.clone());
                 }
             }
         }
     }
-    for (grant, matched) in state.config.grants.iter().zip(&matches) {
-        if *matched && crate::secret::vault::now_ms() >= grant.expires_at_ms {
-            return Err(grant.rule.label.clone());
-        }
-    }
-    // Authenticate the upstream first. Material is the vault's revocation
-    // check, so obtain it only after asynchronous connection work ends.
-    let upstream = connect_upstream(authority, state, ws).await?;
+    // Earlier releases belong only to this request and are already spent: any
+    // later refusal or deadline drops them without sending or reusing them.
+    drop(pending);
+    let upstream = reconnected.into_inner().pop().unwrap_or(initial);
     let http2 = matches!(&upstream, Upstream::Http2(_));
     let response = {
         let _gate = state.material_gate.lock();
-        let mut materials = Vec::new();
-        for ((rule, matched), grant) in rules.iter().zip(&matches).zip(&state.config.grants) {
-            if !matched {
-                materials.push(None);
-                continue;
-            }
-            if state.stopped.load(Ordering::Acquire)
-                || !state.generation_valid()
-                || crate::secret::vault::now_ms() >= grant.expires_at_ms
-            {
-                return Err(rule.label.clone());
-            }
-            let material = state
-                .config
-                .vault
-                .material(
-                    &state.config.authorization_scope,
-                    &rule.label,
-                    &rule.grant_id,
-                )
-                .map_err(|_| rule.label.clone())?;
-            check_admissible(material.expose(), &rule.label, &rule.location)
-                .map_err(|_| rule.label.clone())?;
-            state
-                .install(&rule.label, material.expose())
-                .map_err(|_| rule.label.clone())?;
-            materials.push(Some(material));
-        }
         let mut query_edits = Vec::new();
         let mut body_edits = Vec::new();
         let mut header_edits = Vec::new();
@@ -341,31 +441,22 @@ async fn prepare_and_send(
         }
         #[cfg(test)]
         state.headers_sensitive.store(
-            plan.header_edits.iter().all(|edit| {
-                outbound
-                    .headers()
-                    .get(edit.name.as_str())
-                    .is_some_and(|value| value.is_sensitive())
-            }),
+            !plan.header_edits.is_empty()
+                && plan.header_edits.iter().all(|edit| {
+                    outbound
+                        .headers()
+                        .get(edit.name.as_str())
+                        .is_some_and(|value| value.is_sensitive())
+                }),
             Ordering::Release,
         );
         if state.stopped.load(Ordering::Acquire) || !state.generation_valid() {
             return Err(fail());
         }
-        for (grant, matched) in state.config.grants.iter().zip(&matches) {
-            if *matched && crate::secret::vault::now_ms() >= grant.expires_at_ms {
-                return Err(grant.rule.label.clone());
-            }
-        }
-        audit.decide(&plan.labels)?;
+        audit.decide(&rules, &plan.labels)?;
         if state.stopped.load(Ordering::Acquire) || !state.generation_valid() {
             return Err(fail());
         }
-        for (grant, matched) in state.config.grants.iter().zip(&matches) {
-            if *matched && crate::secret::vault::now_ms() >= grant.expires_at_ms {
-                return Err(grant.rule.label.clone());
-            }
-        }
         let response = upstream.send(outbound);
         drop(materials);
         response
@@ -376,6 +467,66 @@ async fn prepare_and_send(
         .map_err(|_| fail())
 }
 
+fn not_approved(
+    label: &str,
+    host: &str,
+    state: &State,
+    reason: crate::secret::requests::UseError,
+) -> Response<Body> {
+    let body = Zeroizing::new(crate::secret::requests::consent_failure_message(
+        label, host, reason,
+    ));
+    let mut response = Response::new(full(Bytes::from(
+        state
+            .scrub(body.as_bytes())
+            .unwrap_or_else(|_| super::PROXY_REFUSAL.as_bytes().to_vec()),
+    )));
+    *response.status_mut() = hyper::StatusCode::FORBIDDEN;
+    response
+}
+
+fn plan_location(
+    label: &str,
+    token: &str,
+    addressed: &crate::secret::ApiKeyTarget,
+    authority: &ConnectAuthority,
+    target: &str,
+    headers: &hyper::HeaderMap,
+    body: &[u8],
+) -> Result<(), ()> {
+    let location = secret_rules::location::parse_vault_location(token).ok_or(())?;
+    if let Location::Json(pointer) = &location {
+        let value: serde_json::Value = serde_json::from_slice(body).map_err(|_| ())?;
+        if value
+            .pointer(pointer)
+            .is_some_and(|value| !value.is_string())
+        {
+            return Err(());
+        }
+    }
+    let rule = secret_rules::location::LabelRule {
+        label: label.into(),
+        host: addressed.host.clone(),
+        port: authority.port,
+        path_prefix: addressed.path.clone(),
+        location,
+    };
+    let headers = headers
+        .iter()
+        .map(|(n, v)| HeaderField::value(n.as_str(), v.as_bytes()))
+        .collect();
+    let view = RequestView::new(target, headers).with_body(body);
+    let dummy = [(label.to_owned(), b"proxy-planning-value-0000".to_vec())];
+    if evaluate_request_with_connect(&view, authority, &[rule], &dummy)
+        .refusal
+        .is_some()
+    {
+        Err(())
+    } else {
+        Ok(())
+    }
+}
+
 pub(super) fn body_buffer(_has_json: bool) -> Zeroizing<Vec<u8>> {
     Zeroizing::new(Vec::new())
 }
@@ -438,10 +589,16 @@ async fn connect_upstream(
     websocket: bool,
 ) -> Result<Upstream, String> {
     let fail = || String::new();
-    let socket = tokio::time::timeout(
-        state.idle_timeout(),
-        tokio::net::TcpStream::connect((super::network_host(&authority.host), authority.port)),
-    )
+    let socket = tokio::time::timeout(state.idle_timeout(), async {
+        #[cfg(test)]
+        {
+            let address = state.test_upstream.lock().get(&authority.host).copied();
+            if let Some(address) = address {
+                return tokio::net::TcpStream::connect(address).await;
+            }
+        }
+        tokio::net::TcpStream::connect((super::network_host(&authority.host), authority.port)).await
+    })
     .await
     .map_err(|_| fail())?
     .map_err(|_| fail())?;
diff --git a/crates/aft/src/secret_proxy/tests.rs b/crates/aft/src/secret_proxy/tests.rs
index 686d6b832b..a8b882cb68 100644
--- a/crates/aft/src/secret_proxy/tests.rs
+++ b/crates/aft/src/secret_proxy/tests.rs
@@ -10,7 +10,9 @@ use secret_rules::location::Location;
 use serde_json::{json, Value};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 
-use crate::secret::vault::{AuditError, Material, MaterialError, Resolution};
+use crate::secret::vault::{AuditError, Material, UseAnswer};
+use crate::secret::{ApiKeyTarget, ReleasedApiKey};
+use secret_rules::location::LabelRule;
 
 const K1: &[u8] = b"test-key-12345678";
 const K2: &[u8] = b"rotated-key-987654321";
@@ -18,6 +20,7 @@ const MARKER: &str = "{{ck-secret:test}}";
 const SPECIAL: &[u8] = b"alpha&percent%quote\"slash\\\r\nkey";
 
 struct Vault {
+    rules: Mutex<HashMap<String, LabelRule>>,
     calls: AtomicUsize,
     denied: AtomicBool,
     rotate: AtomicBool,
@@ -33,6 +36,7 @@ struct Vault {
 impl Vault {
     fn new() -> Arc<Self> {
         Arc::new(Self {
+            rules: Mutex::default(),
             calls: AtomicUsize::new(0),
             denied: AtomicBool::new(false),
             rotate: AtomicBool::new(false),
@@ -48,17 +52,19 @@ impl Vault {
 }
 
 impl SecretVault for Vault {
-    fn resolve(&self, _: &SecretScope, _: &str) -> Resolution {
-        panic!("proxy must not resolve or file consent")
-    }
-    fn material(
-        &self,
-        scope: &SecretScope,
-        label: &str,
-        _: &str,
-    ) -> Result<Material, MaterialError> {
+    fn use_secret(&self, scope: &SecretScope, label: &str, target: &ApiKeyTarget) -> UseAnswer {
         assert_eq!(scope.reference(), "head");
         let count = self.calls.fetch_add(1, Ordering::SeqCst);
+        let Some(rule) = self.rules.lock().get(label).cloned() else {
+            return UseAnswer::NotFound;
+        };
+        if rule.host != target.host
+            || !(target.path == rule.path_prefix
+                || target.path.starts_with(&format!("{}/", rule.path_prefix)))
+        {
+            return UseAnswer::NotFound;
+        }
+        let location = crate::secret::vault::fake::location_text(&rule.location);
         if self.block_material.load(Ordering::Acquire) {
             self.material_entered.notify_one();
             let mut released = self.material_released.lock().unwrap();
@@ -68,18 +74,24 @@ impl SecretVault for Vault {
         }
         if self.denied.load(Ordering::SeqCst) || self.refused_label.lock().as_deref() == Some(label)
         {
-            return Err(MaterialError::GrantLapsed);
+            return UseAnswer::Unavailable;
         }
         if self.special.load(Ordering::SeqCst) {
-            return Ok(Material::new(SPECIAL.to_vec()));
+            return UseAnswer::Released(ReleasedApiKey::new(
+                location,
+                Material::new(SPECIAL.to_vec()),
+            ));
         }
-        Ok(Material::new(
-            if self.rotate.load(Ordering::SeqCst) && count > 0 {
-                K2
-            } else {
-                K1
-            }
-            .to_vec(),
+        UseAnswer::Released(ReleasedApiKey::new(
+            location,
+            Material::new(
+                if self.rotate.load(Ordering::SeqCst) && count > 0 {
+                    K2
+                } else {
+                    K1
+                }
+                .to_vec(),
+            ),
         ))
     }
     fn audit(&self, record: &secret_rules::audit::AuditRecordV1) -> Result<(), AuditError> {
@@ -99,25 +111,29 @@ fn scope(reference: &str) -> SecretScope {
 }
 
 fn config(vault: Arc<Vault>, port: u16, locations: &[(&str, Location)]) -> ProxyConfig {
-    ProxyConfig {
-        vault,
-        authorization_scope: scope("head"),
-        lifetime_scope: scope("run"),
-        scanned_labels: locations.iter().map(|(l, _)| (*l).to_owned()).collect(),
-        grants: locations
-            .iter()
-            .map(|(label, location)| GrantedLabel {
-                rule: LabelRule {
+    *vault.rules.lock() = locations
+        .iter()
+        .map(|(label, location)| {
+            (
+                (*label).to_owned(),
+                LabelRule {
                     label: (*label).to_owned(),
                     host: "localhost".into(),
-                    port,
+                    port: 443,
                     path_prefix: "/approved".into(),
                     location: location.clone(),
-                    grant_id: "grant".into(),
                 },
-                expires_at_ms: u64::MAX,
-            })
-            .collect(),
+            )
+        })
+        .collect();
+    ProxyConfig {
+        vault,
+        authorization_scope: scope("head"),
+        lifetime_scope: scope("run"),
+        scanned_labels: locations.iter().map(|(l, _)| (*l).to_owned()).collect(),
+        consent_context: None,
+        test_https_port: Some(port),
+        approval_clock: None,
         origin: "test-task".into(),
     }
 }
@@ -149,7 +165,12 @@ impl Server {
         let names = if mode == "wrong-name" {
             vec!["wrong.invalid".into()]
         } else {
-            vec!["localhost".into(), "127.0.0.1".into(), "::1".into()]
+            vec![
+                "localhost".into(),
+                "127.0.0.1".into(),
+                "::1".into(),
+                "other.test".into(),
+            ]
         };
         let mut params = CertificateParams::new(names).unwrap();
         if mode == "expired" {
@@ -259,6 +280,25 @@ impl Server {
                                 .lock()
                                 .push(json!({"target":parts.uri.to_string(),"headers":fields,
                                 "body":String::from_utf8_lossy(&data)}));
+                            if mode == "redirect"
+                                && parts
+                                    .headers
+                                    .get("host")
+                                    .is_some_and(|v| v.as_bytes().starts_with(b"localhost:"))
+                            {
+                                let host = parts.headers["host"].to_str().unwrap();
+                                let port = host.rsplit_once(':').unwrap().1;
+                                let mut response = Response::new(full(Bytes::new()));
+                                *response.status_mut() = StatusCode::FOUND;
+                                response.headers_mut().insert(
+                                    "location",
+                                    HeaderValue::from_str(&format!(
+                                        "https://other.test:{port}/approved"
+                                    ))
+                                    .unwrap(),
+                                );
+                                return Ok::<_, std::convert::Infallible>(response);
+                            }
                             if let Some(upgrade) = upgrade {
                                 let mut response = Response::new(full(Bytes::new()));
                                 *response.status_mut() = StatusCode::SWITCHING_PROTOCOLS;
@@ -674,6 +714,9 @@ fn client_child() {
 #[path = "audit_tests.rs"]
 mod audit_tests;
 
+#[path = "vault_tests.rs"]
+mod vault_tests;
+
 fn child_reply(line: &str) -> Option<Value> {
     // With a single test thread, libtest prefixes uncaptured output with the
     // test name on the same line. Only the following JSON is our IPC reply.
@@ -745,11 +788,19 @@ async fn proxy_h1_h2_locations_keepalive_authority_and_scanned_set() {
             server.seen.lock().last().unwrap()["headers"]["authorization"],
             format!("Bearer {MARKER}")
         );
+        assert!(
+            !proxy.state.headers_sensitive.load(Ordering::Acquire),
+            "an empty edit list must not report a sensitive-header substitution"
+        );
         assert_eq!(client.request("/approved/two", json!({"authorization":format!("Bearer {MARKER}"),"content-type":"application/json"}), "{}")["status"], 200);
         let response = client.command(json!({"op":"request", "authority":"other.invalid", "path":"/approved", "headers":{"authorization":format!("Bearer {MARKER}")}}));
         assert_eq!(response["status"], 403, "{response}");
     }
-    assert_eq!(vault.calls.load(Ordering::SeqCst), 16);
+    assert_eq!(
+        vault.calls.load(Ordering::SeqCst),
+        12,
+        "every present label is asked, including the two NotFound targets"
+    );
     proxy.stop();
     assert!(proxy.state.patterns.lock().is_empty());
 }
@@ -839,9 +890,10 @@ async fn proxy_literal_responses_only_gain_matchers_after_material() {
     );
     assert!(!after.to_string().contains(std::str::from_utf8(K1).unwrap()));
     assert_eq!(
-        server.seen.lock().last().unwrap()["headers"]["authorization"],
-        "Bearer {{ck-secret:from-file}}"
+        after["status"], 403,
+        "an unscanned header label is refused before dispatch"
     );
+    assert_eq!(server.seen.lock().len(), 2);
     assert_eq!(vault.calls.load(Ordering::SeqCst), 1);
 }
 
@@ -865,12 +917,16 @@ async fn proxy_atomic_json_and_material_refusals_send_nothing_upstream() {
     proxy.arm_command(client.process.id()).unwrap();
     client.connect(false);
     for body in [
-        r#"{"key":4}"#,
+        r#"{"key":4,"other":"{{ck-secret:json}}"}"#,
         r#"{"key":"{{ck-secret:json}}","key":"{{ck-secret:json}}"}"#,
     ] {
         assert_eq!(client.request("/approved", json!({"authorization":format!("Bearer {MARKER}"),"content-type":"application/json"}), body)["status"], 403);
     }
-    assert_eq!(vault.calls.load(Ordering::SeqCst), 0);
+    assert_eq!(
+        vault.calls.load(Ordering::SeqCst),
+        2,
+        "duplicate JSON structure refuses before asking; the valid JSON request reveals each location with its release"
+    );
     assert!(server.seen.lock().is_empty());
     *vault.refused_label.lock() = Some("json".into());
     let refused = client.request(
@@ -883,7 +939,7 @@ async fn proxy_atomic_json_and_material_refusals_send_nothing_upstream() {
         refused["body"],
         "Secret proxy refused the request: json (localhost)\n"
     );
-    assert_eq!(vault.calls.load(Ordering::SeqCst), 2);
+    assert_eq!(vault.calls.load(Ordering::SeqCst), 4);
     assert!(server.seen.lock().is_empty());
     *vault.refused_label.lock() = None;
     assert_eq!(
@@ -986,18 +1042,16 @@ async fn proxy_websocket_scrubs_fragments_and_refuses_extensions_and_rsv() {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn proxy_non_rule_connect_is_tunnelled_without_interception() {
+async fn proxy_non_https443_connect_is_tunnelled_without_interception() {
     let server = Server::new("echo-request").await;
     let vault = Vault::new();
-    let proxy = SecretProxy::start_with_tls(
-        config(
-            vault.clone(),
-            server.address.port(),
-            &[("test", Location::Bearer)],
-        ),
-        server.client_tls.clone(),
-    )
-    .unwrap();
+    let mut cfg = config(
+        vault.clone(),
+        server.address.port(),
+        &[("test", Location::Bearer)],
+    );
+    cfg.test_https_port = None;
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
     let mut client = Client::spawn(&proxy, &server);
     proxy.arm_command(client.process.id()).unwrap();
     assert_eq!(
@@ -1251,15 +1305,15 @@ async fn proxy_query_and_json_escape_material_without_partial_header_writes() {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn proxy_expired_grant_refuses_without_material_and_tunnel_closes_on_stop() {
+async fn proxy_unavailable_release_refuses_and_tunnel_closes_on_stop() {
     let server = Server::new("echo-request").await;
     let vault = Vault::new();
-    let mut cfg = config(
+    let cfg = config(
         vault.clone(),
         server.address.port(),
         &[("test", Location::Bearer)],
     );
-    cfg.grants[0].expires_at_ms = 0;
+    vault.denied.store(true, Ordering::SeqCst);
     let mut proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
     let mut client = Client::spawn(&proxy, &server);
     proxy.arm_command(client.process.id()).unwrap();
@@ -1272,20 +1326,13 @@ async fn proxy_expired_grant_refuses_without_material_and_tunnel_closes_on_stop(
         )["status"],
         403
     );
-    assert_eq!(vault.calls.load(Ordering::SeqCst), 0);
+    assert_eq!(vault.calls.load(Ordering::SeqCst), 1);
     assert!(server.seen.lock().is_empty());
     assert_eq!(
         client.command(json!({"op":"connect","authority":server.address.to_string()}))["ok"],
         true
     );
-    assert_eq!(
-        client.request(
-            "/approved",
-            json!({"authorization":format!("Bearer {MARKER}")}),
-            ""
-        )["status"],
-        200
-    );
+    assert_eq!(client.command(json!({"op":"request", "authority":server.address.to_string(), "path":"/approved", "headers":{"authorization":format!("Bearer {MARKER}")}}))["status"], 200);
     proxy.process_tree_ended();
     assert_post_stop_connect_is_not_served(&proxy, server.address).await;
     assert_eq!(client.request("/approved", json!({}), "")["error"], true);
@@ -1393,30 +1440,24 @@ async fn proxy_requires_armed_session_token_and_canonical_connect_authority() {
 }
 
 #[test]
-fn proxy_only_accepts_grants_for_the_exact_launch_scan() {
+fn proxy_only_accepts_a_nonempty_unique_valid_launch_scan() {
     let vault = Vault::new();
     let make = || config(vault.clone(), 443, &[("test", Location::Bearer)]);
     let tls = rustls::ClientConfig::builder()
         .with_root_certificates(rustls::RootCertStore::empty())
         .with_no_client_auth();
-    let mut cfg = make();
-    cfg.scanned_labels.clear();
-    assert_eq!(
-        SecretProxy::start_with_tls(cfg, tls.clone()).err(),
-        Some(ProxyError::InvalidRules)
-    );
-    let mut cfg = make();
-    cfg.scanned_labels.push("file-label".into());
-    assert_eq!(
-        SecretProxy::start_with_tls(cfg, tls.clone()).err(),
-        Some(ProxyError::InvalidRules)
-    );
-    let mut cfg = make();
-    cfg.grants[0].rule.location = Location::Header("Accept-Encoding".into());
-    assert_eq!(
-        SecretProxy::start_with_tls(cfg, tls).err(),
-        Some(ProxyError::InvalidRules)
-    );
+    for labels in [
+        vec![],
+        vec!["test".into(), "test".into()],
+        vec!["bad label".into()],
+    ] {
+        let mut cfg = make();
+        cfg.scanned_labels = labels;
+        assert_eq!(
+            SecretProxy::start_with_tls(cfg, tls.clone()).err(),
+            Some(ProxyError::InvalidRules)
+        );
+    }
 }
 
 /// A stopped proxy's listener is closed before `stop()` returns, so a fresh
diff --git a/crates/aft/src/secret_proxy/vault_tests.rs b/crates/aft/src/secret_proxy/vault_tests.rs
new file mode 100644
index 0000000000..c8f877a9bd
--- /dev/null
+++ b/crates/aft/src/secret_proxy/vault_tests.rs
@@ -0,0 +1,1098 @@
+//! Real proxy requests using routes authenticated as AFT's module identity.
+//! A consent transport double records phone cards and supplies allow or decline.
+
+use super::*;
+use crate::secret::transport::fake::{FakeClaustrum, Record, NONCE};
+use crate::secret::{
+    ConsentOutcome, SecretConsentRequest, SecretConsentTransport, SubcSecretVault,
+};
+use std::sync::atomic::AtomicU64;
+
+struct Clock {
+    now: Arc<AtomicU64>,
+    ticks: tokio::sync::watch::Sender<u64>,
+}
+
+#[test]
+fn stopping_the_proxy_prevents_a_queued_vault_ask_from_spending_a_once_approval() {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .max_blocking_threads(1)
+        .enable_all()
+        .build()
+        .unwrap();
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    daemon.state.lock().unwrap().once = true;
+    let server = runtime.block_on(Server::new("plain"));
+    let cfg = live_config(&daemon, server.address.port(), Clock::new());
+    let vault = cfg.vault.clone();
+    let scope = cfg.authorization_scope.clone();
+    let target = addressed("localhost");
+    let crate::secret::UseAnswer::ApprovalRequired(pending) =
+        vault.use_secret(&scope, "test", &target)
+    else {
+        panic!("initial approval required")
+    };
+    daemon
+        .state
+        .lock()
+        .unwrap()
+        .approve(&pending.statement_b64url);
+    let mut proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let state = proxy.state.clone();
+    let (entered, started) = std::sync::mpsc::channel();
+    let (unblock, blocked) = std::sync::mpsc::channel();
+    let blocker = runtime.spawn_blocking(move || {
+        entered.send(()).unwrap();
+        blocked.recv().unwrap();
+    });
+    started.recv_timeout(Duration::from_secs(2)).unwrap();
+    runtime.block_on(async {
+        let queued = Arc::new(tokio::sync::Notify::new());
+        let announced = queued.clone();
+        let ask = tokio::spawn(async move {
+            announced.notify_one();
+            state.approvals.ask("test", &addressed("localhost")).await
+        });
+        queued.notified().await;
+        assert!(
+            !ask.is_finished(),
+            "the vault ask is queued behind the occupied blocking worker"
+        );
+        proxy.stop();
+        unblock.send(()).unwrap();
+        blocker.await.unwrap();
+        assert!(matches!(
+            ask.await.unwrap(),
+            crate::secret::UseAnswer::Unavailable
+        ));
+    });
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        1,
+        "shutdown must not dispatch the queued ask"
+    );
+    assert!(
+        matches!(
+            vault.use_secret(&scope, "test", &target),
+            crate::secret::UseAnswer::Released(_)
+        ),
+        "the once approval remains unspent"
+    );
+    assert!(server.seen.lock().is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_cancelled_proxy_card_uses_the_exact_approved_line_and_never_sends() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Cancelled);
+    let (reply, _client) = worker.join().unwrap();
+    assert_eq!(reply["status"], 403);
+    assert_eq!(
+        reply["body"],
+        "secret test: the request for localhost was cancelled; the request was not sent"
+    );
+    assert_eq!(daemon.state.lock().unwrap().calls, 1);
+    assert!(server.seen.lock().is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn an_unfiled_proxy_card_uses_the_exact_approved_line_and_never_sends() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let mut cfg = live_config(&daemon, server.address.port(), Clock::new());
+    cfg.consent_context = None;
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let reply = client.request(
+        "/approved",
+        json!({"authorization":format!("Bearer {MARKER}")}),
+        "",
+    );
+    assert_eq!(reply["status"], 403);
+    assert_eq!(reply["body"], "secret test: the approval request for localhost could not be filed; the request was not sent");
+    assert!(phone.phone.state.lock().unwrap().requests.is_empty());
+    assert_eq!(daemon.state.lock().unwrap().calls, 1);
+    assert!(server.seen.lock().is_empty());
+}
+
+impl Clock {
+    fn new() -> Arc<Self> {
+        let (ticks, _) = tokio::sync::watch::channel(1_700_000_000_000);
+        Arc::new(Self {
+            now: Arc::new(AtomicU64::new(1_700_000_000_000)),
+            ticks,
+        })
+    }
+    fn advance(&self, ms: u64) {
+        let now = self.now.fetch_add(ms, Ordering::SeqCst) + ms;
+        self.ticks.send_replace(now);
+    }
+}
+
+impl crate::secret::requests::ApprovalClock for Clock {
+    fn now_ms(&self) -> u64 {
+        self.now.load(Ordering::SeqCst)
+    }
+    fn deadline(&self) -> std::pin::Pin<Box<dyn std::future::Future<Output = ()> + Send>> {
+        let end = self.now.load(Ordering::SeqCst) + 600_000;
+        let mut ticks = self.ticks.subscribe();
+        Box::pin(async move {
+            while *ticks.borrow_and_update() < end {
+                if ticks.changed().await.is_err() {
+                    break;
+                }
+            }
+        })
+    }
+}
+
+#[derive(Default)]
+struct PhoneState {
+    requests: Vec<SecretConsentRequest>,
+    answers: HashMap<String, ConsentOutcome>,
+    closed: bool,
+    withdrawn: Vec<String>,
+}
+
+struct Phone {
+    runtime: tokio::runtime::Handle,
+    state: std::sync::Mutex<PhoneState>,
+    answer: std::sync::Condvar,
+    filed: tokio::sync::Notify,
+}
+
+impl Phone {
+    fn new() -> Arc<Self> {
+        Arc::new(Self {
+            runtime: tokio::runtime::Handle::current(),
+            state: Default::default(),
+            answer: Default::default(),
+            filed: Default::default(),
+        })
+    }
+    async fn card(&self, count: usize) -> SecretConsentRequest {
+        tokio::time::timeout(Duration::from_secs(5), async {
+            loop {
+                let notified = self.filed.notified();
+                if let Some(request) = self.state.lock().unwrap().requests.get(count - 1).cloned() {
+                    return request;
+                }
+                notified.await;
+            }
+        })
+        .await
+        .expect("the proxy filed the expected card")
+    }
+    fn decide(&self, daemon: &FakeClaustrum, count: usize, answer: ConsentOutcome) {
+        let mut state = self.state.lock().unwrap();
+        let request = &state.requests[count - 1];
+        if matches!(
+            answer,
+            ConsentOutcome::Answered | ConsentOutcome::AnsweredOnce
+        ) {
+            daemon
+                .state
+                .lock()
+                .unwrap()
+                .approve(&request.statement_b64url);
+        }
+        let id = request.request_id.clone();
+        state.answers.insert(id, answer);
+        self.answer.notify_all();
+    }
+    fn close(&self) {
+        self.state.lock().unwrap().closed = true;
+        self.answer.notify_all();
+    }
+}
+
+impl SecretConsentTransport for Phone {
+    fn runtime(&self) -> Option<tokio::runtime::Handle> {
+        Some(self.runtime.clone())
+    }
+    fn file(&self, request: &SecretConsentRequest) -> ConsentOutcome {
+        self.hold(request, &Default::default())
+    }
+    fn hold(
+        &self,
+        request: &SecretConsentRequest,
+        cancel: &crate::secret::consent::Cancellation,
+    ) -> ConsentOutcome {
+        let mut state = self.state.lock().unwrap();
+        assert!(
+            !state
+                .requests
+                .iter()
+                .any(|r| r.request_id == request.request_id),
+            "never file the same vault id twice"
+        );
+        state.requests.push(request.clone());
+        self.filed.notify_one();
+        loop {
+            if cancel.is_cancelled() {
+                return ConsentOutcome::Cancelled;
+            }
+            if state.closed {
+                return ConsentOutcome::Expired;
+            }
+            if let Some(answer) = state.answers.get(&request.request_id) {
+                return answer.clone();
+            }
+            state = self.answer.wait(state).unwrap();
+        }
+    }
+    fn withhold(&self, request: &SecretConsentRequest) -> ConsentOutcome {
+        let mut state = self.state.lock().unwrap();
+        state.withdrawn.push(request.request_id.clone());
+        state
+            .answers
+            .insert(request.request_id.clone(), ConsentOutcome::Expired);
+        self.answer.notify_all();
+        ConsentOutcome::Expired
+    }
+}
+
+struct PhoneGuard {
+    phone: Arc<Phone>,
+    _lock: std::sync::MutexGuard<'static, ()>,
+}
+
+impl PhoneGuard {
+    fn install() -> Self {
+        let lock = crate::secret::consent::TEST_TRANSPORT_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let phone = Phone::new();
+        crate::secret::consent::install_transport(Some(phone.clone()));
+        Self { phone, _lock: lock }
+    }
+}
+impl Drop for PhoneGuard {
+    fn drop(&mut self) {
+        self.phone.close();
+        crate::secret::consent::install_transport(None);
+    }
+}
+
+fn record(location: &str) -> Record {
+    Record {
+        name: "test".into(),
+        host: "localhost".into(),
+        path: "/approved".into(),
+        location: location.into(),
+        key: K1.to_vec(),
+    }
+}
+
+fn live_config(daemon: &FakeClaustrum, port: u16, clock: Arc<Clock>) -> ProxyConfig {
+    static SEQUENCE: AtomicU64 = AtomicU64::new(1);
+    let auth = scope(&format!(
+        "live-vault-{}",
+        SEQUENCE.fetch_add(1, Ordering::SeqCst)
+    ));
+    let transport = crate::secret::transport::SubcSecretUseTransport::for_test(
+        daemon.path.clone(),
+        subc_protocol::BindIdentity::new("test", "session"),
+        Duration::from_secs(2),
+        subc_client_rs::ConsumerIdentity {
+            module_id: "aft".into(),
+            launch_nonce: NONCE.into(),
+        },
+    );
+    ProxyConfig {
+        vault: Arc::new(SubcSecretVault::new(Arc::new(transport))),
+        authorization_scope: auth,
+        lifetime_scope: scope("run"),
+        scanned_labels: vec!["test".into()],
+        consent_context: Some((std::path::PathBuf::from("project"), "session".into())),
+        test_https_port: Some(port),
+        approval_clock: Some(clock),
+        origin: "live-proxy-task".into(),
+    }
+}
+
+fn request_in_thread(
+    mut client: Client,
+    overlap: bool,
+) -> std::thread::JoinHandle<(Value, Client)> {
+    std::thread::spawn(move || {
+        let reply = if overlap {
+            client.command(json!({"op":"overlap"}))
+        } else {
+            client.request(
+                "/approved",
+                json!({"authorization":format!("Bearer {MARKER}")}),
+                "",
+            )
+        };
+        (reply, client)
+    })
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_release_injects_only_the_deposit_location_and_every_use_is_audited() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let cfg = live_config(&daemon, server.address.port(), Clock::new());
+    let expected_scope = cfg.authorization_scope.clone();
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = request_in_thread(client, false);
+    let card = phone.phone.card(1).await;
+    assert_eq!(card.scope, expected_scope);
+    assert!(
+        server.seen.lock().is_empty(),
+        "approval holds before any upstream request"
+    );
+    assert_eq!(proxy.approval_status(), vec!["secret test: waiting for approval on the phone for localhost (requests wait up to 10 minutes)"]);
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Answered);
+    let (reply, mut client) = worker.join().unwrap();
+    assert_eq!(reply["status"], 200);
+    assert!(!reply.to_string().contains(std::str::from_utf8(K1).unwrap()));
+    let next = client.request(
+        &format!("/approved/next?key={MARKER}"),
+        json!({"authorization":format!("Bearer {MARKER}"), "x-literal":MARKER}),
+        "",
+    );
+    assert_eq!(next["status"], 200);
+    let seen = server.seen.lock();
+    assert_eq!(seen.len(), 2);
+    assert_eq!(
+        seen[1]["headers"]["authorization"],
+        format!("Bearer {}", std::str::from_utf8(K1).unwrap())
+    );
+    assert_eq!(seen[1]["headers"]["x-literal"], MARKER);
+    assert!(seen[1]["target"].as_str().unwrap().contains(MARKER));
+    let state = daemon.state.lock().unwrap();
+    assert_eq!(state.calls, 3, "initial ask, approved retry, next request");
+    assert_eq!(
+        state.connections, 1,
+        "one command owns one reused daemon consumer"
+    );
+    assert_eq!(
+        state.params[2]["target"],
+        json!({"scheme":"https", "host":"localhost", "port":443, "path":"/approved/next"})
+    );
+    assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 1);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_decline_and_expiry_answer_403_without_sending_or_retrying() {
+    for (decision, expected) in [
+        (
+            ConsentOutcome::Declined,
+            "secret test: approval was declined for localhost; the request was not sent",
+        ),
+        (
+            ConsentOutcome::Expired,
+            "secret test: approval expired for localhost; the request was not sent",
+        ),
+    ] {
+        let daemon = FakeClaustrum::start();
+        daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+        let phone = PhoneGuard::install();
+        let server = Server::new("echo-request").await;
+        let proxy = SecretProxy::start_with_tls(
+            live_config(&daemon, server.address.port(), Clock::new()),
+            server.client_tls.clone(),
+        )
+        .unwrap();
+        let mut client = Client::spawn(&proxy, &server);
+        proxy.arm_command(client.process.id()).unwrap();
+        client.connect(false);
+        let worker = request_in_thread(client, false);
+        phone.phone.card(1).await;
+        phone.phone.decide(&daemon, 1, decision);
+        let (reply, mut client) = worker.join().unwrap();
+        assert_eq!(reply["status"], 403);
+        assert_eq!(reply["body"], expected);
+        assert!(server.seen.lock().is_empty());
+        assert_eq!(
+            daemon.state.lock().unwrap().calls,
+            1,
+            "an answered decline/expiry never retries"
+        );
+        let next = client.request(
+            "/approved",
+            json!({"authorization":format!("Bearer {MARKER}")}),
+            "",
+        );
+        assert_eq!(
+            next["status"], 403,
+            "a matching retry sees the same unanswered vault id"
+        );
+        assert_eq!(
+            phone.phone.state.lock().unwrap().requests.len(),
+            1,
+            "the same request_id is never refiled"
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_injected_ten_minute_deadline_answers_403_locally() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let clock = Clock::new();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), clock.clone()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    proxy
+        .state
+        .test_idle_timeout_ms
+        .store(100, Ordering::Release);
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    tokio::time::sleep(Duration::from_millis(250)).await;
+    assert!(
+        !worker.is_finished(),
+        "a held approval outlives the socket idle timeout"
+    );
+    clock.advance(599_999);
+    tokio::task::yield_now().await;
+    tokio::time::sleep(Duration::from_millis(30)).await;
+    assert!(
+        !worker.is_finished(),
+        "the full ten-minute window remains available"
+    );
+    clock.advance(1);
+    let (reply, _client) = worker.join().unwrap();
+    assert_eq!(reply["status"], 403);
+    assert_eq!(
+        reply["body"],
+        "secret test: approval expired for localhost; the request was not sent"
+    );
+    assert!(server.seen.lock().is_empty());
+    assert!(proxy.approval_status().is_empty());
+    phone.phone.close();
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_concurrent_requests_share_one_card_and_once_queues_cards_serially() {
+    for once in [false, true] {
+        let daemon = FakeClaustrum::start();
+        {
+            let mut state = daemon.state.lock().unwrap();
+            state.record = Some(record("authorization_bearer"));
+            state.once = once;
+        }
+        let phone = PhoneGuard::install();
+        let server = Server::new("echo-request").await;
+        let proxy = SecretProxy::start_with_tls(
+            live_config(&daemon, server.address.port(), Clock::new()),
+            server.client_tls.clone(),
+        )
+        .unwrap();
+        let mut client = Client::spawn(&proxy, &server);
+        proxy.arm_command(client.process.id()).unwrap();
+        client.connect(true);
+        let worker = request_in_thread(client, true);
+        let first = phone.phone.card(1).await;
+        assert!(server.seen.lock().is_empty());
+        assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 1);
+        phone.phone.decide(
+            &daemon,
+            1,
+            if once {
+                ConsentOutcome::AnsweredOnce
+            } else {
+                ConsentOutcome::Answered
+            },
+        );
+        if once {
+            let second = phone.phone.card(2).await;
+            assert_ne!(first.request_id, second.request_id);
+            assert!(!worker.is_finished());
+            assert!(proxy.approval_status().iter().any(|line| line
+                == "secret test: the approval covered one request; another card was sent"));
+            phone.phone.decide(&daemon, 2, ConsentOutcome::AnsweredOnce);
+        }
+        let (reply, _client) = worker.join().unwrap();
+        assert!(
+            reply.get("a").is_some(),
+            "both HTTP/2 requests completed: {reply}"
+        );
+        assert!(!reply.to_string().contains(std::str::from_utf8(K1).unwrap()));
+        assert_eq!(server.seen.lock().len(), 2);
+        assert_eq!(
+            phone.phone.state.lock().unwrap().requests.len(),
+            if once { 2 } else { 1 }
+        );
+        assert_eq!(daemon.state.lock().unwrap().calls, if once { 5 } else { 4 });
+        assert_eq!(daemon.state.lock().unwrap().connections, 1);
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_wrong_host_is_literal_and_never_files_a_card() {
+    let daemon = FakeClaustrum::start();
+    let mut other = record("authorization_bearer");
+    other.host = "other.test".into();
+    daemon.state.lock().unwrap().record = Some(other);
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    assert_eq!(
+        client.request(
+            "/approved",
+            json!({"authorization":format!("Bearer {MARKER}")}),
+            ""
+        )["status"],
+        200
+    );
+    assert_eq!(
+        server.seen.lock()[0]["headers"]["authorization"],
+        format!("Bearer {MARKER}")
+    );
+    assert_eq!(daemon.state.lock().unwrap().calls, 1);
+    assert!(phone.phone.state.lock().unwrap().requests.is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_redirect_to_another_host_asks_again_and_sends_no_key() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("redirect").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Answered);
+    let (first, mut client) = worker.join().unwrap();
+    assert_eq!(first["status"], 302);
+    let location = url::Url::parse(first["headers"]["location"].as_str().unwrap()).unwrap();
+    assert_eq!(location.host_str(), Some("other.test"));
+    proxy
+        .state
+        .test_upstream
+        .lock()
+        .insert("other.test".into(), server.address);
+    assert_eq!(
+        client.command(
+            json!({"op":"connect", "authority":format!("other.test:{}", server.address.port())})
+        )["ok"],
+        true
+    );
+    let second = client.command(json!({"op":"request", "authority":format!("other.test:{}", server.address.port()), "path":location.path(), "headers":{"authorization":format!("Bearer {MARKER}")}}));
+    assert_eq!(second["status"], 200);
+    assert_eq!(
+        server.seen.lock()[1]["headers"]["authorization"],
+        format!("Bearer {MARKER}")
+    );
+    assert_eq!(daemon.state.lock().unwrap().calls, 3);
+    assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 1);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_fetch_uses_the_concrete_target_and_holds_for_the_phone() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("query:key"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request-h1").await;
+    let cfg = live_config(&daemon, server.address.port(), Clock::new());
+    let root = tempfile::tempdir().unwrap();
+    let project = root.path().to_owned();
+    let options = crate::url_fetch::UrlFetchOptions {
+        allow_private: true,
+        tls_config: Some(server.client_tls.clone()),
+        ..Default::default()
+    };
+    let url = format!(
+        "https://localhost:{}/approved/doc.md?key={MARKER}#local-fragment",
+        server.address.port()
+    );
+    let port = server.address.port();
+    let worker = std::thread::spawn(move || {
+        crate::subc::with_secret_identity_for_test(
+            &project,
+            cfg.authorization_scope.stamp().clone(),
+            || {
+                let secrets = crate::url_fetch::SecretFetch {
+                    vault: cfg.vault.clone(),
+                    authorization: Some(cfg.authorization_scope.clone()),
+                    labels: vec!["test".into()],
+                    test_https_port: Some(port),
+                    call_id: "fetch-live-vault".into(),
+                    cancellation: Default::default(),
+                };
+                let result =
+                    crate::url_fetch::fetch_url_with_secrets(&url, &project, options, &secrets);
+                result.map(|path| std::fs::read_to_string(path).unwrap())
+            },
+        )
+    });
+    phone.phone.card(1).await;
+    assert!(server.seen.lock().is_empty());
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Answered);
+    let document = worker
+        .join()
+        .unwrap()
+        .expect("the approved document was fetched");
+    assert!(!document.contains(std::str::from_utf8(K1).unwrap()));
+    assert!(document.contains(MARKER));
+    let seen = server.seen.lock();
+    assert_eq!(seen.len(), 1);
+    assert!(seen[0]["target"]
+        .as_str()
+        .unwrap()
+        .contains(std::str::from_utf8(K1).unwrap()));
+    assert!(!seen[0]["target"]
+        .as_str()
+        .unwrap()
+        .contains("local-fragment"));
+    assert_eq!(daemon.state.lock().unwrap().calls, 2);
+    assert_eq!(daemon.state.lock().unwrap().connections, 1);
+    assert_eq!(
+        daemon.state.lock().unwrap().params[0]["target"],
+        json!({"scheme":"https", "host":"localhost", "port":443, "path":"/approved/doc.md"})
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn live_vault_new_card_after_longer_approval_does_not_claim_it_was_once() {
+    let daemon = FakeClaustrum::start();
+    {
+        let mut state = daemon.state.lock().unwrap();
+        state.record = Some(record("authorization_bearer"));
+        state.once = true;
+    }
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let first = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Answered);
+    let (reply, client) = first.join().unwrap();
+    assert_eq!(reply["status"], 200);
+    // The fixture expires coverage after one request despite the longer phone
+    // answer, standing in for a revoked grant before another request arrives.
+    let second = request_in_thread(client, false);
+    phone.phone.card(2).await;
+    assert_eq!(proxy.approval_status(), vec!["secret test: waiting for approval on the phone for localhost (requests wait up to 10 minutes)"]);
+    phone.phone.decide(&daemon, 2, ConsentOutcome::Declined);
+    let (reply, _client) = second.join().unwrap();
+    assert_eq!(reply["status"], 403);
+    assert_eq!(server.seen.lock().len(), 1);
+}
+
+async fn condition(mut check: impl FnMut() -> bool) {
+    tokio::time::timeout(Duration::from_secs(5), async {
+        while !check() {
+            tokio::time::sleep(Duration::from_millis(5)).await;
+        }
+    })
+    .await
+    .unwrap();
+}
+fn addressed(host: &str) -> crate::secret::ApiKeyTarget {
+    crate::secret::ApiKeyTarget {
+        scheme: "https".into(),
+        host: host.into(),
+        port: Some(443),
+        path: "/approved".into(),
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn pending_label_does_not_block_an_immediate_vault_answer_for_another_target() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let cfg = live_config(&daemon, 443, Clock::new());
+    let secrets = Arc::new(crate::secret::requests::RequestSecrets::new(
+        cfg.vault,
+        cfg.authorization_scope,
+        cfg.consent_context,
+    ));
+    let held = secrets.clone();
+    let first = tokio::spawn(async move {
+        held.use_in_request("test", &addressed("localhost"), u64::MAX, || async {
+            Ok(())
+        })
+        .await
+    });
+    phone.phone.card(1).await;
+    let answer = tokio::time::timeout(
+        Duration::from_millis(500),
+        secrets.use_in_request("test", &addressed("other.test"), u64::MAX, || async {
+            Ok(())
+        }),
+    )
+    .await
+    .expect("a pending card must not lock another vault lookup")
+    .unwrap();
+    assert!(matches!(answer, crate::secret::UseAnswer::NotFound));
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        2,
+        "count NotFound asks too"
+    );
+    let statement = phone.phone.state.lock().unwrap().requests[0]
+        .statement_b64url
+        .clone();
+    daemon.state.lock().unwrap().approve(&statement);
+    let released = tokio::time::timeout(
+        Duration::from_millis(500),
+        secrets.use_in_request("test", &addressed("localhost"), u64::MAX, || async {
+            Ok(())
+        }),
+    )
+    .await
+    .expect("an already-covered request must not wait on the older card")
+    .unwrap();
+    assert!(matches!(released, crate::secret::UseAnswer::Released(_)));
+    assert!(!first.is_finished());
+    first.abort();
+    let _ = first.await;
+    condition(|| phone.phone.state.lock().unwrap().withdrawn.len() == 1).await;
+    assert!(
+        secrets.status().is_empty(),
+        "cancelled waiter removes its waiting line in Drop"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn cancelling_one_waiter_keeps_the_pending_card_and_a_retry_joins_until_the_last_waiter_leaves(
+) {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let cfg = live_config(&daemon, 443, Clock::new());
+    let secrets = Arc::new(crate::secret::requests::RequestSecrets::new(
+        cfg.vault,
+        cfg.authorization_scope,
+        cfg.consent_context,
+    ));
+    let spawn = || {
+        let secrets = secrets.clone();
+        tokio::spawn(async move {
+            secrets
+                .use_in_request("test", &addressed("localhost"), u64::MAX, || async {
+                    Ok(())
+                })
+                .await
+        })
+    };
+    let first = spawn();
+    phone.phone.card(1).await;
+    let second = spawn();
+    condition(|| secrets.status().len() == 2).await;
+    first.abort();
+    let _ = first.await;
+    assert!(phone.phone.state.lock().unwrap().withdrawn.is_empty());
+    let retry = spawn();
+    condition(|| secrets.status().len() == 2).await;
+    assert!(
+        !second.is_finished() && !retry.is_finished(),
+        "a cancelled peer is not a declined card"
+    );
+    assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 1);
+    second.abort();
+    let _ = second.await;
+    assert!(phone.phone.state.lock().unwrap().withdrawn.is_empty());
+    retry.abort();
+    let _ = retry.await;
+    condition(|| phone.phone.state.lock().unwrap().withdrawn.len() == 1).await;
+    assert!(secrets.status().is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn two_labels_file_concurrently_and_share_one_absolute_deadline() {
+    let daemon = FakeClaustrum::start();
+    let mut second = record("header:x-second");
+    second.name = "second".into();
+    second.key = K2.to_vec();
+    daemon.state.lock().unwrap().records = vec![record("authorization_bearer"), second];
+    let phone = PhoneGuard::install();
+    let clock = Clock::new();
+    let server = Server::new("echo-request").await;
+    let mut cfg = live_config(&daemon, server.address.port(), clock.clone());
+    cfg.scanned_labels.push("second".into());
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = std::thread::spawn(move || {
+        let reply = client.request(
+            "/approved",
+            json!({"authorization":format!("Bearer {MARKER}"),"x-second":"{{ck-secret:second}}"}),
+            "",
+        );
+        (reply, client)
+    });
+    phone.phone.card(2).await;
+    let requests = phone.phone.state.lock().unwrap().requests.clone();
+    assert!(
+        requests
+            .iter()
+            .all(|r| r.expires_at_ms == Some(1_700_000_600_000)),
+        "each filed card expires by the request's one deadline"
+    );
+    clock.advance(599_999);
+    tokio::task::yield_now().await;
+    tokio::time::sleep(Duration::from_millis(30)).await;
+    assert!(!worker.is_finished());
+    let first_index = requests.iter().position(|r| r.label == "test").unwrap() + 1;
+    phone
+        .phone
+        .decide(&daemon, first_index, ConsentOutcome::AnsweredOnce);
+    condition(|| daemon.state.lock().unwrap().calls >= 3).await;
+    assert!(server.seen.lock().is_empty());
+    clock.advance(1);
+    let (reply, _client) = worker.join().unwrap();
+    assert_eq!(reply["status"], 403);
+    assert!(
+        server.seen.lock().is_empty(),
+        "the earlier release is spent, not sent or reused when another label times out"
+    );
+    condition(|| phone.phone.state.lock().unwrap().withdrawn.len() == 1).await;
+    assert!(proxy.approval_status().is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn approval_status_and_denial_scrub_a_label_that_equals_an_earlier_released_key() {
+    let daemon = FakeClaustrum::start();
+    let name = std::str::from_utf8(K1).unwrap();
+    let mut second = record("header:x-second");
+    second.name = name.into();
+    second.key = K2.to_vec();
+    daemon.state.lock().unwrap().records = vec![record("authorization_bearer"), second];
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let mut cfg = live_config(&daemon, server.address.port(), Clock::new());
+    cfg.scanned_labels.push(name.into());
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let first = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    phone.phone.decide(&daemon, 1, ConsentOutcome::Answered);
+    let (reply, mut client) = first.join().unwrap();
+    assert_eq!(reply["status"], 200);
+    let marker = format!("{{{{ck-secret:{name}}}}}");
+    let second = std::thread::spawn(move || {
+        let reply = client.request("/approved", json!({"x-second":marker}), "");
+        (reply, client)
+    });
+    phone.phone.card(2).await;
+    assert!(!proxy.approval_status().is_empty());
+    assert!(proxy
+        .approval_status()
+        .iter()
+        .all(|line| !line.contains(name)));
+    phone.phone.decide(&daemon, 2, ConsentOutcome::Declined);
+    let (reply, _client) = second.join().unwrap();
+    assert_eq!(reply["status"], 403);
+    assert!(
+        !reply.to_string().contains(name),
+        "a local denial must use the command's released-key scrubber"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn malformed_json_structure_refuses_before_any_vault_ask_or_phone_card() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("json_pointer:/key"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    for body in [
+        "{not json {{ck-secret:test}}",
+        "{\"key\":\"{{ck-secret:test}}\",\"ke\\u0079\":\"other\"}",
+    ] {
+        let reply = client.request(
+            "/approved",
+            json!({"content-type":"application/json"}),
+            body,
+        );
+        assert_eq!(reply["status"], 403);
+    }
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        0,
+        "structure checks must precede releasing secret.use"
+    );
+    assert!(phone.phone.state.lock().unwrap().requests.is_empty());
+    assert!(server.seen.lock().is_empty());
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_fetch_and_proxy_request_share_one_once_card_then_raise_exactly_one_successor() {
+    let daemon = FakeClaustrum::start();
+    {
+        let mut state = daemon.state.lock().unwrap();
+        state.record = Some(record("query:key"));
+        state.once = true;
+    }
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request-h1").await;
+    let cfg = live_config(&daemon, server.address.port(), Clock::new());
+    let fetch_vault = cfg.vault.clone();
+    let fetch_scope = cfg.authorization_scope.clone();
+    let proxy = SecretProxy::start_with_tls(cfg, server.client_tls.clone()).unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let proxy_worker = std::thread::spawn(move || {
+        let reply = client.request(&format!("/approved?key={MARKER}"), json!({}), "");
+        (reply, client)
+    });
+    phone.phone.card(1).await;
+    let root = tempfile::tempdir().unwrap();
+    let project = root.path().to_owned();
+    let port = server.address.port();
+    let options = crate::url_fetch::UrlFetchOptions {
+        allow_private: true,
+        tls_config: Some(server.client_tls.clone()),
+        ..Default::default()
+    };
+    let fetch_worker = std::thread::spawn(move || {
+        crate::subc::with_secret_identity_for_test(&project, fetch_scope.stamp().clone(), || {
+            let secrets = crate::url_fetch::SecretFetch {
+                vault: fetch_vault,
+                authorization: Some(fetch_scope),
+                labels: vec!["test".into()],
+                test_https_port: Some(port),
+                call_id: "concurrent-fetch".into(),
+                cancellation: Default::default(),
+            };
+            crate::url_fetch::fetch_url_with_secrets(
+                &format!("https://localhost:{port}/approved/doc.md?key={MARKER}"),
+                &project,
+                options,
+                &secrets,
+            )
+        })
+    });
+    condition(|| daemon.state.lock().unwrap().calls >= 2).await;
+    assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 1);
+    phone.phone.decide(&daemon, 1, ConsentOutcome::AnsweredOnce);
+    phone.phone.card(2).await;
+    condition(|| server.seen.lock().len() == 1).await;
+    assert_eq!(
+        server.seen.lock().len(),
+        1,
+        "one once approval can dispatch only one waiting request"
+    );
+    phone.phone.decide(&daemon, 2, ConsentOutcome::AnsweredOnce);
+    let (reply, _client) = proxy_worker.join().unwrap();
+    assert_eq!(reply["status"], 200);
+    assert!(fetch_worker.join().unwrap().is_ok());
+    assert_eq!(phone.phone.state.lock().unwrap().requests.len(), 2);
+    assert_eq!(server.seen.lock().len(), 2);
+    assert!(server.seen.lock().iter().all(|r| r["target"]
+        .as_str()
+        .unwrap()
+        .contains(std::str::from_utf8(K1).unwrap())));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn stopping_a_proxy_with_a_held_request_withdraws_the_card_and_removes_status() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("authorization_bearer"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let mut proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let worker = request_in_thread(client, false);
+    phone.phone.card(1).await;
+    assert!(!proxy.approval_status().is_empty());
+    proxy.stop();
+    condition(|| phone.phone.state.lock().unwrap().withdrawn.len() == 1).await;
+    assert!(proxy.approval_status().is_empty());
+    assert!(server.seen.lock().is_empty());
+    let _ = worker.join().unwrap();
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn pending_statement_location_is_planned_before_filing_or_consuming_a_release() {
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().record = Some(record("json_pointer:/key"));
+    let phone = PhoneGuard::install();
+    let server = Server::new("echo-request").await;
+    let proxy = SecretProxy::start_with_tls(
+        live_config(&daemon, server.address.port(), Clock::new()),
+        server.client_tls.clone(),
+    )
+    .unwrap();
+    let mut client = Client::spawn(&proxy, &server);
+    proxy.arm_command(client.process.id()).unwrap();
+    client.connect(false);
+    let reply = client.request(
+        "/approved",
+        json!({"content-type":"application/json"}),
+        "{\"key\":42,\"other\":\"{{ck-secret:test}}\"}",
+    );
+    assert_eq!(reply["status"], 403);
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        1,
+        "read location from approval_required, without a releasing retry"
+    );
+    assert!(phone.phone.state.lock().unwrap().requests.is_empty());
+    assert!(server.seen.lock().is_empty());
+}
diff --git a/crates/aft/src/semantic_index.rs b/crates/aft/src/semantic_index.rs
index bb33ece3d1..690111fc24 100644
--- a/crates/aft/src/semantic_index.rs
+++ b/crates/aft/src/semantic_index.rs
@@ -7817,22 +7817,6 @@ impl SemanticIndex {
         })
     }
 
-    /// The modification time, and the size when one was recorded, of exactly
-    /// `path` when its vectors were embedded, or `None` when the index holds no
-    /// vectors for that spelling of the path.
-    ///
-    /// Unlike [`Self::recorded_file_freshness`] this never canonicalizes a
-    /// missing path, so a caller can probe every file of a directory walk (whose
-    /// paths already use the index's own spelling of the root) without one extra
-    /// filesystem call per file the index does not cover.
-    pub(crate) fn recorded_stat(&self, path: &Path) -> Option<(SystemTime, Option<u64>)> {
-        let mtime = *self.metadata_value(path, &self.file_mtimes, |base| &base.file_mtimes)?;
-        let size = self
-            .metadata_value(path, &self.file_sizes, |base| &base.file_sizes)
-            .copied();
-        Some((mtime, size))
-    }
-
     /// Keep only the files whose vectors are out of date: those whose content on
     /// disk no longer matches what this index embedded, plus deleted files and
     /// files the index has no record of. See [`indexed_file_content_unchanged`]
@@ -15468,17 +15452,36 @@ public class Greeter {
 
     #[test]
     fn slow_backend_converges_without_being_marked_down() {
-        // The reporter's shape (2 s/item against a 25 s floor) scaled so the
-        // test exercises real HTTP deadlines in seconds, not minutes: a 64-item
-        // batch cannot fit the initial deadline, a 4-item batch can.
-        let server = ProgrammableEmbeddingServer::start(Duration::from_millis(50));
-        let config = programmable_http_config(&server);
+        // A 1.5 s floor leaves a singleton 1.25 s of scheduling margin on loaded
+        // CI runners. Scale the per-item delay with it: a 64-item batch still
+        // takes 16 s against its initial 6 s deadline, while 4 items fit in
+        // the 1.5 s floor. The per-item latency EMA (exponential moving average)
+        // must raise the deadline to recover to 64.
+        // Keep the shared config's short deadlines for the never-answer test.
+        let server = ProgrammableEmbeddingServer::start(Duration::from_millis(250));
+        let mut config = programmable_http_config(&server);
+        config.timeout_ms = 1_500;
         let mut model = SemanticEmbeddingModel::from_config(&config).unwrap();
 
-        for _ in 0..3 {
+        for _ in 0..2 {
             assert_eq!(model.embed(embedding_inputs(64)).unwrap().len(), 64);
         }
 
+        assert_eq!(model.adaptive_build_batch_size, config.max_batch_size);
+        assert!(
+            server.request_sizes().starts_with(&[64, 32, 16, 8, 4]),
+            "the initial deadline must force smaller batches: requests={:?}",
+            server.request_sizes(),
+        );
+        // Start at the recovered size and require the client to receive all
+        // rows; a timed-out server handler can still finish writing a response.
+        let requests_before_recovery = server.request_sizes().len();
+        assert_eq!(model.embed(embedding_inputs(64)).unwrap().len(), 64);
+        assert_eq!(
+            &server.request_sizes()[requests_before_recovery..],
+            &[64],
+            "the recovered 64-item request must complete without another downshift",
+        );
         assert_eq!(model.adaptive_build_batch_size, config.max_batch_size);
         assert!(
             server.completed_sizes().contains(&64),
diff --git a/crates/aft/src/shared_timer.rs b/crates/aft/src/shared_timer.rs
new file mode 100644
index 0000000000..848cc98fcb
--- /dev/null
+++ b/crates/aft/src/shared_timer.rs
@@ -0,0 +1,201 @@
+//! Process-wide deadlines. Callbacks only check state or enqueue work: blocking
+//! I/O and cache destruction belong on the caller's existing work pool.
+
+use std::collections::{BTreeMap, HashMap};
+use std::io;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Condvar, Mutex, OnceLock};
+use std::time::Instant;
+
+type Callback = Box<dyn FnMut() -> Option<Instant> + Send>;
+type Key = (Instant, u64);
+
+struct Entry {
+    active: Arc<AtomicBool>,
+    fire: Callback,
+}
+
+#[derive(Default)]
+struct Queue {
+    next_id: u64,
+    deadlines: BTreeMap<Key, Entry>,
+    keys: HashMap<u64, Key>,
+}
+
+#[derive(Default)]
+struct Service {
+    queue: Mutex<Queue>,
+    wake: Condvar,
+}
+
+fn service() -> io::Result<&'static Arc<Service>> {
+    static SERVICE: OnceLock<Result<Arc<Service>, String>> = OnceLock::new();
+    SERVICE
+        .get_or_init(|| {
+            let service = Arc::new(Service::default());
+            let worker = Arc::clone(&service);
+            std::thread::Builder::new()
+                .name("aft-shared-timer".into())
+                .spawn(move || worker.run())
+                .map_err(|error| error.to_string())?;
+            Ok(service)
+        })
+        .as_ref()
+        .map_err(|error| io::Error::other(error.clone()))
+}
+
+impl Service {
+    fn run(&self) {
+        loop {
+            let mut queue = self.queue.lock().unwrap_or_else(|e| e.into_inner());
+            let Some((&(at, id), _)) = queue.deadlines.first_key_value() else {
+                drop(self.wake.wait(queue).unwrap_or_else(|e| e.into_inner()));
+                continue;
+            };
+            let now = Instant::now();
+            if now < at {
+                drop(
+                    self.wake
+                        .wait_timeout(queue, at - now)
+                        .unwrap_or_else(|e| e.into_inner()),
+                );
+                continue;
+            }
+            let mut entry = queue.deadlines.remove(&(at, id)).unwrap();
+            queue.keys.remove(&id);
+            drop(queue);
+            if !entry.active.load(Ordering::Acquire) {
+                continue;
+            }
+            // A bad callback must not disable every root's deadlines.
+            let next = std::panic::catch_unwind(std::panic::AssertUnwindSafe(&mut entry.fire));
+            if let Ok(Some(at)) = next {
+                let mut queue = self.queue.lock().unwrap_or_else(|e| e.into_inner());
+                if entry.active.load(Ordering::Acquire) {
+                    queue.keys.insert(id, (at, id));
+                    queue.deadlines.insert((at, id), entry);
+                }
+            }
+        }
+    }
+}
+
+/// Cancels a pending deadline on drop, removing its callback immediately. A
+/// callback already being dispatched must also fence its work with the root's
+/// lifecycle (usually a weak owner and the executor's cancellation token).
+pub(crate) struct Timer {
+    service: &'static Arc<Service>,
+    id: u64,
+    active: Arc<AtomicBool>,
+}
+
+impl Timer {
+    #[cfg(test)]
+    pub(crate) fn registration_for_test(&self) -> u64 {
+        self.id
+    }
+
+    #[cfg(test)]
+    pub(crate) fn registered_for_test(id: u64) -> bool {
+        service()
+            .unwrap()
+            .queue
+            .lock()
+            .unwrap()
+            .keys
+            .contains_key(&id)
+    }
+
+    #[cfg(all(test, target_os = "linux"))]
+    pub(crate) fn deadline_for_test(id: u64) -> Option<Instant> {
+        service()
+            .unwrap()
+            .queue
+            .lock()
+            .unwrap()
+            .keys
+            .get(&id)
+            .map(|key| key.0)
+    }
+
+    pub(crate) fn at(
+        at: Instant,
+        fire: impl FnMut() -> Option<Instant> + Send + 'static,
+    ) -> io::Result<Self> {
+        let service = service()?;
+        let active = Arc::new(AtomicBool::new(true));
+        let mut queue = service.queue.lock().unwrap_or_else(|e| e.into_inner());
+        let id = queue.next_id;
+        queue.next_id = queue.next_id.checked_add(1).expect("timer id exhausted");
+        queue.keys.insert(id, (at, id));
+        queue.deadlines.insert(
+            (at, id),
+            Entry {
+                active: Arc::clone(&active),
+                fire: Box::new(fire),
+            },
+        );
+        service.wake.notify_one();
+        Ok(Self {
+            service,
+            id,
+            active,
+        })
+    }
+}
+
+impl Drop for Timer {
+    fn drop(&mut self) {
+        self.active.store(false, Ordering::Release);
+        let mut queue = self.service.queue.lock().unwrap_or_else(|e| e.into_inner());
+        let removed = queue
+            .keys
+            .remove(&self.id)
+            .and_then(|key| queue.deadlines.remove(&key));
+        self.service.wake.notify_one();
+        drop(queue);
+        drop(removed);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::mpsc;
+    use std::time::Duration;
+
+    #[test]
+    fn deadlines_rearm_cancel_and_survive_panics() {
+        let (tx, rx) = mpsc::channel();
+        let start = Instant::now();
+        let mut count = 0;
+        let _timer = Timer::at(start, move || {
+            count += 1;
+            tx.send((count, Instant::now())).unwrap();
+            (count == 1).then_some(start + Duration::from_millis(30))
+        })
+        .unwrap();
+        assert_eq!(rx.recv_timeout(Duration::from_secs(2)).unwrap().0, 1);
+        let (count, at) = rx.recv_timeout(Duration::from_secs(2)).unwrap();
+        assert_eq!(count, 2);
+        assert!(at >= start + Duration::from_millis(30));
+
+        let (tx, rx) = mpsc::channel();
+        let timer = Timer::at(Instant::now() + Duration::from_millis(30), move || {
+            tx.send(()).unwrap();
+            None
+        })
+        .unwrap();
+        drop(timer);
+        assert!(rx.recv_timeout(Duration::from_millis(60)).is_err());
+
+        let _panic = Timer::at(Instant::now(), || panic!("isolated callback panic")).unwrap();
+        let (tx, rx) = mpsc::channel();
+        let _later = Timer::at(Instant::now() + Duration::from_millis(10), move || {
+            tx.send(()).unwrap();
+            None
+        })
+        .unwrap();
+        rx.recv_timeout(Duration::from_secs(2)).unwrap();
+    }
+}
diff --git a/crates/aft/src/subc/bash.rs b/crates/aft/src/subc/bash.rs
index 6a1f58e396..070d219b7e 100644
--- a/crates/aft/src/subc/bash.rs
+++ b/crates/aft/src/subc/bash.rs
@@ -2296,28 +2296,30 @@ pub(super) fn submit_deferred_bash(
             .and_then(crate::subc_translate::model_boolean)
             == Some(true)
     });
-    // A server-owned call normally owns its command until it ends. A head
-    // agent on one of Thalamus's runners is the exception for a `background`
-    // or `pty` launch: it gets the ordinary launch reply at once, and the
-    // task's completion reaches it later as a notice, which the runner turns
-    // into a message in the session. Its task is then an ordinary background
-    // task: a cancel or route close before the reply hands it off instead of
-    // killing it, and a slow startup hands back its task id. Workers, Broca's
-    // routes and every other carrier keep the hold.
+    // A PTY launch always hands back its task id so the caller can drive the
+    // interactive command with bash_write/bash_status.
+    // Other server-owned calls own their command until it ends, except a
+    // `background` launch by a top-level (head) agent on a Thalamus runner,
+    // where completion reaches the session later as a notice. Handed-back
+    // tasks are ordinary background tasks: a cancel or route close before
+    // the reply hands them off instead of killing them, and a slow startup
+    // hands back the task id.
     let hands_back_launch = server_completion
-        && !run_scoped
-        && !worker_session
-        && !worker_preset
-        && !worker_jail
-        && secret_identity
-            .as_ref()
-            .is_some_and(|identity| identity.session == session_id && runner_head_route(identity))
-        && ["background", "pty"].iter().any(|key| {
-            raw_args
-                .get(*key)
-                .and_then(crate::subc_translate::model_boolean)
-                == Some(true)
-        });
+        && (raw_args
+            .get("pty")
+            .and_then(crate::subc_translate::model_boolean)
+            == Some(true)
+            || (!run_scoped
+                && !worker_session
+                && !worker_preset
+                && !worker_jail
+                && secret_identity.as_ref().is_some_and(|identity| {
+                    identity.session == session_id && runner_head_route(identity)
+                })
+                && raw_args
+                    .get("background")
+                    .and_then(crate::subc_translate::model_boolean)
+                    == Some(true)));
     let owns_command = server_completion && !hands_back_launch;
     let capture_wait_mode = raw_args
         .get("wait")
@@ -4730,7 +4732,7 @@ mod grant_path_tests {
             1052,
             Flags::new(false, Priority::Interactive, false),
             PROTOCOL_VERSION,
-            json!({"command": "echo hello; while [ ! -f release ]; do sleep 0.1; done", "wait": true}),
+            json!({"command": format!("echo hello; {}", crate::test_gate::gate("release", "sleep 0.1")), "wait": true}),
             crate::subc_format::FormatContext::default(),
             BashWaitCancel {
                 keepalive: None,
@@ -4880,21 +4882,13 @@ mod grant_path_tests {
     }
 
     fn secret_bash_scope_probe(req: RawRequest, _: &AppContext) -> Response {
-        use crate::secret::{Material, MaterialError, Resolution, SecretScope, SecretVault};
+        use crate::secret::{ApiKeyTarget, SecretScope, SecretVault, UseAnswer};
         struct Vault(std::sync::atomic::AtomicUsize);
         impl SecretVault for Vault {
-            fn resolve(&self, scope: &SecretScope, _: &str) -> Resolution {
+            fn use_secret(&self, scope: &SecretScope, _: &str, _: &ApiKeyTarget) -> UseAnswer {
                 assert_eq!(scope.reference(), "secret-bash");
                 self.0.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                Resolution::Unavailable
-            }
-            fn material(
-                &self,
-                _: &SecretScope,
-                _: &str,
-                _: &str,
-            ) -> Result<Material, MaterialError> {
-                panic!("launch must not request material")
+                UseAnswer::Unavailable
             }
             fn audit(
                 &self,
@@ -4904,7 +4898,16 @@ mod grant_path_tests {
             }
         }
         let vault = Vault(std::sync::atomic::AtomicUsize::new(0));
-        let decision = super::super::secret_consent::resolve_current_secret_label(&vault, "test");
+        let decision = super::super::secret_consent::use_current_secret_label(
+            &vault,
+            "test",
+            &ApiKeyTarget {
+                scheme: "https".into(),
+                host: "x.test".into(),
+                port: Some(443),
+                path: "/repos/a".into(),
+            },
+        );
         let super::super::secret_consent::LaunchDecision::Refuse(outcome) = decision else {
             panic!("unavailable vault must refuse");
         };
@@ -5244,9 +5247,12 @@ mod grant_path_tests {
         let marker_path = marker.to_string_lossy().replace('\\', "/");
         let release_path = release.to_string_lossy().replace('\\', "/");
         let command = if cfg!(windows) {
-            format!("Set-Content -Path '{marker_path}' -Value started; while (-not (Test-Path '{release_path}')) {{ Start-Sleep -Milliseconds 20 }}; Write-Output 'handoff-finished'")
+            format!("Set-Content -Path '{marker_path}' -Value started; {}; Write-Output 'handoff-finished'", crate::test_gate::powershell_gate(&release_path, 20))
         } else {
-            format!("printf started > '{marker_path}'; until [ -e '{release_path}' ]; do sleep 0.02; done; printf 'handoff-finished\\n'")
+            format!(
+                "printf started > '{marker_path}'; {}; printf 'handoff-finished\\n'",
+                crate::test_gate::gate_exists(&format!("'{release_path}'"), "sleep 0.02")
+            )
         };
         let session = "detach-log-session";
         let request = RawRequest {
@@ -5766,7 +5772,7 @@ mod grant_path_tests {
 
     #[cfg(unix)]
     #[tokio::test]
-    async fn v1_server_completion_never_returns_a_promoted_or_background_launch() {
+    async fn v1_server_completion_holds_foreground_and_background_launches() {
         let ctx = super::super::test_support::test_ctx();
         let registry = ctx.bash_background().clone();
         let target = drain::BashDetachTarget {
@@ -5798,7 +5804,7 @@ mod grant_path_tests {
             detached["detail"],
             json!({"task_id":"bash-00000000000000aa","late_results":false})
         );
-        for (background, pty) in [(false, false), (true, false), (false, true)] {
+        for background in [false, true] {
             let (_dir, root) = super::super::test_support::test_root("v1-shell-completion");
             let ctx = super::super::test_support::test_ctx();
             ctx.update_config(|config| config.foreground_wait_window_ms = 10);
@@ -5826,7 +5832,7 @@ mod grant_path_tests {
                 1,
                 Flags::new(false, Priority::Interactive, false),
                 PROTOCOL_VERSION,
-                json!({"command":"sleep 0.2", "timeout":5000,"background":background,"pty":pty,"foreground_orchestrate":true,"block_to_completion":true}),
+                json!({"command":"sleep 0.2", "timeout":5000,"background":background,"foreground_orchestrate":true,"block_to_completion":true}),
                 crate::subc_format::FormatContext::default(),
                 BashWaitCancel {
                     keepalive: None,
@@ -6475,7 +6481,7 @@ mod grant_path_tests {
             let release = dir.path().join("release");
             let _release = DeferredWaitReleaseGuard(vec![release.clone()]);
             let call = start(&executor, &root, &ctx, local_bash_stub,
-                json!({"command":format!("until [ -e '{}' ]; do sleep 0.02; done", release.display()), "timeout":60000}), true).await;
+                json!({"command":crate::test_gate::gate_exists(&format!("'{}'", release.display()), "sleep 0.02"), "timeout":60000}), true).await;
             answer_from_loop(&call, &root, true).await;
             assert_eq!(
                 settled(&ctx, &call.task_id).await.status,
@@ -8476,8 +8482,8 @@ mod grant_path_tests {
         let (identity, cancel, run, _) = codemode_run_call(&root);
         let release = dir.path().join("release");
         let command = format!(
-            "while [ ! -f '{}' ]; do sleep 0.05; done; echo finished",
-            release.display()
+            "{}; echo finished",
+            crate::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.05")
         );
         let task_id = codemode_background_launch(
             &executor,
@@ -11231,15 +11237,11 @@ mod grant_path_tests {
             // Each command polls for its release file. Windows runs bash commands
             // through PowerShell, so the loop is written in its syntax there.
             #[cfg(windows)]
-            let command = format!(
-                "while (-not (Test-Path -LiteralPath '{}')) {{ Start-Sleep -Milliseconds 10 }}",
-                releases.0[index].display()
-            );
+            let command =
+                crate::test_gate::powershell_gate(&releases.0[index].display().to_string(), 10);
             #[cfg(not(windows))]
-            let command = format!(
-                "while [ ! -f '{}' ]; do sleep 0.01; done",
-                releases.0[index].display()
-            );
+            let command =
+                crate::test_gate::gate(&format!("'{}'", releases.0[index].display()), "sleep 0.01");
             let connection = PersistentCancelSignal::new();
             let route = PersistentCancelSignal::new();
             submit_deferred_bash(
diff --git a/crates/aft/src/subc/bash_keepalive_tests.rs b/crates/aft/src/subc/bash_keepalive_tests.rs
index bfc4ba39a0..70cdea0d63 100644
--- a/crates/aft/src/subc/bash_keepalive_tests.rs
+++ b/crates/aft/src/subc/bash_keepalive_tests.rs
@@ -59,7 +59,7 @@ impl WaitHarness {
             clock.corr,
             control_flags(),
             PROTOCOL_VERSION,
-            json!({"command":"while [ ! -f release ]; do sleep 0.02; done; exit 7", "wait":true, "timeout":timeout}),
+            json!({"command":format!("{}; exit 7", crate::test_gate::gate("release", "sleep 0.02")), "wait":true, "timeout":timeout}),
             Default::default(),
             BashWaitCancel {
                 keepalive: progress,
diff --git a/crates/aft/src/subc/bash_selector_tests.rs b/crates/aft/src/subc/bash_selector_tests.rs
index 63c563fd7d..8b1859a161 100644
--- a/crates/aft/src/subc/bash_selector_tests.rs
+++ b/crates/aft/src/subc/bash_selector_tests.rs
@@ -485,9 +485,9 @@ async fn cancelled_wait_names_its_task_once_and_delivers_its_completion_after_re
     let started = dir.path().join("started");
     let release = dir.path().join("release");
     let command = format!(
-        "touch '{}'; while [ ! -f '{}' ]; do sleep 0.05; done; printf cancelled-call-done",
+        "touch '{}'; {}; printf cancelled-call-done",
         started.display(),
-        release.display()
+        crate::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.05")
     );
 
     let first = cancel_test_context(&root, &storage);
diff --git a/crates/aft/src/subc/call_yield.rs b/crates/aft/src/subc/call_yield.rs
index 31f0baf509..c29cee70dc 100644
--- a/crates/aft/src/subc/call_yield.rs
+++ b/crates/aft/src/subc/call_yield.rs
@@ -762,8 +762,8 @@ mod tests {
         let old = recovery_context(&root, &storage);
         let release = root.join("release");
         let command = format!(
-            "while [ ! -f '{}' ]; do sleep 0.02; done; echo restart-released",
-            release.display()
+            "{}; echo restart-released",
+            crate::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.02")
         );
         let req = serde_json::from_value(json!({"id":"launch", "command":"bash", "session_id":"restart-worker", "params":{"command":command,"background":true,"timeout":20000}})).unwrap();
         let launched = crate::commands::bash::handle(&req, &old);
diff --git a/crates/aft/src/subc/consent.rs b/crates/aft/src/subc/consent.rs
index 164c8144e4..ecfd871708 100644
--- a/crates/aft/src/subc/consent.rs
+++ b/crates/aft/src/subc/consent.rs
@@ -268,6 +268,7 @@ static TEST_TRANSPORT: LazyLock<StdMutex<Option<Arc<dyn ConsentTransport>>>> =
 
 /// Install the production transport for this process's daemon connection.
 pub(super) fn install_subc_transport(connection_file: &Path) {
+    crate::secret::transport::install_connection_file(connection_file);
     let transport: Arc<dyn ConsentTransport> = Arc::new(SharedSubcConsent(Arc::new(
         SubcConsentTransport::new(connection_file.to_path_buf()),
     )));
@@ -2027,10 +2028,13 @@ impl DirectoryScopeProbe {
     }
 }
 
+const DIRECTORY_SCOPE_MISSING_LOG_CAP: usize = 4_096;
+
 #[derive(Default)]
 struct DirectoryScopeProbes {
     probes: HashMap<PathBuf, Arc<DirectoryScopeProbe>>,
     logged: HashMap<(PathBuf, &'static str), Instant>,
+    missing_logged: std::collections::HashSet<PathBuf>,
     last_pruned: Option<Instant>,
 }
 
@@ -2057,6 +2061,17 @@ impl DirectoryScopeProbes {
     }
 
     fn note_fallback(&mut self, directory: &Path, reason: &'static str) -> bool {
+        if reason == "directory does not exist" {
+            if self.missing_logged.contains(directory) {
+                return false;
+            }
+            // Bound vanished-scope log history in the long-lived daemon.
+            // A new scope clears the full set; older scopes may then log again.
+            if self.missing_logged.len() >= DIRECTORY_SCOPE_MISSING_LOG_CAP {
+                self.missing_logged.clear();
+            }
+            return self.missing_logged.insert(directory.to_path_buf());
+        }
         match self.logged.entry((directory.to_path_buf(), reason)) {
             std::collections::hash_map::Entry::Occupied(mut entry) => {
                 if entry.get().elapsed() < DIRECTORY_SCOPE_MEMO_TTL {
@@ -2128,16 +2143,29 @@ where
                 .unwrap()
                 .note_fallback(parent, reason);
             if should_log {
-                log::warn!(
-                    "consent directory scope fell back to file-only for {}: {reason}",
-                    parent.display()
-                );
+                log_directory_scope_fallback(parent, reason);
             }
             grant.clone()
         }
     }
 }
 
+fn log_directory_scope_fallback(parent: &Path, reason: &str) {
+    // Scratch directories may be removed after their command exits, before
+    // consent can offer a wider grant. The original file grant is still safe.
+    if reason == "directory does not exist" {
+        crate::slog_info!(
+            "consent directory scope fell back to file-only for {}: {reason}",
+            parent.display()
+        );
+    } else {
+        crate::slog_warn!(
+            "consent directory scope fell back to file-only for {}: {reason}",
+            parent.display()
+        );
+    }
+}
+
 async fn scope_before_db(grant: &AccessGrant) -> AccessGrant {
     let probing = grant.clone();
     // A bounded helper still waits for its deadline. Keep that wait off the
diff --git a/crates/aft/src/subc/consent_running_tests.rs b/crates/aft/src/subc/consent_running_tests.rs
index 993d7891fb..bdbd039cef 100644
--- a/crates/aft/src/subc/consent_running_tests.rs
+++ b/crates/aft/src/subc/consent_running_tests.rs
@@ -53,8 +53,8 @@ fn gated_command(root: &Path) -> (String, PathBuf) {
     let release = root.join("release-shell");
     (
         format!(
-            "while [ ! -e '{}' ]; do sleep 0.01; done; printf running-result",
-            release.display()
+            "{}; printf running-result",
+            crate::test_gate::gate_exists(&format!("'{}'", release.display()), "sleep 0.01")
         ),
         release,
     )
diff --git a/crates/aft/src/subc/consent_tests.rs b/crates/aft/src/subc/consent_tests.rs
index a05bbfbbc8..9fdbb72c2b 100644
--- a/crates/aft/src/subc/consent_tests.rs
+++ b/crates/aft/src/subc/consent_tests.rs
@@ -4250,6 +4250,61 @@ fn consent_scope_unknown_alias_answer_is_not_memoized() {
     );
 }
 
+#[test]
+fn consent_scope_vanished_directory_is_info_once_even_after_memo_pruning() {
+    let _lock = CONSENT_TEST_LOCK.blocking_lock();
+    let dir = tempfile::tempdir().unwrap();
+    let parent = dir.path().join("removed-scratch");
+    let grant = AccessGrant {
+        path: parent.join("first.txt"),
+        kind: GrantKind::File,
+        operation: AccessOperation::Read,
+    };
+    let (_, lines) = crate::logging::capture_log_lines(|| {
+        assert_eq!(directory_scope_with(&grant, |_, _| Some(false)), grant);
+        let mut state = DIRECTORY_SCOPE_PROBES.lock().unwrap();
+        state.last_pruned = Some(Instant::now() - DIRECTORY_SCOPE_MEMO_TTL);
+        drop(state);
+        let sibling = AccessGrant {
+            path: parent.join("second.txt"),
+            ..grant.clone()
+        };
+        assert_eq!(directory_scope_with(&sibling, |_, _| Some(false)), sibling);
+    });
+    assert_eq!(lines.len(), 1, "{lines:?}");
+    assert!(lines[0].starts_with("INFO "), "{lines:?}");
+    assert!(lines[0].contains("directory does not exist"), "{lines:?}");
+    let (_, lines) = crate::logging::capture_log_lines(|| {
+        log_directory_scope_fallback(&parent, "home identity unknown");
+        log_directory_scope_fallback(&parent, "directory probe timed out");
+    });
+    assert_eq!(lines.len(), 2);
+    assert!(
+        lines.iter().all(|line| line.starts_with("WARN ")),
+        "{lines:?}"
+    );
+
+    let mut probes = DirectoryScopeProbes::default();
+    for index in 0..DIRECTORY_SCOPE_MISSING_LOG_CAP {
+        assert!(probes.note_fallback(&parent.join(index.to_string()), "directory does not exist"));
+        assert_eq!(probes.missing_logged.len(), index + 1);
+    }
+    assert!(!probes.note_fallback(&parent.join("0"), "directory does not exist"));
+    assert_eq!(probes.missing_logged.len(), DIRECTORY_SCOPE_MISSING_LOG_CAP);
+    assert!(probes.note_fallback(&parent.join("next"), "directory does not exist"));
+    assert_eq!(
+        probes.missing_logged.len(),
+        1,
+        "a new scope clears the full set"
+    );
+    assert!(probes.note_fallback(&parent.join("0"), "directory does not exist"));
+    assert_eq!(
+        probes.missing_logged.len(),
+        2,
+        "an older scope may log again"
+    );
+}
+
 #[cfg(unix)]
 #[test]
 fn consent_scope_memo_expires_and_unsafe_answers_keep_each_file() {
@@ -7783,3 +7838,6 @@ fn standalone_approval_deadline_leaves_the_rerun_margin() {
         now
     );
 }
+#[cfg(unix)]
+#[path = "secret_fetch_cancellation_tests.rs"]
+mod secret_fetch_cancellation;
diff --git a/crates/aft/src/subc/diagnostics_findings.rs b/crates/aft/src/subc/diagnostics_findings.rs
index 972a5e3916..8647b1947f 100644
--- a/crates/aft/src/subc/diagnostics_findings.rs
+++ b/crates/aft/src/subc/diagnostics_findings.rs
@@ -274,6 +274,20 @@ pub(super) fn from_health(
     stale_reason: Option<&str>,
     now: u64,
     window: u64,
+) -> Vec<Finding> {
+    let deadline = std::time::Instant::now() + std::time::Duration::from_millis(20);
+    from_health_with_budget(metrics, age_ms, stale_reason, now, window, || {
+        std::time::Instant::now() >= deadline
+    })
+}
+
+fn from_health_with_budget(
+    metrics: &Value,
+    age_ms: Option<u64>,
+    stale_reason: Option<&str>,
+    now: u64,
+    window: u64,
+    mut exhausted: impl FnMut() -> bool,
 ) -> Vec<Finding> {
     let mut findings = vec![];
     if stale_reason.is_some() || age_ms.is_none_or(|age| age > SNAPSHOT_MAX_AGE_MS) {
@@ -285,27 +299,49 @@ pub(super) fn from_health(
         return findings;
     }
     let observed = now.saturating_sub(age_ms.unwrap_or(0));
-    let deadline = std::time::Instant::now() + std::time::Duration::from_millis(20);
+    // Omitted diagnostic evidence is still unknown. The caller must supply the
+    // complete in-memory snapshot, never the size-budgeted presentation report.
     for field in ["root_details_omitted", "cache_unavailable_omitted"] {
         if metrics[field].as_u64().unwrap_or(0) > 0 {
             findings.push(unknown("health_snapshot", field, now));
         }
     }
+    // The rollup clock covers backend/root/cleanup evidence. Allocator walks
+    // have their own adaptive reuse window, recorded with that observation.
+    // Unsupported allocator accounting has no age and is not a root-health check.
+    if let Some(age) = metrics["memory"]["allocator_observation_age_ms"].as_u64() {
+        if metrics["memory"]["allocator_reuse_ms"]
+            .as_u64()
+            .is_none_or(|reuse| age.saturating_add(age_ms.unwrap_or(0)) > reuse)
+        {
+            findings.push(unknown(
+                "health_snapshot",
+                "allocator_observation_expired",
+                now,
+            ));
+        }
+    }
     match metrics["embedding_backend"]["available"].as_bool() {
+        // Planned downtime is information in health, not a warn/error finding.
+        Some(false) if metrics["embedding_backend"]["state"] == "paused" && metrics["embedding_backend"]["pause_cause"] == "lane_paused" => {},
         Some(false) => findings.push(condition("semantic_backend", "unavailable", Severity::Error, 1,
             metrics["embedding_backend"]["since_ms"].as_u64().unwrap_or(observed), now,
-            "The semantic embedding backend is unavailable or paused.", vec![],
+            "The semantic embedding backend is unavailable.", vec![],
             "Read health embedding_backend and semantic_index; inspect synapse availability and retry state.")),
         Some(true) => {},
         None => findings.push(unknown("semantic_backend", "backend_state_unmeasured", now)),
     }
     if let Some(roots) = metrics["roots"].as_array() {
-        for root in roots {
-            if std::time::Instant::now() >= deadline {
-                findings.push(unknown("health_snapshot", "root_scan_deadline", now));
-                break;
-            }
+        'roots: for root in roots {
             let key = root_key(root);
+            if exhausted() {
+                findings.push(unknown(
+                    "root_health",
+                    &format!("{key}/root_scan_deadline"),
+                    now,
+                ));
+                continue;
+            }
             if let Some(reserves) = root["view_storage_reserve"].as_object() {
                 for (plane, reserve) in reserves {
                     if let Some(message) = reserve["message"].as_str() {
@@ -344,9 +380,13 @@ pub(super) fn from_health(
                 findings.push(unknown("build_breaker", &format!("{key}/{reason}"), now));
             } else if let Some(domains) = root["suspended_domains"].as_array() {
                 for domain in domains {
-                    if std::time::Instant::now() >= deadline {
-                        findings.push(unknown("build_breaker", "domain_scan_deadline", now));
-                        return findings;
+                    if exhausted() {
+                        findings.push(unknown(
+                            "root_health",
+                            &format!("{key}/domain_scan_deadline"),
+                            now,
+                        ));
+                        continue 'roots;
                     }
                     let domain_name = domain["domain"].as_str().unwrap_or("unknown");
                     // Hash labels rather than returning roots, custom server names or error text.
@@ -375,9 +415,13 @@ pub(super) fn from_health(
             }
             if let Some(failures) = evidence["lsp_start_failures"].as_object() {
                 for (server, count) in failures {
-                    if std::time::Instant::now() >= deadline {
-                        findings.push(unknown("lsp_start_failures", "server_scan_deadline", now));
-                        return findings;
+                    if exhausted() {
+                        findings.push(unknown(
+                            "root_health",
+                            &format!("{key}/server_scan_deadline"),
+                            now,
+                        ));
+                        continue 'roots;
                     }
                     if let Some(count) = count.as_u64().filter(|n| *n > 0) {
                         let server_key = format!("{key}/{:x}", Sha256::digest(server.as_bytes()));
@@ -579,6 +623,26 @@ mod tests {
         assert!(findings.is_empty());
     }
 
+    #[test]
+    fn diagnostics_findings_planned_lane_pause_is_information_not_failure() {
+        let mut metrics = healthy_metrics();
+        metrics["embedding_backend"] = json!({"available": false, "state": "paused", "pause_cause": "lane_paused", "paused_until_ms": 2_000_000});
+        let findings = snapshot(&metrics);
+        assert!(
+            findings.is_empty(),
+            "planned pauses are not failures: {findings:?}"
+        );
+        for backend in [
+            json!({"available": false, "state": "backend_unavailable"}),
+            json!({"available": false, "state": "paused", "pause_cause": "transient"}),
+        ] {
+            metrics["embedding_backend"] = backend;
+            let findings = snapshot(&metrics);
+            assert_eq!(findings.len(), 1);
+            assert_eq!(findings[0].severity, Severity::Error);
+        }
+    }
+
     #[test]
     fn diagnostics_findings_seeded_standing_conditions_and_redaction() {
         let mut metrics = healthy_metrics();
@@ -759,6 +823,121 @@ mod tests {
             .all(|f| f.severity == Severity::Error && f.key.contains("unavailable")));
     }
 
+    #[test]
+    fn diagnostics_findings_freshness_is_per_part() {
+        let mut metrics = healthy_metrics();
+        metrics["memory"] = json!({
+            "rss_bytes": 6_000_000_000_u64,
+            "allocator_observation_age_ms": 90_000,
+            "allocator_reuse_ms": 120_000,
+        });
+        assert!(from_health(&metrics, Some(3_000), None, 1_000_000, 1).is_empty());
+        assert!(from_health(&metrics, Some(30_000), None, 1_000_000, 1).is_empty());
+
+        // A stopped rollup cannot borrow the allocator's longer reuse window.
+        let stale = from_health(&metrics, Some(30_001), None, 1_000_000, 1);
+        assert_eq!(stale.len(), 1);
+        assert_eq!(stale[0].check, "health_snapshot");
+        assert_eq!(stale[0].severity, Severity::Error);
+
+        metrics["memory"]["allocator_observation_age_ms"] = json!(120_001);
+        let expired = snapshot(&metrics);
+        assert_eq!(expired.len(), 1);
+        assert_eq!(expired[0].check, "health_snapshot");
+        assert_eq!(
+            expired[0].samples[0]["reason"],
+            "allocator_observation_expired"
+        );
+
+        metrics["memory"]["allocator_observation_age_ms"] = json!(120_000);
+        assert!(snapshot(&metrics).is_empty());
+        assert_eq!(from_health(&metrics, Some(1), None, 1_000_000, 1).len(), 1);
+    }
+
+    #[test]
+    fn diagnostics_findings_unmeasured_backend_is_unknown() {
+        let mut metrics = healthy_metrics();
+        metrics["embedding_backend"]["available"] = Value::Null;
+        let findings = snapshot(&metrics);
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].check, "semantic_backend");
+        assert_eq!(findings[0].severity, Severity::Error);
+        assert_eq!(findings[0].samples[0]["reason"], "backend_state_unmeasured");
+        assert_eq!(
+            findings[0].summary,
+            "AFT could not determine this check from its recorded evidence."
+        );
+    }
+
+    #[test]
+    fn diagnostics_findings_root_deadline_names_every_unexamined_root() {
+        let mut metrics = healthy_metrics();
+        let root = metrics["roots"][0].clone();
+        metrics["roots"] = json!((0..200)
+            .map(|index| {
+                let mut root = root.clone();
+                root["project_root"] = json!(format!("/private/root-{index:03}"));
+                root
+            })
+            .collect::<Vec<_>>());
+        let mut calls = 0;
+        let findings = from_health_with_budget(&metrics, Some(0), None, 1_000_000, 1, || {
+            calls += 1;
+            calls > 1
+        });
+        assert_eq!(findings.len(), 199);
+        for (finding, root) in findings
+            .iter()
+            .zip(metrics["roots"].as_array().unwrap().iter().skip(1))
+        {
+            assert_eq!(finding.check, "root_health");
+            assert_eq!(finding.severity, Severity::Error);
+            assert_eq!(
+                finding.samples[0]["reason"],
+                format!("{}/root_scan_deadline", root_key(root))
+            );
+        }
+        assert!(!serde_json::to_string(&findings)
+            .unwrap()
+            .contains("/private/"));
+    }
+
+    #[test]
+    fn diagnostics_findings_nested_deadlines_keep_remaining_roots_and_cleanup() {
+        for (field, entries, reason) in [
+            (
+                "suspended_domains",
+                json!([{"domain": "custom"}]),
+                "domain_scan_deadline",
+            ),
+            (
+                "diagnostics_evidence",
+                json!({"database_open_failed": false, "lsp_start_failures": {"custom": 1}}),
+                "server_scan_deadline",
+            ),
+        ] {
+            let mut metrics = healthy_metrics();
+            let second = metrics["roots"][0].clone();
+            metrics["roots"][0][field] = entries;
+            metrics["roots"].as_array_mut().unwrap().push(second);
+            metrics["storage_retention"] =
+                json!({"storage": {"at_ms": 1_000_000, "errors": ["failed"]}});
+            let mut calls = 0;
+            let findings = from_health_with_budget(&metrics, Some(0), None, 1_000_000, 1, || {
+                calls += 1;
+                calls > 1
+            });
+            assert_eq!(findings.len(), 3);
+            assert_eq!(findings[0].check, "root_health");
+            assert!(findings[0].samples[0]["reason"]
+                .as_str()
+                .unwrap()
+                .ends_with(reason));
+            assert_eq!(findings[1].check, "root_health");
+            assert_eq!(findings[2].check, "cleanup_failures");
+        }
+    }
+
     fn scope(kind: ScopeKind) -> ScopeStamp {
         let mut stamp = ScopeStamp::new(
             subc_protocol::Principal::Reserved {
diff --git a/crates/aft/src/subc/health.rs b/crates/aft/src/subc/health.rs
index 4785802fb9..d93393cf12 100644
--- a/crates/aft/src/subc/health.rs
+++ b/crates/aft/src/subc/health.rs
@@ -2003,6 +2003,7 @@ fn ordinary_ready_health_root(root: &Value) -> bool {
                 )
             })
         && root["data_store"]["failure"].is_null()
+        && root["data_store"]["skipped_folders"].as_u64().unwrap_or(0) == 0
         && root["suspended_domains"]
             .as_array()
             .is_none_or(Vec::is_empty)
@@ -2096,9 +2097,29 @@ fn abbreviate_health_root(root: &mut Value) -> bool {
             *path = abbreviated_health_path(path);
         }
     }
+    if let (Some(root_path), Some(count)) = (
+        row.get("project_root").and_then(Value::as_str),
+        row.get("data_store")
+            .and_then(|store| store["skipped_folders"].as_u64()),
+    ) {
+        if count > 0 {
+            let note = crate::data_layer::surfaces::skipped_folder_health_note(
+                Path::new(root_path),
+                count as usize,
+            );
+            row["data_store"]["skipped_folder_note"] = Value::String(note);
+        }
+    }
     if let Some(Value::String(refusal)) = row.get_mut("standing_refusal") {
         *refusal = abbreviated_health_refusal(refusal);
     }
+    if let Some(store) = row.get_mut("data_store") {
+        for field in ["/error", "/failure/error"] {
+            if let Some(Value::String(error)) = store.pointer_mut(field) {
+                *error = abbreviated_health_refusal(error);
+            }
+        }
+    }
     for component in ["search_index", "semantic_index", "callgraph_store", "tier2"] {
         if let Some(Value::Object(component)) = row.get_mut(component) {
             component.retain(|key, _| key == "status");
@@ -2210,24 +2231,40 @@ fn budget_health_metrics(metrics: &mut serde_json::Map<String, Value>) {
                         .rposition(ordinary_ready_health_root)
                         .unwrap_or(roots.len() - 1)
                 });
-                let Some(index) = index else {
+                if let Some(index) = index {
+                    roots.remove(index);
+                    let omitted = metrics
+                        .get("root_details_omitted")
+                        .and_then(Value::as_u64)
+                        .unwrap_or(0)
+                        .saturating_add(1);
+                    metrics.insert("root_details_omitted".into(), json!(omitted));
+                    continue;
+                } else {
                     // Keep an identifiable status even when the last root is ready.
                     // Abbreviating the last row does not omit a root.
                     if abbreviate_health_root(&mut roots[0]) {
                         continue;
                     }
-                    return;
-                };
-                roots.remove(index);
-                let omitted = metrics
-                    .get("root_details_omitted")
-                    .and_then(Value::as_u64)
-                    .unwrap_or(0)
-                    .saturating_add(1);
-                metrics.insert("root_details_omitted".into(), json!(omitted));
-                continue;
+                }
             }
         }
+        // The failure count and last actionable root survive even when these
+        // additional names do not fit. Keep the longest prefix that fits, and
+        // account for every removed name in the existing omitted count.
+        if metrics
+            .get_mut("data_store_failed")
+            .and_then(Value::as_array_mut)
+            .is_some_and(|failed| failed.pop().is_some())
+        {
+            let omitted = metrics
+                .get("data_store_failed_omitted")
+                .and_then(Value::as_u64)
+                .unwrap_or(0)
+                .saturating_add(1);
+            metrics.insert("data_store_failed_omitted".into(), json!(omitted));
+            continue;
+        }
         return;
     }
 }
@@ -2242,6 +2279,9 @@ struct HealthDiagnosticRollup {
     generation: u64,
     stale_reason: Option<&'static str>,
     metrics: Value,
+    /// Compact evidence for every root, independent of the public report's
+    /// root-count and byte budgets. Freshness metadata travels with the evidence.
+    findings_metrics: Value,
     /// The full memory census `memory.census` serves. It is measured at its
     /// own cadence (see [`HEALTH_MEMORY_CENSUS_INTERVAL_MS`]), so a rollup may
     /// carry forward the census an earlier rollup measured; sharing it by
@@ -2304,6 +2344,7 @@ impl HealthDiagnosticRollup {
             generated_at_ms: None,
             generation: 0,
             stale_reason: Some("not_yet_sampled"),
+            findings_metrics: metrics.clone(),
             metrics,
             memory_census: Arc::new(placeholder_memory_census()),
             memory_census_at_ms: None,
@@ -2425,7 +2466,7 @@ impl HealthRollupCache {
             snapshot.stale_reason
         };
         super::diagnostics_findings::from_health(
-            &snapshot.metrics,
+            &snapshot.findings_metrics,
             age_ms,
             reason,
             now_ms,
@@ -2462,7 +2503,7 @@ impl HealthRollupCache {
         }
     }
 
-    fn allocator_observation(&self) -> crate::memory::AllocatorObservation {
+    fn allocator_observation(&self) -> (crate::memory::AllocatorObservation, u64) {
         let mut cached = self
             .allocator
             .lock()
@@ -2475,7 +2516,7 @@ impl HealthRollupCache {
                 let mut reused = observation.clone();
                 // Unsupported platforms keep a null age, not a measured zero.
                 reused.age_ms = observation.age_ms.map(|_| age_ms);
-                return reused;
+                return (reused, cached.reuse_ms);
             }
         }
         let walk_started = Instant::now();
@@ -2488,15 +2529,14 @@ impl HealthRollupCache {
         };
         // The observation already includes time spent walking the allocator.
         // Start the reuse clock after that walk so its duration is not counted twice.
+        let reuse_ms =
+            crate::memory::allocator_reuse_window_ms(HEALTH_ALLOCATOR_MIN_REUSE_MS, walk_ms);
         *cached = Some(CachedAllocatorObservation {
             cached_at_ms: self.now_ms(),
-            reuse_ms: crate::memory::allocator_reuse_window_ms(
-                HEALTH_ALLOCATOR_MIN_REUSE_MS,
-                walk_ms,
-            ),
+            reuse_ms,
             observation: observation.clone(),
         });
-        observation
+        (observation, reuse_ms)
     }
 
     fn step_log_due(&self) -> bool {
@@ -3477,6 +3517,7 @@ fn build_health_diagnostic_rollup_from_actors(
     let mut embedding_backend_available = true;
     let mut embedding_backend_paused_until_ms: Option<u64> = None;
     let mut embedding_backend_down = false;
+    let mut embedding_backend_only_planned_pauses = true;
     let mut embedding_backend_last_error = None;
     let mut embedding_backend_since_ms = None;
     let mut task_storage_roots = std::collections::HashSet::new();
@@ -3551,6 +3592,8 @@ fn build_health_diagnostic_rollup_from_actors(
         let backend = ctx.semantic_backend_health_snapshot();
         if !backend.available {
             embedding_backend_available = false;
+            embedding_backend_only_planned_pauses &=
+                backend.pause_cause == Some(crate::synapse_embed::PauseCause::LanePaused);
             if let Some(until) = backend.paused_until_ms {
                 embedding_backend_paused_until_ms =
                     Some(embedding_backend_paused_until_ms.map_or(until, |old| old.max(until)));
@@ -3662,6 +3705,12 @@ fn build_health_diagnostic_rollup_from_actors(
             .cmp(&left.attributed_bytes)
             .then_with(|| left.root_label.cmp(&right.root_label))
     });
+    // Only fields used by diagnosis are copied for all roots. Rich health and
+    // memory rendering stays capped, without discarding evidence for diagnosis.
+    let diagnostics_roots = candidates
+        .iter()
+        .map(|candidate| root_findings_evidence(&candidate.health, &candidate.diagnostics_evidence))
+        .collect::<Vec<_>>();
     let root_details_omitted = candidates.len().saturating_sub(HEALTH_ROOT_DETAIL_CAP);
     let roots: Vec<(String, Value)> = candidates
         .into_iter()
@@ -3758,7 +3807,8 @@ fn build_health_diagnostic_rollup_from_actors(
 
     let root_count = root_details_omitted.saturating_add(roots.len());
     rollup_mark!(timer, "root JSON assembly");
-    let allocator = cache.allocator_observation();
+    let (allocator, allocator_reuse_ms) = cache.allocator_observation();
+    let allocator_age_ms = allocator.age_ms;
     rollup_mark!(timer, "allocator observation");
     // Shared bases and semantic arenas are measured once for the compact
     // rollup; a rollup that also measures the census reuses that measurement.
@@ -3873,6 +3923,7 @@ fn build_health_diagnostic_rollup_from_actors(
             "available": embedding_backend_available,
             "state": if embedding_backend_available { "available" } else if !embedding_backend_down && embedding_backend_paused_until_ms.is_some() { "paused" } else { "backend_unavailable" },
             "paused_until_ms": embedding_backend_paused_until_ms,
+            "pause_cause": if !embedding_backend_available && !embedding_backend_down && embedding_backend_only_planned_pauses { Some("lane_paused") } else { None },
             "last_error": embedding_backend_last_error,
             "since_ms": embedding_backend_since_ms,
         },
@@ -3887,6 +3938,15 @@ fn build_health_diagnostic_rollup_from_actors(
     });
     insert_lifecycle_metrics(&mut metrics, lifecycle);
     data_store_failures.insert_into(&mut metrics);
+    let findings_metrics = json!({
+        "roots": diagnostics_roots,
+        "embedding_backend": metrics["embedding_backend"],
+        "storage_retention": metrics["storage_retention"],
+        "memory": {
+            "allocator_observation_age_ms": allocator_age_ms,
+            "allocator_reuse_ms": allocator_reuse_ms,
+        },
+    });
     rollup_mark!(timer, "metrics JSON assembly");
     let tick = timer.metrics();
     if log::log_enabled!(log::Level::Debug) && cache.step_log_due() {
@@ -3915,12 +3975,24 @@ fn build_health_diagnostic_rollup_from_actors(
         generation: 0,
         stale_reason: None,
         metrics,
+        findings_metrics,
         memory_census,
         memory_census_at_ms,
         memory_census_answers,
     }
 }
 
+fn root_findings_evidence(health: &RootHealthSnapshot, evidence: &Value) -> Value {
+    json!({
+        "project_root": health.project_root,
+        "state": health.state,
+        "cache_unavailable_reason": health.cache_unavailable_reason,
+        "view_storage_reserve": health.view_storage_reserve,
+        "suspended_domains": health.suspended_domains,
+        "diagnostics_evidence": evidence,
+    })
+}
+
 /// How many roots with a failed index store the health summary names, in
 /// path order; the rest are only counted.
 const HEALTH_DATA_STORE_FAILED_NAMED: usize = 5;
@@ -4211,6 +4283,10 @@ fn assemble_health_report(
         None => cached_mutating_lanes.unwrap_or_else(|| json!({ "scheduler_busy": true })),
     };
     metrics.insert("snapshot_age_ms".to_string(), json!(snapshot_age_ms));
+    metrics.insert(
+        "manifest_sync".into(),
+        crate::gh_shim::manifest_sync::health(),
+    );
     metrics.insert("age_ms".to_string(), json!(snapshot_age_ms));
     metrics.insert("generated_at_ms".to_string(), json!(rollup.generated_at_ms));
     metrics.insert("stale".to_string(), json!(stale_reason.is_some()));
@@ -4219,6 +4295,14 @@ fn assemble_health_report(
         "durable_log".to_string(),
         crate::logging::durable_log_health(),
     );
+    metrics.insert(
+        "gh_speech".to_string(),
+        json!({"unconfigured_binding_refusals_total": crate::gh_shim_speech::service::unconfigured_binding_refusals_total()}),
+    );
+    metrics.insert(
+        "full_sync_fallbacks".to_string(),
+        json!(aft_store::sync::full_sync_fallbacks()),
+    );
     metrics.insert(
         "runtime".to_string(),
         json!({
@@ -4260,6 +4344,11 @@ fn assemble_health_report(
         );
         metrics.insert("bash_pty_spawn".to_string(), spawn["pty_backend"].clone());
     }
+    #[cfg(target_os = "linux")]
+    metrics.insert(
+        "bash_oom_priority_failures".to_string(),
+        crate::bash_background::process::oom_priority_failures().into(),
+    );
     metrics.insert(
         "cold_build_limiter".to_string(),
         render_cold_build_limiter_census(crate::cold_build_limiter::global_limiter().census()),
@@ -4861,6 +4950,68 @@ mod tests {
         assert_eq!(metrics, once, "abbreviation must survive rebudgeting");
     }
 
+    #[test]
+    fn health_budget_bounds_failed_store_names_with_long_roots() {
+        use crate::data_layer::surfaces::{reason, DataStoreHealth};
+        let paths = (0..50)
+            .map(|index| format!("/long-health-root/{}/{index:02}", "parent-".repeat(26)))
+            .collect::<Vec<_>>();
+        let store = DataStoreHealth {
+            skipped_folders: 0,
+            skipped_folder_note: None,
+            reason: Some(reason::BIND_FAILED),
+            error: Some(format!("could not bind {}", paths[0].repeat(3))),
+            pending_edits: 0,
+            unparsed_files: 0,
+            failure: None,
+        };
+        let failed =
+            DataStoreFailedRoots::collect(paths.iter().map(|path| (path.as_str(), &store)));
+        let mut metrics = json!({
+            "root_count": 50, "root_details_omitted": 49,
+            "roots": [{
+                "project_root": paths[0], "state": "degraded", "data_store": store
+            }],
+            // Fixed live counters already use most of the budget in a real
+            // report; failed-root names and error paths must yield before them.
+            "fresh_liveness": "x".repeat(11400)
+        });
+        failed.insert_into(&mut metrics);
+        let mut roomy = metrics.as_object().unwrap().clone();
+        roomy.insert("fresh_liveness".into(), json!("x".repeat(10000)));
+        budget_health_metrics(&mut roomy);
+        assert_eq!(roomy["data_store_failed"].as_array().unwrap().len(), 5);
+        assert_eq!(roomy["data_store_failed_omitted"], 45);
+        let metrics = metrics.as_object_mut().unwrap();
+        assert!(refresh_metrics_bytes(metrics) > HEALTH_METRICS_BUDGET_BYTES);
+        budget_health_metrics(metrics);
+        let bytes = serde_json::to_vec(metrics).unwrap().len();
+        assert!(bytes <= HEALTH_METRICS_BUDGET_BYTES, "{bytes}");
+        assert_eq!(metrics["metrics_bytes"], bytes);
+        assert_eq!(metrics["data_store_failed_roots"], 50);
+        let names = metrics["data_store_failed"].as_array().unwrap();
+        assert!(!names.is_empty() && names.len() < 5);
+        assert_eq!(
+            names.len() as u64 + metrics["data_store_failed_omitted"].as_u64().unwrap(),
+            50
+        );
+        for (entry, path) in names.iter().zip(&paths) {
+            assert_eq!(entry["reason"], reason::BIND_FAILED);
+            assert!(entry["project_root"]
+                .as_str()
+                .unwrap()
+                .contains(blake3::hash(path.as_bytes()).to_hex().as_str()));
+        }
+        assert_eq!(
+            metrics["roots"][0]["data_store"]["reason"],
+            reason::BIND_FAILED
+        );
+        assert_eq!(metrics["fresh_liveness"].as_str().unwrap().len(), 11400);
+        let once = metrics.clone();
+        budget_health_metrics(metrics);
+        assert_eq!(*metrics, once, "budgeting must be idempotent");
+    }
+
     #[test]
     fn health_budget_drops_healthy_roots_before_degraded_refused_and_standing_rows() {
         for (detail_bytes, expected) in [
@@ -5010,6 +5161,8 @@ mod tests {
         failure: Option<(&'static str, bool)>,
     ) -> crate::data_layer::surfaces::DataStoreHealth {
         crate::data_layer::surfaces::DataStoreHealth {
+            skipped_folders: 0,
+            skipped_folder_note: None,
             reason,
             error: None,
             pending_edits: 0,
@@ -5025,6 +5178,31 @@ mod tests {
         }
     }
 
+    #[test]
+    fn data_store_unreadable_folders_are_informational_and_keep_budgeted_identity() {
+        let mut store = data_store_health(None, None);
+        store.skipped_folders = 2;
+        let root_path = format!("/work/{}/project", "long/".repeat(100));
+        store.skipped_folder_note = Some(crate::data_layer::surfaces::skipped_folder_health_note(
+            Path::new(&root_path),
+            2,
+        ));
+        assert_eq!(data_store_failure_reason(&store), None);
+        let failed = DataStoreFailedRoots::collect([(root_path.as_str(), &store)]);
+        let state = root_health_rollup_state(0, 0, 1, None);
+        assert_eq!(with_data_store_failures(state.clone(), &failed), state);
+        let mut root = json!({"project_root": root_path, "data_store": store});
+        assert!(abbreviate_health_root(&mut root));
+        assert_eq!(root["data_store"]["skipped_folders"], 2);
+        assert_eq!(
+            root["data_store"]["skipped_folder_note"],
+            format!(
+                "{}: index skipped 2 unreadable folders",
+                abbreviated_health_path(&root_path)
+            )
+        );
+    }
+
     #[test]
     fn failed_index_store_roots_are_named_in_path_order_with_reasons_up_to_five() {
         use crate::data_layer::surfaces::reason;
@@ -5164,6 +5342,7 @@ mod tests {
             "project_root": "standing", "state": "ready", "standing": true,
             "standing_refusal": "resolved-path-drift refusal", "diagnostics_evidence": evidence
         }]);
+        rollup.findings_metrics["roots"] = rollup.metrics["roots"].clone();
         cache.publish(Some(rollup));
 
         let report = build_health_report(
@@ -7025,6 +7204,118 @@ mod tests {
         )
     }
 
+    #[test]
+    fn diagnostics_findings_allocator_window_travels_with_snapshot() {
+        let cache = HealthRollupCache::new();
+        cache.clock_ms.store(0, Ordering::Relaxed);
+        cache
+            .allocator_walk_ms_for_test
+            .store(600, Ordering::Relaxed);
+        cache.publish(Some(allocator_rollup(&cache)));
+
+        cache.clock_ms.store(90_000, Ordering::Relaxed);
+        let rollup = allocator_rollup(&cache);
+        assert_eq!(
+            rollup.findings_metrics["memory"]["allocator_reuse_ms"],
+            120_000
+        );
+        #[cfg(target_os = "linux")]
+        assert!(
+            rollup.findings_metrics["memory"]["allocator_observation_age_ms"]
+                .as_u64()
+                .unwrap()
+                >= 90_000
+        );
+        cache.publish(Some(rollup));
+        let has_snapshot_finding = || {
+            serde_json::to_value(cache.findings(1_000_000, 60_000))
+                .unwrap()
+                .as_array()
+                .unwrap()
+                .iter()
+                .any(|finding| finding["check"] == "health_snapshot")
+        };
+        assert!(!has_snapshot_finding());
+        cache.clock_ms.store(120_001, Ordering::Relaxed);
+        assert!(
+            has_snapshot_finding(),
+            "a stopped rollup must still be unknown"
+        );
+    }
+
+    #[test]
+    fn diagnostics_findings_200_roots_are_independent_of_report_trimming() {
+        let cache = HealthRollupCache::new();
+        let executor = Executor::new();
+        let app = App::default_shared();
+        let context = test_ctx();
+        let roots = (0..200)
+            .map(|index| test_root(&format!("diagnostics-root-{index:03}")))
+            .collect::<Vec<_>>();
+        let actors = roots
+            .iter()
+            .map(|(_, root)| (root.clone(), Arc::clone(&context)))
+            .collect();
+        let mut rollup =
+            build_health_diagnostic_rollup_from_actors(&cache, &executor, &app, actors);
+        // Seed an empty retention measurement: no retention worker runs in this
+        // fixture, and missing cleanup evidence is independently unknown.
+        rollup.findings_metrics["storage_retention"] = json!({});
+        assert_eq!(
+            rollup.findings_metrics["roots"].as_array().unwrap().len(),
+            200
+        );
+        assert_eq!(
+            rollup.metrics["root_details_omitted"],
+            200 - HEALTH_ROOT_DETAIL_CAP
+        );
+        // Long cache paths also force the byte budget to omit cache entries.
+        rollup.metrics["cache_unavailable"] = json!((0..200)
+            .map(|index| {
+                (
+                    format!("/cache/{index:03}/{}", "segment/".repeat(30)),
+                    json!("unavailable"),
+                )
+            })
+            .collect::<serde_json::Map<_, _>>());
+        cache.publish(Some(rollup));
+
+        let report = build_health_report(
+            &cache,
+            &executor,
+            &HashMap::new(),
+            &DispatchPathMetrics::new(),
+            &app,
+        );
+        let metrics = report.metrics.unwrap();
+        assert!(metrics["root_details_omitted"].as_u64().unwrap() > 0);
+        assert!(metrics["cache_unavailable_omitted"].as_u64().unwrap() > 0);
+        assert!(metrics["metrics_bytes"].as_u64().unwrap() <= HEALTH_METRICS_BUDGET_BYTES as u64);
+        let findings = serde_json::to_value(cache.findings(1_000_000, 60_000)).unwrap();
+        assert!(findings.as_array().unwrap().is_empty(), "{findings}");
+
+        // A failure beyond the rendered roots must not disappear with their detail.
+        let mut rollup = (*cache.snapshot().0).clone();
+        let hidden = rollup.findings_metrics["roots"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .position(|root| {
+                !rollup.metrics["roots"]
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .any(|shown| shown["project_root"] == root["project_root"])
+            })
+            .unwrap();
+        rollup.findings_metrics["roots"][hidden]["diagnostics_evidence"]["database_open_failed"] =
+            json!(true);
+        cache.publish(Some(rollup));
+        let findings = serde_json::to_value(cache.findings(1_000_000, 60_000)).unwrap();
+        assert_eq!(findings.as_array().unwrap().len(), 1, "{findings}");
+        assert_eq!(findings[0]["check"], "database_open");
+    }
+
     #[test]
     fn rollup_allocator_both_surfaces_share_one_measurement() {
         let cache = HealthRollupCache::new();
@@ -8230,6 +8521,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn health_report_exposes_unconfigured_binding_refusal_counter() {
+        let executor = Executor::new();
+        let metrics = DispatchPathMetrics::new();
+        let app = App::default_shared();
+        let report = build_health_report(
+            &HealthRollupCache::new(),
+            &executor,
+            &HashMap::new(),
+            &metrics,
+            &app,
+        );
+        assert!(report.metrics.expect("health metrics")["gh_speech"]
+            ["unconfigured_binding_refusals_total"]
+            .is_u64());
+    }
+
+    #[test]
+    fn health_report_exposes_full_sync_fallbacks() {
+        let before = aft_store::sync::full_sync_fallbacks();
+        let report = build_health_report(
+            &HealthRollupCache::new(),
+            &Executor::new(),
+            &HashMap::new(),
+            &DispatchPathMetrics::new(),
+            &App::default_shared(),
+        );
+        let metrics = report.metrics.expect("health metrics");
+        let fallbacks = metrics["full_sync_fallbacks"]
+            .as_u64()
+            .expect("fallback count");
+        assert!(fallbacks >= before);
+        #[cfg(not(target_os = "macos"))]
+        assert_eq!(fallbacks, 0);
+    }
+
     #[test]
     fn health_report_lists_stopped_routes() {
         let executor = Executor::new();
@@ -8605,7 +8932,8 @@ mod tests {
             let detail = report.detail.clone().expect("a degraded detail");
             let metrics = report.metrics.expect("health metrics");
 
-            let named = root_count.min(HEALTH_DATA_STORE_FAILED_NAMED);
+            let named = metrics["data_store_failed"].as_array().unwrap().len();
+            assert!(named <= root_count.min(HEALTH_DATA_STORE_FAILED_NAMED));
             assert_eq!(metrics["data_store_failed_roots"], json!(root_count));
             assert_eq!(
                 metrics["data_store_failed"],
@@ -8639,13 +8967,14 @@ mod tests {
                 names.len() <= HEALTH_DATA_STORE_FAILED_DETAIL_BYTES,
                 "{names}"
             );
-            let expected = paths[..named]
+            let detail_named = root_count.min(HEALTH_DATA_STORE_FAILED_NAMED);
+            let expected = paths[..detail_named]
                 .iter()
                 .map(|path| format!("{path} (bind_failed)"))
                 .collect::<Vec<_>>()
                 .join(", ");
-            let tail = if root_count > named {
-                format!(" and {} more", root_count - named)
+            let tail = if root_count > detail_named {
+                format!(" and {} more", root_count - detail_named)
             } else {
                 String::new()
             };
@@ -8681,6 +9010,55 @@ mod tests {
         assert_eq!(semantic["query_embed_p50_ms"], 200);
     }
 
+    #[test]
+    fn semantic_backend_planned_pause_is_information_but_does_not_hide_outages() {
+        let executor = Executor::new();
+        let (dir, root) = test_root("semantic-planned-pause-health");
+        let ctx = Arc::new(AppContext::new(
+            Box::new(crate::parser::TreeSitterProvider::new()),
+            crate::config::Config {
+                storage_dir: Some(dir.path().join("storage")),
+                project_root: Some(root.as_path().into()),
+                ..crate::config::Config::default()
+            },
+        ));
+        ctx.set_canonical_cache_root(root.as_path().to_path_buf());
+        let until = crate::semantic_index::unix_millis_now() + 1_399_000;
+        crate::synapse_embed::share_lane_pause(
+            root.as_path(),
+            &crate::synapse_embed::LanePause {
+                lane_id: "health-planned-lane".into(),
+                fingerprint: None,
+                retry_after_ms: Some(1_399_000),
+                paused_until_ms: until,
+                reason: "Neural Engine maintenance".into(),
+                cause: crate::synapse_embed::PauseCause::LanePaused,
+                safe_to_retry_same_request: true,
+                record_id: 0,
+            },
+        );
+        assert!(executor.register_actor(root, ctx));
+        let app = App::default_shared();
+        let cache = HealthRollupCache::new();
+        let report = refresh_until_root_count(&cache, &executor, &app, 1)
+            .metrics
+            .unwrap();
+        assert_eq!(report["embedding_backend"]["available"], false);
+        assert_eq!(report["embedding_backend"]["state"], "paused");
+        assert_eq!(report["embedding_backend"]["pause_cause"], "lane_paused");
+        assert_eq!(report["embedding_backend"]["paused_until_ms"], until);
+
+        let (_outage_dir, outage_root) = test_root("semantic-outage-with-pause-health");
+        let outage = test_ctx();
+        outage.trip_semantic_refresh_circuit(1, "connection refused");
+        assert!(executor.register_actor(outage_root, outage));
+        let report = refresh_until_root_count(&cache, &executor, &app, 2)
+            .metrics
+            .unwrap();
+        assert_eq!(report["embedding_backend"]["state"], "backend_unavailable");
+        assert!(report["embedding_backend"]["pause_cause"].is_null());
+    }
+
     #[test]
     fn semantic_backend_outage_is_distinct_per_root_and_aggregated_once() {
         let executor = Executor::new();
@@ -8916,6 +9294,33 @@ mod tests {
         );
     }
 
+    #[test]
+    fn manifest_sync_health_stays_inside_existing_budget() {
+        let sync = crate::gh_shim::manifest_sync::health();
+        for key in [
+            "active_version",
+            "newest_version_seen",
+            "last_report",
+            "last_report_outcome",
+            "last_refusal_code",
+        ] {
+            assert!(sync.get(key).is_some(), "missing manifest sync field {key}");
+        }
+        let mut metrics = json!({
+            "manifest_sync": sync,
+            "roots": (0..100).map(|i| json!({
+                "project_root": format!("/workspace/{i}/{}", "long-path".repeat(20)),
+                "health": "ready"
+            })).collect::<Vec<_>>()
+        })
+        .as_object()
+        .unwrap()
+        .clone();
+        budget_health_metrics(&mut metrics);
+        assert_eq!(metrics["manifest_sync"], sync);
+        assert!(encoded_health_metrics_len(&metrics) <= HEALTH_METRICS_BUDGET_BYTES);
+    }
+
     #[test]
     fn budgeted_health_metrics_fit_subc_headroom_with_many_roots() {
         let long_segment = "root-segment".repeat(18);
diff --git a/crates/aft/src/subc/manifest.rs b/crates/aft/src/subc/manifest.rs
index a4a5bcb9af..8eb29565d0 100644
--- a/crates/aft/src/subc/manifest.rs
+++ b/crates/aft/src/subc/manifest.rs
@@ -911,6 +911,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn broca_scope_background_advertisement_and_harness_parse_ship_together() {
+        use crate::harness::Harness;
+        use std::str::FromStr;
+
+        // Broca sends the harness name `broca` only when the module manifest
+        // provides scope-background-tasks/v1. Advertising it without accepting
+        // that harness name would make every Broca bind be refused.
+        let manifest = build_manifest_for_host(true);
+        assert!(manifest
+            .capabilities
+            .as_ref()
+            .expect("capabilities")
+            .provides
+            .iter()
+            .any(|capability| capability == "scope-background-tasks/v1"));
+        assert_eq!(Harness::from_str("broca"), Ok(Harness::Runner));
+    }
+
     /// A session starter finds tool providers by this catalog field, so a
     /// manifest without it leaves every worker without a plan or preset.
     #[test]
diff --git a/crates/aft/src/subc/mod.rs b/crates/aft/src/subc/mod.rs
index aca41bbf27..eeff255474 100644
--- a/crates/aft/src/subc/mod.rs
+++ b/crates/aft/src/subc/mod.rs
@@ -245,7 +245,8 @@ pub(crate) use secret_consent::with_secret_bound_identity_for_test;
 #[cfg(test)]
 pub(crate) use secret_consent::with_secret_identity_for_test;
 pub(crate) use secret_consent::{
-    current_call_scopes, current_secret_audit_scope, resolve_current_secret_label, LaunchDecision,
+    current_call_scopes, current_fetch_reply_deadline, current_secret_audit_scope,
+    current_secret_consent_context, use_current_secret_labels, LaunchDecision,
 };
 mod standalone;
 #[doc(hidden)]
@@ -5462,6 +5463,7 @@ where
         crate::gh_shim_worker_broker::install(Arc::clone(&gh_relay));
     // Stamped workers' permission asks go to Cingulate over this daemon.
     consent::install_subc_transport(connection_file_path);
+    let _manifest_sync = crate::gh_shim::manifest_sync::start(connection_file_path.to_path_buf());
     // Withdraw the macOS access cards earlier builds filed. It runs beside the
     // route loop, never before it: each withdrawal waits on Cingulate, and a
     // slow or absent Cingulate must not delay route binds.
@@ -10730,6 +10732,7 @@ impl PlainToolRun {
         }
         let run_spec = self.clone();
         let runtime = tokio::runtime::Handle::current();
+        let secret_scopes = Some(secret_consent::call_scopes(&self.identity));
         Box::new(move |ctx| {
             let PlainToolRun {
                 progress,
@@ -10791,6 +10794,10 @@ impl PlainToolRun {
                 io_budget
             };
             let _io = crate::bounded_io::enter(Some(io_budget.clone()));
+            let _fetch_deadline = secret_consent::FetchReplyDeadline::enter(reply_deadline);
+            let _secret_scope = secret_consent::SecretScopeGuard::install(secret_scopes);
+            let _secret_identity =
+                secret_consent::SecretIdentityGuard::install(identity_for_run.clone());
             // Translation resolves tool paths before dispatch. Keep the agent's
             // spelling for messages about folders a walk could not read, without
             // changing the translated paths.
@@ -12294,8 +12301,10 @@ async fn handle_tool_call_with_capabilities(
         // reads them through `SecretScopeGuard`, so a background command keeps
         // them for its whole life.
         let secret_scopes = Some(secret_consent::call_scopes(&identity_for_run));
+        let fetch_reply_deadline = reply_budget.deadline;
         let job: crate::executor::ExecutorJob = Box::new(move |ctx| {
             let _io = crate::bounded_io::enter(Some(io_budget.clone()));
+            let _fetch_deadline = secret_consent::FetchReplyDeadline::enter(fetch_reply_deadline);
             let _deferred_wake_scope = completion_wake.install();
             let _secret_scope = secret_consent::SecretScopeGuard::install(secret_scopes.clone());
             let _secret_identity =
@@ -14628,10 +14637,13 @@ pub(crate) mod test_support {
             .bash_background()
             .spawn(
                 crate::sandbox_spawn::SpawnPlan::Unsandboxed,
-                if case == "completion" {
-                    "while [ ! -f exit-ready ]; do sleep 0.05; done; echo terminal"
+                &if case == "completion" {
+                    format!(
+                        "{}; echo terminal",
+                        crate::test_gate::gate("exit-ready", "sleep 0.05")
+                    )
                 } else {
-                    "sleep 30"
+                    "sleep 30".to_string()
                 },
                 "polled-bash-session".into(),
                 dir.path().to_path_buf(),
diff --git a/crates/aft/src/subc/runner_head_background_tests.rs b/crates/aft/src/subc/runner_head_background_tests.rs
index 11e6752222..3317bcc800 100644
--- a/crates/aft/src/subc/runner_head_background_tests.rs
+++ b/crates/aft/src/subc/runner_head_background_tests.rs
@@ -1,8 +1,8 @@
-//! A `background` bash launch by a head agent on one of Thalamus's runners
-//! answers at once with its task id, and the task's completion reaches that
-//! head's route later as a notice. Every other server-owned call (a Broca
-//! head, any worker, any other carrier) and every foreground call keeps
-//! holding until its command ends.
+//! A `background` bash launch by a top-level (head) agent on one of Thalamus's
+//! runners answers at once with its task id, and the task's completion reaches that
+//! head's route later as a notice. Other server-owned background calls and
+//! every foreground call keep holding until their commands end. PTY launches
+//! always answer at once so any caller can drive its interactive command.
 
 use super::super::test_support::*;
 use super::*;
@@ -93,8 +93,11 @@ impl Fixture {
     /// A command that runs until [`Self::release`] is called with `name`.
     fn blocked_command(&self, name: &str) -> String {
         format!(
-            "while [ ! -f '{}' ]; do sleep 0.05; done; echo released",
-            self.release_path(name).display()
+            "{}; echo released",
+            crate::test_gate::gate(
+                &format!("'{}'", self.release_path(name).display()),
+                "sleep 0.05"
+            )
         )
     }
 
@@ -372,6 +375,67 @@ async fn thalamus_harness_pi_head_background_answers_at_once_and_sends_a_notice(
     assert_runner_head_background_hands_back("reserved:thalamus-harness", "pi").await;
 }
 
+async fn assert_pty_launch_hands_back(principal: &str, harness: &str, kind: &str, worker: bool) {
+    let fixture = Fixture::new("pty-launch-handback");
+    let route = v1_route(&fixture.root, principal, harness, kind);
+    let received = fixture.release_path("received-input");
+    let (mut replies, cancel) = fixture.call(
+        &route,
+        worker,
+        json!({
+            "command": format!(
+                "IFS= read -r line; printf '%s' \"$line\" > '{}'",
+                received.display()
+            ),
+            "pty": true,
+            "timeout": 60_000,
+        }),
+    );
+    // The command needs stdin to finish, so only a launch reply can arrive
+    // before bash_write supplies the input.
+    let reply = reply_within(&mut replies, Duration::from_millis(750)).await;
+    let response = reply.response_for_test();
+    assert!(response.success, "{response:?}");
+    assert_eq!(response.data["status"], "running", "{response:?}");
+    assert_eq!(response.data["mode"], "pty", "{response:?}");
+    assert!(reply
+        .text_for_test()
+        .unwrap()
+        .starts_with("PTY task started:"));
+    let task_id = response.data["task_id"].as_str().unwrap();
+    assert_eq!(fixture.status(task_id), BgTaskStatus::Running);
+
+    cancel.route.cancel();
+    cancel.connection.cancel();
+    let request: crate::protocol::RawRequest = serde_json::from_value(json!({
+        "id": "pty-input",
+        "command": "bash_write",
+        "session_id": SESSION,
+        "params": {"task_id": task_id, "input": "interactive-input\n"},
+    }))
+    .unwrap();
+    let write = crate::commands::bash_write::handle(&request, &fixture.ctx);
+    assert!(write.success, "{write:?}");
+    assert_eq!(write.data["bytes_written"], 18);
+    fixture.wait_terminal(task_id).await;
+    assert_eq!(fixture.status(task_id), BgTaskStatus::Completed);
+    assert_eq!(
+        std::fs::read_to_string(received).unwrap(),
+        "interactive-input"
+    );
+    assert!(replies.try_recv().is_err(), "the call answers exactly once");
+}
+
+#[tokio::test]
+async fn broca_worker_pty_launch_answers_at_once_and_accepts_input() {
+    assert_pty_launch_hands_back("reserved:broca", "broca", "worker", true).await;
+}
+
+#[tokio::test]
+async fn runner_head_pty_launch_answers_at_once_and_accepts_input() {
+    assert_pty_launch_hands_back("reserved:thalamus-harness", "opencode2", "head", false).await;
+}
+
 /// The completion of a runner head's handed-back task goes to routes with
 /// the same launching identity only: another route for the same session id,
 /// such as the OpenCode plugin's or another runner's, never receives it.
diff --git a/crates/aft/src/subc/secret_consent.rs b/crates/aft/src/subc/secret_consent.rs
index 79581bd0aa..4fb3cf95bd 100644
--- a/crates/aft/src/subc/secret_consent.rs
+++ b/crates/aft/src/subc/secret_consent.rs
@@ -5,7 +5,7 @@
 //! route policy instead of in the route-agnostic `crate::secret` types.
 //!
 //! A call is eligible in exactly three forms, and every other call is
-//! ineligible and never reaches `resolve`:
+//! ineligible and never asks the vault:
 //!
 //! 1. **Direct Head**: a Classic call whose route carries the head agent's own
 //!    stamp. Both scopes are that stamp.
@@ -27,10 +27,10 @@
 use super::{carrier_read_only, flow_read, tool_provider, RouteIdentity};
 use crate::secret::eligibility::{alfonso_of_kind, COMMAND_SCOPE_KINDS};
 #[cfg(test)]
-use crate::secret::withhold_consent;
+use crate::secret::{file_consent, withhold_consent};
 use crate::secret::{
-    file_consent, CallScopes, ConsentOutcome, EligibilityForm, Ineligibility, LabelOutcome,
-    Resolution, SecretConsentRequest, SecretScope,
+    CallScopes, ConsentOutcome, EligibilityForm, Ineligibility, LabelOutcome, SecretConsentRequest,
+    SecretScope,
 };
 use std::sync::Arc;
 use std::time::Duration;
@@ -40,19 +40,54 @@ use subc_protocol::scope::ScopeKind;
 use subc_protocol::scope::ScopeStamp;
 
 const SECRET_CONSENT_TIMEOUT: Duration = Duration::from_secs(10);
+const SECRET_AWAIT_CAP: Duration = Duration::from_secs(120);
+const SECRET_PENDING_BACKOFF: Duration = Duration::from_millis(50);
 
-/// Use the same scoped daemon connection and reserved AFT filer as permission
-/// asks. The production vault remains the fail-closed stand-in.
+thread_local! {
+    static FETCH_REPLY_DEADLINE: std::cell::Cell<Option<std::time::Instant>> = const { std::cell::Cell::new(None) };
+}
+
+/// The caller's reply deadline is independent of a fetch's network budget.
+pub(super) struct FetchReplyDeadline(Option<std::time::Instant>);
+impl FetchReplyDeadline {
+    pub(super) fn enter(deadline: std::time::Instant) -> Self {
+        Self(FETCH_REPLY_DEADLINE.with(|slot| slot.replace(Some(deadline))))
+    }
+}
+impl Drop for FetchReplyDeadline {
+    fn drop(&mut self) {
+        FETCH_REPLY_DEADLINE.with(|slot| slot.set(self.0));
+    }
+}
+pub(crate) fn current_fetch_reply_deadline() -> Option<std::time::Instant> {
+    FETCH_REPLY_DEADLINE.with(std::cell::Cell::get)
+}
+
+/// Use the daemon connection that files filesystem-access questions with
+/// Cingulate as its reserved AFT module principal. Retain each secret card's id
+/// so a held call waits for the existing card instead of filing another.
 pub(super) fn install_subc_transport(transport: Arc<dyn super::consent::ConsentTransport>) {
     crate::secret::consent::install_transport(Some(Arc::new(SubcSecretConsent {
         transport,
         runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
     })));
 }
 
 struct SubcSecretConsent {
     transport: Arc<dyn super::consent::ConsentTransport>,
     runtime: tokio::runtime::Handle,
+    cards: tokio::sync::Mutex<
+        std::collections::HashMap<(SecretScope, String), Arc<tokio::sync::Mutex<Card>>>,
+    >,
+}
+
+struct Card {
+    created: std::time::Instant,
+    statement: String,
+    elicitation: Option<String>,
+    answered: Option<ConsentOutcome>,
+    warned_unreadable: bool,
 }
 
 fn consent_unavailable(detail: &str) -> ConsentOutcome {
@@ -72,16 +107,43 @@ fn decode_secret_elicitation(result: &serde_json::Value) -> Option<&str> {
         .filter(|id| id.starts_with("el_") && id.len() > 3)
 }
 
-fn decode_secret_record(record: &serde_json::Value) -> ConsentOutcome {
+fn decode_secret_record(record: &serde_json::Value, request_id: &str) -> ConsentOutcome {
     if record.get("kind").and_then(serde_json::Value::as_str) != Some("secret_use") {
         return consent_unavailable("Cingulate did not return a secret-use card");
     }
     match record.get("state").and_then(serde_json::Value::as_str) {
         Some("pending") => ConsentOutcome::Pending,
-        // The answer is only a cue to retry the vault, never a grant or denial
-        // to apply locally. In particular, a decline also retries secret.use.
-        Some("answered") => ConsentOutcome::Answered,
-        Some("expired") => consent_unavailable("the secret-use card ended without an answer"),
+        Some("answered") => {
+            let answer = &record["secret_use_answer"];
+            let decision = if let Some(items) = answer.get("items") {
+                let Some(items) = items.as_array() else {
+                    return ConsentOutcome::Indeterminate;
+                };
+                let mut matching = items
+                    .iter()
+                    .filter(|item| item["request_id"].as_str() == Some(request_id));
+                let decision = matching.next().and_then(|item| item["decision"].as_str());
+                if matching.next().is_some() {
+                    return ConsentOutcome::Indeterminate;
+                }
+                decision
+            } else {
+                answer["decision"].as_str()
+            };
+            if decision == Some("allow") {
+                if answer["duration"].as_str() == Some("once") {
+                    ConsentOutcome::AnsweredOnce
+                } else {
+                    ConsentOutcome::Answered
+                }
+            } else if decision == Some("decline") {
+                ConsentOutcome::Declined
+            } else {
+                ConsentOutcome::Indeterminate
+            }
+        }
+        Some("expired") => ConsentOutcome::Expired,
+        Some("withdrawn") => ConsentOutcome::Cancelled,
         _ => consent_unavailable("Cingulate returned an unknown secret-use card state"),
     }
 }
@@ -114,42 +176,209 @@ impl SubcSecretConsent {
             })?
     }
 
-    async fn file(&self, request: &SecretConsentRequest) -> ConsentOutcome {
-        // Cingulate deduplicates the exact ordered items for this filer. Refile
-        // unchanged to recover the same card across retries or a lost reply,
-        // without refreshing its deadline or introducing a local idempotency key.
-        let filed = match self
+    async fn file(&self, request: &SecretConsentRequest, hold: Duration) -> ConsentOutcome {
+        self.file_cancellable(request, hold, None).await
+    }
+
+    async fn recover_lost_filing(
+        &self,
+        request: &SecretConsentRequest,
+        params: serde_json::Value,
+        card: &mut Card,
+        cancel: Option<&crate::secret::consent::Cancellation>,
+    ) -> ConsentOutcome {
+        if cancel.is_some_and(|cancel| cancel.is_cancelled()) {
+            // An unknown card id cannot be withdrawn. Never create or replay
+            // an ask after cancellation; its request-bounded expiry is the
+            // backstop for a card whose filing reply was lost.
+            card.answered = Some(ConsentOutcome::Cancelled);
+            return ConsentOutcome::Cancelled;
+        }
+        // Cingulate deduplicates an identical secret_use body under the same
+        // stamped scope, including its epoch. Recover its id once, then withdraw
+        // rather than leaving an unobserved card able to approve a lost caller.
+        let recovered = self
+            .call(request, "consent.request", params, SECRET_CONSENT_TIMEOUT)
+            .await;
+        let id = recovered
+            .as_ref()
+            .ok()
+            .and_then(decode_secret_elicitation)
+            .map(str::to_owned);
+        let Some(id) = id else {
+            crate::slog_warn!("secret consent filing recovery failed");
+            return consent_unavailable("Cingulate could not file the secret-use card");
+        };
+        card.elicitation = Some(id.clone());
+        card.answered = Some(ConsentOutcome::Cancelled);
+        if self
             .call(
                 request,
-                "consent.request",
-                crate::secret::request_params(request),
+                "consent.withdraw",
+                serde_json::json!({"elicitation_id": id}),
                 SECRET_CONSENT_TIMEOUT,
             )
             .await
+            .is_err()
         {
-            Ok(filed) => filed,
-            Err(_) => return consent_unavailable("Cingulate could not file the secret-use card"),
-        };
-        let Some(id) = decode_secret_elicitation(&filed) else {
-            return consent_unavailable("Cingulate did not return a secret-use card id");
+            crate::slog_warn!("secret consent withdrawal failed");
+        }
+        ConsentOutcome::Cancelled
+    }
+
+    async fn file_cancellable(
+        &self,
+        request: &SecretConsentRequest,
+        hold: Duration,
+        cancel: Option<&crate::secret::consent::Cancellation>,
+    ) -> ConsentOutcome {
+        let card = {
+            let mut cards = self.cards.lock().await;
+            cards.retain(|_, card| {
+                Arc::strong_count(card) > 1
+                    || card
+                        .try_lock()
+                        .is_ok_and(|card| card.created.elapsed() < Duration::from_secs(600))
+            });
+            cards
+                .entry((request.scope.clone(), request.request_id.clone()))
+                .or_insert_with(|| {
+                    Arc::new(tokio::sync::Mutex::new(Card {
+                        created: std::time::Instant::now(),
+                        statement: request.statement_b64url.clone(),
+                        elicitation: None,
+                        answered: None,
+                        warned_unreadable: false,
+                    }))
+                })
+                .clone()
         };
-        let hold = super::consent::hold_budget(None);
-        match self
+        let mut card = card.lock().await;
+        if card.statement != request.statement_b64url {
+            return consent_unavailable("Cingulate could not file the secret-use card");
+        }
+        if let Some(answer) = &card.answered {
+            return answer.clone();
+        }
+        if card.elicitation.is_none() {
+            if cancel.is_some_and(|cancel| cancel.is_cancelled()) {
+                card.answered = Some(ConsentOutcome::Cancelled);
+                return ConsentOutcome::Cancelled;
+            }
+            // Reserve the failure before filing so a failed bounded recovery is
+            // terminal in this cache and cannot start another recovery loop.
+            card.answered = Some(consent_unavailable(
+                "Cingulate could not file the secret-use card",
+            ));
+            let params = crate::secret::request_params(request);
+            let filed = match self
+                .call(
+                    request,
+                    "consent.request",
+                    params.clone(),
+                    SECRET_CONSENT_TIMEOUT,
+                )
+                .await
+            {
+                Ok(filed) => filed,
+                Err(super::consent::ConsentError::Unavailable(_)) => {
+                    return self
+                        .recover_lost_filing(request, params, &mut card, cancel)
+                        .await
+                }
+                Err(_) => {
+                    return consent_unavailable("Cingulate could not file the secret-use card")
+                }
+            };
+            let Some(id) = decode_secret_elicitation(&filed) else {
+                return self
+                    .recover_lost_filing(request, params, &mut card, cancel)
+                    .await;
+            };
+            card.elicitation = Some(id.to_owned());
+            card.answered = None;
+        }
+        let await_card = self
             .call(
                 request,
                 "consent.await",
-                serde_json::json!({"elicitation_id": id, "timeout_ms": hold.as_millis() as u64}),
-                hold + SECRET_CONSENT_TIMEOUT,
-            )
-            .await
-        {
-            Ok(record) => decode_secret_record(&record),
+                serde_json::json!({"elicitation_id": card.elicitation, "timeout_ms": hold.min(SECRET_AWAIT_CAP).as_millis() as u64}),
+                hold.min(SECRET_AWAIT_CAP) + SECRET_CONSENT_TIMEOUT,
+            );
+        let cancelled = async {
+            match cancel {
+                Some(cancel) => cancel.cancelled().await,
+                None => std::future::pending::<()>().await,
+            }
+        };
+        let response = tokio::select! {
+            biased;
+            () = cancelled => {
+                let result = self.call(request, "consent.withdraw", serde_json::json!({"elicitation_id": card.elicitation}), SECRET_CONSENT_TIMEOUT).await;
+                if result.is_err() {
+                    crate::slog_warn!("secret consent withdrawal failed");
+                }
+                card.answered = Some(ConsentOutcome::Cancelled);
+                return ConsentOutcome::Cancelled;
+            },
+            response = await_card => response,
+        };
+        let outcome = match response {
+            Ok(record) => {
+                let outcome = decode_secret_record(&record, &request.request_id);
+                if outcome == ConsentOutcome::Indeterminate && !card.warned_unreadable {
+                    card.warned_unreadable = true;
+                    // Peer decision text is untrusted and can contain a key.
+                    // Fingerprint its value instead of copying it into logs.
+                    use sha2::{Digest, Sha256};
+                    let value = zeroize::Zeroizing::new(
+                        serde_json::to_vec(&record["secret_use_answer"]).unwrap_or_default(),
+                    );
+                    crate::slog_warn!(
+                        "unreadable secret consent answer: card={} decision_sha256={:x}",
+                        card.elicitation.as_deref().unwrap_or("unknown"),
+                        Sha256::digest(&*value)
+                    );
+                }
+                outcome
+            }
             Err(_) => consent_unavailable("Cingulate could not settle the secret-use card"),
+        };
+        if matches!(
+            outcome,
+            ConsentOutcome::Answered
+                | ConsentOutcome::AnsweredOnce
+                | ConsentOutcome::Declined
+                | ConsentOutcome::Expired
+                | ConsentOutcome::Cancelled
+        ) {
+            card.answered = Some(outcome.clone());
+        }
+        if cancel.is_some() && matches!(outcome, ConsentOutcome::Unavailable { .. }) {
+            // An unsuccessful await still leaves a live phone card. Withdraw it
+            // before returning an error, using the same authorization scope as consent.request.
+            if self
+                .call(
+                    request,
+                    "consent.withdraw",
+                    serde_json::json!({"elicitation_id": card.elicitation}),
+                    SECRET_CONSENT_TIMEOUT,
+                )
+                .await
+                .is_err()
+            {
+                crate::slog_warn!("secret consent withdrawal failed");
+            }
+            // A known id means the card was filed for the person. A failed
+            // await is cancellation, never evidence of a decline or expiry.
+            card.answered = Some(ConsentOutcome::Cancelled);
+            return ConsentOutcome::Cancelled;
         }
+        outcome
     }
 
-    fn dispatch(&self, request: &SecretConsentRequest) -> ConsentOutcome {
-        let future = self.file(request);
+    fn dispatch(&self, request: &SecretConsentRequest, hold: Duration) -> ConsentOutcome {
+        let future = self.file(request, hold);
         match tokio::runtime::Handle::try_current() {
             Ok(current)
                 if current.runtime_flavor() == tokio::runtime::RuntimeFlavor::MultiThread =>
@@ -163,15 +392,84 @@ impl SubcSecretConsent {
 }
 
 impl crate::secret::SecretConsentTransport for SubcSecretConsent {
+    fn runtime(&self) -> Option<tokio::runtime::Handle> {
+        Some(self.runtime.clone())
+    }
+
+    fn wait(
+        self: Arc<Self>,
+        request: SecretConsentRequest,
+        cancel: crate::secret::consent::Cancellation,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = ConsentOutcome> + Send>> {
+        Box::pin(async move {
+            let mut request = request;
+            let expires = request
+                .expires_at_ms
+                .unwrap_or(u64::MAX)
+                .min(crate::secret::vault::now_ms().saturating_add(600_000));
+            request.expires_at_ms = Some(expires);
+            loop {
+                let now = crate::secret::vault::now_ms();
+                if now >= expires {
+                    cancel.cancel();
+                }
+                let outcome = self
+                    .file_cancellable(
+                        &request,
+                        Duration::from_millis(expires.saturating_sub(now)).min(SECRET_AWAIT_CAP),
+                        Some(&cancel),
+                    )
+                    .await;
+                if outcome != ConsentOutcome::Pending {
+                    return outcome;
+                }
+                // Re-await the same card, but a service that returns pending
+                // early must not turn a held request into a tight polling loop.
+                let delay = SECRET_PENDING_BACKOFF.min(Duration::from_millis(
+                    expires.saturating_sub(crate::secret::vault::now_ms()),
+                ));
+                tokio::select! {
+                    biased;
+                    () = cancel.cancelled() => {},
+                    () = tokio::time::sleep(delay) => {},
+                }
+            }
+        })
+    }
     fn file(&self, request: &SecretConsentRequest) -> ConsentOutcome {
-        self.dispatch(request)
+        self.dispatch(request, super::consent::hold_budget(None))
+    }
+
+    fn hold(
+        &self,
+        request: &SecretConsentRequest,
+        cancel: &crate::secret::consent::Cancellation,
+    ) -> ConsentOutcome {
+        let future = self.file_cancellable(request, Duration::from_secs(600), Some(cancel));
+        match tokio::runtime::Handle::try_current() {
+            Ok(current)
+                if current.runtime_flavor() == tokio::runtime::RuntimeFlavor::MultiThread =>
+            {
+                tokio::task::block_in_place(|| self.runtime.block_on(future))
+            }
+            Ok(_) => consent_unavailable("secret consent cannot block a single-threaded runtime"),
+            Err(_) => self.runtime.block_on(future),
+        }
     }
 
-    fn withhold(&self, _request: &SecretConsentRequest) -> ConsentOutcome {
-        // Cingulate has not published a withdrawal method for secret_use cards
-        // yet. Do not send the filesystem permission method; the vault still
-        // governs release and the card's original deadline is unchanged.
-        consent_unavailable("secret-use card withdrawal is not supported")
+    fn withhold(&self, request: &SecretConsentRequest) -> ConsentOutcome {
+        let cancel = crate::secret::consent::Cancellation::default();
+        cancel.cancel();
+        let future = self.file_cancellable(request, Duration::ZERO, Some(&cancel));
+        match tokio::runtime::Handle::try_current() {
+            Ok(current)
+                if current.runtime_flavor() == tokio::runtime::RuntimeFlavor::MultiThread =>
+            {
+                tokio::task::block_in_place(|| self.runtime.block_on(future))
+            }
+            Ok(_) => consent_unavailable("secret consent cannot block a single-threaded runtime"),
+            Err(_) => self.runtime.block_on(future),
+        }
     }
 }
 
@@ -290,6 +588,7 @@ fn bound_codemode(
 /// A launch outcome that may end the call with `access_pending`, carrying
 /// the ask it needs answered.
 #[derive(Clone, Debug, PartialEq, Eq)]
+#[cfg(test)]
 pub(crate) struct PendingSecretConsent {
     /// The ask filed under the authorization scope.
     pub(super) request: SecretConsentRequest,
@@ -299,6 +598,7 @@ pub(crate) struct PendingSecretConsent {
     pub(crate) message: &'static str,
 }
 
+#[cfg(test)]
 pub(super) enum SecretConsentFiling {
     Answered,
     Pending(PendingSecretConsent),
@@ -310,6 +610,7 @@ pub(super) enum SecretConsentFiling {
 /// A filing failure or expired card ends the call with `access_unavailable`;
 /// a pending card holds it with `access_pending`. An answer only tells the
 /// launch to ask the vault again before starting any child, job or proxy.
+#[cfg(test)]
 pub(super) fn file_secret_consent(
     identity: &RouteIdentity,
     scopes: &CallScopes,
@@ -324,11 +625,18 @@ pub(super) fn file_secret_consent(
         label: label.to_string(),
         request_id: request_id.to_string(),
         statement_b64url: statement_b64url.to_string(),
+        expires_at_ms: None,
     };
     match file_consent(&request) {
         // No usable card or answer: nothing is held, nothing starts.
-        ConsentOutcome::Unavailable { .. } => Err(crate::secret::SECRET_ACCESS_UNAVAILABLE),
-        ConsentOutcome::Answered => Ok(SecretConsentFiling::Answered),
+        ConsentOutcome::Unavailable { .. }
+        | ConsentOutcome::Declined
+        | ConsentOutcome::Expired
+        | ConsentOutcome::Indeterminate
+        | ConsentOutcome::Cancelled => Err(crate::secret::SECRET_ACCESS_UNAVAILABLE),
+        ConsentOutcome::Answered | ConsentOutcome::AnsweredOnce => {
+            Ok(SecretConsentFiling::Answered)
+        }
         ConsentOutcome::Pending => Ok(SecretConsentFiling::Pending(PendingSecretConsent {
             request,
             label: label.to_string(),
@@ -346,37 +654,48 @@ pub(super) fn withdraw_secret_consent(pending: &PendingSecretConsent) {
     let _ = withhold_consent(&pending.request);
 }
 
-/// What one launch decided for one label, before anything starts.
-#[derive(Clone, Debug, PartialEq, Eq)]
+/// Result of the fetch's addressed vault call, before sending upstream.
+#[derive(Debug)]
 pub(crate) enum LaunchDecision {
-    /// The label may be used: the rule to follow and the grant to ask for
-    /// material with.
-    Proceed {
-        /// The label's rule, as the vault resolved it.
-        rule: secret_rules::location::LabelRule,
-        /// The grant the material call names.
-        grant_id: String,
-        expires_at_ms: u64,
-    },
-    /// The launch is held until the user answers the filed ask.
+    Proceed(crate::secret::UseAnswer),
+    #[cfg(test)]
     Pending(PendingSecretConsent),
-    /// The launch ends with this outcome, whose code names the reason.
     Refuse(LabelOutcome),
+    InvalidPlan(&'static str),
 }
 
-/// Resolve one scanned label for the launch on `identity`: the one entry a
-/// bash or fetch launch calls for each label it found in the command text.
-///
-/// The order is the outcome table's: an ineligible scope refuses with
-/// `secret_refused` before the vault is asked anything, then resolution decides
-/// between proceeding, holding the call for consent, and refusing. A label the
-/// vault needs an answer for files one consent ask under the call's
-/// authorization scope. An answer retries the vault immediately; a pending
-/// card holds the launch until the caller retries. Neither answer grants here.
-pub(crate) fn resolve_label_for_launch(
+fn fetch_consent_refusal(
+    label: &str,
+    host: &str,
+    reason: crate::secret::requests::UseError,
+    held: &crate::url_fetch::HeldKeys,
+) -> LabelOutcome {
+    use crate::secret::requests::UseError;
+    if matches!(reason, UseError::Indeterminate) {
+        let outcome = crate::secret::outcome_for(label, &crate::secret::UseAnswer::Unavailable);
+        return match outcome {
+            LabelOutcome::Refuse { code, message } => LabelOutcome::Refuse {
+                code,
+                message: held.sanitize_detail(&message),
+            },
+            other => other,
+        };
+    }
+    let message = crate::secret::requests::consent_failure_message(label, host, reason);
+    LabelOutcome::Refuse {
+        code: crate::secret::SECRET_ACCESS_UNAVAILABLE,
+        message: held.sanitize_detail(&message),
+    }
+}
+
+/// Fetch tools already know the target. Check eligibility before asking once,
+/// then use the existing held-call consent path if approval is required.
+#[cfg(test)]
+pub(crate) fn use_label_for_fetch(
     identity: &RouteIdentity,
     vault: &dyn crate::secret::SecretVault,
     label: &str,
+    target: &crate::secret::ApiKeyTarget,
 ) -> LaunchDecision {
     let (scopes, _) = match call_scopes(identity) {
         Ok(scopes) => scopes,
@@ -384,8 +703,6 @@ pub(crate) fn resolve_label_for_launch(
             return LaunchDecision::Refuse(crate::secret::refuse_ineligible(label, reason))
         }
     };
-    // Some vault adapters transiently receive material even at resolution.
-    // Harden here as well as at proxy startup so fetch and bash share the guard.
     #[cfg(unix)]
     if vault.can_release_material() && crate::secret_proxy::protect_secret_process().is_err() {
         return LaunchDecision::Refuse(LabelOutcome::Refuse {
@@ -393,50 +710,38 @@ pub(crate) fn resolve_label_for_launch(
             message: crate::bash_background::secrets::PROXY_UNAVAILABLE.to_owned(),
         });
     }
-    let resolution = vault.resolve(&scopes.authorization, label);
-    let outcome = crate::secret::outcome_for(label, &resolution);
-    match outcome {
-        LabelOutcome::Proceed => match resolution {
-            Resolution::Granted {
-                rule,
-                grant_id,
-                expires_at_ms,
-            } => LaunchDecision::Proceed {
-                rule,
-                grant_id,
-                expires_at_ms,
-            },
-            // A Proceed outcome must correspond to the captured grant.
-            other => LaunchDecision::Refuse(crate::secret::outcome_for(label, &other)),
-        },
-        LabelOutcome::FileConsent {
-            request_id,
-            statement_b64url,
-        } => match file_secret_consent(identity, &scopes, label, &request_id, &statement_b64url) {
+    let answer = vault.use_secret(&scopes.authorization, label, target);
+    if let crate::secret::UseAnswer::ApprovalRequired(pending) = answer {
+        return match file_secret_consent(
+            identity,
+            &scopes,
+            label,
+            &pending.request_id,
+            &pending.statement_b64url,
+        ) {
             Ok(SecretConsentFiling::Pending(pending)) => LaunchDecision::Pending(pending),
             Ok(SecretConsentFiling::Answered) => {
-                match vault.resolve(&scopes.authorization, label) {
-                    Resolution::Granted {
-                        rule,
-                        grant_id,
-                        expires_at_ms,
-                    } => LaunchDecision::Proceed {
-                        rule,
-                        grant_id,
-                        expires_at_ms,
-                    },
-                    other => LaunchDecision::Refuse(crate::secret::outcome_for_second_resolve(
-                        label, &other,
-                    )),
+                let answer = vault.use_secret(&scopes.authorization, label, target);
+                let outcome = crate::secret::outcome_for_second_use(label, &answer);
+                if outcome.proceeds() {
+                    LaunchDecision::Proceed(answer)
+                } else {
+                    LaunchDecision::Refuse(outcome)
                 }
             }
-            Err(code) => LaunchDecision::Refuse(crate::secret::refuse(
-                code,
+            Err(_) => LaunchDecision::Refuse(fetch_consent_refusal(
                 label,
-                "the consent ask could not be filed",
+                &target.host,
+                crate::secret::requests::UseError::Unavailable,
+                &Default::default(),
             )),
-        },
-        refusal => LaunchDecision::Refuse(refusal),
+        };
+    }
+    let outcome = crate::secret::outcome_for(label, &answer);
+    if outcome.proceeds() {
+        LaunchDecision::Proceed(answer)
+    } else {
+        LaunchDecision::Refuse(outcome)
     }
 }
 
@@ -459,18 +764,8 @@ thread_local! {
         const { std::cell::RefCell::new(None) };
 }
 
-/// Resolve only with the identity installed by dispatch, never tool arguments.
-pub(crate) fn resolve_current_secret_label(
-    vault: &dyn crate::secret::SecretVault,
-    label: &str,
-) -> LaunchDecision {
-    CURRENT_IDENTITY.with(|slot| match slot.borrow().as_ref() {
-        Some(identity) => resolve_label_for_launch(identity, vault, label),
-        None => LaunchDecision::Refuse(crate::secret::refuse_ineligible(
-            label,
-            Ineligibility::NoScope,
-        )),
-    })
+pub(crate) fn current_secret_consent_context() -> Option<(std::path::PathBuf, String)> {
+    current_identity().map(|identity| (identity.project_root.clone(), identity.session.clone()))
 }
 
 pub(super) fn current_identity() -> Option<RouteIdentity> {
@@ -630,3 +925,231 @@ impl Drop for SecretScopeGuard {
 #[cfg(test)]
 #[path = "secret_consent_tests.rs"]
 mod tests;
+
+/// Fetch and proxy requests join the same scope/request-id cards, each with
+/// one person-wait deadline shared by every concurrently requested label.
+pub(crate) fn use_current_secret_labels(
+    vault: Arc<dyn crate::secret::SecretVault>,
+    labels: &[String],
+    target: &crate::secret::ApiKeyTarget,
+    request_target: &str,
+    cancellation: &crate::url_fetch::SecretFetchCancellation,
+) -> Vec<LaunchDecision> {
+    if labels.is_empty() {
+        return Vec::new();
+    }
+    let redactions = Arc::new(std::sync::Mutex::new(crate::url_fetch::HeldKeys::default()));
+    let refuse = |index: usize, reason| {
+        labels
+            .iter()
+            .map(|_| {
+                LaunchDecision::Refuse(fetch_consent_refusal(
+                    &labels[index],
+                    &target.host,
+                    reason,
+                    &redactions
+                        .lock()
+                        .unwrap_or_else(std::sync::PoisonError::into_inner),
+                ))
+            })
+            .collect()
+    };
+    if let Some(reason) = cancellation.reason() {
+        return refuse(0, reason);
+    }
+    let scopes = match current_call_scopes() {
+        Ok((scopes, _)) => scopes,
+        Err(reason) => {
+            return labels
+                .iter()
+                .map(|label| {
+                    LaunchDecision::Refuse(crate::secret::refuse_ineligible(label, reason))
+                })
+                .collect()
+        }
+    };
+    #[cfg(unix)]
+    if vault.can_release_material() && crate::secret_proxy::protect_secret_process().is_err() {
+        return refuse(0, crate::secret::requests::UseError::Unavailable);
+    }
+    let checkpoint = cancellation.clone();
+    let coordinator = crate::secret::requests::RequestSecrets::new(
+        vault,
+        scopes.authorization,
+        current_secret_consent_context(),
+    )
+    .with_request_cancellation(move || checkpoint.is_cancelled());
+    let labels = labels.to_vec();
+    let target = target.clone();
+    let request_target = request_target.to_owned();
+    let cancellation = cancellation.clone();
+    let observed = redactions.clone();
+    let future = async move {
+        use futures_util::StreamExt;
+        let mut budget = coordinator.budget();
+        if let Some(expires) = cancellation.expires_at_ms() {
+            budget.expires_at_ms = budget.expires_at_ms.min(expires);
+        }
+        let mut pending = futures_util::stream::FuturesUnordered::new();
+        for (index, label) in labels.iter().enumerate() {
+            let target = &target;
+            let request_target = &request_target;
+            let coordinator = &coordinator;
+            let expires = budget.expires_at_ms;
+            let observed = &observed;
+            pending.push(async move {
+                (
+                    index,
+                    coordinator
+                        .use_planned_in_request(
+                            label,
+                            target,
+                            expires,
+                            |location| {
+                                let location =
+                                    secret_rules::location::parse_vault_location(location).ok_or(
+                                        crate::secret::requests::UseError::InvalidPlan(
+                                            "missing_material",
+                                        ),
+                                    )?;
+                                if !matches!(location, secret_rules::location::Location::Query(_)) {
+                                    // A covered deposit reveals its location only with the key, so the vault already recorded one release for that first ask.
+                                    return Err(crate::secret::requests::UseError::InvalidPlan(
+                                        "missing_material",
+                                    ));
+                                }
+                                let authority = secret_rules::target::ConnectAuthority {
+                                    host: target.host.clone(),
+                                    port: target.port.unwrap_or(443),
+                                };
+                                let rule = secret_rules::location::LabelRule {
+                                    label: label.clone(),
+                                    host: target.host.clone(),
+                                    port: 443,
+                                    path_prefix: target.path.clone(),
+                                    location,
+                                };
+                                let view = secret_rules::location::RequestView::new(
+                                    request_target,
+                                    Vec::new(),
+                                );
+                                let dummy =
+                                    [(label.clone(), b"proxy-planning-value-0000".to_vec())];
+                                // Without a pending card, the vault reveals a deposit location only when releasing its key, so location-dependent refusals can follow that release.
+                                if let Some(refusal) =
+                                    secret_rules::location::evaluate_request_with_connect(
+                                        &view,
+                                        &authority,
+                                        &[rule],
+                                        &dummy,
+                                    )
+                                    .refusal
+                                {
+                                    Err(crate::secret::requests::UseError::InvalidPlan(
+                                        refusal.reason(),
+                                    ))
+                                } else {
+                                    Ok(())
+                                }
+                            },
+                            |key| {
+                                secret_rules::material::check_admissible(
+                                    key,
+                                    label,
+                                    &secret_rules::location::Location::Query("_".into()),
+                                )
+                                .map_err(|_| {
+                                    crate::secret::requests::UseError::InvalidPlan(
+                                        "material_not_admissible",
+                                    )
+                                })?;
+                                observed
+                                    .lock()
+                                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                                    .hold(label, key)
+                                    .map_err(|_| {
+                                        crate::secret::requests::UseError::InvalidPlan(
+                                            "replacement_discloses_key",
+                                        )
+                                    })
+                            },
+                            || async { Ok(()) },
+                        )
+                        .await,
+                )
+            });
+        }
+        let mut answers: Vec<Option<crate::secret::UseAnswer>> =
+            (0..labels.len()).map(|_| None).collect();
+        while !pending.is_empty() {
+            let index = answers.iter().position(Option::is_none).unwrap_or(0);
+            let (index, answer) = tokio::select! {
+                biased;
+                () = cancellation.cancelled() => return Err((index, cancellation.reason().unwrap_or(crate::secret::requests::UseError::Cancelled))),
+                () = budget.expired() => return Err((index, crate::secret::requests::UseError::Expired)),
+                result = pending.next() => result.ok_or((index, crate::secret::requests::UseError::Unavailable))?,
+            };
+            if let Some(reason) = cancellation.reason() {
+                return Err((index, reason));
+            }
+            match answer {
+                Ok(answer) => answers[index] = Some(answer),
+                Err(crate::secret::requests::UseError::InvalidPlan(reason)) => {
+                    return Ok(labels
+                        .iter()
+                        .map(|_| LaunchDecision::InvalidPlan(reason))
+                        .collect())
+                }
+                Err(reason) => return Err((index, reason)),
+            }
+        }
+        Ok(labels
+            .iter()
+            .zip(answers)
+            .map(|(label, answer)| {
+                let answer = answer.unwrap_or(crate::secret::UseAnswer::Unavailable);
+                let outcome = crate::secret::outcome_for(label, &answer);
+                if outcome.proceeds() {
+                    LaunchDecision::Proceed(answer)
+                } else {
+                    LaunchDecision::Refuse(outcome)
+                }
+            })
+            .collect())
+    };
+    // Blocking fetches run on tool worker threads. A local runtime drives only
+    // their coordinator; production card workers stay on the daemon runtime.
+    let result = match tokio::runtime::Handle::try_current() {
+        Ok(handle) if handle.runtime_flavor() == tokio::runtime::RuntimeFlavor::MultiThread => {
+            tokio::task::block_in_place(|| handle.block_on(future))
+        }
+        Ok(_) => Err((0, crate::secret::requests::UseError::Unavailable)),
+        Err(_) => tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .map_err(|_| (0, crate::secret::requests::UseError::Unavailable))
+            .and_then(|runtime| {
+                let result = runtime.block_on(future);
+                // An already-started blocking vault call cannot be aborted; do
+                // not make cancellation wait for its transport timeout.
+                runtime.shutdown_background();
+                result
+            }),
+    };
+    result.unwrap_or_else(|(index, reason)| refuse(index, reason))
+}
+
+#[cfg(test)]
+pub(crate) fn use_current_secret_label(
+    vault: &dyn crate::secret::SecretVault,
+    label: &str,
+    target: &crate::secret::ApiKeyTarget,
+) -> LaunchDecision {
+    CURRENT_IDENTITY.with(|slot| match slot.borrow().as_ref() {
+        Some(identity) => use_label_for_fetch(identity, vault, label, target),
+        None => LaunchDecision::Refuse(crate::secret::refuse_ineligible(
+            label,
+            Ineligibility::NoScope,
+        )),
+    })
+}
diff --git a/crates/aft/src/subc/secret_consent_audit_tests.rs b/crates/aft/src/subc/secret_consent_audit_tests.rs
new file mode 100644
index 0000000000..39bb82282d
--- /dev/null
+++ b/crates/aft/src/subc/secret_consent_audit_tests.rs
@@ -0,0 +1,277 @@
+use super::*;
+
+#[test]
+fn answered_records_require_an_explicit_per_request_decision() {
+    let id = "01HF7YAT000000000000000001";
+    for answer in [
+        json!(null),
+        json!({}),
+        json!({"decision":"future"}),
+        json!({"decision":false}),
+        json!({"decision":"allow", "items":null}),
+        json!({"decision":"allow", "items":{}}),
+        json!({"decision":"allow", "items":[]}),
+        json!({"items":[{"request_id":id,"decision":"future"}]}),
+        json!({"items":[{"request_id":id,"decision":"allow"},{"request_id":id,"decision":"decline"}]}),
+    ] {
+        let record = json!({"kind":"secret_use","state":"answered","secret_use_answer":answer});
+        assert_eq!(
+            decode_secret_record(&record, id),
+            ConsentOutcome::Indeterminate,
+            "{record}"
+        );
+    }
+    let record =
+        json!({"kind":"secret_use","state":"answered","secret_use_answer":{"decision":"decline"}});
+    assert_eq!(decode_secret_record(&record, id), ConsentOutcome::Declined);
+}
+
+struct UnreadableAnswerEndpoint {
+    calls: StdMutex<Vec<super::super::super::consent::ConsentCall>>,
+}
+impl super::super::super::consent::ConsentTransport for UnreadableAnswerEndpoint {
+    fn call(
+        &self,
+        call: super::super::super::consent::ConsentCall,
+    ) -> super::super::super::consent::ConsentFuture {
+        self.calls.lock().unwrap().push(call.clone());
+        Box::pin(async move {
+            match call.method {
+                "consent.request" => Ok(json!({"elicitation_id":"el_unreadable"})),
+                "consent.await" => Ok(
+                    json!({"kind":"secret_use","state":"answered","secret_use_answer":{"decision":"future"}}),
+                ),
+                other => panic!("unexpected call after unreadable answered record: {other}"),
+            }
+        })
+    }
+}
+
+#[tokio::test]
+async fn an_unreadable_answer_never_becomes_a_cached_person_decision() {
+    let endpoint = Arc::new(UnreadableAnswerEndpoint {
+        calls: Default::default(),
+    });
+    let transport = SubcSecretConsent {
+        transport: endpoint.clone(),
+        runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
+    };
+    let request = held_request(crate::secret::vault::now_ms() + 600_000);
+    for _ in 0..2 {
+        assert_eq!(
+            transport
+                .file_cancellable(&request, SECRET_AWAIT_CAP, Some(&Default::default()))
+                .await,
+            ConsentOutcome::Indeterminate
+        );
+        let cards = transport.cards.lock().await;
+        let card = cards
+            .get(&(request.scope.clone(), request.request_id.clone()))
+            .unwrap()
+            .lock()
+            .await;
+        assert!(
+            card.answered.is_none(),
+            "a malformed answer is not a decision"
+        );
+        assert!(card.warned_unreadable);
+    }
+    let calls = endpoint.calls.lock().unwrap();
+    assert_eq!(
+        calls.iter().map(|call| call.method).collect::<Vec<_>>(),
+        ["consent.request", "consent.await", "consent.await"]
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn an_indeterminate_shared_outcome_is_evicted_and_uses_the_vault_unavailable_refusal() {
+    struct Answers(std::sync::atomic::AtomicUsize);
+    impl crate::secret::SecretConsentTransport for Answers {
+        fn file(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+            if self.0.fetch_add(1, std::sync::atomic::Ordering::SeqCst) == 0 {
+                ConsentOutcome::Indeterminate
+            } else {
+                ConsentOutcome::Declined
+            }
+        }
+        fn withhold(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+            ConsentOutcome::Cancelled
+        }
+    }
+    let answer = Arc::new(Answers(Default::default()));
+    let _installed = TransportGuard::install(Some(answer.clone()));
+    let request = held_request(crate::secret::vault::now_ms() + 600_000);
+    assert_eq!(
+        crate::secret::consent::wait_consent(request.clone()).await,
+        ConsentOutcome::Indeterminate
+    );
+    assert_eq!(
+        crate::secret::consent::wait_consent(request).await,
+        ConsentOutcome::Declined
+    );
+    assert_eq!(
+        answer.0.load(std::sync::atomic::Ordering::SeqCst),
+        2,
+        "do not reuse an indeterminate result as a person's cached decline"
+    );
+    let refusal = fetch_consent_refusal(
+        "test",
+        "x.test",
+        crate::secret::requests::UseError::Indeterminate,
+        &Default::default(),
+    );
+    assert_eq!(
+        refusal,
+        crate::secret::outcome_for("test", &crate::secret::UseAnswer::Unavailable)
+    );
+}
+
+struct CancelledLostFiling {
+    calls: StdMutex<Vec<super::super::super::consent::ConsentCall>>,
+    cancel: crate::secret::consent::Cancellation,
+    garbled: bool,
+}
+impl super::super::super::consent::ConsentTransport for CancelledLostFiling {
+    fn call(
+        &self,
+        call: super::super::super::consent::ConsentCall,
+    ) -> super::super::super::consent::ConsentFuture {
+        assert_eq!(call.method, "consent.request");
+        self.calls.lock().unwrap().push(call);
+        let cancel = self.cancel.clone();
+        let garbled = self.garbled;
+        Box::pin(async move {
+            cancel.cancel();
+            if garbled {
+                Ok(json!({"accepted":true}))
+            } else {
+                Err(super::super::super::consent::ConsentError::Unavailable(
+                    "lost filing reply".into(),
+                ))
+            }
+        })
+    }
+}
+
+#[tokio::test]
+async fn cancellation_after_a_lost_or_garbled_filing_never_creates_a_recovery_call() {
+    for garbled in [false, true] {
+        let cancel = crate::secret::consent::Cancellation::default();
+        let endpoint = Arc::new(CancelledLostFiling {
+            calls: Default::default(),
+            cancel: cancel.clone(),
+            garbled,
+        });
+        let transport = Arc::new(SubcSecretConsent {
+            transport: endpoint.clone(),
+            runtime: tokio::runtime::Handle::current(),
+            cards: Default::default(),
+        });
+        let deadline = crate::secret::vault::now_ms() + 600_000;
+        let request = held_request(deadline);
+        assert_eq!(
+            transport.clone().wait(request.clone(), cancel).await,
+            ConsentOutcome::Cancelled
+        );
+        assert_eq!(
+            transport
+                .file_cancellable(&request, SECRET_AWAIT_CAP, None)
+                .await,
+            ConsentOutcome::Cancelled
+        );
+        let calls = endpoint.calls.lock().unwrap();
+        assert_eq!(
+            calls.len(),
+            1,
+            "cancellation must not create an identical replay, even to recover an unknown id"
+        );
+        assert!(
+            calls[0].params["expires_at_ms"].as_u64().unwrap() <= deadline,
+            "the unknown-id card must expire by the original request deadline"
+        );
+    }
+}
+
+#[test]
+fn production_card_withdrawal_uses_the_daemon_runtime_after_the_request_runtime_stops() {
+    struct Endpoint {
+        started: tokio::sync::Notify,
+        withdrawn: tokio::sync::Notify,
+        calls: StdMutex<Vec<(&'static str, String)>>,
+    }
+    impl super::super::super::consent::ConsentTransport for Endpoint {
+        fn call(
+            &self,
+            call: super::super::super::consent::ConsentCall,
+        ) -> super::super::super::consent::ConsentFuture {
+            self.calls.lock().unwrap().push((
+                call.method,
+                format!("{:?}", tokio::runtime::Handle::current().id()),
+            ));
+            let response = match call.method {
+                "consent.request" => Some(json!({"elicitation_id":"el_runtime"})),
+                "consent.await" => {
+                    self.started.notify_one();
+                    None
+                }
+                "consent.withdraw" => {
+                    self.withdrawn.notify_one();
+                    Some(json!({}))
+                }
+                other => panic!("unexpected call {other}"),
+            };
+            Box::pin(async move {
+                match response {
+                    Some(reply) => Ok(reply),
+                    None => std::future::pending().await,
+                }
+            })
+        }
+    }
+    let _installed = TransportGuard::install(None);
+    let daemon = tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(1)
+        .enable_all()
+        .build()
+        .unwrap();
+    let endpoint = Arc::new(Endpoint {
+        started: Default::default(),
+        withdrawn: Default::default(),
+        calls: Default::default(),
+    });
+    // Exercise the production installer: it must capture the daemon handle,
+    // not the short-lived proxy/request runtime that later joins the card.
+    daemon.block_on(async {
+        install_subc_transport(endpoint.clone());
+    });
+    let request_runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    request_runtime.block_on(async {
+        let joined = crate::secret::consent::wait_consent(held_request(
+            crate::secret::vault::now_ms() + 600_000,
+        ));
+        tokio::pin!(joined);
+        tokio::select! {
+            () = endpoint.started.notified() => {},
+            _ = &mut joined => panic!("the phone card is still pending"),
+            () = tokio::time::sleep(Duration::from_secs(2)) => panic!("the card was not filed"),
+        }
+    });
+    drop(request_runtime);
+    daemon.block_on(async {
+        tokio::time::timeout(Duration::from_secs(2), endpoint.withdrawn.notified())
+            .await
+            .unwrap();
+    });
+    let calls = endpoint.calls.lock().unwrap();
+    assert_eq!(
+        calls.iter().map(|(method, _)| *method).collect::<Vec<_>>(),
+        ["consent.request", "consent.await", "consent.withdraw"]
+    );
+    assert!(calls
+        .iter()
+        .all(|(_, runtime)| runtime == &format!("{:?}", daemon.handle().id())));
+}
diff --git a/crates/aft/src/subc/secret_consent_outcome_tests.rs b/crates/aft/src/subc/secret_consent_outcome_tests.rs
new file mode 100644
index 0000000000..d5fb360952
--- /dev/null
+++ b/crates/aft/src/subc/secret_consent_outcome_tests.rs
@@ -0,0 +1,112 @@
+use super::*;
+
+struct Answer(ConsentOutcome);
+impl crate::secret::SecretConsentTransport for Answer {
+    fn file(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+        self.0.clone()
+    }
+    fn withhold(&self, _: &SecretConsentRequest) -> ConsentOutcome {
+        ConsentOutcome::Cancelled
+    }
+}
+
+async fn exact_line(scope_ref: &str, outcome: ConsentOutcome, expected: &str) {
+    let _transport = TransportGuard::install(Some(Arc::new(Answer(outcome))));
+    let coordinator = crate::secret::requests::RequestSecrets::new(
+        Arc::new(crate::secret::UnavailableVault),
+        SecretScope::from_stamp(&stamp(scope_ref, "head")),
+        Some((head().project_root.clone(), "fetch".into())),
+    );
+    let end = crate::secret::vault::now_ms() + 600_000;
+    let reason = coordinator
+        .approve(
+            "repo",
+            &target(),
+            crate::secret::ApprovalRequest {
+                request_id: "01HF7YAT000000000000000001".into(),
+                statement_b64url: "c3RhdGVtZW50".into(),
+                expires_at_ms: end,
+            },
+            end,
+        )
+        .await
+        .unwrap_err();
+    let LabelOutcome::Refuse { code, message } =
+        fetch_consent_refusal("repo", "x.test", reason, &Default::default())
+    else {
+        panic!("a refused fetch")
+    };
+    assert_eq!(code, crate::secret::SECRET_ACCESS_UNAVAILABLE);
+    assert_eq!(message, expected);
+    #[cfg(unix)]
+    assert!(
+        coordinator.status().is_empty(),
+        "terminal outcomes clear the approval status"
+    );
+    assert_eq!(
+        coordinator
+            .activity()
+            .load(std::sync::atomic::Ordering::Acquire),
+        0
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_declined_fetch_uses_the_exact_approved_line() {
+    exact_line(
+        "fetch-declined",
+        ConsentOutcome::Declined,
+        "secret repo: approval was declined for x.test; the request was not sent",
+    )
+    .await;
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn an_expired_fetch_uses_the_exact_approved_line() {
+    exact_line(
+        "fetch-expired",
+        ConsentOutcome::Expired,
+        "secret repo: approval expired for x.test; the request was not sent",
+    )
+    .await;
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_fetch_that_could_not_file_uses_the_exact_approved_line() {
+    exact_line(
+        "fetch-unfiled",
+        consent_unavailable("Cingulate could not file the secret-use card"),
+        "secret repo: the approval request for x.test could not be filed; the request was not sent",
+    )
+    .await;
+}
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn a_cancelled_fetch_uses_the_exact_approved_line() {
+    exact_line(
+        "fetch-cancelled",
+        ConsentOutcome::Cancelled,
+        "secret repo: the request for x.test was cancelled; the request was not sent",
+    )
+    .await;
+}
+
+#[test]
+fn each_approved_fetch_line_scrubs_both_name_and_host_against_an_earlier_release() {
+    const KEY: &str = "already-released-key-0123456789";
+    let mut held = crate::url_fetch::HeldKeys::default();
+    held.hold("first", KEY.as_bytes()).unwrap();
+    for reason in [
+        crate::secret::requests::UseError::Declined,
+        crate::secret::requests::UseError::Expired,
+        crate::secret::requests::UseError::Cancelled,
+        crate::secret::requests::UseError::Unavailable,
+    ] {
+        let LabelOutcome::Refuse { message, .. } =
+            fetch_consent_refusal(KEY, &format!("{KEY}.test"), reason, &held)
+        else {
+            panic!("a refused fetch")
+        };
+        assert!(!message.contains(KEY));
+        assert!(message.starts_with("secret {{ck-secret:first}}:"));
+        assert!(message.contains("{{ck-secret:first}}.test"));
+        assert!(message.ends_with("; the request was not sent"));
+    }
+}
diff --git a/crates/aft/src/subc/secret_consent_tests.rs b/crates/aft/src/subc/secret_consent_tests.rs
index 4da367bf12..99fb20a75e 100644
--- a/crates/aft/src/subc/secret_consent_tests.rs
+++ b/crates/aft/src/subc/secret_consent_tests.rs
@@ -8,9 +8,9 @@
 
 use super::*;
 use crate::secret::{
-    first_failure, outcome_for, outcome_for_second_resolve, refuse_ineligible, ApprovalRequest,
-    FakeVault, FakeVaultScript, LabelOutcome, Resolution, SecretConsentTransport, SecretVault,
-    SECRETS_UNAVAILABLE, SECRET_REFUSED,
+    first_failure, outcome_for, outcome_for_second_use, refuse_ineligible, ApiKeyTarget,
+    ApprovalRequest, FakeReply, FakeVault, FakeVaultScript, LabelOutcome, SecretConsentTransport,
+    SecretVault, UseAnswer, SECRETS_UNAVAILABLE, SECRET_REFUSED,
 };
 use serde_json::json;
 use std::sync::Mutex as StdMutex;
@@ -375,14 +375,14 @@ fn every_ineligible_form_refuses_with_secret_refused_and_never_resolves() {
         // grant the label is installed, so a launch that reached it would
         // proceed: the counts below are only zero if the seam refused first.
         let vault = FakeVault::new();
-        vault.set_resolution("repo", crate::secret::granted(rule(), "grant-1"));
+        vault.set_answer("repo", crate::secret::granted(rule()));
         vault.set_material("repo", vec![b"first-key-material-1".to_vec()]);
-        let decision = resolve_label_for_launch(&identity, &vault, "repo");
+        let decision = use_label_for_fetch(&identity, &vault, "repo", &target());
         let LaunchDecision::Refuse(outcome) = decision else {
             panic!("{name}: an ineligible scope must refuse, got {decision:?}");
         };
         assert_eq!(outcome.code(), Some(SECRET_REFUSED), "{name}");
-        assert_eq!(vault.resolve_calls(), 0, "{name}: no resolve may happen");
+        assert_eq!(vault.use_calls(), 0, "{name}: no resolve may happen");
         assert_eq!(
             vault.material_calls(),
             0,
@@ -400,15 +400,13 @@ struct RecordingTransport {
     filed: StdMutex<Vec<SecretConsentRequest>>,
 }
 
-static SECRET_TRANSPORT_LOCK: StdMutex<()> = StdMutex::new(());
-
 struct TransportGuard {
     _lock: std::sync::MutexGuard<'static, ()>,
 }
 
 impl TransportGuard {
     fn install(transport: Option<Arc<dyn SecretConsentTransport>>) -> Self {
-        let guard = SECRET_TRANSPORT_LOCK
+        let guard = crate::secret::consent::TEST_TRANSPORT_LOCK
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner);
         crate::secret::consent::install_transport(transport);
@@ -433,8 +431,8 @@ impl SecretConsentTransport for RecordingTransport {
     }
 }
 
-fn approval(request_id: &str) -> Resolution {
-    Resolution::ApprovalRequired(ApprovalRequest {
+fn approval(request_id: &str) -> FakeReply {
+    FakeReply::ApprovalRequired(ApprovalRequest {
         request_id: request_id.into(),
         statement_b64url: "c3RhdGVtZW50".into(),
         expires_at_ms: crate::secret::now_ms() + 60_000,
@@ -444,11 +442,10 @@ fn approval(request_id: &str) -> Resolution {
 fn rule() -> secret_rules::location::LabelRule {
     secret_rules::location::LabelRule {
         label: "repo".into(),
-        host: "api.example.com".into(),
+        host: "x.test".into(),
         port: 443,
-        path_prefix: "/v1".into(),
+        path_prefix: "/repos/a".into(),
         location: secret_rules::location::Location::Bearer,
-        grant_id: "grant-1".into(),
     }
 }
 
@@ -457,7 +454,7 @@ fn a_head_call_goes_pending_then_resolves_again_then_substitutes() {
     let head = head();
     let (scopes, _) = call_scopes(&head).expect("a head call is eligible");
     let mut script = FakeVaultScript::default();
-    script.resolutions.insert("repo".into(), approval("req-1"));
+    script.answers.insert("repo".into(), approval("req-1"));
     script
         .material
         .insert("repo".into(), vec![b"first-key-material-1".to_vec()]);
@@ -470,7 +467,10 @@ fn a_head_call_goes_pending_then_resolves_again_then_substitutes() {
 
     // First resolve: the vault is waiting, so the call is held before a child,
     // a job or a proxy exists.
-    let first = outcome_for("repo", &vault.resolve(&scopes.authorization, "repo"));
+    let first = outcome_for(
+        "repo",
+        &vault.use_secret(&scopes.authorization, "repo", &target()),
+    );
     let LabelOutcome::FileConsent {
         request_id,
         statement_b64url,
@@ -494,21 +494,29 @@ fn a_head_call_goes_pending_then_resolves_again_then_substitutes() {
     // Cingulate's answer alone grants nothing: the vault still refuses until it
     // grants, and only the second resolve decides.
     assert_eq!(
-        outcome_for_second_resolve("repo", &vault.resolve(&scopes.authorization, "repo")).code(),
+        outcome_for_second_use(
+            "repo",
+            &vault.use_secret(&scopes.authorization, "repo", &target())
+        )
+        .code(),
         Some(SECRETS_UNAVAILABLE)
     );
-    vault.set_resolution("repo", crate::secret::granted(rule(), "grant-1"));
-    let second = outcome_for_second_resolve("repo", &vault.resolve(&scopes.authorization, "repo"));
+    vault.set_answer("repo", crate::secret::granted(rule()));
+    let second = outcome_for_second_use(
+        "repo",
+        &vault.use_secret(&scopes.authorization, "repo", &target()),
+    );
     assert!(second.proceeds(), "{second:?}");
 
     // The intercepted request takes its material once, under the lifetime
     // scope, from the grant the head's authorization allowed.
-    let material = vault
-        .material(&scopes.lifetime, "repo", "grant-1")
-        .expect("the grant hands out material");
-    assert_eq!(material.expose(), b"first-key-material-1");
-    assert_eq!(vault.resolve_calls(), 3);
-    assert_eq!(vault.material_calls(), 1);
+    let UseAnswer::Released(material) = vault.use_secret(&scopes.authorization, "repo", &target())
+    else {
+        panic!("addressed release");
+    };
+    assert_eq!(material.material(), b"first-key-material-1");
+    assert_eq!(vault.use_calls(), 4);
+    assert_eq!(vault.material_calls(), 2);
 }
 
 #[test]
@@ -568,60 +576,63 @@ fn approval_reply() -> serde_json::Value {
     }})
 }
 
-// The saved Cingulate 0.12.0 secret-use-approval-v1.1 responses live in
-// crates/aft/tests/fixtures/secret/cingulate-secret-use-v1.1/. These hashes pin
-// the reviewed response bytes independently of the decoder.
+// These requester records are vendored from Cingulate commit 56fa35f2.
+// Independent hashes pin their exact bytes, not a decoder's reconstruction.
 const FILER_VECTORS: &[(&str, &str, &str)] = &[
     (
         "request",
-        include_str!("../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-request.json"),
+        include_str!(
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-request.json"
+        ),
         "be75724519b10547d1baacdee20095f753130251b1519c10342ab19ed42364c9",
     ),
     (
         "request-repeat",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-request-repeat.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-request-repeat.json"
         ),
         "be75724519b10547d1baacdee20095f753130251b1519c10342ab19ed42364c9",
     ),
     (
         "pending",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-await-pending.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-await-pending.json"
         ),
         "db39e1458276124efd66694d39f64e0ce34f0811c860b3ac4af2be6e6afbd0e6",
     ),
     (
         "allowed",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-await-allowed.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-await-allowed.json"
         ),
         "e5e665b918c4cb19750a8217457497c068eb4fb098df694da5f6dbd18511b286",
     ),
     (
         "partial",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-await-partial.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-await-partial.json"
         ),
         "8ebc4ce81712071e97c1a53b471722c1ac83020ed468723b83fcb674785a6b99",
     ),
     (
         "declined",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-await-declined.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-await-declined.json"
         ),
         "f49061b64579f5601883bd466aea4d0951915fc4e121c3e1390830003acc0c84",
     ),
     (
         "expired",
         include_str!(
-            "../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-await-expired.json"
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-await-expired.json"
         ),
         "95eb5015d42f4e3d059729696f12ac0bfc2447a6f74b24c450bef36a39b0a6c4",
     ),
     (
         "refusals",
-        include_str!("../../tests/fixtures/secret/cingulate-secret-use-v1.1/filer-refusals.json"),
+        include_str!(
+            "../../../../test-vectors/cingulate-secret-use-approval-v1/filer-refusals.json"
+        ),
         "66740bda26d96c0abd25e22244965209fcdee04e120bcd4d7214644e0580fa65",
     ),
 ];
@@ -637,6 +648,14 @@ fn filer_vector(name: &str) -> serde_json::Value {
 fn decode_filer_reply(
     reply: &serde_json::Value,
 ) -> Result<serde_json::Value, super::super::consent::ConsentError> {
+    // These handler samples show refusals as error envelopes; the live SDK
+    // delivers them as module errors, not successful result bytes.
+    if let Some(error) = reply.get("error") {
+        return Err(super::super::consent::ConsentError::Refused {
+            code: error["code"].as_str().unwrap().into(),
+            message: error["message"].as_str().unwrap().into(),
+        });
+    }
     super::super::consent::decode_result(&serde_json::to_vec(reply).unwrap())
 }
 
@@ -662,21 +681,47 @@ fn secret_filer_vectors_are_pinned_and_decode_the_published_card_states() {
         decode_secret_elicitation(&filer_reply("request").unwrap()),
         Some("el_1")
     );
-    for name in ["allowed", "partial", "declined"] {
+    for name in ["allowed", "partial"] {
         assert_eq!(
-            decode_secret_record(&filer_reply(name).unwrap()),
+            decode_secret_record(&filer_reply(name).unwrap(), "01HF7YAT000000000000000001"),
             ConsentOutcome::Answered,
             "{name}"
         );
     }
+    let mut once = filer_reply("allowed").unwrap();
+    once["secret_use_answer"]["duration"] = json!("once");
+    assert_eq!(
+        decode_secret_record(&once, "01HF7YAT000000000000000001"),
+        ConsentOutcome::AnsweredOnce
+    );
     assert_eq!(
-        decode_secret_record(&filer_reply("pending").unwrap()),
+        decode_secret_record(
+            &filer_reply("pending").unwrap(),
+            "01HF7YAT000000000000000001"
+        ),
         ConsentOutcome::Pending
     );
     assert!(matches!(
-        decode_secret_record(&filer_reply("expired").unwrap()),
-        ConsentOutcome::Unavailable { .. }
+        decode_secret_record(
+            &filer_reply("expired").unwrap(),
+            "01HF7YAT000000000000000001"
+        ),
+        ConsentOutcome::Expired
     ));
+    assert_eq!(
+        decode_secret_record(
+            &filer_reply("partial").unwrap(),
+            "01HF7YAT000000000000000002"
+        ),
+        ConsentOutcome::Declined
+    );
+    assert_eq!(
+        decode_secret_record(
+            &filer_reply("declined").unwrap(),
+            "01HF7YAT000000000000000001"
+        ),
+        ConsentOutcome::Declined
+    );
 }
 
 #[derive(Default)]
@@ -713,6 +758,7 @@ impl super::super::consent::ConsentTransport for SecretCards {
                 assert_eq!(call.params["elicitation_id"], "el_1");
                 filer_reply(self.record)
             }
+            "consent.withdraw" => Ok(serde_json::json!({})),
             method => panic!("unexpected consent method: {method}"),
         };
         Box::pin(async move { reply })
@@ -725,14 +771,19 @@ struct ScriptedSecretUse {
 }
 
 impl crate::secret::SecretUseTransport for ScriptedSecretUse {
-    fn secret_use(&self, params: serde_json::Value) -> Result<serde_json::Value, String> {
+    fn secret_use(&self, params: serde_json::Value) -> Result<zeroize::Zeroizing<Vec<u8>>, String> {
         self.calls.lock().unwrap().push(params);
-        Ok(self
-            .replies
-            .lock()
-            .unwrap()
-            .pop_front()
-            .expect("an expected secret.use retry"))
+        Ok(zeroize::Zeroizing::new(
+            serde_json::to_vec(
+                &self
+                    .replies
+                    .lock()
+                    .unwrap()
+                    .pop_front()
+                    .expect("an expected secret.use retry"),
+            )
+            .unwrap(),
+        ))
     }
 }
 
@@ -755,6 +806,7 @@ fn install_cards(runtime: &tokio::runtime::Runtime, cards: Arc<SecretCards>) ->
     TransportGuard::install(Some(Arc::new(SubcSecretConsent {
         transport: cards,
         runtime: runtime.handle().clone(),
+        cards: Default::default(),
     })))
 }
 
@@ -770,15 +822,19 @@ fn a_refiled_secret_launch_recovers_the_same_card_and_exact_statement() {
     let vault = crate::secret::SubcSecretVault::new(wire.clone());
     let identity = head();
     for decision in [
-        resolve_label_for_launch(&identity, &vault, "key"),
-        runtime.block_on(async { resolve_label_for_launch(&identity, &vault, "key") }),
+        use_label_for_fetch(&identity, &vault, "key", &target()),
+        runtime.block_on(async { use_label_for_fetch(&identity, &vault, "key", &target()) }),
     ] {
         assert!(matches!(decision, LaunchDecision::Pending(_)));
     }
     assert_eq!(cards.cards.lock().unwrap().len(), 1);
     assert_eq!(wire.calls.lock().unwrap().len(), 2);
     let calls = cards.calls.lock().unwrap();
-    assert_eq!(calls.len(), 4);
+    assert_eq!(
+        calls.len(),
+        3,
+        "resume awaits the existing card without filing it again"
+    );
     let item = phone_item();
     let expected = format!(
         r#"{{"method":"consent.request","params":{{"kind":"secret_use","secret_use":{{"items":[{{"request_id":"{}","statement_b64url":"{}"}}]}}}}}}"#,
@@ -806,7 +862,7 @@ fn a_refiled_secret_launch_recovers_the_same_card_and_exact_statement() {
 }
 
 #[test]
-fn secret_allow_partial_and_decline_retry_secret_use_and_only_the_vault_decides() {
+fn secret_allow_and_allowed_partial_retry_but_decline_never_retries() {
     let runtime = secret_consent_runtime();
     for state in ["allowed", "partial", "declined"] {
         for (reply, expected_code) in [
@@ -816,7 +872,7 @@ fn secret_allow_partial_and_decline_retry_secret_use_and_only_the_vault_decides(
             ),
             (
                 json!({"result": {"error": {"code": "not_found", "class": "permanent"}}}),
-                Some(SECRET_REFUSED),
+                None,
             ),
             (approval_reply(), Some(SECRETS_UNAVAILABLE)),
         ] {
@@ -828,7 +884,16 @@ fn secret_allow_partial_and_decline_retry_secret_use_and_only_the_vault_decides(
             let wire = secret_use_script(vec![approval_reply(), reply]);
             let vault = crate::secret::SubcSecretVault::new(wire.clone());
             let identity = head();
-            let decision = resolve_label_for_launch(&identity, &vault, "key");
+            let decision = use_label_for_fetch(&identity, &vault, "key", &target());
+            if state == "declined" {
+                assert!(matches!(decision, LaunchDecision::Refuse(_)));
+                assert_eq!(
+                    wire.calls.lock().unwrap().len(),
+                    1,
+                    "a decline is final, without another vault call"
+                );
+                continue;
+            }
             match expected_code {
                 None => assert!(
                     matches!(decision, LaunchDecision::Proceed { .. }),
@@ -878,7 +943,8 @@ fn expired_or_refused_secret_cards_end_the_launch_without_retrying_the_vault() {
         let _guard = install_cards(&runtime, cards.clone());
         let wire = secret_use_script(vec![approval_reply()]);
         let vault = crate::secret::SubcSecretVault::new(wire.clone());
-        let LaunchDecision::Refuse(outcome) = resolve_label_for_launch(&head(), &vault, "key")
+        let LaunchDecision::Refuse(outcome) =
+            use_label_for_fetch(&head(), &vault, "key", &target())
         else {
             panic!("an expired or refused card cannot start a launch")
         };
@@ -899,14 +965,13 @@ fn secret_cards_reject_unknown_or_permission_reply_shapes() {
     for record in [
         json!({"kind": "secret_use", "state": "granted"}),
         json!({"kind": "secret_use", "state": "declined"}),
-        json!({"kind": "secret_use", "state": "withdrawn"}),
         json!({"kind": "secret_use", "state": "settled", "outcome": "allow_once"}),
         json!({"kind": "tool_permission", "state": "granted"}),
         json!({"kind": "secret_use", "state": "future"}),
         json!({"state": "granted"}),
     ] {
         assert!(matches!(
-            decode_secret_record(&record),
+            decode_secret_record(&record, "01HF7YAT000000000000000001"),
             ConsentOutcome::Unavailable { .. }
         ));
     }
@@ -920,7 +985,7 @@ fn secret_cards_reject_unknown_or_permission_reply_shapes() {
 }
 
 #[test]
-fn withholding_a_secret_card_fails_closed_without_an_unsupported_method() {
+fn withholding_a_secret_card_withdraws_once_and_keeps_the_terminal_cancelled_outcome() {
     let runtime = secret_consent_runtime();
     let cards = Arc::new(SecretCards {
         record: "pending",
@@ -929,16 +994,19 @@ fn withholding_a_secret_card_fails_closed_without_an_unsupported_method() {
     let _guard = install_cards(&runtime, cards.clone());
     let wire = secret_use_script(vec![approval_reply()]);
     let vault = crate::secret::SubcSecretVault::new(wire);
-    let LaunchDecision::Pending(pending) = resolve_label_for_launch(&head(), &vault, "key") else {
+    let LaunchDecision::Pending(pending) = use_label_for_fetch(&head(), &vault, "key", &target())
+    else {
         panic!("the card is pending")
     };
     assert!(matches!(
         crate::secret::withhold_consent(&pending.request),
-        ConsentOutcome::Unavailable { .. }
+        ConsentOutcome::Cancelled
     ));
     withdraw_secret_consent(&pending);
     let calls = cards.calls.lock().unwrap();
-    assert_eq!(calls.len(), 2);
+    assert_eq!(calls.len(), 3);
+    assert_eq!(calls[2].method, "consent.withdraw");
+    assert_eq!(calls[2].scope, calls[0].scope);
     assert_eq!(cards.cards.lock().unwrap().len(), 1);
 }
 
@@ -975,11 +1043,14 @@ fn the_production_vault_ends_an_eligible_launch_with_secrets_unavailable() {
     let (scopes, _) = call_scopes(&head()).expect("a head call is eligible");
     let vault = crate::secret::UnavailableVault;
     assert_eq!(
-        vault.resolve(&scopes.authorization, "repo"),
-        Resolution::Unavailable
+        matches!(
+            vault.use_secret(&scopes.authorization, "repo", &target()),
+            UseAnswer::Unavailable
+        ),
+        true
     );
     assert_eq!(
-        crate::secret::outcome_for("repo", &Resolution::Unavailable).code(),
+        crate::secret::outcome_for("repo", &UseAnswer::Unavailable).code(),
         Some(SECRETS_UNAVAILABLE)
     );
 }
@@ -990,7 +1061,7 @@ fn the_production_vault_never_hardens_the_process() {
     // own /proc counters. A vault that can never release a key must not
     // trigger it, even when an eligible launch names a placeholder.
     let LaunchDecision::Refuse(outcome) =
-        resolve_label_for_launch(&head(), &crate::secret::UnavailableVault, "repo")
+        use_label_for_fetch(&head(), &crate::secret::UnavailableVault, "repo", &target())
     else {
         panic!("the production vault refuses every launch")
     };
@@ -1122,12 +1193,447 @@ fn a_run_bound_to_an_unauthorized_head_stamp_is_ineligible() {
     assert_eq!(call_scopes(&run), Err(Ineligibility::HeadScopeNotAlfonso));
 
     let vault = FakeVault::new();
-    vault.set_resolution("repo", crate::secret::granted(rule(), "grant-1"));
-    let decision = resolve_label_for_launch(&run, &vault, "repo");
+    vault.set_answer("repo", crate::secret::granted(rule()));
+    let decision = use_label_for_fetch(&run, &vault, "repo", &target());
     let LaunchDecision::Refuse(outcome) = decision else {
         panic!("an unauthorized head stamp must refuse, got {decision:?}");
     };
     assert_eq!(outcome.code(), Some(SECRET_REFUSED));
-    assert_eq!(vault.resolve_calls(), 0);
+    assert_eq!(vault.use_calls(), 0);
     assert_eq!(vault.material_calls(), 0);
 }
+
+fn target() -> ApiKeyTarget {
+    ApiKeyTarget {
+        scheme: "https".into(),
+        host: "x.test".into(),
+        port: Some(443),
+        path: "/repos/a".into(),
+    }
+}
+
+#[test]
+fn every_vendored_secret_approval_sample_matches_its_source_checksum_and_decodes() {
+    use sha2::{Digest, Sha256};
+    let root = crate::test_support::manifest_dir()
+        .join("../../test-vectors/cingulate-secret-use-approval-v1");
+    let manifest =
+        include_str!("../../../../test-vectors/cingulate-secret-use-approval-v1/SHA256SUMS");
+    let mut count = 0;
+    for line in manifest.lines() {
+        let (hash, name) = line.split_once("  ").unwrap();
+        let bytes = std::fs::read(root.join(name)).unwrap();
+        assert_eq!(format!("{:x}", Sha256::digest(&bytes)), hash, "{name}");
+        if name.ends_with(".json") {
+            let sample: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+            assert!(sample.is_object(), "{name}");
+            if name.starts_with("filer-await-") {
+                let outcome =
+                    decode_secret_record(&sample["reply"]["result"], "01HF7YAT000000000000000001");
+                assert!(
+                    !matches!(outcome, ConsentOutcome::Unavailable { .. }),
+                    "{name}"
+                );
+            }
+        }
+        count += 1;
+    }
+    assert_eq!(count, 12);
+    let fallback = json!({"kind":"secret_use", "state":"answered", "answered_choice_id":"allow", "secret_use_answer":{"decision":"allow"}});
+    assert_eq!(
+        decode_secret_record(&fallback, "one"),
+        ConsentOutcome::Answered
+    );
+    let withdrawn = json!({"kind":"secret_use", "state":"withdrawn"});
+    assert_eq!(
+        decode_secret_record(&withdrawn, "one"),
+        ConsentOutcome::Cancelled
+    );
+}
+
+#[derive(Default)]
+struct HeldCardEndpoint {
+    calls: StdMutex<Vec<super::super::consent::ConsentCall>>,
+    awaits: std::sync::atomic::AtomicUsize,
+    allow_after: usize,
+    fail_withdraw: bool,
+    fail_await: bool,
+    pending_early: bool,
+}
+impl super::super::consent::ConsentTransport for HeldCardEndpoint {
+    fn call(
+        &self,
+        call: super::super::consent::ConsentCall,
+    ) -> super::super::consent::ConsentFuture {
+        self.calls.lock().unwrap().push(call.clone());
+        let attempt = self.awaits.fetch_add(
+            usize::from(call.method == "consent.await"),
+            std::sync::atomic::Ordering::SeqCst,
+        );
+        let allow = self.allow_after > 0 && attempt + 1 >= self.allow_after;
+        let fail_withdraw = self.fail_withdraw;
+        let fail_await = self.fail_await;
+        let pending_early = self.pending_early;
+        Box::pin(async move {
+            match call.method {
+                "consent.request" => Ok(serde_json::json!({"elicitation_id":"el_held"})),
+                "consent.await" => {
+                    if fail_await {
+                        return Err(super::super::consent::ConsentError::Unavailable(
+                            "offline".into(),
+                        ));
+                    }
+                    if !pending_early {
+                        tokio::time::sleep(Duration::from_millis(
+                            call.params["timeout_ms"].as_u64().unwrap(),
+                        ))
+                        .await;
+                    }
+                    if allow {
+                        filer_reply("allowed")
+                    } else {
+                        filer_reply("pending")
+                    }
+                }
+                "consent.withdraw" if fail_withdraw => Err(
+                    super::super::consent::ConsentError::Unavailable("offline".into()),
+                ),
+                "consent.withdraw" => Ok(serde_json::json!({})),
+                method => panic!("unexpected secret consent operation {method}"),
+            }
+        })
+    }
+}
+fn held_request(expires_at_ms: u64) -> SecretConsentRequest {
+    SecretConsentRequest {
+        scope: SecretScope::from_stamp(&stamp("held-card", "head")),
+        project_root: head().project_root.clone(),
+        session: "held".into(),
+        label: "key".into(),
+        request_id: "01HF7YAT000000000000000001".into(),
+        statement_b64url: "c3RhdGVtZW50".into(),
+        expires_at_ms: Some(expires_at_ms),
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn production_secret_cards_reawait_the_same_id_at_the_service_cap_and_keep_the_request_expiry(
+) {
+    let endpoint = Arc::new(HeldCardEndpoint {
+        allow_after: 3,
+        ..Default::default()
+    });
+    let transport = Arc::new(SubcSecretConsent {
+        transport: endpoint.clone(),
+        runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
+    });
+    let end = crate::secret::vault::now_ms() + 600_000;
+    let cancel = crate::secret::consent::Cancellation::default();
+    let waiter = tokio::spawn(transport.wait(held_request(end), cancel));
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(20)).await;
+    tokio::task::yield_now().await;
+    assert!(
+        !waiter.is_finished(),
+        "the filesystem hold budget is not the person-wait deadline"
+    );
+    for _ in 0..3 {
+        tokio::time::advance(Duration::from_secs(120)).await;
+        tokio::task::yield_now().await;
+    }
+    assert_eq!(waiter.await.unwrap(), ConsentOutcome::Answered);
+    let calls = endpoint.calls.lock().unwrap();
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.method == "consent.request")
+            .count(),
+        1
+    );
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.method == "consent.await")
+            .count(),
+        3
+    );
+    for call in calls.iter().filter(|call| call.method == "consent.await") {
+        assert_eq!(call.params["elicitation_id"], "el_held");
+        assert!(call.params["timeout_ms"].as_u64().unwrap() <= 120_000);
+    }
+    assert_eq!(calls[0].params["expires_at_ms"].as_u64(), Some(end));
+    assert!(calls.iter().all(|call| call.scope == calls[0].scope));
+}
+
+#[tokio::test(start_paused = true)]
+async fn production_secret_card_cancellation_withdraws_once_on_its_original_scope_even_if_withdrawal_fails(
+) {
+    for fail_withdraw in [false, true] {
+        let endpoint = Arc::new(HeldCardEndpoint {
+            fail_withdraw,
+            ..Default::default()
+        });
+        let transport = Arc::new(SubcSecretConsent {
+            transport: endpoint.clone(),
+            runtime: tokio::runtime::Handle::current(),
+            cards: Default::default(),
+        });
+        let cancel = crate::secret::consent::Cancellation::default();
+        let waiter = tokio::spawn(transport.clone().wait(
+            held_request(crate::secret::vault::now_ms() + 600_000),
+            cancel.clone(),
+        ));
+        tokio::task::yield_now().await;
+        assert!(endpoint
+            .calls
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|call| call.method == "consent.await"));
+        cancel.cancel();
+        let outcome = waiter.await.unwrap();
+        assert_eq!(
+            outcome,
+            ConsentOutcome::Cancelled,
+            "withdrawal failure does not turn a caller cancellation into a user answer"
+        );
+        let cached = transport
+            .file_cancellable(
+                &held_request(crate::secret::vault::now_ms() + 600_000),
+                Duration::ZERO,
+                None,
+            )
+            .await;
+        assert_eq!(
+            cached,
+            ConsentOutcome::Cancelled,
+            "the original requester cache retains cancellation, not expiry"
+        );
+        for _ in 0..3 {
+            tokio::task::yield_now().await;
+        }
+        let calls = endpoint.calls.lock().unwrap();
+        let withdraw: Vec<_> = calls
+            .iter()
+            .filter(|call| call.method == "consent.withdraw")
+            .collect();
+        assert_eq!(
+            withdraw.len(),
+            1,
+            "failed withdrawal is logged once, never retried"
+        );
+        assert_eq!(withdraw[0].scope, calls[0].scope);
+        assert_eq!(withdraw[0].params["elicitation_id"], "el_held");
+    }
+}
+
+#[tokio::test]
+async fn a_failed_secret_card_await_withdraws_before_returning_cancelled_and_cancelled_filing_does_not_start(
+) {
+    let endpoint = Arc::new(HeldCardEndpoint {
+        fail_await: true,
+        ..Default::default()
+    });
+    let transport = Arc::new(SubcSecretConsent {
+        transport: endpoint.clone(),
+        runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
+    });
+    let answer = transport
+        .wait(
+            held_request(crate::secret::vault::now_ms() + 600_000),
+            Default::default(),
+        )
+        .await;
+    assert_eq!(answer, ConsentOutcome::Cancelled, "a filed card may already have reached the person; a failed await is not a failed filing or a user answer");
+    let calls = endpoint.calls.lock().unwrap();
+    assert_eq!(
+        calls.iter().map(|call| call.method).collect::<Vec<_>>(),
+        vec!["consent.request", "consent.await", "consent.withdraw"]
+    );
+    assert!(calls.iter().all(|call| call.scope == calls[0].scope));
+    drop(calls);
+    let endpoint = Arc::new(HeldCardEndpoint::default());
+    let transport = Arc::new(SubcSecretConsent {
+        transport: endpoint.clone(),
+        runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
+    });
+    let cancel = crate::secret::consent::Cancellation::default();
+    cancel.cancel();
+    assert_eq!(
+        transport
+            .wait(
+                held_request(crate::secret::vault::now_ms() + 600_000),
+                cancel
+            )
+            .await,
+        ConsentOutcome::Cancelled
+    );
+    assert!(
+        endpoint.calls.lock().unwrap().is_empty(),
+        "a worker scheduled after its last request disappeared must not file a card"
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn early_pending_secret_answers_back_off_before_reawaiting_the_same_card() {
+    let endpoint = Arc::new(HeldCardEndpoint {
+        pending_early: true,
+        ..Default::default()
+    });
+    let transport = Arc::new(SubcSecretConsent {
+        transport: endpoint.clone(),
+        runtime: tokio::runtime::Handle::current(),
+        cards: Default::default(),
+    });
+    let cancel = crate::secret::consent::Cancellation::default();
+    let waiter = tokio::spawn(transport.wait(
+        held_request(crate::secret::vault::now_ms() + 600_000),
+        cancel.clone(),
+    ));
+    tokio::task::yield_now().await;
+    assert_eq!(endpoint.awaits.load(std::sync::atomic::Ordering::SeqCst), 1);
+    tokio::time::advance(SECRET_PENDING_BACKOFF - Duration::from_millis(1)).await;
+    tokio::task::yield_now().await;
+    assert_eq!(
+        endpoint.awaits.load(std::sync::atomic::Ordering::SeqCst),
+        1,
+        "an early pending reply cannot spin on consent.await"
+    );
+    tokio::time::advance(Duration::from_millis(1)).await;
+    tokio::task::yield_now().await;
+    assert_eq!(endpoint.awaits.load(std::sync::atomic::Ordering::SeqCst), 2);
+    cancel.cancel();
+    assert_eq!(waiter.await.unwrap(), ConsentOutcome::Cancelled);
+    let calls = endpoint.calls.lock().unwrap();
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.method == "consent.request")
+            .count(),
+        1
+    );
+    assert!(calls
+        .iter()
+        .filter(|call| call.method == "consent.await")
+        .all(|call| call.params["elicitation_id"] == "el_held"));
+}
+
+#[path = "secret_consent_outcome_tests.rs"]
+mod fetch_outcome_lines;
+
+#[path = "secret_consent_audit_tests.rs"]
+mod audit_followups;
+
+struct LostFilingEndpoint {
+    calls: StdMutex<Vec<super::super::consent::ConsentCall>>,
+    files: std::sync::atomic::AtomicUsize,
+    garbled_first: bool,
+    fail_recovery: bool,
+    fail_withdraw: bool,
+}
+impl super::super::consent::ConsentTransport for LostFilingEndpoint {
+    fn call(
+        &self,
+        call: super::super::consent::ConsentCall,
+    ) -> super::super::consent::ConsentFuture {
+        self.calls.lock().unwrap().push(call.clone());
+        let reply = match call.method {
+            "consent.request" => match self.files.fetch_add(1, std::sync::atomic::Ordering::SeqCst)
+            {
+                0 if self.garbled_first => Ok(json!({"accepted":true})),
+                0 => Err(super::super::consent::ConsentError::Unavailable(
+                    "lost reply".into(),
+                )),
+                1 if self.fail_recovery => Err(super::super::consent::ConsentError::Unavailable(
+                    "recovery unavailable".into(),
+                )),
+                1 => Ok(json!({"elicitation_id":"el_recovered"})),
+                _ => panic!("filing recovery must be bounded to one identical retry"),
+            },
+            "consent.withdraw" if self.fail_withdraw => Err(
+                super::super::consent::ConsentError::Unavailable("withdraw unavailable".into()),
+            ),
+            "consent.withdraw" => Ok(json!({"state":"withdrawn"})),
+            other => panic!("a lost filing must be withdrawn, never awaited: {other}"),
+        };
+        Box::pin(async move { reply })
+    }
+}
+
+#[tokio::test]
+async fn lost_or_garbled_secret_filing_is_refiled_identically_once_then_withdrawn_on_the_original_scope(
+) {
+    for garbled_first in [false, true] {
+        for fail_recovery in [false, true] {
+            for fail_withdraw in [false, true] {
+                let endpoint = Arc::new(LostFilingEndpoint {
+                    calls: Default::default(),
+                    files: Default::default(),
+                    garbled_first,
+                    fail_recovery,
+                    fail_withdraw,
+                });
+                let transport = SubcSecretConsent {
+                    transport: endpoint.clone(),
+                    runtime: tokio::runtime::Handle::current(),
+                    cards: Default::default(),
+                };
+                let request = held_request(crate::secret::vault::now_ms() + 600_000);
+                let answer = transport
+                    .file_cancellable(&request, SECRET_AWAIT_CAP, Some(&Default::default()))
+                    .await;
+                if fail_recovery {
+                    assert!(matches!(answer, ConsentOutcome::Unavailable { .. }));
+                } else {
+                    assert_eq!(answer, ConsentOutcome::Cancelled, "a recovered known card was filed for the person and is cancelled, not expired");
+                }
+                let cached = transport
+                    .file_cancellable(&request, SECRET_AWAIT_CAP, None)
+                    .await;
+                assert_eq!(
+                    cached, answer,
+                    "a repeated caller cannot launch another recovery or withdrawal loop"
+                );
+                let calls = endpoint.calls.lock().unwrap();
+                assert_eq!(calls.len(), if fail_recovery { 2 } else { 3 });
+                assert_eq!(calls[0].method, "consent.request");
+                assert_eq!(calls[1].method, "consent.request");
+                assert_eq!(
+                    calls[0].params, calls[1].params,
+                    "the complete request body, including expiry, is replayed byte for byte"
+                );
+                assert!(calls.iter().all(|call| call.scope == calls[0].scope
+                    && call.project_root == calls[0].project_root
+                    && call.session == calls[0].session));
+                if !fail_recovery {
+                    assert_eq!(calls[2].method, "consent.withdraw");
+                    assert_eq!(calls[2].params, json!({"elicitation_id":"el_recovered"}));
+                }
+            }
+        }
+    }
+}
+
+#[test]
+fn handler_refusal_samples_are_named_module_errors_not_lost_filing_replies() {
+    let vectors = filer_vector("refusals");
+    let cases = vectors["cases"].as_array().unwrap();
+    let expected = [
+        "elicitation_invalid_request",
+        "elicitation_invalid_request",
+        "elicitation_request_conflict",
+        "elicitation_requester_refused",
+    ];
+    assert_eq!(cases.len(), expected.len());
+    for (case, code) in cases.iter().zip(expected) {
+        let Err(super::super::consent::ConsentError::Refused { code: actual, .. }) =
+            decode_filer_reply(&case["reply"])
+        else {
+            panic!("a published named refusal is a module error, not Unavailable")
+        };
+        assert_eq!(actual, code);
+    }
+}
diff --git a/crates/aft/src/subc/secret_fetch_cancellation_tests.rs b/crates/aft/src/subc/secret_fetch_cancellation_tests.rs
new file mode 100644
index 0000000000..6ba036e953
--- /dev/null
+++ b/crates/aft/src/subc/secret_fetch_cancellation_tests.rs
@@ -0,0 +1,606 @@
+//! Foreground executor cancellation must reach a real placeholder fetch.
+use super::*;
+use crate::secret::transport::fake::{FakeClaustrum, Record, NONCE};
+use crate::secret::{SecretVault, SubcSecretVault};
+use crate::url_fetch::UrlFetchOptions;
+use std::sync::atomic::AtomicUsize;
+
+static FINISHED: AtomicUsize = AtomicUsize::new(0);
+static NO_RUNTIME: AtomicBool = AtomicBool::new(false);
+static FETCH_ENV: std::sync::LazyLock<StdMutex<Option<(Arc<dyn SecretVault>, UrlFetchOptions)>>> =
+    std::sync::LazyLock::new(Default::default);
+
+fn dispatch(request: RawRequest, ctx: &AppContext) -> Response {
+    let (vault, options) = FETCH_ENV.lock().unwrap().clone().unwrap();
+    NO_RUNTIME.store(
+        tokio::runtime::Handle::try_current().is_err(),
+        Ordering::SeqCst,
+    );
+    let response = crate::commands::with_secret_fetch_for_test(vault, options, || {
+        crate::commands::outline::handle_outline(&request, ctx)
+    });
+    FINISHED.fetch_add(1, Ordering::SeqCst);
+    response
+}
+
+#[derive(Default)]
+struct Phone {
+    requests: StdMutex<Vec<Value>>,
+    answers: StdMutex<HashMap<String, Value>>,
+    withdrawals: StdMutex<Vec<String>>,
+}
+impl ConsentTransport for Phone {
+    fn call(&self, call: ConsentCall) -> ConsentFuture {
+        match call.method {
+            "consent.request" => {
+                let mut requests = self.requests.lock().unwrap();
+                requests.push(call.params.clone());
+                let id = format!("el_{}", requests.len());
+                Box::pin(async move { Ok(json!({"elicitation_id": id})) })
+            }
+            "consent.withdraw" => {
+                self.withdrawals
+                    .lock()
+                    .unwrap()
+                    .push(call.params["elicitation_id"].as_str().unwrap().into());
+                Box::pin(async { Ok(json!({"state":"withdrawn"})) })
+            }
+            "consent.await" => {
+                let id = call.params["elicitation_id"].as_str().unwrap().to_owned();
+                let phone = PHONE.lock().unwrap().as_ref().unwrap().clone();
+                Box::pin(async move {
+                    loop {
+                        if let Some(answer) = phone.answers.lock().unwrap().get(&id).cloned() {
+                            return Ok(answer);
+                        }
+                        tokio::time::sleep(Duration::from_millis(5)).await;
+                    }
+                })
+            }
+            other => panic!("unexpected consent method {other}"),
+        }
+    }
+}
+static PHONE: std::sync::LazyLock<StdMutex<Option<Arc<Phone>>>> =
+    std::sync::LazyLock::new(Default::default);
+
+struct Restore;
+impl Drop for Restore {
+    fn drop(&mut self) {
+        crate::secret::consent::install_transport(None);
+        FETCH_ENV.lock().unwrap().take();
+        if let Some(phone) = PHONE.lock().unwrap().take() {
+            for index in 0..phone.requests.lock().unwrap().len() {
+                phone
+                    .answers
+                    .lock()
+                    .unwrap()
+                    .insert(format!("el_{}", index + 1), json!({"state":"expired"}));
+            }
+        }
+    }
+}
+
+fn server_tls() -> (rustls::ClientConfig, tokio_rustls::TlsAcceptor) {
+    let provider = Arc::new(rustls::crypto::ring::default_provider());
+    let key = rcgen::KeyPair::generate().unwrap();
+    let certificate = rcgen::CertificateParams::new(vec!["api.secret.test".into()])
+        .unwrap()
+        .self_signed(&key)
+        .unwrap();
+    let mut roots = rustls::RootCertStore::empty();
+    roots.add(certificate.der().clone()).unwrap();
+    let client = rustls::ClientConfig::builder_with_provider(provider.clone())
+        .with_safe_default_protocol_versions()
+        .unwrap()
+        .with_root_certificates(roots)
+        .with_no_client_auth();
+    let tls = rustls::ServerConfig::builder_with_provider(provider)
+        .with_safe_default_protocol_versions()
+        .unwrap()
+        .with_no_client_auth()
+        .with_single_cert(
+            vec![certificate.der().clone()],
+            rustls::pki_types::PrivatePkcs8KeyDer::from(key.serialize_der()).into(),
+        )
+        .unwrap();
+    let acceptor = tokio_rustls::TlsAcceptor::from(Arc::new(tls));
+    (client, acceptor)
+}
+
+async fn server() -> (
+    std::net::SocketAddr,
+    rustls::ClientConfig,
+    Arc<AtomicUsize>,
+    tokio::task::JoinHandle<()>,
+) {
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let (client, acceptor) = server_tls();
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let sends = Arc::new(AtomicUsize::new(0));
+    let seen = sends.clone();
+    let worker = tokio::spawn(async move {
+        while let Ok((socket, _)) = listener.accept().await {
+            let mut tls = acceptor.accept(socket).await.unwrap();
+            let mut request = Vec::new();
+            let mut buffer = [0u8; 1024];
+            while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+                let count = tls.read(&mut buffer).await.unwrap();
+                if count == 0 {
+                    break;
+                }
+                request.extend_from_slice(&buffer[..count]);
+            }
+            seen.fetch_add(1, Ordering::SeqCst);
+            let _ = tls.write_all(b"HTTP/1.1 200 OK\r\nContent-Type: text/markdown\r\nContent-Length: 8\r\nConnection: close\r\n\r\n# Fetch\n").await;
+        }
+    });
+    (address, client, sends, worker)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn foreground_fetch_cancel_with_two_pending_labels_withdraws_both_and_a_late_allow_cannot_release_or_send(
+) {
+    held_foreground_fetch_late_allow(false).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn foreground_fetch_cancel_during_tls_setup_never_hands_the_keyed_request_to_http() {
+    use crate::secret::SecretVault;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    let _consent_lock = CONSENT_TEST_LOCK.lock().await;
+    let _secret_lock = crate::secret::consent::TEST_TRANSPORT_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    // The uncancelled control uses the same certificate and held handshake,
+    // so a TLS setup failure cannot make the no-request assertion pass.
+    for cancel in [true, false] {
+        let f = fixture(FakeCingulate::up());
+        let _restore = Restore;
+        let daemon = FakeClaustrum::start();
+        {
+            let mut state = daemon.state.lock().unwrap();
+            state.pending_expires_at_ms = Some(crate::secret::vault::now_ms() + 600_000);
+            state.once = true;
+            state.record = Some(Record {
+                name: "first".into(),
+                host: "api.secret.test".into(),
+                path: "/v1".into(),
+                location: "query:first".into(),
+                key: b"tls-stall-released-key-0123456789".to_vec(),
+            });
+        }
+        let transport = crate::secret::transport::SubcSecretUseTransport::for_test(
+            daemon.path.clone(),
+            subc_protocol::BindIdentity::new("test", "session"),
+            Duration::from_secs(2),
+            subc_client_rs::ConsumerIdentity {
+                module_id: "aft".into(),
+                launch_nonce: NONCE.into(),
+            },
+        );
+        let vault = Arc::new(SubcSecretVault::new(Arc::new(transport)));
+        let scope = crate::secret::SecretScope::from_stamp(f.head.scope.as_ref().unwrap());
+        let target = crate::secret::ApiKeyTarget {
+            scheme: "https".into(),
+            host: "api.secret.test".into(),
+            port: Some(443),
+            path: "/v1/doc.md".into(),
+        };
+        let crate::secret::UseAnswer::ApprovalRequired(pending) =
+            vault.use_secret(&scope, "first", &target)
+        else {
+            panic!("approval required")
+        };
+        daemon
+            .state
+            .lock()
+            .unwrap()
+            .approve(&pending.statement_b64url);
+        let (tls, acceptor) = server_tls();
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let (accepted, connected) = tokio::sync::oneshot::channel();
+        let (resume, resumed) = tokio::sync::oneshot::channel();
+        let server = tokio::spawn(async move {
+            let (socket, _) = listener.accept().await.unwrap();
+            accepted.send(()).unwrap();
+            resumed.await.unwrap();
+            let Ok(mut tls) = acceptor.accept(socket).await else {
+                return Vec::new();
+            };
+            let mut request = Vec::new();
+            let mut byte = [0u8; 1];
+            while !request.ends_with(b"\r\n\r\n") {
+                match tokio::time::timeout(Duration::from_secs(2), tls.read(&mut byte)).await {
+                    Ok(Ok(1)) => request.push(byte[0]),
+                    _ => break,
+                }
+            }
+            if !request.is_empty() {
+                let _ = tls.write_all(b"HTTP/1.1 200 OK\r\nContent-Type: text/markdown\r\nContent-Length: 8\r\nConnection: close\r\n\r\n# Fetch\n").await;
+            }
+            request
+        });
+        *FETCH_ENV.lock().unwrap() = Some((
+            vault,
+            UrlFetchOptions {
+                tls_config: Some(tls),
+                public_host_overrides: vec![(
+                    "api.secret.test".into(),
+                    vec!["93.184.216.34".parse().unwrap()],
+                )],
+                connect_overrides: vec![("api.secret.test".into(), address)],
+                ..Default::default()
+            },
+        ));
+        let url = format!(
+            "https://api.secret.test:{}/v1/doc.md?first={{{{ck-secret:first}}}}",
+            address.port()
+        );
+        let mut replies = f
+            .send_tool(&f.head, "outline", json!({"target":url}), 91, dispatch)
+            .await;
+        tokio::time::timeout(Duration::from_secs(3), connected)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            daemon.state.lock().unwrap().calls,
+            2,
+            "the covered key was released before the held connection setup"
+        );
+        if cancel {
+            assert!(cancel_active_tool_call(
+                &f.active,
+                &f.executor,
+                route_key(41, 1),
+                91,
+                "cancel during TLS setup"
+            )
+            .is_some());
+        }
+        resume.send(()).unwrap();
+        let request = tokio::time::timeout(Duration::from_secs(4), server)
+            .await
+            .unwrap()
+            .unwrap();
+        if cancel {
+            assert!(
+                request.is_empty(),
+                "no HTTP request line may follow cancellation during TLS setup: {}",
+                String::from_utf8_lossy(&request)
+            );
+        } else {
+            assert!(
+                request.starts_with(
+                    b"GET /v1/doc.md?first=tls-stall-released-key-0123456789 HTTP/1.1\r\n"
+                ),
+                "the control must complete TLS and send the real keyed request"
+            );
+        }
+        let _ = tokio::time::timeout(Duration::from_secs(3), replies.recv()).await;
+        assert_eq!(
+            daemon.state.lock().unwrap().calls,
+            2,
+            "neither cancellation nor a connect failure may retry the release"
+        );
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn foreground_fetch_reply_deadline_with_two_pending_labels_withdraws_both_and_cannot_send_after_late_allow(
+) {
+    held_foreground_fetch_late_allow(true).await;
+}
+
+async fn held_foreground_fetch_late_allow(expire: bool) {
+    let _consent_lock = CONSENT_TEST_LOCK.lock().await;
+    let _secret_lock = crate::secret::consent::TEST_TRANSPORT_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    let f = fixture(FakeCingulate::up());
+    let _restore = Restore;
+    let daemon = FakeClaustrum::start();
+    daemon.state.lock().unwrap().pending_expires_at_ms =
+        Some(crate::secret::vault::now_ms() + 600_000);
+    for label in ["first", "second"] {
+        daemon.state.lock().unwrap().records.push(Record {
+            name: label.into(),
+            host: "api.secret.test".into(),
+            path: "/v1".into(),
+            location: format!("query:{label}"),
+            key: format!("released-key-for-{label}-0000").into_bytes(),
+        });
+    }
+    let transport = crate::secret::transport::SubcSecretUseTransport::for_test(
+        daemon.path.clone(),
+        subc_protocol::BindIdentity::new("test", "session"),
+        Duration::from_secs(2),
+        subc_client_rs::ConsumerIdentity {
+            module_id: "aft".into(),
+            launch_nonce: NONCE.into(),
+        },
+    );
+    let phone = Arc::new(Phone::default());
+    *PHONE.lock().unwrap() = Some(phone.clone());
+    super::super::secret_consent::install_subc_transport(phone.clone());
+    let (address, tls, sends, server) = server().await;
+    *FETCH_ENV.lock().unwrap() = Some((
+        Arc::new(SubcSecretVault::new(Arc::new(transport))),
+        UrlFetchOptions {
+            tls_config: Some(tls),
+            public_host_overrides: vec![(
+                "api.secret.test".into(),
+                vec!["93.184.216.34".parse().unwrap()],
+            )],
+            connect_overrides: vec![("api.secret.test".into(), address)],
+            ..Default::default()
+        },
+    ));
+    let url = format!("https://api.secret.test:{}/v1/doc.md?first={{{{ck-secret:first}}}}&second={{{{ck-secret:second}}}}", address.port());
+    let reply_deadline_ms = crate::secret::vault::now_ms() + 2000;
+    if expire {
+        f.deadlines.lock().unwrap().insert(91, reply_deadline_ms);
+    }
+    let mut replies = f
+        .send_tool(&f.head, "outline", json!({"target":url}), 91, dispatch)
+        .await;
+    wait_for(|| phone.requests.lock().unwrap().len() == 2).await;
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        2,
+        "one initial approval-required ask per label"
+    );
+    assert_eq!(sends.load(Ordering::SeqCst), 0);
+    if expire {
+        assert!(phone
+            .requests
+            .lock()
+            .unwrap()
+            .iter()
+            .all(|request| request["expires_at_ms"].as_u64().unwrap() <= reply_deadline_ms));
+    } else {
+        assert!(cancel_active_tool_call(
+            &f.active,
+            &f.executor,
+            route_key(41, 1),
+            91,
+            "cancel foreground fetch"
+        )
+        .is_some());
+    }
+    wait_for(|| phone.withdrawals.lock().unwrap().len() == 2).await;
+    // Deliver both signed allows even after cancellation. Neither answer may
+    // revive the executor job, re-ask the vault, or dispatch its HTTP request.
+    let requests = phone.requests.lock().unwrap().clone();
+    for (index, request) in requests.iter().enumerate() {
+        let item = &request["secret_use"]["items"][0];
+        daemon
+            .state
+            .lock()
+            .unwrap()
+            .approve(item["statement_b64url"].as_str().unwrap());
+        phone.answers.lock().unwrap().insert(
+            format!("el_{}", index + 1),
+            json!({
+                "state":"answered", "answered_choice_id":"allow", "secret_use_answer": {
+                    "decision":"allow", "duration":"once", "envelope_sha256":"00".repeat(32),
+                    "items":[{"request_id":item["request_id"],"decision":"allow"}]
+                }
+            }),
+        );
+    }
+    wait_for(|| phone.withdrawals.lock().unwrap().len() == 2).await;
+    let _ = tokio::time::timeout(Duration::from_secs(5), replies.recv()).await;
+    tokio::time::sleep(Duration::from_millis(150)).await;
+    assert_eq!(
+        daemon.state.lock().unwrap().calls,
+        2,
+        "cancellation forbids even a releasing retry"
+    );
+    assert_eq!(
+        sends.load(Ordering::SeqCst),
+        0,
+        "the late allow must not send an HTTP request"
+    );
+    server.abort();
+}
+
+#[derive(Default)]
+struct HeldVault {
+    entered: AtomicBool,
+    released: StdMutex<bool>,
+    wake: std::sync::Condvar,
+}
+impl HeldVault {
+    fn release(&self) {
+        *self.released.lock().unwrap() = true;
+        self.wake.notify_all();
+    }
+}
+impl SecretVault for HeldVault {
+    fn use_secret(
+        &self,
+        _: &crate::secret::SecretScope,
+        _: &str,
+        _: &crate::secret::ApiKeyTarget,
+    ) -> crate::secret::UseAnswer {
+        self.entered.store(true, Ordering::SeqCst);
+        let mut released = self.released.lock().unwrap();
+        while !*released {
+            released = self.wake.wait(released).unwrap();
+        }
+        crate::secret::UseAnswer::Unavailable
+    }
+    fn audit(
+        &self,
+        _: &secret_rules::audit::AuditRecordV1,
+    ) -> Result<(), crate::secret::AuditError> {
+        Ok(())
+    }
+    fn can_release_material(&self) -> bool {
+        false
+    }
+}
+struct ReleaseHeld(Arc<HeldVault>);
+impl Drop for ReleaseHeld {
+    fn drop(&mut self) {
+        self.0.release();
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn foreground_fetch_cancellation_does_not_wait_for_local_runtime_blocking_work_to_finish() {
+    let _consent_lock = CONSENT_TEST_LOCK.lock().await;
+    let f = fixture(FakeCingulate::up());
+    let _restore = Restore;
+    FINISHED.store(0, Ordering::SeqCst);
+    NO_RUNTIME.store(false, Ordering::SeqCst);
+    let vault = Arc::new(HeldVault::default());
+    let _release = ReleaseHeld(vault.clone());
+    *FETCH_ENV.lock().unwrap() = Some((
+        vault.clone(),
+        UrlFetchOptions {
+            public_host_overrides: vec![(
+                "api.secret.test".into(),
+                vec!["93.184.216.34".parse().unwrap()],
+            )],
+            ..Default::default()
+        },
+    ));
+    let _replies = f
+        .send_tool(
+            &f.head,
+            "outline",
+            json!({"target":"https://api.secret.test/v1/doc.md?first={{ck-secret:first}}"}),
+            92,
+            dispatch,
+        )
+        .await;
+    wait_for(|| vault.entered.load(Ordering::SeqCst)).await;
+    assert!(
+        NO_RUNTIME.load(Ordering::SeqCst),
+        "the foreground executor really uses the no-current-runtime branch"
+    );
+    assert!(cancel_active_tool_call(
+        &f.active,
+        &f.executor,
+        route_key(41, 1),
+        92,
+        "cancel blocked lookup"
+    )
+    .is_some());
+    tokio::time::timeout(Duration::from_secs(2), async {
+        while FINISHED.load(Ordering::SeqCst) == 0 {
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await
+    .expect("runtime destruction must not wait for the vault transport's blocking timeout");
+    assert!(
+        !*vault.released.lock().unwrap(),
+        "the blocked lookup is still held when the caller finishes"
+    );
+    vault.release();
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn foreground_fetch_refuses_non_query_locations_before_any_card_or_releasing_retry() {
+    let _consent_lock = CONSENT_TEST_LOCK.lock().await;
+    let _secret_lock = crate::secret::consent::TEST_TRANSPORT_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
+    for covered in [false, true] {
+        let f = fixture(FakeCingulate::up());
+        let _restore = Restore;
+        let daemon = FakeClaustrum::start();
+        {
+            let mut state = daemon.state.lock().unwrap();
+            state.pending_expires_at_ms = Some(crate::secret::vault::now_ms() + 600_000);
+            state.record = Some(Record {
+                name: "first".into(),
+                host: "api.secret.test".into(),
+                path: "/v1".into(),
+                location: "authorization_bearer".into(),
+                key: b"must-never-leave-fetch-0123456789".to_vec(),
+            });
+        }
+        let transport = crate::secret::transport::SubcSecretUseTransport::for_test(
+            daemon.path.clone(),
+            subc_protocol::BindIdentity::new("test", "session"),
+            Duration::from_secs(2),
+            subc_client_rs::ConsumerIdentity {
+                module_id: "aft".into(),
+                launch_nonce: NONCE.into(),
+            },
+        );
+        let vault = Arc::new(SubcSecretVault::new(Arc::new(transport)));
+        if covered {
+            let scope = crate::secret::SecretScope::from_stamp(f.head.scope.as_ref().unwrap());
+            let ask = vault.clone();
+            let answer = tokio::task::spawn_blocking(move || {
+                ask.use_secret(
+                    &scope,
+                    "first",
+                    &crate::secret::ApiKeyTarget {
+                        scheme: "https".into(),
+                        host: "api.secret.test".into(),
+                        port: Some(443),
+                        path: "/v1/doc.md".into(),
+                    },
+                )
+            })
+            .await
+            .unwrap();
+            let crate::secret::UseAnswer::ApprovalRequired(pending) = answer else {
+                panic!("setup needs one real vault statement")
+            };
+            daemon
+                .state
+                .lock()
+                .unwrap()
+                .approve(&pending.statement_b64url);
+        }
+        let phone = Arc::new(Phone::default());
+        *PHONE.lock().unwrap() = Some(phone.clone());
+        super::super::secret_consent::install_subc_transport(phone.clone());
+        let (address, tls, sends, server) = server().await;
+        *FETCH_ENV.lock().unwrap() = Some((
+            vault,
+            UrlFetchOptions {
+                tls_config: Some(tls),
+                public_host_overrides: vec![(
+                    "api.secret.test".into(),
+                    vec!["93.184.216.34".parse().unwrap()],
+                )],
+                connect_overrides: vec![("api.secret.test".into(), address)],
+                ..Default::default()
+            },
+        ));
+        let url = format!(
+            "https://api.secret.test:{}/v1/doc.md?first={{{{ck-secret:first}}}}",
+            address.port()
+        );
+        let reply = f
+            .checkout_tool(&f.head, "outline", json!({"target":url}), 93, dispatch)
+            .await;
+        assert_eq!(reply["structuredContent"]["success"], false, "{reply}");
+        assert!(
+            phone.requests.lock().unwrap().is_empty(),
+            "a pending non-query statement must be refused before a phone card is filed"
+        );
+        assert_eq!(
+            daemon.state.lock().unwrap().calls,
+            if covered { 2 } else { 1 },
+            "including the setup ask, there is no releasing retry after refusing the location"
+        );
+        assert_eq!(
+            sends.load(Ordering::SeqCst),
+            0,
+            "even an already-covered release is dropped unsent"
+        );
+        server.abort();
+    }
+}
diff --git a/crates/aft/src/subc/tool_provider.rs b/crates/aft/src/subc/tool_provider.rs
index 2117fe2f64..ff89aeffaa 100644
--- a/crates/aft/src/subc/tool_provider.rs
+++ b/crates/aft/src/subc/tool_provider.rs
@@ -8281,7 +8281,7 @@ pub(in crate::subc) mod route_tests {
         let ctx = runner_restore_context(&root);
         let request: crate::protocol::RawRequest = serde_json::from_value(json!({
             "id": "runner-start", "command": "bash", "session_id": "runner-restore",
-            "params": { "command": "printf 'stdout before restart\\n'; printf 'stderr before restart\\n' >&2; while [ ! -f release ]; do sleep 0.05; done; printf 'stdout after restart\\n'; printf 'stderr after restart\\n' >&2; while [ ! -f finish ]; do sleep 0.05; done",
+            "params": { "command": format!("printf 'stdout before restart\\n'; printf 'stderr before restart\\n' >&2; {}; printf 'stdout after restart\\n'; printf 'stderr after restart\\n' >&2; {}", crate::test_gate::gate("release", "sleep 0.05"), crate::test_gate::gate("finish", "sleep 0.05")),
                 "background": true, "compressed": true },
         })).unwrap();
         let response = crate::sandbox_spawn::with_authenticated_principal(
diff --git a/crates/aft/src/subc_format.rs b/crates/aft/src/subc_format.rs
index 6e666b4b78..2b26186713 100644
--- a/crates/aft/src/subc_format.rs
+++ b/crates/aft/src/subc_format.rs
@@ -1166,6 +1166,11 @@ pub(crate) fn format_bash_task_status_header(
     exit_code: Option<i64>,
     status_reason: Option<&str>,
 ) -> String {
+    if status == "fate_unknown"
+        && status_reason == Some(crate::bash_background::PTY_EXIT_STATUS_UNKNOWN_REASON)
+    {
+        return format!("Task {task_id}: exit status unknown (AFT could not read how it ended)");
+    }
     let mut text = format!("Task {task_id}: {status}");
     if status == "killed" {
         if let Some(label) = crate::bash_background::registry::scope_end_label(status_reason) {
@@ -1212,7 +1217,11 @@ fn format_bash_status(
     if paged {
         return text;
     }
-    if let Some(duration_ms) = data.get("duration_ms").and_then(Value::as_u64) {
+    if let Some(duration_ms) = data.get("duration_ms").and_then(Value::as_u64).filter(|_| {
+        !(status == "fate_unknown"
+            && data.get("status_reason").and_then(Value::as_str)
+                == Some(crate::bash_background::PTY_EXIT_STATUS_UNKNOWN_REASON))
+    }) {
         // Rounded to the nearest second, as the plugin displays it.
         text.push_str(&format!(" {}s", duration_ms.saturating_add(500) / 1000));
     }
@@ -5511,6 +5520,35 @@ mod bash_companion_format_tests {
         }
     }
 
+    #[test]
+    fn pty_lost_exit_status_renders_approved_line_without_exit_code() {
+        let text = status_text(
+            json!({
+                "task_id": "bash-lost", "status": "fate_unknown", "mode": "pty",
+                "exit_code": null, "duration_ms": 1000,
+                "status_reason": "AFT could not read how it ended",
+            }),
+            None,
+        );
+        assert_eq!(
+            text,
+            "Task bash-lost: exit status unknown (AFT could not read how it ended)"
+        );
+        assert_eq!(
+            format_bash_task_status_header("bash-killed", "killed", Some(137), None),
+            "Task bash-killed: killed (exit 137)"
+        );
+        assert_eq!(
+            format_bash_task_status_header(
+                "bash-remote",
+                "fate_unknown",
+                None,
+                Some("connection lost")
+            ),
+            "Task bash-remote: fate_unknown"
+        );
+    }
+
     #[test]
     fn failed_bash_status_renders_its_reason_without_incomplete_output() {
         let reason = "failed to spawn background bash command: No such file or directory";
diff --git a/crates/aft/src/synapse_embed.rs b/crates/aft/src/synapse_embed.rs
index 99fcf79a2d..6783a8214a 100644
--- a/crates/aft/src/synapse_embed.rs
+++ b/crates/aft/src/synapse_embed.rs
@@ -61,6 +61,7 @@ pub struct LanePause {
     pub lane_id: String,
     pub fingerprint: Option<String>,
     pub retry_after_ms: Option<u64>,
+    #[serde(default)]
     pub paused_until_ms: u64,
     pub reason: String,
     #[serde(default)]
@@ -297,6 +298,15 @@ pub(crate) fn lane_pause_for_root(root: &Path) -> Option<LanePause> {
     Some(pause)
 }
 
+/// A fill that waits on another root's lane pause reports the same planned
+/// downtime in health, even though it made no request of its own.
+pub(crate) fn share_lane_pause(root: &Path, pause: &LanePause) {
+    lane_pauses()
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .insert(root.to_path_buf(), pause.clone());
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum SynapseEmbeddingError {
     MissingConnectionFile,
@@ -1549,20 +1559,28 @@ fn decode_result_envelope_for_request(
                         });
                     }
                 }
-                let paused_until_ms = details["paused_until_ms"].as_u64().ok_or_else(|| {
-                    SynapseEmbeddingError::InvalidEnvelope(
-                        "lane_paused omitted paused_until_ms".into(),
-                    )
-                })?;
+                let retry_after_ms = error["retry_after_ms"]
+                    .as_u64()
+                    .filter(|ms| (1_000..=MAX_LANE_PAUSE_MS).contains(ms));
+                let paused_until_ms = details["paused_until_ms"]
+                    .as_u64()
+                    .or_else(|| {
+                        retry_after_ms.map(|delay| {
+                            crate::semantic_index::unix_millis_now().saturating_add(delay)
+                        })
+                    })
+                    .ok_or_else(|| {
+                        SynapseEmbeddingError::InvalidEnvelope(
+                            "lane_paused omitted paused_until_ms".into(),
+                        )
+                    })?;
                 let reason = details["reason"].as_str().ok_or_else(|| {
                     SynapseEmbeddingError::InvalidEnvelope("lane_paused omitted reason".into())
                 })?;
                 Err(SynapseEmbeddingError::LanePaused(LanePause {
                     lane_id: lane_id.to_owned(),
                     fingerprint: fingerprint.and_then(Value::as_str).map(str::to_owned),
-                    retry_after_ms: error["retry_after_ms"]
-                        .as_u64()
-                        .filter(|ms| (1_000..=MAX_LANE_PAUSE_MS).contains(ms)),
+                    retry_after_ms,
                     paused_until_ms,
                     reason: reason.to_owned(),
                     cause: PauseCause::LanePaused,
@@ -2109,6 +2127,26 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn lane_paused_retry_hint_supplies_missing_absolute_end() {
+        use super::pause_test_support::*;
+        let mut reply = pause_reply(json!(1_399_000));
+        reply["error"]["details"]
+            .as_object_mut()
+            .unwrap()
+            .remove("paused_until_ms");
+        let before = crate::semantic_index::unix_millis_now();
+        let error = decode_result_envelope_for_request(
+            serde_json::to_vec(&reply).unwrap(),
+            Some(&json!({"model": MODEL, "required_fingerprint": "pinned"})),
+        )
+        .unwrap_err();
+        let after = crate::semantic_index::unix_millis_now();
+        let pause = LanePause::from_error(&error.to_string()).unwrap();
+        assert!((before + 1_399_000..=after + 1_399_000).contains(&pause.paused_until_ms));
+        assert_eq!(pause.cause, PauseCause::LanePaused);
+    }
+
     #[test]
     fn lane_paused_fake_synapse_preserves_breaker_and_reports_health() {
         use super::pause_test_support::*;
diff --git a/crates/aft/src/test_gate.rs b/crates/aft/src/test_gate.rs
new file mode 100644
index 0000000000..2af4d5779f
--- /dev/null
+++ b/crates/aft/src/test_gate.rs
@@ -0,0 +1,111 @@
+//! Shell gates used by tests that hold a process until a file appears.
+#![allow(dead_code)]
+
+/// Render a POSIX shell loop. `file` is a shell word and `sleep` is the
+/// existing sleep command and interval, for example `sleep 0.05`.
+pub(crate) fn gate(file: &str, sleep: &str) -> String {
+    gate_with_limit(file, sleep, 600, "-f")
+}
+
+pub(crate) fn gate_exists(file: &str, sleep: &str) -> String {
+    gate_with_limit(file, sleep, 600, "-e")
+}
+
+pub(crate) fn gate_socket(file: &str, sleep: &str) -> String {
+    gate_with_limit(file, sleep, 600, "-S")
+}
+
+pub(crate) fn powershell_gate(file: &str, millis: u32) -> String {
+    let file = file.replace('\'', "''");
+    format!("$aftGateFile = '{file}'; $aftGateParent = Split-Path -Parent $aftGateFile; $aftGateDeadline = [DateTime]::UtcNow.AddSeconds(600); while (-not (Test-Path -LiteralPath $aftGateFile) -and (Test-Path -LiteralPath $aftGateParent -PathType Container) -and [DateTime]::UtcNow -lt $aftGateDeadline) {{ Start-Sleep -Milliseconds {millis} }}")
+}
+
+fn gate_with_limit(file: &str, sleep: &str, seconds: u64, predicate: &str) -> String {
+    format!(
+        "(aft_gate_file={file}; \
+         aft_gate_parent=$(cd \"$(dirname \"$aft_gate_file\")\" 2>/dev/null && pwd -P) || exit 0; \
+         aft_gate_deadline=$(($(date +%s) + {seconds})); \
+         while [ ! {predicate} \"$aft_gate_file\" ] && [ -d \"$aft_gate_parent\" ] && \
+         [ \"$(date +%s)\" -lt \"$aft_gate_deadline\" ]; do {sleep}; done)"
+    )
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use super::gate_with_limit;
+    use std::os::unix::process::CommandExt;
+    use std::process::{Command, Stdio};
+    use std::time::{Duration, Instant};
+
+    struct Shell(std::process::Child);
+
+    impl Drop for Shell {
+        fn drop(&mut self) {
+            if matches!(self.0.try_wait(), Ok(None)) {
+                unsafe { libc::kill(-(self.0.id() as i32), libc::SIGKILL) };
+                let _ = self.0.wait();
+            }
+        }
+    }
+
+    #[test]
+    fn gate_ends_when_parent_disappears_or_limit_passes() {
+        fn wait(mut child: Shell) -> Duration {
+            let started = Instant::now();
+            loop {
+                if let Some(status) = child.0.try_wait().unwrap() {
+                    assert!(status.success());
+                    return started.elapsed();
+                }
+                if started.elapsed() > Duration::from_secs(5) {
+                    panic!("gate did not end");
+                }
+                std::thread::sleep(Duration::from_millis(10));
+            }
+        }
+
+        let dir = tempfile::tempdir().unwrap();
+        let file = format!("'{}'", dir.path().join("release").display());
+        let marker = dir.path().join("started");
+        let script = format!(
+            ": > '{}'; {}",
+            marker.display(),
+            gate_with_limit(&file, "sleep 0.02", 60, "-f")
+        );
+        let mut child = Shell(
+            Command::new("/bin/sh")
+                .args(["-c", &script])
+                .stdout(Stdio::null())
+                .process_group(0)
+                .spawn()
+                .unwrap(),
+        );
+        let started = Instant::now();
+        while !marker.exists() {
+            assert!(started.elapsed() < Duration::from_secs(5));
+            std::thread::sleep(Duration::from_millis(10));
+        }
+        // Let the shell resolve the parent before removing it.
+        std::thread::sleep(Duration::from_millis(100));
+        assert!(
+            child.0.try_wait().unwrap().is_none(),
+            "gate exited before removal"
+        );
+        dir.close().unwrap();
+        assert!(wait(child) < Duration::from_secs(5));
+
+        let dir = tempfile::tempdir().unwrap();
+        let file = format!("'{}'", dir.path().join("release").display());
+        let child = Shell(
+            Command::new("/bin/sh")
+                .args(["-c", &gate_with_limit(&file, "sleep 0.02", 2, "-f")])
+                .stdout(Stdio::null())
+                .process_group(0)
+                .spawn()
+                .unwrap(),
+        );
+        let elapsed = wait(child);
+        assert!(elapsed >= Duration::from_millis(500));
+        assert!(elapsed < Duration::from_secs(5));
+    }
+}
diff --git a/crates/aft/src/url_fetch.rs b/crates/aft/src/url_fetch.rs
index dd237ea66c..75298adf1d 100644
--- a/crates/aft/src/url_fetch.rs
+++ b/crates/aft/src/url_fetch.rs
@@ -27,7 +27,7 @@ use secret_rules::location::{
 };
 use secret_rules::material::{check_admissible, encode_for_location};
 use secret_rules::scrub::{MatcherSet, ScrubError, Scrubber};
-use secret_rules::target::{normalize_request_target, ConnectAuthority, RequestTarget, RuleTarget};
+use secret_rules::target::{normalize_request_target, ConnectAuthority};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use url::Url;
@@ -35,6 +35,9 @@ use zeroize::Zeroizing;
 
 use crate::parser::detect_language;
 
+#[path = "url_fetch_sensitive.rs"]
+mod sensitive;
+
 const MAX_RESPONSE_BYTES: u64 = 8 * 1024 * 1024;
 const CACHE_TTL_MS: u64 = 24 * 60 * 60 * 1000;
 /// Longest a request may take to set up its connection (name lookup, TCP
@@ -817,25 +820,80 @@ pub(crate) fn create_secret_fetch_dir(storage_dir: &Path) -> Result<PathBuf, Url
 }
 
 /// What a placeholder fetch may do with its secrets.
-pub struct SecretFetch<'a> {
-    /// The vault `material` and `audit` go to.
-    pub vault: &'a dyn crate::secret::SecretVault,
+pub struct SecretFetch {
+    /// The vault each addressed request and audit record go to.
+    pub vault: Arc<dyn crate::secret::SecretVault>,
     /// The call's authorization scope; `None` only when the URL holds no
     /// well-formed placeholder, in which case nothing is resolved or audited.
     pub authorization: Option<crate::secret::SecretScope>,
-    /// Every label found in the URL, in order. Each has a rule in `rules`.
+    /// Every label found in the URL, in order.
     pub labels: Vec<String>,
-    /// The rule the vault granted for each label, carrying its grant id.
-    pub rules: Vec<LabelRule>,
+    /// Map an ephemeral test upstream to the vault's HTTPS/443 target.
+    #[cfg(test)]
+    pub test_https_port: Option<u16>,
     /// The fetch call's id: audit records name it, plus the hop index.
     pub call_id: String,
+    /// The foreground call's cancellation and absolute reply deadline.
+    pub cancellation: SecretFetchCancellation,
+}
+
+#[derive(Clone, Default)]
+pub struct SecretFetchCancellation {
+    job: Option<crate::executor::JobCancellation>,
+    deadline: Option<Instant>,
+}
+impl SecretFetchCancellation {
+    pub(crate) fn for_current_call() -> Self {
+        Self {
+            job: crate::executor::current_job_cancellation(),
+            deadline: crate::subc::current_fetch_reply_deadline(),
+        }
+    }
+    pub(crate) fn is_cancelled(&self) -> bool {
+        self.reason().is_some()
+    }
+    pub(crate) fn reason(&self) -> Option<crate::secret::requests::UseError> {
+        self.job
+            .as_ref()
+            .is_some_and(|job| job.cancel_requested_before_commit())
+            .then_some(crate::secret::requests::UseError::Cancelled)
+            .or_else(|| {
+                self.deadline
+                    .is_some_and(|at| Instant::now() >= at)
+                    .then_some(crate::secret::requests::UseError::Expired)
+            })
+    }
+    pub(crate) fn expires_at_ms(&self) -> Option<u64> {
+        self.deadline.map(|deadline| {
+            now_ms().saturating_add(
+                deadline
+                    .saturating_duration_since(Instant::now())
+                    .as_millis() as u64,
+            )
+        })
+    }
+    pub(crate) async fn cancelled(&self) {
+        loop {
+            if self.is_cancelled() {
+                return;
+            }
+            let delay = self.deadline.map_or(Duration::from_millis(25), |deadline| {
+                deadline
+                    .saturating_duration_since(Instant::now())
+                    .min(Duration::from_millis(25))
+            });
+            tokio::time::sleep(delay).await;
+        }
+    }
 }
 
 /// Keys the vault released during one placeholder fetch. They are kept, wiped
 /// on drop, only until the fetch returns, so every header and body read after
 /// a key was sent is scrubbed of it.
+/// These retained bytes are scrub patterns, never authorization or material
+/// for another send; every request obtains its own release from the vault.
 #[derive(Default)]
-struct HeldKeys(Vec<(String, Zeroizing<Vec<u8>>)>);
+pub(crate) struct HeldKeys(Vec<(String, Zeroizing<Vec<u8>>)>);
 
 impl HeldKeys {
     fn matchers(&self) -> Result<Vec<MatcherSet>, ScrubError> {
@@ -847,7 +905,7 @@ impl HeldKeys {
 
     /// Hold `key` for `label`, refusing a key whose matcher would collide with
     /// one already held (the scrubber could then write one key into a reply).
-    fn hold(&mut self, label: &str, key: &[u8]) -> Result<(), ScrubError> {
+    pub(crate) fn hold(&mut self, label: &str, key: &[u8]) -> Result<(), ScrubError> {
         if self
             .0
             .iter()
@@ -878,7 +936,7 @@ impl HeldKeys {
     /// Error text from a library (reqwest, the decoders) with every held key
     /// replaced by its placeholder. Text that still spells a key after that,
     /// or that cannot be scrubbed, is dropped whole.
-    fn sanitize_detail(&self, detail: &str) -> String {
+    pub(crate) fn sanitize_detail(&self, detail: &str) -> String {
         let deadline = Instant::now() + DETAIL_CHECK_LIMIT;
         match self.scrub(detail.as_bytes()) {
             Ok(clean) if self.reveal(&clean, deadline).is_clean() => {
@@ -947,7 +1005,7 @@ pub fn fetch_url_with_secrets(
     logical_url: &str,
     document_dir: &Path,
     options: UrlFetchOptions,
-    secrets: &SecretFetch<'_>,
+    secrets: &SecretFetch,
 ) -> Result<PathBuf, UrlFetchError> {
     let key_sent = std::cell::Cell::new(false);
     let result = fetch_with_secrets(logical_url, document_dir, options, secrets, &key_sent)
@@ -970,7 +1028,7 @@ fn fetch_with_secrets(
     logical_url: &str,
     document_dir: &Path,
     options: UrlFetchOptions,
-    secrets: &SecretFetch<'_>,
+    secrets: &SecretFetch,
     key_sent: &std::cell::Cell<bool>,
 ) -> Result<PathBuf, UrlFetchError> {
     let mut current = Url::parse(logical_url)
@@ -978,27 +1036,45 @@ fn fetch_with_secrets(
     // A fragment never reaches a server, and a rule never matches one.
     current.set_fragment(None);
     let start = current.clone();
-    let deadline = FetchDeadline::for_current_call();
+    let mut deadline = FetchDeadline::for_current_call();
     let approved = Arc::new(ApprovedHosts::default());
     let progress = Arc::new(ConnectProgress::default());
-    let client = build_client(&options, Arc::clone(&approved), Arc::clone(&progress))?;
+    let client = build_client(
+        &options,
+        Arc::clone(&approved),
+        Arc::clone(&progress),
+        false,
+        Some(secrets.cancellation.clone()),
+    )?;
     let mut held = HeldKeys::default();
     let mut hop = 0;
     let response = loop {
+        if secrets.cancellation.is_cancelled() {
+            return Err(secret_fetch_refused("missing_material", logical_url));
+        }
         validate_public_url(&current, &options, &deadline, &approved)?;
+        let waiting = Instant::now();
         let outbound = secret_hop(&current, hop, secrets, &mut held)?;
-        if outbound.is_some() {
-            key_sent.set(true);
-        }
+        // Approval is a separate person-wait budget, not network time.
+        let waited = waiting.elapsed();
+        deadline.at += waited;
+        crate::bounded_io::exclude_secret_approval_wait(waited);
         let sent = send_request(
             &client,
-            outbound.as_ref().unwrap_or(&current),
-            Some((current.as_str(), &held)),
+            &current,
+            Some(SecretSend {
+                shown: current.as_str(),
+                held: &held,
+                released: outbound.is_some(),
+                cancellation: &secrets.cancellation,
+                key_sent,
+                outbound: outbound.as_ref(),
+            }),
             &deadline,
             &progress,
         );
         // Wipe this function's copy of the key-bearing URL now that it is sent.
-        drop(outbound.map(|url| Zeroizing::new(String::from(url))));
+        drop(outbound);
         let response = sent?;
         if !response.status().is_redirection() {
             break response;
@@ -1102,7 +1178,6 @@ fn fetch_with_secrets(
         };
     let (raw, mut download_truncated) =
         read_response_body_with(response, logical_url, &deadline, &sanitize)?;
-    let raw = Zeroizing::new(raw);
     let decoded = decode_secret_body(&raw, &codings, &mut download_truncated, logical_url)?;
     let mut body = held.scrub(&decoded).map_err(scrub_refusal(logical_url))?;
     drop(decoded);
@@ -1316,11 +1391,11 @@ fn decode_secret_body(
     codings: &[SecretCoding],
     truncated: &mut bool,
     url: &str,
-) -> Result<Zeroizing<Vec<u8>>, UrlFetchError> {
+) -> Result<sensitive::Bytes, UrlFetchError> {
     use async_compression::tokio::bufread::{BrotliDecoder, GzipDecoder, ZlibDecoder};
     use tokio::io::{AsyncRead, BufReader};
 
-    let mut data = Zeroizing::new(body.to_vec());
+    let mut data = sensitive::Factory::current().copy(body);
     for coding in codings.iter().rev() {
         let input: &[u8] = &data;
         let reader: std::pin::Pin<Box<dyn AsyncRead + Send + '_>> = match coding {
@@ -1352,14 +1427,15 @@ fn decode_secret_body(
 fn drain_decoder(
     mut reader: std::pin::Pin<Box<dyn tokio::io::AsyncRead + Send + '_>>,
     input_truncated: bool,
-) -> Result<(Zeroizing<Vec<u8>>, bool), ()> {
+) -> Result<(sensitive::Bytes, bool), ()> {
     use std::future::Future;
     use tokio::io::AsyncReadExt;
 
-    let mut output = Zeroizing::new(Vec::new());
+    let factory = sensitive::Factory::current();
+    let mut output = factory.with_capacity(0);
     let polled = {
         let decoding = async {
-            let mut buffer = Zeroizing::new(vec![0u8; 16 * 1024]);
+            let mut buffer = factory.zeroed(16 * 1024);
             loop {
                 match reader.read(&mut buffer).await {
                     Ok(0) => return Ok(false),
@@ -1392,15 +1468,15 @@ fn drain_decoder(
 ///
 /// Returns the URL to send when a rule substitutes a key into this hop, or
 /// `None` to send `current` itself, whose placeholders then go out literally.
-/// Only `query` rules substitute; a rule with any other location leaves its
-/// placeholder literal. Each scanned label gets one audit record for the hop,
+/// Only `query` rules substitute; another location refuses before any card or
+/// releasing retry. Each scanned label gets one audit record for the hop,
 /// and a hop whose records cannot be written is not sent.
 fn secret_hop(
     current: &Url,
     hop: usize,
-    secrets: &SecretFetch<'_>,
+    secrets: &SecretFetch,
     held: &mut HeldKeys,
-) -> Result<Option<Url>, UrlFetchError> {
+) -> Result<Option<SecretOutboundUrl>, UrlFetchError> {
     let logical = current.as_str();
     let path = current.path();
     let target = match current.query() {
@@ -1417,45 +1493,91 @@ fn secret_hop(
                 .map(|host| ConnectAuthority { host, port })
         });
     let Some(authority) = authority else {
-        emit_hop_audit(secrets, held, hop, None, |_| {
+        emit_hop_audit(secrets, held, hop, None, &[], |_| {
             (Decision::Literal, AuditReason::OutOfScope)
         })
         .map_err(|_| secret_fetch_refused("audit_unavailable", logical))?;
         return Ok(None);
     };
     let refused = |held: &HeldKeys, reason: &str| {
-        let _ = emit_hop_audit(secrets, held, hop, Some(&authority), |_| {
+        let _ = emit_hop_audit(secrets, held, hop, Some(&authority), &[], |_| {
             (Decision::Refused, AuditReason::Refused)
         });
         secret_fetch_refused(reason, logical)
     };
 
-    let rules: Vec<LabelRule> = secrets
-        .rules
-        .iter()
-        .filter(|rule| matches!(rule.location, Location::Query(_)))
-        .cloned()
-        .collect();
-    let request = RequestTarget {
+    let mut rules = Vec::new();
+    let mut materials = Vec::new();
+    let present = secret_labels_in_url(logical).unwrap_or_default();
+    let normalized = normalize_request_target(path).map_err(|_| refused(held, "malformed_path"))?;
+    let addressed = crate::secret::ApiKeyTarget {
+        scheme: "https".into(),
         host: authority.host.clone(),
-        port: authority.port,
-        scheme: "https",
-        target: &target,
+        port: Some(443),
+        path: String::from_utf8(normalized.wire).map_err(|_| refused(held, "malformed_path"))?,
     };
-    let matched: Vec<bool> = rules
-        .iter()
-        .map(|rule| {
-            request
-                .matches(&RuleTarget {
-                    host: &rule.host,
-                    port: rule.port,
-                    path_prefix: &rule.path_prefix,
-                })
-                .is_ok()
-        })
-        .collect();
+    let mut eligible = Vec::new();
+    for label in &secrets.labels {
+        let https_port = authority.port == 443;
+        #[cfg(test)]
+        let https_port = https_port || secrets.test_https_port == Some(authority.port);
+        if !https_port || !present.contains(label) {
+            continue;
+        }
+        eligible.push(label.clone());
+    }
+    let answers = crate::subc::use_current_secret_labels(
+        secrets.vault.clone(),
+        &eligible,
+        &addressed,
+        &target,
+        &secrets.cancellation,
+    );
+    for (label, answer) in eligible.iter().zip(answers) {
+        let answer = match answer {
+            crate::subc::LaunchDecision::InvalidPlan(reason) => return Err(refused(held, reason)),
+            crate::subc::LaunchDecision::Proceed(answer) => answer,
+            #[cfg(test)]
+            crate::subc::LaunchDecision::Pending(pending) => {
+                let _ = refused(held, "missing_material");
+                return Err(UrlFetchError::secret(
+                    crate::secret::SECRET_ACCESS_PENDING,
+                    pending.message,
+                ));
+            }
+            crate::subc::LaunchDecision::Refuse(crate::secret::LabelOutcome::Refuse {
+                code,
+                message,
+            }) => {
+                let _ = refused(held, "missing_material");
+                return Err(UrlFetchError::secret(code, message));
+            }
+            _ => return Err(refused(held, "missing_material")),
+        };
+        if let crate::secret::UseAnswer::Released(released) = answer {
+            let (location, material) = released.into_parts();
+            let location = secret_rules::location::parse_vault_location(&location)
+                .ok_or_else(|| refused(held, "missing_material"))?;
+            if !matches!(location, Location::Query(_)) {
+                return Err(refused(held, "missing_material"));
+            }
+            if check_admissible(material.expose(), label, &location).is_err() {
+                return Err(refused(held, "material_not_admissible"));
+            }
+            held.hold(label, material.expose())
+                .map_err(|_| refused(held, "replacement_discloses_key"))?;
+            rules.push(LabelRule {
+                label: label.clone(),
+                host: addressed.host.clone(),
+                port: authority.port,
+                path_prefix: addressed.path.clone(),
+                location,
+            });
+            materials.push(Some(material));
+        }
+    }
     // Plan with a stand-in key first: the rules decide where a key would go,
-    // and refuse an ambiguous request, before the vault releases anything.
+    // and refuse an ambiguous request before copying released bytes into a URL.
     let planning: Vec<(String, Vec<u8>)> = rules
         .iter()
         .map(|rule| (rule.label.clone(), SECRET_PLANNING_KEY.to_vec()))
@@ -1466,45 +1588,6 @@ fn secret_hop(
         return Err(refused(&*held, refusal.reason()));
     }
 
-    // Material is asked only for a rule this hop actually substitutes. A
-    // rule whose host and path match while its placeholder is absent, not the
-    // whole value, or in another parameter needs no key, and asking anyway
-    // would spend a single-use grant on a request that sends none.
-    let mut materials = Vec::with_capacity(rules.len());
-    for ((rule, matched), planned) in rules.iter().zip(&matched).zip(&plan.labels) {
-        if !matched || !planned.is_substituted() {
-            materials.push(None);
-            continue;
-        }
-        let Some(scope) = secrets.authorization.as_ref() else {
-            return Err(refused(&*held, "missing_material"));
-        };
-        let material = match secrets.vault.material(scope, &rule.label, &rule.grant_id) {
-            Ok(material) => material,
-            Err(error) => {
-                let _ = emit_hop_audit(secrets, held, hop, Some(&authority), |_| {
-                    (Decision::Refused, AuditReason::Refused)
-                });
-                return Err(
-                    match crate::secret::outcome_for_material(&rule.label, &error) {
-                        crate::secret::LabelOutcome::Refuse { code, message } => {
-                            UrlFetchError::secret(code, message)
-                        }
-                        _ => secret_fetch_refused("missing_material", logical),
-                    },
-                );
-            }
-        };
-        if check_admissible(material.expose(), &rule.label, &rule.location).is_err() {
-            return Err(refused(&*held, "material_not_admissible"));
-        }
-        // The matcher is installed before any byte of this hop is sent.
-        if held.hold(&rule.label, material.expose()).is_err() {
-            return Err(refused(&*held, "replacement_discloses_key"));
-        }
-        materials.push(Some(material));
-    }
-
     let query_start = path.len() + 1;
     let mut edits: Vec<(usize, usize, Zeroizing<Vec<u8>>)> = Vec::new();
     for ((rule, outcome), material) in rules.iter().zip(&plan.labels).zip(&materials) {
@@ -1538,21 +1621,15 @@ fn secret_hop(
         }
     };
     if edits.is_empty() {
-        emit_hop_audit(secrets, held, hop, Some(&authority), decide)
+        emit_hop_audit(secrets, held, hop, Some(&authority), &rules, decide)
             .map_err(|_| secret_fetch_refused("audit_unavailable", logical))?;
         return Ok(None);
     }
 
     edits.sort_by_key(|(start, _, _)| *start);
     let query = current.query().unwrap_or_default().as_bytes();
-    let mut substituted = Zeroizing::new(Vec::with_capacity(query.len() + 64));
-    let mut cursor = 0;
-    for (start, end, replacement) in &edits {
-        substituted.extend_from_slice(&query[cursor..*start]);
-        substituted.extend_from_slice(replacement);
-        cursor = *end;
-    }
-    substituted.extend_from_slice(&query[cursor..]);
+    let substituted =
+        substitute_query(query, &edits).ok_or_else(|| refused(held, "malformed_query"))?;
     let Ok(substituted) = std::str::from_utf8(&substituted) else {
         return Err(refused(&*held, "malformed_query"));
     };
@@ -1564,21 +1641,91 @@ fn secret_hop(
     let Ok(wire_path) = std::str::from_utf8(&normalized.wire) else {
         return Err(refused(&*held, "malformed_path"));
     };
-    let mut outbound = current.clone();
-    outbound.set_path(wire_path);
-    outbound.set_query(Some(substituted));
-    emit_hop_audit(secrets, held, hop, Some(&authority), decide)
+    emit_hop_audit(secrets, held, hop, Some(&authority), &rules, decide)
         .map_err(|_| secret_fetch_refused("audit_unavailable", logical))?;
-    Ok(Some(outbound))
+    secret_outbound_url(current, wire_path, substituted)
+        .map(Some)
+        .ok_or_else(|| refused(held, "malformed_query"))
+}
+
+#[cfg(test)]
+thread_local! { static SECRET_URL_BUILDS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) }; }
+
+struct SecretOutboundUrl(sensitive::Bytes);
+impl std::ops::Deref for SecretOutboundUrl {
+    type Target = str;
+    fn deref(&self) -> &str {
+        std::str::from_utf8(&self.0).expect("URL serialization is UTF-8")
+    }
+}
+impl SecretOutboundUrl {
+    fn as_str(&self) -> &str {
+        self
+    }
+}
+impl fmt::Debug for SecretOutboundUrl {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("ProtectedOutboundUrl")
+    }
+}
+
+fn secret_outbound_url(
+    current: &Url,
+    wire_path: &str,
+    substituted: &str,
+) -> Option<SecretOutboundUrl> {
+    #[cfg(test)]
+    SECRET_URL_BUILDS.with(|n| n.set(n.get() + 1));
+    let prefix = &current[..url::Position::BeforePath];
+    let capacity = prefix
+        .len()
+        .checked_add(wire_path.len())?
+        .checked_add(1)?
+        .checked_add(substituted.len())?;
+    // Build the complete serialization in protected, pre-sized storage instead
+    // of reallocating a partially key-bearing Url with clone/set_query.
+    let mut serialized = sensitive::Factory::current().with_capacity(capacity);
+    serialized.extend_from_slice(prefix.as_bytes());
+    serialized.extend_from_slice(wire_path.as_bytes());
+    serialized.extend_from_slice(b"?");
+    serialized.extend_from_slice(substituted.as_bytes());
+    Some(SecretOutboundUrl(serialized))
+}
+
+fn substitute_query(
+    query: &[u8],
+    edits: &[(usize, usize, Zeroizing<Vec<u8>>)],
+) -> Option<Zeroizing<Vec<u8>>> {
+    let final_len = edits
+        .iter()
+        .try_fold(query.len(), |len, (start, end, value)| {
+            len.checked_sub(end.checked_sub(*start)?)?
+                .checked_add(value.len())
+        })?;
+    // Allocate the complete result before copying the first credential: growing
+    // a partially filled Vec would free an old, unwiped credential allocation.
+    let mut substituted = Zeroizing::new(Vec::with_capacity(final_len));
+    let mut cursor = 0;
+    for (start, end, replacement) in edits {
+        if *start < cursor || *end < *start || *end > query.len() {
+            return None;
+        }
+        substituted.extend_from_slice(&query[cursor..*start]);
+        substituted.extend_from_slice(replacement);
+        cursor = *end;
+    }
+    substituted.extend_from_slice(&query[cursor..]);
+    Some(substituted)
 }
 
 /// One audit record per scanned label for one hop. A record is handed to the
 /// vault only after the crate's writer checked it against every held key.
 fn emit_hop_audit(
-    secrets: &SecretFetch<'_>,
+    secrets: &SecretFetch,
     held: &HeldKeys,
     hop: usize,
     authority: Option<&ConnectAuthority>,
+    rules: &[LabelRule],
     decide: impl Fn(&str) -> (Decision, AuditReason),
 ) -> Result<(), ()> {
     let origin = format!("{}#{hop}", secrets.call_id);
@@ -1600,11 +1747,14 @@ fn emit_hop_audit(
                 .as_ref()
                 .map(crate::secret::SecretScope::to_scope_ref),
         );
-        let rule = secrets.rules.iter().find(|rule| &rule.label == label);
-        if let (Some(authority), Some(rule)) = (authority, rule) {
+        if let Some(authority) = authority {
+            record.host = Some(authority.host.clone());
+            record.port = Some(authority.port);
+        }
+        if let Some(rule) = rules.iter().find(|rule| &rule.label == label) {
             record = record.with_rule(
-                &authority.host,
-                authority.port,
+                &rule.host,
+                rule.port,
                 &rule.path_prefix,
                 location_kind_token(&rule.location),
             );
@@ -1915,7 +2065,13 @@ fn fetch_with_redirects(
     approved: Arc<ApprovedHosts>,
 ) -> Result<HttpResponse, UrlFetchError> {
     let progress = Arc::new(ConnectProgress::default());
-    let client = build_client(options, Arc::clone(&approved), Arc::clone(&progress))?;
+    let client = build_client(
+        options,
+        Arc::clone(&approved),
+        Arc::clone(&progress),
+        true,
+        None,
+    )?;
     let mut current_url = start_url.clone();
 
     for redirect_count in 0..=MAX_REDIRECTS {
@@ -1976,6 +2132,16 @@ fn send_with_transient_retries(
     send_request(client, target, None, deadline, progress)
 }
 
+#[derive(Clone, Copy)]
+struct SecretSend<'a> {
+    shown: &'a str,
+    held: &'a HeldKeys,
+    released: bool,
+    cancellation: &'a SecretFetchCancellation,
+    key_sent: &'a std::cell::Cell<bool>,
+    outbound: Option<&'a SecretOutboundUrl>,
+}
+
 /// [`send_with_transient_retries`] for one request. With `secret` set, the
 /// request belongs to a placeholder fetch: every message names the given
 /// placeholder URL instead of `target`, a failure is reported through
@@ -1984,7 +2150,7 @@ fn send_with_transient_retries(
 fn send_request(
     client: &Client,
     target: &Url,
-    secret: Option<(&str, &HeldKeys)>,
+    secret: Option<SecretSend<'_>>,
     deadline: &FetchDeadline,
     progress: &ConnectProgress,
 ) -> Result<HttpResponse, UrlFetchError> {
@@ -2005,12 +2171,12 @@ fn send_request(
 fn send_request_attempts(
     client: &Client,
     target: &Url,
-    secret: Option<(&str, &HeldKeys)>,
+    secret: Option<SecretSend<'_>>,
     deadline: &FetchDeadline,
     progress: &ConnectProgress,
 ) -> Result<HttpResponse, UrlFetchError> {
-    let named = secret.map_or(target.as_str(), |(shown, _)| shown);
-    let held = secret.map(|(_, held)| held);
+    let named = secret.map_or(target.as_str(), |secret| secret.shown);
+    let held = secret.map(|secret| secret.held);
     let mut attempt = 0;
     loop {
         let remaining = deadline.remaining();
@@ -2020,25 +2186,47 @@ fn send_request_attempts(
         // A per-request timeout replaces reqwest's default 30 s, which would
         // otherwise let one silent server hold each attempt for 30 s.
         progress.begin_attempt();
+        // Parse directly from protected serialization and move the Url into
+        // reqwest. AFT must not clone a key-bearing URL's ordinary String.
+        let outbound = match secret.and_then(|secret| secret.outbound) {
+            Some(outbound) => Url::parse(outbound.as_str())
+                .map_err(|_| secret_fetch_refused("malformed_query", named))?,
+            None => target.clone(),
+        };
         let mut request = client
-            .get(target.clone())
+            .get(outbound)
             .header(USER_AGENT, USER_AGENT_VALUE)
             .header(ACCEPT, ACCEPT_HEADER)
             .timeout(remaining.min(HEADERS_TIMEOUT));
         if held.is_some() {
             request = request.header(ACCEPT_ENCODING, "identity");
         }
+        if secret.is_some_and(|secret| secret.cancellation.is_cancelled()) {
+            return Err(secret_fetch_refused("missing_material", named));
+        }
+        if let Some(secret) = secret.filter(|secret| secret.released) {
+            secret.key_sent.set(true);
+        }
         let error = match request.send() {
             Ok(response) => return Ok(response),
             Err(error) => error,
         };
+        if secret.is_some_and(|secret| secret.cancellation.is_cancelled()) {
+            // A cancelled secret request returns its existing refusal rather
+            // than exposing a transport error from connection setup.
+            return Err(secret_fetch_refused("missing_material", named));
+        }
         let phase = error
             .is_timeout()
             .then(|| timed_out_phase(&error, progress));
         // A server that accepted the request and stayed silent until the
         // headers limit is not a passing connection fault; retrying it would
         // only spend the rest of the deadline the same way.
-        let retryable = is_transient_reqwest_error(&error) && phase != Some(FetchPhase::Headers);
+        // One released key authorizes one send attempt, even if the peer received
+        // the credential and reset before its response reached this process.
+        let retryable = !secret.is_some_and(|secret| secret.released)
+            && is_transient_reqwest_error(&error)
+            && phase != Some(FetchPhase::Headers);
         let backoff = TRANSIENT_RETRY_BACKOFFS_MS
             .get(attempt)
             .map(|ms| Duration::from_millis(*ms))
@@ -2137,6 +2325,8 @@ fn build_client(
     options: &UrlFetchOptions,
     approved: Arc<ApprovedHosts>,
     progress: Arc<ConnectProgress>,
+    automatic_replays: bool,
+    cancellation: Option<SecretFetchCancellation>,
 ) -> Result<Client, UrlFetchError> {
     let resolver = GuardedResolver {
         approved,
@@ -2150,8 +2340,14 @@ fn build_client(
         .connector_layer(TrackConnect {
             progress,
             delay: options.connect_delay,
+            cancellation,
         })
         .dns_resolver(Arc::new(resolver));
+    let builder = if automatic_replays {
+        builder
+    } else {
+        builder.retry(reqwest::retry::never())
+    };
 
     let tls_config = match &options.tls_config {
         Some(config) => config.clone(),
@@ -2276,6 +2472,7 @@ impl ConnectProgress {
 struct TrackConnect {
     progress: Arc<ConnectProgress>,
     delay: Option<Duration>,
+    cancellation: Option<SecretFetchCancellation>,
 }
 
 impl<S> tower_layer::Layer<S> for TrackConnect {
@@ -2286,6 +2483,7 @@ impl<S> tower_layer::Layer<S> for TrackConnect {
             inner,
             progress: Arc::clone(&self.progress),
             delay: self.delay,
+            cancellation: self.cancellation.clone(),
         }
     }
 }
@@ -2295,6 +2493,7 @@ struct TrackedConnector<S> {
     inner: S,
     progress: Arc<ConnectProgress>,
     delay: Option<Duration>,
+    cancellation: Option<SecretFetchCancellation>,
 }
 
 impl<S, Target> tower_service::Service<Target> for TrackedConnector<S>
@@ -2302,24 +2501,26 @@ where
     S: tower_service::Service<Target>,
     S::Future: Send + 'static,
     S::Response: Send + 'static,
-    S::Error: Send + 'static,
+    S::Error: Into<Box<dyn std::error::Error + Send + Sync>> + Send + 'static,
 {
     type Response = S::Response;
-    type Error = S::Error;
-    type Future =
-        std::pin::Pin<Box<dyn std::future::Future<Output = Result<S::Response, S::Error>> + Send>>;
+    type Error = Box<dyn std::error::Error + Send + Sync>;
+    type Future = std::pin::Pin<
+        Box<dyn std::future::Future<Output = Result<S::Response, Self::Error>> + Send>,
+    >;
 
     fn poll_ready(
         &mut self,
         cx: &mut std::task::Context<'_>,
     ) -> std::task::Poll<Result<(), Self::Error>> {
-        self.inner.poll_ready(cx)
+        self.inner.poll_ready(cx).map_err(Into::into)
     }
 
     fn call(&mut self, target: Target) -> Self::Future {
         let attempt = self.progress.connect_started();
         let progress = Arc::clone(&self.progress);
         let delay = self.delay;
+        let cancellation = self.cancellation.clone();
         let connecting = self.inner.call(target);
         Box::pin(async move {
             // Records on drop too, so a connect a timeout abandons still
@@ -2331,11 +2532,14 @@ where
             if let Some(delay) = delay {
                 tokio::time::sleep(delay).await;
             }
-            let connection = connecting.await;
-            if connection.is_ok() {
-                progress.connected(attempt);
+            let connection = connecting.await.map_err(Into::into)?;
+            // The inner connector includes DNS, TCP and TLS. Check again at
+            // its handover boundary, before hyper can write request bytes.
+            if cancellation.is_some_and(|cancel| cancel.is_cancelled()) {
+                return Err(std::io::Error::from(std::io::ErrorKind::Interrupted).into());
             }
-            connection
+            progress.connected(attempt);
+            Ok(connection)
         })
     }
 }
@@ -3050,10 +3254,10 @@ fn element_attr_value<'a>(element: &'a Element<'_>, name: &str) -> Option<&'a st
 }
 
 enum BodyReadEvent {
-    Chunk(Vec<u8>),
+    Chunk(sensitive::Bytes),
     Done,
     /// A read failed after waiting this long for data.
-    Error(io::ErrorKind, String, Duration),
+    Error(io::ErrorKind, sensitive::Bytes, Duration),
 }
 
 /// Read at most [`MAX_RESPONSE_BYTES`] (plus one lookahead byte) of the body.
@@ -3075,6 +3279,7 @@ fn read_response_body(
     deadline: &FetchDeadline,
 ) -> Result<(Vec<u8>, bool), UrlFetchError> {
     read_response_body_with(response, url, deadline, &|detail: &str| detail.to_string())
+        .map(|(body, truncated)| (body.into_plain_vec(), truncated))
 }
 
 /// [`read_response_body`] with `detail` applied to the text of a failed read
@@ -3084,15 +3289,17 @@ fn read_response_body_with(
     url: &str,
     deadline: &FetchDeadline,
     detail: &dyn Fn(&str) -> String,
-) -> Result<(Vec<u8>, bool), UrlFetchError> {
+) -> Result<(sensitive::Bytes, bool), UrlFetchError> {
     // Bound the producer, not just its consumer: an unbounded channel can
     // queue the entire response before the caller notices the byte ceiling.
     let (tx, rx) = mpsc::sync_channel(1);
+    let factory = sensitive::Factory::current();
+    let worker = factory.clone();
     thread::spawn(move || {
         // One lookahead byte distinguishes an exact-size body from a cut,
         // including chunked responses without Content-Length.
         let mut response = response.take(MAX_RESPONSE_BYTES + 1);
-        let mut buffer = [0u8; 16 * 1024];
+        let mut buffer = worker.zeroed(16 * 1024);
         loop {
             let read_started = Instant::now();
             match response.read(&mut buffer) {
@@ -3101,13 +3308,16 @@ fn read_response_body_with(
                     break;
                 }
                 Ok(n) => {
-                    if tx.send(BodyReadEvent::Chunk(buffer[..n].to_vec())).is_err() {
+                    if tx
+                        .send(BodyReadEvent::Chunk(worker.copy(&buffer[..n])))
+                        .is_err()
+                    {
                         break;
                     }
                 }
                 Err(error) => {
                     let kind = error.kind();
-                    let message = error.to_string();
+                    let message = worker.format(format_args!("{error}"));
                     let waited = read_started.elapsed();
                     let _ = tx.send(BodyReadEvent::Error(kind, message, waited));
                     break;
@@ -3135,7 +3345,7 @@ fn read_response_body_with(
         started: Instant::now(),
         bytes: 0,
     };
-    let mut chunks = Vec::new();
+    let mut chunks = factory.with_capacity(0);
     let mut total = 0u64;
     let slow_body_error = || {
         if deadline.expired() {
@@ -3165,7 +3375,7 @@ fn read_response_body_with(
                     deadline,
                     url,
                     kind,
-                    &detail(&message),
+                    &detail(std::str::from_utf8(&message).unwrap_or_default()),
                     waited,
                 ));
             }
@@ -4104,3 +4314,86 @@ mod fetch_times_tests {
         );
     }
 }
+
+#[cfg(test)]
+mod secret_audit_regressions {
+    use super::*;
+    #[test]
+    fn substituted_query_allocates_its_exact_complete_size_before_copying_any_key() {
+        let first = Zeroizing::new(vec![b'a'; 1001]);
+        let second = Zeroizing::new(vec![b'b'; 2103]);
+        let result = substitute_query(b"a=x&b=y", &[(2, 3, first), (6, 7, second)]).unwrap();
+        assert_eq!(result.len(), 5 + 1001 + 2103);
+        assert_eq!(
+            result.capacity(),
+            result.len(),
+            "a later key must not reallocate a buffer that already contains an earlier key"
+        );
+        assert_eq!(&result[..2], b"a=");
+        assert_eq!(&result[1003..1006], b"&b=");
+    }
+    #[test]
+    fn approval_wait_preserves_the_fetch_and_read_back_network_budget() {
+        let _scope = crate::bounded_io::enter(Some(crate::bounded_io::Budget::after(
+            Duration::from_secs(25),
+        )));
+        let before = crate::bounded_io::current().unwrap().deadline;
+        let deadline = FetchDeadline::for_current_call();
+        let person_wait = Duration::from_secs(360);
+        crate::bounded_io::exclude_secret_approval_wait(person_wait);
+        assert_eq!(
+            crate::bounded_io::current().unwrap().deadline,
+            before + person_wait
+        );
+        assert_eq!(deadline.allowed, URL_FETCH_CEILING);
+    }
+    #[test]
+    fn failed_audit_does_not_create_an_ordinary_key_bearing_url() {
+        struct NoAudit;
+        impl crate::secret::SecretVault for NoAudit {
+            fn use_secret(
+                &self,
+                _: &crate::secret::SecretScope,
+                _: &str,
+                _: &crate::secret::ApiKeyTarget,
+            ) -> crate::secret::UseAnswer {
+                crate::secret::UseAnswer::Released(crate::secret::ReleasedApiKey::new(
+                    "query:key".into(),
+                    crate::secret::Material::new(b"released-test-key-123456".to_vec()),
+                ))
+            }
+            fn audit(&self, _: &AuditRecordV1) -> Result<(), crate::secret::AuditError> {
+                Err(crate::secret::AuditError::Unavailable {
+                    detail: "offline".into(),
+                })
+            }
+        }
+        let root = tempfile::tempdir().unwrap();
+        let stamp: subc_protocol::scope::ScopeStamp = serde_json::from_value(serde_json::json!({"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"audit-url","kind":"head","scope_epoch":1,"owner_authorized":true})).unwrap();
+        let scope = crate::secret::SecretScope::from_stamp(&stamp);
+        SECRET_URL_BUILDS.with(|n| n.set(0));
+        crate::subc::with_secret_identity_for_test(root.path(), stamp, || {
+            let secrets = SecretFetch {
+                vault: Arc::new(NoAudit),
+                authorization: Some(scope),
+                labels: vec!["test".into()],
+                test_https_port: None,
+                call_id: "audit-url".into(),
+                cancellation: Default::default(),
+            };
+            let mut held = HeldKeys::default();
+            assert!(secret_hop(
+                &Url::parse("https://example.test/doc.md?key={{ck-secret:test}}").unwrap(),
+                0,
+                &secrets,
+                &mut held
+            )
+            .is_err());
+        });
+        assert_eq!(
+            SECRET_URL_BUILDS.with(std::cell::Cell::get),
+            0,
+            "audit refusal must precede construction of any Url that owns a key"
+        );
+    }
+}
diff --git a/crates/aft/src/url_fetch_sensitive.rs b/crates/aft/src/url_fetch_sensitive.rs
new file mode 100644
index 0000000000..aa1daf14ef
--- /dev/null
+++ b/crates/aft/src/url_fetch_sensitive.rs
@@ -0,0 +1,368 @@
+//! Fetch-owned response and formatting buffers wipe before every allocation is freed.
+use std::ops::{Deref, DerefMut};
+use zeroize::{Zeroize, Zeroizing};
+
+#[derive(Clone, Default)]
+pub(super) struct Factory {
+    #[cfg(test)]
+    trace: Option<std::sync::Arc<testing::Trace>>,
+}
+impl Factory {
+    pub(super) fn current() -> Self {
+        Self {
+            #[cfg(test)]
+            trace: testing::CURRENT.with(|slot| slot.borrow().clone()),
+        }
+    }
+    pub(super) fn with_capacity(&self, capacity: usize) -> Bytes {
+        Bytes {
+            data: Zeroizing::new(Vec::with_capacity(capacity)),
+            factory: self.clone(),
+        }
+    }
+    pub(super) fn copy(&self, bytes: &[u8]) -> Bytes {
+        let mut owned = self.with_capacity(bytes.len());
+        owned.extend_from_slice(bytes);
+        owned
+    }
+    pub(super) fn zeroed(&self, length: usize) -> Bytes {
+        let mut owned = self.with_capacity(length);
+        owned.data.resize(length, 0);
+        owned
+    }
+    pub(super) fn format(&self, args: std::fmt::Arguments<'_>) -> Bytes {
+        use std::fmt::Write;
+        let mut owned = self.with_capacity(0);
+        owned
+            .write_fmt(args)
+            .expect("formatting into owned memory cannot fail");
+        owned
+    }
+    fn wipe(&self, data: &mut Vec<u8>, growth: bool) {
+        #[cfg(test)]
+        let contained_key = self
+            .trace
+            .as_ref()
+            .is_some_and(|trace| trace.contains(data));
+        data.as_mut_slice().zeroize();
+        #[cfg(test)]
+        if contained_key {
+            self.trace.as_ref().unwrap().record(data, growth);
+        }
+        #[cfg(not(test))]
+        let _ = growth;
+    }
+}
+
+pub(super) struct Bytes {
+    data: Zeroizing<Vec<u8>>,
+    factory: Factory,
+}
+impl Bytes {
+    pub(super) fn extend_from_slice(&mut self, bytes: &[u8]) {
+        let required = self
+            .data
+            .len()
+            .checked_add(bytes.len())
+            .expect("buffer length overflow");
+        if required > self.data.capacity() {
+            // Vec::reserve may free a populated allocation without wiping it.
+            // Copy into a new owner, then wipe the old allocation before drop.
+            let capacity = required.max(self.data.capacity().saturating_mul(2));
+            let mut next = Zeroizing::new(Vec::with_capacity(capacity));
+            next.extend_from_slice(&self.data);
+            self.factory.wipe(&mut self.data, true);
+            self.data = next;
+        }
+        self.data.extend_from_slice(bytes);
+    }
+    pub(super) fn into_plain_vec(mut self) -> Vec<u8> {
+        // Only the ordinary, non-secret downloader transfers plain ownership.
+        std::mem::take(&mut *self.data)
+    }
+}
+impl Drop for Bytes {
+    fn drop(&mut self) {
+        self.factory.wipe(&mut self.data, false);
+    }
+}
+impl Deref for Bytes {
+    type Target = [u8];
+    fn deref(&self) -> &[u8] {
+        &self.data
+    }
+}
+impl DerefMut for Bytes {
+    fn deref_mut(&mut self) -> &mut [u8] {
+        &mut self.data
+    }
+}
+impl std::fmt::Write for Bytes {
+    fn write_str(&mut self, text: &str) -> std::fmt::Result {
+        self.extend_from_slice(text.as_bytes());
+        Ok(())
+    }
+}
+impl std::fmt::Debug for Bytes {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ProtectedFetchBytes")
+            .field("length", &self.len())
+            .finish()
+    }
+}
+
+#[cfg(test)]
+pub(super) mod testing {
+    use std::sync::{Arc, Condvar, Mutex};
+    use std::time::{Duration, Instant};
+    thread_local! { pub(super) static CURRENT: std::cell::RefCell<Option<Arc<Trace>>> = const { std::cell::RefCell::new(None) }; }
+    #[derive(Clone, Debug)]
+    pub(in crate::url_fetch) struct Wipe {
+        pub growth: bool,
+        pub zeroed: bool,
+        pub capacity: usize,
+    }
+    pub(in crate::url_fetch) struct Trace {
+        needle: &'static [u8],
+        records: Mutex<Vec<Wipe>>,
+        changed: Condvar,
+    }
+    impl Trace {
+        pub(super) fn contains(&self, bytes: &[u8]) -> bool {
+            bytes
+                .windows(self.needle.len())
+                .any(|window| window == self.needle)
+        }
+        pub(super) fn record(&self, bytes: &Vec<u8>, growth: bool) {
+            self.records.lock().unwrap().push(Wipe {
+                growth,
+                zeroed: bytes.iter().all(|byte| *byte == 0),
+                capacity: bytes.capacity(),
+            });
+            self.changed.notify_all();
+        }
+        pub(in crate::url_fetch) fn wait_for(&self, count: usize) -> Vec<Wipe> {
+            let end = Instant::now() + Duration::from_secs(2);
+            let mut records = self.records.lock().unwrap();
+            while records.len() < count && Instant::now() < end {
+                records = self
+                    .changed
+                    .wait_timeout(records, end.saturating_duration_since(Instant::now()))
+                    .unwrap()
+                    .0;
+            }
+            records.clone()
+        }
+    }
+    pub(in crate::url_fetch) struct Restore(Option<Arc<Trace>>);
+    impl Drop for Restore {
+        fn drop(&mut self) {
+            CURRENT.with(|slot| slot.replace(self.0.take()));
+        }
+    }
+    pub(in crate::url_fetch) fn track(needle: &'static [u8]) -> (Arc<Trace>, Restore) {
+        let trace = Arc::new(Trace {
+            needle,
+            records: Default::default(),
+            changed: Default::default(),
+        });
+        let restore = Restore(CURRENT.with(|slot| slot.replace(Some(trace.clone()))));
+        (trace, restore)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::*;
+    use std::io::Cursor;
+    const KEY: &[u8] = b"echo-fetch-key-0123456789";
+
+    struct FailsAfterBody {
+        body: Cursor<Vec<u8>>,
+        pause: Duration,
+    }
+    impl Read for FailsAfterBody {
+        fn read(&mut self, output: &mut [u8]) -> io::Result<usize> {
+            if self.body.position() < self.body.get_ref().len() as u64 {
+                return self.body.read(output);
+            }
+            thread::sleep(self.pause);
+            Err(io::Error::other(
+                "echoed read failure echo-fetch-key-0123456789",
+            ))
+        }
+    }
+
+    #[test]
+    fn secret_body_success_wipes_each_echo_chunk_and_old_accumulator_before_growth() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let input = KEY.repeat(8000);
+        let (body, cut) = read_response_body_with(
+            Cursor::new(input.clone()),
+            "https://api.test/doc",
+            &FetchDeadline::for_current_call(),
+            &str::to_owned,
+        )
+        .unwrap();
+        assert!(!cut);
+        assert_eq!(&*body, &input);
+        drop(body);
+        let wipes = trace.wait_for(4);
+        assert!(
+            wipes.len() >= 4,
+            "chunk, scratch and accumulator owners all wipe"
+        );
+        assert!(
+            wipes.iter().any(|wipe| wipe.growth),
+            "old populated allocations must wipe before growth frees them"
+        );
+        assert!(wipes.iter().all(|wipe| wipe.zeroed));
+    }
+
+    #[test]
+    fn secret_body_read_error_wipes_echo_chunks_accumulator_and_formatted_error() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let mut held = HeldKeys::default();
+        held.hold("test", KEY).unwrap();
+        let input = FailsAfterBody {
+            body: Cursor::new(KEY.repeat(4000)),
+            pause: Duration::ZERO,
+        };
+        let error = read_response_body_with(
+            input,
+            "https://api.test/doc",
+            &FetchDeadline::for_current_call(),
+            &|detail| held.sanitize_detail(detail),
+        )
+        .unwrap_err();
+        assert!(error.to_string().contains("{{ck-secret:test}}"));
+        assert!(!error
+            .to_string()
+            .contains(std::str::from_utf8(KEY).unwrap()));
+        let wipes = trace.wait_for(4);
+        assert!(wipes.len() >= 4);
+        assert!(wipes.iter().any(|wipe| wipe.growth));
+        assert!(
+            wipes.iter().any(|wipe| wipe.capacity < 1024),
+            "the formatted peer error must have a wiping owner too"
+        );
+        assert!(wipes.iter().all(|wipe| wipe.zeroed));
+    }
+
+    #[test]
+    fn secret_body_deadline_wipes_the_accumulator_and_queued_echoes_on_exit() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let input = FailsAfterBody {
+            body: Cursor::new(KEY.repeat(4000)),
+            pause: Duration::from_millis(100),
+        };
+        let mut deadline = FetchDeadline::for_current_call();
+        deadline.at = Instant::now() + Duration::from_millis(30);
+        assert!(
+            read_response_body_with(input, "https://api.test/doc", &deadline, &str::to_owned)
+                .is_err()
+        );
+        let wipes = trace.wait_for(5);
+        assert!(wipes.len() >= 5);
+        assert!(wipes.iter().all(|wipe| wipe.zeroed));
+    }
+
+    struct FailingDecoder {
+        body: Vec<u8>,
+        cursor: usize,
+    }
+    impl tokio::io::AsyncRead for FailingDecoder {
+        fn poll_read(
+            mut self: std::pin::Pin<&mut Self>,
+            _: &mut std::task::Context<'_>,
+            output: &mut tokio::io::ReadBuf<'_>,
+        ) -> std::task::Poll<io::Result<()>> {
+            if self.cursor == self.body.len() {
+                return std::task::Poll::Ready(Err(io::Error::other("injected decoder failure")));
+            }
+            let count = output.remaining().min(self.body.len() - self.cursor);
+            output.put_slice(&self.body[self.cursor..self.cursor + count]);
+            self.cursor += count;
+            std::task::Poll::Ready(Ok(()))
+        }
+    }
+
+    #[test]
+    fn secret_decoder_error_wipes_scratch_output_and_old_growth_allocations() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let reader = FailingDecoder {
+            body: KEY.repeat(4000),
+            cursor: 0,
+        };
+        assert!(drain_decoder(Box::pin(reader), false).is_err());
+        let wipes = trace.wait_for(3);
+        assert!(wipes.len() >= 3);
+        assert!(wipes.iter().any(|wipe| wipe.growth));
+        assert!(wipes.iter().all(|wipe| wipe.zeroed));
+    }
+
+    #[test]
+    fn secret_outbound_serialization_is_presized_owned_and_wiped_without_url_mutation() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let current =
+            Url::parse("https://api.test:443/old?key={{ck-secret:test}}#never-sent").unwrap();
+        let query = "key=echo-fetch-key-0123456789";
+        let expected = format!("https://api.test/normalized?{query}");
+        let outbound = secret_outbound_url(&current, "/normalized", query).unwrap();
+        assert_eq!(outbound.as_str(), expected);
+        assert_eq!(format!("{outbound:?}"), "ProtectedOutboundUrl");
+        drop(outbound);
+        let wipes = trace.wait_for(1);
+        assert_eq!(
+            wipes.len(),
+            1,
+            "one protected whole serialization, no clone/set_query intermediates"
+        );
+        assert!(!wipes[0].growth);
+        assert_eq!(wipes[0].capacity, expected.len());
+        assert!(wipes[0].zeroed);
+    }
+
+    #[test]
+    fn secret_outbound_buffer_remains_zeroizing_until_reqwest_takes_its_url() {
+        let (trace, _scope) = super::testing::track(KEY);
+        let current = Url::parse("https://api.test/old?key={{ck-secret:test}}").unwrap();
+        let outbound =
+            secret_outbound_url(&current, "/normalized", "key=echo-fetch-key-0123456789").unwrap();
+        assert!(trace.wait_for(0).is_empty(), "the protected serialization must stay owned until handover, not be replaced by an ordinary Url string");
+        let request_url = Url::parse(outbound.as_str()).unwrap();
+        let client = Client::builder().build().unwrap();
+        let request = client.get(request_url).build().unwrap();
+        assert_eq!(request.url().query(), Some("key=echo-fetch-key-0123456789"));
+        drop(outbound);
+        let wipes = trace.wait_for(1);
+        assert_eq!(wipes.len(), 1);
+        assert!(wipes[0].zeroed && !wipes[0].growth);
+    }
+
+    #[test]
+    fn sanitize_detail_masks_raw_and_percent_encoded_key_spellings() {
+        let mut held = HeldKeys::default();
+        held.hold("test", KEY).unwrap();
+        let raw = std::str::from_utf8(KEY).unwrap();
+        for spelling in [
+            raw.to_owned(),
+            KEY.iter()
+                .map(|byte| format!("%{byte:02X}"))
+                .collect::<String>(),
+            KEY.iter()
+                .map(|byte| format!("%{byte:02x}"))
+                .collect::<String>(),
+            format!("%65{}", &raw[1..]),
+        ] {
+            let clean =
+                held.sanitize_detail(&format!("request https://api.test/?key={spelling} failed"));
+            assert!(!clean.contains(&spelling));
+            assert!(!clean.contains(raw));
+            assert!(
+                clean.is_empty() || clean.contains("{{ck-secret:test}}"),
+                "an encoded spelling is masked or dropped, never copied through"
+            );
+        }
+    }
+}
diff --git a/crates/aft/src/watcher_backend/fsevents.rs b/crates/aft/src/watcher_backend/fsevents.rs
index 8d9d8eabca..71f217e977 100644
--- a/crates/aft/src/watcher_backend/fsevents.rs
+++ b/crates/aft/src/watcher_backend/fsevents.rs
@@ -3,7 +3,7 @@ use std::os::unix::ffi::OsStringExt;
 use std::path::{Path, PathBuf};
 use std::ptr;
 use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-use std::sync::{mpsc, Arc};
+use std::sync::{mpsc, Arc, OnceLock};
 use std::thread::{self, JoinHandle};
 use std::time::{Duration, Instant};
 
@@ -459,9 +459,67 @@ impl DirectoryWatcher {
 
 struct FsEventsStream {
     stream: usize,
-    run_loop: usize,
-    join: Option<JoinHandle<()>>,
+    queue: usize,
     sender: NativeEventSender,
+    #[cfg(test)]
+    context_release_calls: Arc<AtomicU64>,
+}
+
+/// All streams deliver on one serial queue. Only native event translation runs
+/// here; topology probes, exclusion replanning and per-root backpressure remain
+/// on their existing workers. The queue lives for the process, not for a root.
+fn delivery_queue() -> notify::Result<usize> {
+    static QUEUE: OnceLock<usize> = OnceLock::new();
+    let queue = *QUEUE.get_or_init(|| unsafe {
+        dispatch_queue_create(c"aft-fsevents-delivery".as_ptr(), ptr::null()) as usize
+    });
+    if queue == 0 {
+        Err(notify::Error::generic(
+            "failed to create FSEvents delivery queue",
+        ))
+    } else {
+        Ok(queue)
+    }
+}
+
+struct StreamAction {
+    stream: usize,
+    start: bool,
+    started: bool,
+}
+
+extern "C" fn act_on_stream(context: *mut libc::c_void) {
+    unsafe {
+        let action = &mut *context.cast::<StreamAction>();
+        let stream = action.stream as fs::FSEventStreamRef;
+        if action.start {
+            action.started = fs::FSEventStreamStart(stream) != 0;
+        } else {
+            fs::FSEventStreamStop(stream);
+            fs::FSEventStreamInvalidate(stream);
+            fs::FSEventStreamRelease(stream);
+        }
+    }
+}
+
+fn stream_action(queue: usize, stream: usize, start: bool) -> bool {
+    let mut action = StreamAction {
+        stream,
+        start,
+        started: false,
+    };
+    // Serialize lifecycle changes with native delivery. Invalidation stops
+    // callbacks, but FSEvents may retain the stream until queued work drains,
+    // releasing its context after this synchronous call returns. Stream owners
+    // are backend/config workers, never native callbacks.
+    unsafe {
+        dispatch_sync_f(
+            queue as *mut _,
+            (&mut action as *mut StreamAction).cast(),
+            act_on_stream,
+        );
+    }
+    action.started
 }
 
 impl FsEventsStream {
@@ -510,8 +568,12 @@ impl FsEventsStream {
         counters: Arc<crate::context::WatcherCounters>,
     ) -> notify::Result<Self> {
         let watched_paths = create_cf_path_array(paths)?;
+        #[cfg(test)]
+        let context_release_calls = Arc::new(AtomicU64::new(0));
         let context_info = Box::into_raw(Box::new(CallbackContext {
             sender: sender.clone(),
+            #[cfg(test)]
+            release_calls: Arc::clone(&context_release_calls),
             last_delivered_id,
             nonrecursive_paths,
             #[cfg(test)]
@@ -579,50 +641,31 @@ impl FsEventsStream {
             ));
         }
 
-        let stream_address = stream as usize;
-        let (run_loop_tx, run_loop_rx) = mpsc::sync_channel(1);
-        let join = match thread::Builder::new()
-            .name("aft-fsevents-runloop".to_string())
-            .spawn(move || {
-                let stream = stream_address as fs::FSEventStreamRef;
-                unsafe {
-                    let run_loop = cf::CFRunLoopGetCurrent();
-                    fs::FSEventStreamScheduleWithRunLoop(
-                        stream,
-                        run_loop,
-                        cf::kCFRunLoopDefaultMode,
-                    );
-                    if fs::FSEventStreamStart(stream) == 0 {
-                        let _ = run_loop_tx.send(0);
-                    } else {
-                        let _ = run_loop_tx.send(run_loop as usize);
-                        cf::CFRunLoopRun();
-                    }
-                    fs::FSEventStreamStop(stream);
-                    fs::FSEventStreamInvalidate(stream);
-                    fs::FSEventStreamRelease(stream);
-                }
-            }) {
-            Ok(join) => join,
+        let queue = match delivery_queue() {
+            Ok(queue) => queue,
             Err(error) => {
                 unsafe {
                     fs::FSEventStreamInvalidate(stream);
                     fs::FSEventStreamRelease(stream);
                 }
-                return Err(notify::Error::io(error));
+                return Err(error);
             }
         };
-        let run_loop = run_loop_rx.recv().map_err(notify::Error::from)?;
-        if run_loop == 0 {
-            let _ = join.join();
+        unsafe {
+            FSEventStreamSetDispatchQueue(stream, queue as *mut _);
+        }
+        let stream_address = stream as usize;
+        if !stream_action(queue, stream_address, true) {
+            stream_action(queue, stream_address, false);
             return Err(notify::Error::generic("FSEventStreamStart failed"));
         }
 
         Ok(Self {
             stream: stream_address,
-            run_loop,
-            join: Some(join),
+            queue,
             sender,
+            #[cfg(test)]
+            context_release_calls,
         })
     }
 
@@ -633,21 +676,14 @@ impl FsEventsStream {
 
 impl Drop for FsEventsStream {
     fn drop(&mut self) {
-        let run_loop = self.run_loop as cf::CFRunLoopRef;
-        unsafe {
-            while CFRunLoopIsWaiting(run_loop) == 0 {
-                thread::yield_now();
-            }
-            cf::CFRunLoopStop(run_loop);
-        }
-        if let Some(join) = self.join.take() {
-            let _ = join.join();
-        }
+        stream_action(self.queue, self.stream, false);
     }
 }
 
 struct CallbackContext {
     sender: NativeEventSender,
+    #[cfg(test)]
+    release_calls: Arc<AtomicU64>,
     last_delivered_id: Arc<AtomicU64>,
     nonrecursive_paths: Option<Vec<PathBuf>>,
     #[cfg(test)]
@@ -656,7 +692,10 @@ struct CallbackContext {
 
 extern "C" fn release_context(info: *const libc::c_void) {
     unsafe {
-        drop(Box::from_raw(info as *mut CallbackContext));
+        let context = Box::from_raw(info as *mut CallbackContext);
+        #[cfg(test)]
+        context.release_calls.fetch_add(1, Ordering::SeqCst);
+        drop(context);
     }
 }
 
@@ -884,7 +923,16 @@ fn create_cf_path_array(paths: &[PathBuf]) -> notify::Result<cf::CFMutableArrayR
 }
 
 extern "C" {
-    fn CFRunLoopIsWaiting(run_loop: cf::CFRunLoopRef) -> cf::Boolean;
+    fn FSEventStreamSetDispatchQueue(stream: fs::FSEventStreamRef, queue: *mut libc::c_void);
+    fn dispatch_queue_create(
+        label: *const libc::c_char,
+        attr: *const libc::c_void,
+    ) -> *mut libc::c_void;
+    fn dispatch_sync_f(
+        queue: *mut libc::c_void,
+        context: *mut libc::c_void,
+        work: extern "C" fn(*mut libc::c_void),
+    );
 }
 
 #[cfg(test)]
@@ -1007,6 +1055,115 @@ mod tests {
         }
     }
 
+    fn wait_for_context_release(rx: &mpsc::Receiver<notify::Result<Event>>, releases: &AtomicU64) {
+        let start = Instant::now();
+        let deadline = start + Duration::from_secs(5);
+        loop {
+            assert!(
+                Instant::now() < deadline,
+                "stream sender retained after five seconds; release_context calls={}",
+                releases.load(Ordering::SeqCst)
+            );
+            match rx.recv_timeout(deadline.saturating_duration_since(Instant::now())) {
+                Ok(_) => {}
+                Err(mpsc::RecvTimeoutError::Disconnected) => break,
+                Err(mpsc::RecvTimeoutError::Timeout) => panic!(
+                    "stream sender retained after five seconds; release_context calls={}",
+                    releases.load(Ordering::SeqCst)
+                ),
+            }
+        }
+        assert_eq!(
+            releases.load(Ordering::SeqCst),
+            1,
+            "release_context must run exactly once per stream"
+        );
+        eprintln!(
+            "stream disconnected after {:?}; release_context calls=1",
+            start.elapsed()
+        );
+    }
+
+    fn prove_context_release_after_drop(deliver_events: bool) {
+        let root = tempfile::tempdir().unwrap();
+        let root = std::fs::canonicalize(root.path()).unwrap();
+        let (tx, rx) = mpsc::channel();
+        let stream = FsEventsStream::start(
+            &root,
+            &[],
+            tx,
+            fs::kFSEventStreamEventIdSinceNow,
+            Arc::new(AtomicU64::new(0)),
+        )
+        .unwrap();
+        let releases = Arc::clone(&stream.context_release_calls);
+        if deliver_events {
+            let path = root.join("before-drop.rs");
+            std::fs::write(&path, b"pub fn before() {}\n").unwrap();
+            wait_for_raw_path(&rx, &path);
+        } else {
+            assert!(matches!(rx.try_recv(), Err(mpsc::TryRecvError::Empty)));
+        }
+        assert_eq!(releases.load(Ordering::SeqCst), 0);
+        drop(stream);
+        eprintln!(
+            "after drop: delivered_events={deliver_events}, release_context calls={}, channel={:?}",
+            releases.load(Ordering::SeqCst),
+            rx.try_recv()
+        );
+        wait_for_context_release(&rx, &releases);
+    }
+
+    #[test]
+    fn stream_context_released_once_after_eventful_drop() {
+        prove_context_release_after_drop(true);
+    }
+
+    #[test]
+    fn stream_context_released_once_after_eventless_drop() {
+        prove_context_release_after_drop(false);
+    }
+
+    #[test]
+    fn streams_share_delivery_queue_and_drop_independently() {
+        let roots = [tempfile::tempdir().unwrap(), tempfile::tempdir().unwrap()];
+        let mut streams = Vec::new();
+        let mut receivers = Vec::new();
+        let mut paths = Vec::new();
+        let mut releases = Vec::new();
+        for root in &roots {
+            let root = std::fs::canonicalize(root.path()).unwrap();
+            let (tx, rx) = mpsc::channel();
+            let stream = FsEventsStream::start(
+                &root,
+                &[],
+                tx,
+                fs::kFSEventStreamEventIdSinceNow,
+                Arc::new(AtomicU64::new(0)),
+            )
+            .unwrap();
+            assert_eq!(stream.queue, delivery_queue().unwrap());
+            releases.push(Arc::clone(&stream.context_release_calls));
+            paths.push(root.join("before-drop.rs"));
+            streams.push(stream);
+            receivers.push(rx);
+        }
+        for (path, rx) in paths.iter().zip(&receivers) {
+            std::fs::write(path, b"pub fn before() {}\n").unwrap();
+            wait_for_raw_path(rx, path);
+        }
+        drop(streams.remove(0));
+        // FSEvents can retain a stream until queued work drains, so its context
+        // may be released after Drop returns. Bound that deferred release and
+        // verify that context release runs exactly once and drops its sender.
+        wait_for_context_release(&receivers[0], &releases[0]);
+        let survivor = paths[1].with_file_name("after-drop.rs");
+        std::fs::write(&survivor, b"pub fn after() {}\n").unwrap();
+        wait_for_raw_path(&receivers[1], &survivor);
+        drop(streams);
+        wait_for_context_release(&receivers[1], &releases[1]);
+    }
+
     fn symlink_replacement_fixture(
         starts_as_directory: bool,
     ) -> (
@@ -1320,6 +1477,7 @@ mod tests {
         // Each acknowledged rescan republishes an unchanged matcher, as a real
         // overflow drain does, exercising the replacement-stream decision too.
         let mut context = CallbackContext {
+            release_calls: Arc::new(AtomicU64::new(0)),
             sender: NativeEventSender::Events(sender),
             last_delivered_id: Arc::new(AtomicU64::new(0)),
             nonrecursive_paths: None,
@@ -1439,6 +1597,7 @@ mod tests {
         let (sender, rx) = mpsc::channel();
         let cursor = Arc::new(AtomicU64::new(0));
         let mut context = CallbackContext {
+            release_calls: Arc::new(AtomicU64::new(0)),
             sender: NativeEventSender::Batches(sender),
             last_delivered_id: Arc::clone(&cursor),
             nonrecursive_paths: None,
@@ -1522,6 +1681,7 @@ mod tests {
         let root = std::fs::canonicalize(temp.path()).unwrap();
         let (sender, rx) = mpsc::channel();
         let mut context = CallbackContext {
+            release_calls: Arc::new(AtomicU64::new(0)),
             sender: NativeEventSender::Events(sender),
             last_delivered_id: Arc::new(AtomicU64::new(0)),
             nonrecursive_paths: Some(vec![root.clone()]),
diff --git a/crates/aft/tests/fixtures/github_read_render_transport/pr.expected.md b/crates/aft/tests/fixtures/github_read_render_transport/pr.expected.md
index bc38ca382f..00e11f1fa6 100644
--- a/crates/aft/tests/fixtures/github_read_render_transport/pr.expected.md
+++ b/crates/aft/tests/fixtures/github_read_render_transport/pr.expected.md
@@ -2,6 +2,7 @@
 
 Repository: cortexkit/aft
 State: MERGED
+Review thread state couldn't be read; unresolved threads may still block the merge.
 Author: @author
 Created: 2026-08-23T09:00:00Z
 Updated: 2026-08-24T18:30:00Z
diff --git a/crates/aft/tests/fixtures/log_redaction_cases.json b/crates/aft/tests/fixtures/log_redaction_cases.json
index f1c921474a..6477a9ba8b 100644
--- a/crates/aft/tests/fixtures/log_redaction_cases.json
+++ b/crates/aft/tests/fixtures/log_redaction_cases.json
@@ -1,5 +1,5 @@
 {
-  "_comment": "Shared by the Rust log redactor (crates/aft/src/log_redact.rs) and the CLI issue sanitizer (packages/aft-cli/src/lib/sanitize.ts). Both must turn every masked input into exactly its expected output and leave every untouched input byte-for-byte unchanged.",
+  "_comment": "Shared by the Rust log redactor (crates/aft/src/log_redact.rs) and the CLI issue sanitizer (packages/aft-cli/src/lib/sanitize.ts). masked/untouched apply to general log text. command_masked/command_untouched apply only to shell command text; command_logs verify spawn-log metadata stays readable. Masked inputs must match their expected output exactly, and untouched inputs must remain byte-for-byte unchanged.",
   "masked": [
     {
       "input": "push failed: ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8 rejected",
@@ -48,18 +48,101 @@
     {
       "input": "GET https://maps.example.com/api?key=AIzaSyA1b2C3d4E5f6G7h8I9j0KlMnOpQrStUv&q=x",
       "expected": "GET https://maps.example.com/api?key=<REDACTED_SECRET>&q=x"
+    },
+    {
+      "input": "cd /work/x/opencode PW=Ab3dEfGhIjKlMnOpQrStUvWxYz0123456789-_aBcDe curl -s -u \"opencode:$PW\" http://127.0.0.1:4599/api/status",
+      "expected": "cd /work/x/opencode PW=<REDACTED_SECRET> curl -s -u \"opencode:$PW\" http://127.0.0.1:4599/api/status"
+    },
+    {
+      "input": "PW=hunter2 PASS=hunter2 DB_PW=hunter2 DB_PASS=hunter2 ./run",
+      "expected": "PW=<REDACTED_SECRET> PASS=<REDACTED_SECRET> DB_PW=<REDACTED_SECRET> DB_PASS=<REDACTED_SECRET> ./run"
+    },
+    {
+      "input": "pw=hunter2 pass=hunter2 db_pw=hunter2 db_pass=hunter2 ./run",
+      "expected": "pw=<REDACTED_SECRET> pass=<REDACTED_SECRET> db_pw=<REDACTED_SECRET> db_pass=<REDACTED_SECRET> ./run"
+    },
+    {
+      "input": "PW=-hunter2 PASS=-hunter2 ./run",
+      "expected": "PW=<REDACTED_SECRET> PASS=<REDACTED_SECRET> ./run"
+    },
+    {
+      "input": "bash spawned task=bgb_test cmd=PW=hunter2 curl http://127.0.0.1:4599/api/status",
+      "expected": "bash spawned task=bgb_test cmd=PW=<REDACTED_SECRET> curl http://127.0.0.1:4599/api/status"
     }
   ],
+  "command_masked": [
+    {
+      "input": "session=ses_abcDEF0123456789 curl http://127.0.0.1:4599/api/status",
+      "expected": "session=<REDACTED_SECRET> curl http://127.0.0.1:4599/api/status"
+    },
+    {
+      "input": "X=Ab3dEfGhIjKlMnOpQrStUvWxYz0123456789-_aBcDe ./run",
+      "expected": "X=<REDACTED_SECRET> ./run"
+    },
+    {
+      "input": "X=\"Ab3dEfGhIjKlMnOp\" Y='Ab3dEfGhIjKlMnOp' ./run",
+      "expected": "X=\"<REDACTED_SECRET>\" Y='<REDACTED_SECRET>' ./run"
+    },
+    {
+      "input": "X=Ab3dEfGh/IjKlMnOp ./run",
+      "expected": "X=<REDACTED_SECRET> ./run"
+    },
+    {
+      "input": "X=Ab3dEfGhIjKlMnOp|cat",
+      "expected": "X=<REDACTED_SECRET>|cat"
+    }
+  ],
+  "command_logs": [
+    {
+      "input": "bash spawned task=bgb_0123456789 pid=1 session=ses_abcDEF0123456789 root=/project cmd=X=Ab3deFghIjklMnopQ curl http://127.0.0.1:4599/api/status",
+      "expected": "bash spawned task=bgb_0123456789 pid=1 session=ses_abcDEF0123456789 root=/project cmd=X=<REDACTED_SECRET> curl http://127.0.0.1:4599/api/status"
+    },
+    {
+      "input": "bash spawned task=bgb_0123456789 pid=1 session=ses_abcDEF0123456789 root=/project cmd=session=ses_abcDEF0123456789 curl http://127.0.0.1:4599/api/status",
+      "expected": "bash spawned task=bgb_0123456789 pid=1 session=ses_abcDEF0123456789 root=/project cmd=session=<REDACTED_SECRET> curl http://127.0.0.1:4599/api/status"
+    }
+  ],
+  "command_untouched": [
+    "PWD=/tmp/x",
+    "SHA=3f2c9a1b7e4d5c6a8b9f0e1d2c3b4a5968778695",
+    "FILE=/tmp/x",
+    "FILE=/tmp/Ab3deFghIjklMnop",
+    "FILE=~/Ab3deFghIjklMnop",
+    "FILE=./Ab3deFghIjklMnop",
+    "FILE=../Ab3deFghIjklMnop",
+    "COUNT=12345678901234567",
+    "URL=https://example.com/a",
+    "URL=https://example.com/Ab3deFghIjklMnop",
+    "WORD=ordinarywordsarenotsecrets",
+    "X=Ab3dEfGhIjKlMnO"
+  ],
   "untouched": [
     "read crates/aft/src/commands/bash.rs:120",
     "log at /tmp/aft/logs/aft-4242.log rotated",
     "sha256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
     "commit 3f2c9a1b7e4d5c6a8b9f0e1d2c3b4a5968778695",
     "index_event plane=callgraph build_id=b1a2c3 session=ses_0123456789abcdef",
+    "task_id=bgb_0123456789 session=ses_abcDEF0123456789",
+    "request_id=req_Ab3deFghIjklMnopQ task_id=bgb_Ab3deFghIjklMnopQ",
     "identifiers ghost_writer github_patterns gh_cli ghp_short",
     "https://github.com/cortexkit/aft/pull/12?tab=files&page=3",
     "https://maps.example.com/api?key=src_main_rs",
     "https://cdn.example.com/blob?key=9f86d081884c7d659a2feaa0c55ad015",
-    "search ?q=token+refresh+flow"
+    "search ?q=token+refresh+flow",
+    "?key=src_main_rs",
+    "&key=src_main_rs",
+    "PWD=/tmp/x",
+    "SHA=3f2c9a1b7e4d5c6a8b9f0e1d2c3b4a5968778695",
+    "FILE=/tmp/x",
+    "FILE=/tmp/Ab3deFghIjklMnop",
+    "FILE=~/Ab3deFghIjklMnop",
+    "FILE=./Ab3deFghIjklMnop",
+    "FILE=../Ab3deFghIjklMnop",
+    "COUNT=12345678901234567",
+    "URL=https://example.com/a",
+    "URL=https://example.com/Ab3deFghIjklMnop",
+    "WORD=ordinarywordsarenotsecrets",
+    "X=Ab3dEfGhIjKlMnO",
+    "BYPASS=ordinary COMPASS=ordinary"
   ]
 }
diff --git a/crates/aft/tests/fixtures/secret/secret-use-v1.jsonl b/crates/aft/tests/fixtures/secret/secret-use-v1.jsonl
new file mode 100644
index 0000000000..b3fa0ed74b
--- /dev/null
+++ b/crates/aft/tests/fixtures/secret/secret-use-v1.jsonl
@@ -0,0 +1,6 @@
+{"name":"key","coverage":"scope","stamp":{"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"H","scope_epoch":7,"kind":"head","attributes":{"agent_id":"agent-A"},"owner_authorized":true},"target":{"scheme":"https","host":"x.test","port":443,"path":"/repos/a/issues/1"}}
+{"name":"key","stamp":{"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"H","scope_epoch":7,"kind":"head","attributes":{"agent_id":"agent-A"},"owner_authorized":true},"target":{"scheme":"https","host":"x.test","path":"/repos/a/issues/1"}}
+{"name":"login","stamp":{"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"W","scope_epoch":7,"kind":"worker","parent":{"owner":{"kind":"reserved","module_id":"prefrontal-core"},"ref":"H","scope_epoch":7},"parent_state":"linked","attributes":{"agent_id":"agent-A"},"owner_authorized":true},"target":{"origin":"https://x.test"}}
+{"status":"released","kind":"agent_api_key","key_b64url":"c2stZXhhbXBsZQ","location":"header:X-Api-Key"}
+{"status":"released","kind":"site_login","username":"alice","password":"correct horse","totp":"123456"}
+{"status":"approval_required","request_id":"01HF7YAT000000000000000001","statement_b64url":"eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0","expires_at_ms":1700000600000}
diff --git a/crates/aft/tests/helpers/aft_binary.rs b/crates/aft/tests/helpers/aft_binary.rs
index 114aff5076..3e86f6f37b 100644
--- a/crates/aft/tests/helpers/aft_binary.rs
+++ b/crates/aft/tests/helpers/aft_binary.rs
@@ -40,7 +40,7 @@ pub fn aft_binary() -> PathBuf {
 /// Pay macOS's first-exec cost before a command's own timeout starts. Production
 /// warms its startup pin too; the integration launcher override uses this copy.
 #[cfg(target_os = "macos")]
-fn warm_fixture_image(image: &Path) -> io::Result<()> {
+pub fn warm_fixture_image(image: &Path) -> io::Result<()> {
     use std::os::unix::process::CommandExt;
     use std::process::{Command, Stdio};
     use std::time::{Duration, Instant};
@@ -227,7 +227,7 @@ fn deploy_with_pruner(
     if fs::metadata(&pending_image)?.len() != identity.size {
         return Err(io::Error::other("AFT fixture image copy was incomplete"));
     }
-    File::open(&pending_image)?.sync_all()?;
+    aft_store::sync::sync_all(&File::open(&pending_image)?, &pending_image)?;
     copied(&pending_image);
     let mut permissions = input.metadata()?.permissions();
     permissions.set_readonly(true);
diff --git a/crates/aft/tests/helpers/binary_cache.rs b/crates/aft/tests/helpers/binary_cache.rs
index 0ffd272914..e5dcd02162 100644
--- a/crates/aft/tests/helpers/binary_cache.rs
+++ b/crates/aft/tests/helpers/binary_cache.rs
@@ -66,10 +66,10 @@ pub fn install(
         // be inherited by a concurrent fork and make Linux exec return ETXTBSY
         // even after this thread closes it and publishes the immutable path.
         #[cfg(target_os = "linux")]
-        fs::File::open(&pending)?.sync_all()?;
+        aft_store::sync::sync_all(&fs::File::open(&pending)?, &pending)?;
         // Windows FlushFileBuffers requires a writable handle.
         #[cfg(not(target_os = "linux"))]
-        OpenOptions::new().write(true).open(&pending)?.sync_all()?;
+        aft_store::sync::sync_all(&OpenOptions::new().write(true).open(&pending)?, &pending)?;
         // Installation age lives beside the executable. Never write-open or
         // touch an installed executable: macOS can revoke running signatures.
         fs::write(
@@ -148,6 +148,6 @@ pub fn install_bytes(root: &Path, key: &str, target: &str, bytes: &[u8]) -> io::
             use std::os::unix::fs::PermissionsExt;
             file.set_permissions(fs::Permissions::from_mode(0o755))?;
         }
-        file.sync_all()
+        aft_store::sync::sync_all(&file, pending)
     })
 }
diff --git a/crates/aft/tests/helpers/executable_cache.rs b/crates/aft/tests/helpers/executable_cache.rs
index 123e3e91e1..04a29e9c95 100644
--- a/crates/aft/tests/helpers/executable_cache.rs
+++ b/crates/aft/tests/helpers/executable_cache.rs
@@ -45,12 +45,7 @@ pub fn cached_executable_named(bytes: &[u8], name: &str) -> io::Result<PathBuf>
 
 /// Cache an executable inside a fixture root that must remain visible to a sandbox.
 pub fn cached_executable_named_in(root: &Path, bytes: &[u8], name: &str) -> io::Result<PathBuf> {
-    if Path::new(name).file_name().and_then(|value| value.to_str()) != Some(name) {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "cached executable name must be one path component",
-        ));
-    }
+    validate_name(name)?;
     let result = publish_executable(root, bytes, name);
     match result {
         // Another language's cache pruner can claim an old identity between
@@ -62,6 +57,29 @@ pub fn cached_executable_named_in(root: &Path, bytes: &[u8], name: &str) -> io::
     }
 }
 
+/// Warm a new executable at its final path under the publication lock.
+/// Use a separate root from un-warmed publishers: a cache hit must mean the
+/// same warmup already succeeded. Warmup failure removes the new entry.
+pub fn cached_executable_named_in_with_warmup(
+    root: &Path,
+    bytes: &[u8],
+    name: &str,
+    warm: impl Fn(&Path) -> io::Result<()>,
+) -> io::Result<PathBuf> {
+    validate_name(name)?;
+    publish_with_pruner_and_warmup(root, bytes, name, image_cache::prune, warm)
+}
+
+fn validate_name(name: &str) -> io::Result<()> {
+    if Path::new(name).file_name().and_then(|value| value.to_str()) != Some(name) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "cached executable name must be one path component",
+        ));
+    }
+    Ok(())
+}
+
 fn publish_executable(root: &Path, bytes: &[u8], name: &str) -> io::Result<PathBuf> {
     publish_with_pruner(root, bytes, name, image_cache::prune)
 }
@@ -71,6 +89,16 @@ fn publish_with_pruner(
     bytes: &[u8],
     name: &str,
     prune: impl Fn(&Path, &Path, std::time::SystemTime) -> io::Result<()>,
+) -> io::Result<PathBuf> {
+    publish_with_pruner_and_warmup(root, bytes, name, prune, |_| Ok(()))
+}
+
+fn publish_with_pruner_and_warmup(
+    root: &Path,
+    bytes: &[u8],
+    name: &str,
+    prune: impl Fn(&Path, &Path, std::time::SystemTime) -> io::Result<()>,
+    warm: impl Fn(&Path) -> io::Result<()>,
 ) -> io::Result<PathBuf> {
     fs::create_dir_all(root)?;
     let lock = OpenOptions::new()
@@ -96,10 +124,10 @@ fn publish_with_pruner(
     let pending = pending_dir.path().join("executable");
     write_executable_with_mode(&pending, bytes, 0o755)?;
     #[cfg(target_os = "linux")]
-    OpenOptions::new().read(true).open(&pending)?.sync_all()?;
+    aft_store::sync::sync_all(&OpenOptions::new().read(true).open(&pending)?, &pending)?;
     // Windows requires a writable handle for FlushFileBuffers.
     #[cfg(not(target_os = "linux"))]
-    OpenOptions::new().write(true).open(&pending)?.sync_all()?;
+    aft_store::sync::sync_all(&OpenOptions::new().write(true).open(&pending)?, &pending)?;
 
     match fs::hard_link(&pending, &path) {
         Ok(()) => {}
@@ -107,6 +135,10 @@ fn publish_with_pruner(
         Err(error) => return Err(error),
     }
     verify_cached(&path, bytes)?;
+    if let Err(error) = warm(&path) {
+        fs::remove_file(&path)?;
+        return Err(error);
+    }
     image_cache::refresh(directory)?;
     prune(root, directory, std::time::SystemTime::now())?;
     Ok(path)
@@ -329,4 +361,65 @@ mod tests {
         #[cfg(unix)]
         assert!(std::process::Command::new(path).status().unwrap().success());
     }
+
+    #[test]
+    fn executable_cache_warms_once_at_final_owner_writable_path() {
+        let root = tempfile::tempdir().unwrap();
+        let warmed = std::cell::RefCell::new(Vec::new());
+        let bytes = b"private shim image bytes";
+        let daemon = root.path().join("daemon-image");
+        fs::write(&daemon, bytes).unwrap();
+        let image = cached_executable_named_in_with_warmup(root.path(), bytes, "aft", |path| {
+            assert_eq!(fs::read(path).unwrap(), bytes);
+            assert_eq!(path.file_name().unwrap(), "aft");
+            assert_eq!(path.parent().unwrap().parent().unwrap(), root.path());
+            assert!(!fs::metadata(path).unwrap().permissions().readonly());
+            OpenOptions::new().write(true).open(path).unwrap();
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::MetadataExt;
+                assert_ne!(
+                    fs::metadata(path).unwrap().ino(),
+                    fs::metadata(&daemon).unwrap().ino(),
+                    "a sandbox write regression must not corrupt the daemon image"
+                );
+            }
+            warmed.borrow_mut().push(path.to_path_buf());
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(*warmed.borrow(), vec![image.clone()]);
+        let cached = cached_executable_named_in_with_warmup(root.path(), bytes, "aft", |_| {
+            panic!("a cached executable must not be warmed again")
+        })
+        .unwrap();
+        assert_eq!(cached, image);
+    }
+
+    #[test]
+    fn executable_cache_failed_warmup_is_not_reused() {
+        let root = tempfile::tempdir().unwrap();
+        let bytes = b"private shim image bytes";
+        let path = cache_path(root.path(), bytes, "aft");
+        let attempts = std::cell::Cell::new(0);
+        let error = cached_executable_named_in_with_warmup(root.path(), bytes, "aft", |_| {
+            attempts.set(attempts.get() + 1);
+            Err(io::Error::new(
+                io::ErrorKind::NotFound,
+                "injected warmup failure",
+            ))
+        })
+        .unwrap_err();
+        assert_eq!(error.to_string(), "injected warmup failure");
+        assert_eq!(attempts.get(), 1, "warmup errors must not be retried");
+        assert!(!path.exists(), "a failed warmup must not be cached");
+        let warmed = std::cell::Cell::new(false);
+        let retry = cached_executable_named_in_with_warmup(root.path(), bytes, "aft", |_| {
+            warmed.set(true);
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(retry, path);
+        assert!(warmed.get(), "the republished image must finish warmup");
+    }
 }
diff --git a/crates/aft/tests/helpers/mod.rs b/crates/aft/tests/helpers/mod.rs
index 1175e7db2c..b96c699273 100644
--- a/crates/aft/tests/helpers/mod.rs
+++ b/crates/aft/tests/helpers/mod.rs
@@ -3,6 +3,8 @@
 #[allow(dead_code)]
 pub mod executable_cache;
 pub mod fake_lsp;
+#[path = "../../src/test_gate.rs"]
+pub mod test_gate;
 mod timeout_forensics;
 
 #[path = "../../src/test_env.rs"]
diff --git a/crates/aft/tests/integration/bash_background_persistence_test.rs b/crates/aft/tests/integration/bash_background_persistence_test.rs
index 2cd5332ad5..10606a33dd 100644
--- a/crates/aft/tests/integration/bash_background_persistence_test.rs
+++ b/crates/aft/tests/integration/bash_background_persistence_test.rs
@@ -2624,8 +2624,8 @@ fn pi_erased_bundle_notification_is_not_replayed_after_ack_and_second_restart()
         let mut aft = AftProcess::spawn();
         configure_background_for_harness(&mut aft, project.path(), storage.path(), SESSION, "pi");
         let command = format!(
-            "while [ ! -e {} ]; do sleep 0.05; done; printf 'completed\\n'",
-            shell_quote_path(&release)
+            "{}; printf 'completed\\n'",
+            crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05")
         );
         let task_id = spawn_bg(&mut aft, SESSION, &command, Some(30_000));
         let registered = notify_once(&mut aft, SESSION, &task_id, "never-matches");
@@ -3057,8 +3057,9 @@ fn per_match_ack_preserves_sibling_watch_and_rejects_stale_offset() {
     let release_guard = ReleaseOnDrop::new(release.clone());
     let _exit_guard = ReleaseOnDrop::new(exit.clone());
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf 'READY\\n'; while [ ! -e {} ]; do sleep 0.05; done",
-        shell_quote_path(&release), shell_quote_path(&exit),
+        "{}; printf 'READY\\n'; {}",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&exit), "sleep 0.05"),
     );
     let mut aft = AftProcess::spawn();
     configure_background(&mut aft, project.path(), storage.path(), SESSION);
@@ -3133,12 +3134,12 @@ fn mid_run_ack_from_rebound_root_preserves_later_watch_and_completion() {
     let _release_b_guard = ReleaseOnDrop::new(release_b.clone());
     let _release_exit_guard = ReleaseOnDrop::new(release_exit.clone());
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf '%s\\n' '{}'; while [ ! -e {} ]; do sleep 0.05; done; printf '%s\\n' '{}'; while [ ! -e {} ]; do sleep 0.05; done",
-        shell_quote_path(&release_a),
+        "{}; printf '%s\\n' '{}'; {}; printf '%s\\n' '{}'; {}",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release_a), "sleep 0.05"),
         WATCH_A,
-        shell_quote_path(&release_b),
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release_b), "sleep 0.05"),
         WATCH_B,
-        shell_quote_path(&release_exit),
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release_exit), "sleep 0.05"),
     );
 
     let mut owner = AftProcess::spawn();
@@ -4031,8 +4032,8 @@ fn redaction_replay_preserves_masked_preview_and_pattern_frame() {
         format!("finished {MASKED}\n")
     );
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf 'READY %s\\n' \"$DEPLOY_tOkEn\"",
-        shell_quote_path(&release),
+        "{}; printf 'READY %s\\n' \"$DEPLOY_tOkEn\"",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let watch_forensics = TaskForensics {
         storage: storage.path(),
@@ -4112,11 +4113,11 @@ fn redaction_replay_shows_ticket_only_output_without_exposing_ticket() {
     // before printf has written to it.
     let ticket_staging = project.path().join("seen-ticket.partial");
     let command = format!(
-        "printf '%s' \"$AFT_GH_SHIM_TICKET\" > {}; mv {} {}; while [ ! -e {} ]; do sleep 0.05; done; printf 'ticket=%s md5=0123456789abcdef0123456789abcdef\\n' \"$AFT_GH_SHIM_TICKET\"",
+        "printf '%s' \"$AFT_GH_SHIM_TICKET\" > {}; mv {} {}; {}; printf 'ticket=%s md5=0123456789abcdef0123456789abcdef\\n' \"$AFT_GH_SHIM_TICKET\"",
         shell_quote_path(&ticket_staging),
         shell_quote_path(&ticket_staging),
         shell_quote_path(&ticket_path),
-        shell_quote_path(&release),
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let mut owner = AftProcess::spawn();
     configure_background(&mut owner, project.path(), storage.path(), SESSION);
@@ -4164,8 +4165,8 @@ fn redaction_replay_rebuilds_long_classifier_secret_after_preview_cut() {
     let release = project.path().join("release-long-classifier-secret");
     let release_guard = ReleaseOnDrop::new(release.clone());
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf '%s' \"$LONG_PREFIX\"; printf '{{\"api_key\":\"%s\"}}\\n' \"$LONG_VALUE\"",
-        shell_quote_path(&release),
+        "{}; printf '%s' \"$LONG_PREFIX\"; printf '{{\"api_key\":\"%s\"}}\\n' \"$LONG_VALUE\"",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let mut owner = AftProcess::spawn();
     configure_background(&mut owner, project.path(), storage.path(), SESSION);
@@ -4211,8 +4212,8 @@ fn redaction_replay_withholds_new_secret_output() {
     let mut owner = AftProcess::spawn();
     configure_background(&mut owner, project.path(), storage.path(), SESSION);
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf '%s\\n' \"$DEPLOY_tOkEn\"",
-        shell_quote_path(&release),
+        "{}; printf '%s\\n' \"$DEPLOY_tOkEn\"",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let id = spawn_redaction_task(&mut owner, &command, json!({"DEPLOY_tOkEn": SECRET}));
     let watched = spawn_redaction_task(&mut owner, &command, json!({"DEPLOY_tOkEn": SECRET}));
@@ -4278,8 +4279,8 @@ fn redaction_replay_withholds_output_from_inherited_secret_environment() {
     let mut owner = AftProcess::spawn_with_env(&[("OPENAI_API_KEY", std::ffi::OsStr::new(SECRET))]);
     configure_background(&mut owner, project.path(), storage.path(), SESSION);
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf '%s\\n' \"$OPENAI_API_KEY\"",
-        shell_quote_path(&release),
+        "{}; printf '%s\\n' \"$OPENAI_API_KEY\"",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let id = spawn_redaction_task(&mut owner, &command, json!({}));
     wait_for_status(&mut owner, SESSION, &id, "running");
@@ -4320,8 +4321,8 @@ fn redaction_replay_shows_new_output_with_only_revoked_ticket() {
     let mut owner = AftProcess::spawn();
     configure_background(&mut owner, project.path(), storage.path(), SESSION);
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf 'ordinary post-restart output\\n'",
-        shell_quote_path(&release),
+        "{}; printf 'ordinary post-restart output\\n'",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let id = spawn_redaction_task(&mut owner, &command, json!({}));
     wait_for_status(&mut owner, SESSION, &id, "running");
@@ -4360,8 +4361,8 @@ fn per_match_ack_wire_reports_settlement_only_after_last_terminal_watch() {
     let release = project.path().join("release-terminal-matches");
     let release_guard = ReleaseOnDrop::new(release.clone());
     let command = format!(
-        "while [ ! -e {} ]; do sleep 0.05; done; printf 'READY\\n'",
-        shell_quote_path(&release),
+        "{}; printf 'READY\\n'",
+        crate::test_helpers::test_gate::gate_exists(&shell_quote_path(&release), "sleep 0.05"),
     );
     let mut aft = AftProcess::spawn();
     configure_background(&mut aft, project.path(), storage.path(), SESSION);
diff --git a/crates/aft/tests/integration/bash_background_test.rs b/crates/aft/tests/integration/bash_background_test.rs
index 7430685a5a..c19b8be0c3 100644
--- a/crates/aft/tests/integration/bash_background_test.rs
+++ b/crates/aft/tests/integration/bash_background_test.rs
@@ -851,7 +851,7 @@ fn assert_background_artifact_search_access(command: &str) {
                     assert_eq!(
                         denied["message"],
                         format!(
-                            "path '{}' is denied by the access policy floor",
+                            "path '{}' is in AFT's own storage, which file tools never open. For a shell task's output, use bash_status.",
                             path.display()
                         )
                     );
diff --git a/crates/aft/tests/integration/bash_foreground_background_architecture_test.rs b/crates/aft/tests/integration/bash_foreground_background_architecture_test.rs
index 0dd13a6ea6..9b48c0c225 100644
--- a/crates/aft/tests/integration/bash_foreground_background_architecture_test.rs
+++ b/crates/aft/tests/integration/bash_foreground_background_architecture_test.rs
@@ -240,8 +240,8 @@ fn promoted_foreground_completion_while_daemon_is_down_replays_once() {
         &mut first,
         json!({
             "command": format!(
-                "while [ ! -f '{}' ]; do sleep 0.05; done; printf promoted",
-                release.display()
+                "{}; printf promoted",
+                crate::test_helpers::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.05")
             ),
             "notify_on_completion": false,
         }),
diff --git a/crates/aft/tests/integration/bash_reply_timing_contract_test.rs b/crates/aft/tests/integration/bash_reply_timing_contract_test.rs
index d8d3052aa0..4d19d58351 100644
--- a/crates/aft/tests/integration/bash_reply_timing_contract_test.rs
+++ b/crates/aft/tests/integration/bash_reply_timing_contract_test.rs
@@ -794,8 +794,8 @@ fn subc_runner_cancel_of_bash_watch_leaves_the_watched_child_running() {
     run_subc(|mut harness| async move {
         let release = harness.project.path().join("watch-cancel-release");
         let command = format!(
-            "while [ ! -f {} ]; do sleep 0.02; done; exit 7",
-            shell_quote(&release),
+            "{}; exit 7",
+            crate::test_helpers::test_gate::gate(&shell_quote(&release), "sleep 0.02"),
         );
         let task = launch_worker_background(&mut harness.stream, 180, &command).await;
         // The tool-provider-v1 bash route replies on command completion, even
diff --git a/crates/aft/tests/integration/bash_watch_test.rs b/crates/aft/tests/integration/bash_watch_test.rs
index 02e54ae7c2..d11453b004 100644
--- a/crates/aft/tests/integration/bash_watch_test.rs
+++ b/crates/aft/tests/integration/bash_watch_test.rs
@@ -263,8 +263,11 @@ fn each_line_push_batches_all_lines_with_offsets() {
     fs::write(&payload, b"ERROR a\nERROR b\nERROR b\n").unwrap();
     let release_guard = ReleaseOnDrop::new(release.clone());
     let command = format!(
-        "while [ ! -f {} ]; do sleep 0.05; done; cat {}",
-        shell_quote(&release.display().to_string()),
+        "{}; cat {}",
+        crate::test_helpers::test_gate::gate(
+            &shell_quote(&release.display().to_string()),
+            "sleep 0.05"
+        ),
         shell_quote(&payload.display().to_string())
     );
     let task_id = spawn(&mut aft, &command);
diff --git a/crates/aft/tests/integration/call_yield_test.rs b/crates/aft/tests/integration/call_yield_test.rs
index 957100355a..e39774e619 100644
--- a/crates/aft/tests/integration/call_yield_test.rs
+++ b/crates/aft/tests/integration/call_yield_test.rs
@@ -358,9 +358,9 @@ async fn read_pid(path: &Path) -> i32 {
 /// `release` exists.
 fn held_command(pid: &Path, release: &Path) -> String {
     format!(
-        "echo $$ > '{}'; echo started; while [ ! -f '{}' ]; do sleep 0.05; done; echo released",
+        "echo $$ > '{}'; echo started; {}; echo released",
         pid.display(),
-        release.display()
+        crate::test_helpers::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.05")
     )
 }
 
diff --git a/crates/aft/tests/integration/format_test.rs b/crates/aft/tests/integration/format_test.rs
index ca1f8c5d53..879904adf0 100644
--- a/crates/aft/tests/integration/format_test.rs
+++ b/crates/aft/tests/integration/format_test.rs
@@ -1177,7 +1177,7 @@ fn validation_backlog_rejects_overflow_and_duplicate_without_hiding_status() {
     let bin_dir = dir.join("node_modules/.bin");
     fs::create_dir_all(&bin_dir).unwrap();
     let stub = bin_dir.join("tsc");
-    fs::write(&stub, format!("#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo 'Version 5.0.0'; exit 0; fi\n: > '{}'\nwhile [ ! -f '{}' ]; do sleep 0.05; done\nexit 0\n", started.display(), release.display())).unwrap();
+    fs::write(&stub, format!("#!/bin/sh\nif [ \"$1\" = \"--version\" ]; then echo 'Version 5.0.0'; exit 0; fi\n: > '{}'\n{}\nexit 0\n", started.display(), crate::test_helpers::test_gate::gate(&format!("'{}'", release.display()), "sleep 0.05"))).unwrap();
     fs::set_permissions(&stub, fs::Permissions::from_mode(0o755)).unwrap();
     warm_executable(&stub, &["--version"]);
     let _release_guard = ReleaseOnDrop(release.clone());
diff --git a/crates/aft/tests/integration/github_read_render_transport.rs b/crates/aft/tests/integration/github_read_render_transport.rs
index 4a4b7364da..e12b6e84e7 100644
--- a/crates/aft/tests/integration/github_read_render_transport.rs
+++ b/crates/aft/tests/integration/github_read_render_transport.rs
@@ -136,6 +136,7 @@ fn assert_omp_shape_with_aft_metadata(rendered: &str, document: &GithubDocument)
     let permitted_aft_metadata = [
         "Repository:",
         "State:",
+        "Review thread state couldn't be read;",
         "Author:",
         "Created:",
         "Updated:",
@@ -208,7 +209,10 @@ case "$1:$2" in
     cat "$AFT_GH_READ_FIXTURE_DIR/pr.json"
     ;;
    api:graphql)
-     cat "$AFT_GH_READ_FIXTURE_DIR/pr-review-comments.json"
+     case "$4" in
+       *AftReadReviewThreads*) printf '{"errors":[{"message":"fixture thread lookup denied"}]}\n'; exit 0 ;;
+     esac
+      cat "$AFT_GH_READ_FIXTURE_DIR/pr-review-comments.json"
      ;;
     api:repos/*)
       printf '[]\n'
@@ -407,9 +411,11 @@ fn fixture_selected_markdown_is_byte_identical_across_all_transport_harnesses()
             [
                 "pr view",
                 "api graphql",
+                "api graphql",
                 "api repos/cortexkit/aft/issues/42/timeline?per_page=100",
                 "pr view",
                 "api graphql",
+                "api graphql",
                 "api repos/cortexkit/aft/issues/42/timeline?per_page=100",
             ]
         })
diff --git a/crates/aft/tests/integration/github_read_routing.rs b/crates/aft/tests/integration/github_read_routing.rs
index 57405da299..1a5f91644f 100644
--- a/crates/aft/tests/integration/github_read_routing.rs
+++ b/crates/aft/tests/integration/github_read_routing.rs
@@ -168,7 +168,7 @@ fn github_read_routes_short_and_explicit_forms_without_filesystem_rendering() {
     );
     assert_eq!(
         pull_request["content"].as_str(),
-        Some("# Pull request #9: Fixture pull request\n\nRepository: owner/repo\nState: OPEN\n\n## Body\n\npull request body\n\nDiscussion drill-down: pr://owner/repo/9/comments/<sel> (for example 3, 3-5, 3,7, or -1).\n\n")
+        Some("# Pull request #9: Fixture pull request\n\nRepository: owner/repo\nState: OPEN\nReview thread state couldn't be read; unresolved threads may still block the merge.\n\n## Body\n\npull request body\n\nDiscussion drill-down: pr://owner/repo/9/comments/<sel> (for example 3, 3-5, 3,7, or -1).\n\n")
     );
 
     assert!(aft.shutdown().success());
diff --git a/crates/aft/tests/integration/inspect_command_test.rs b/crates/aft/tests/integration/inspect_command_test.rs
index ba8f6b6156..73cb145aeb 100644
--- a/crates/aft/tests/integration/inspect_command_test.rs
+++ b/crates/aft/tests/integration/inspect_command_test.rs
@@ -2578,6 +2578,10 @@ fn rust_inspect_runs_cargo_with_checks_off_and_reuses_saved_record() {
     assert_eq!(runs(), 1, "warm inspect must not run cargo twice");
     ctx.lsp().shutdown_all();
     drop(ctx);
+    // The inspection response can return before the disk-cache write finishes.
+    // A cold manager can reuse the record only after that write becomes visible.
+    wait_for_completed_rust_check(storage.path(), 1, || {})
+        .expect("persist the borrow-check report");
 
     let ctx = make_context();
     let restarted = crate::helpers::inspect_retrying_cold_deadline(|| {
@@ -2595,7 +2599,13 @@ fn rust_inspect_runs_cargo_with_checks_off_and_reuses_saved_record() {
         "persisted report missing: {restarted:#}"
     );
     assert_eq!(runs(), 1, "cold manager must reuse the persisted check");
-    std::fs::write(&lib, "include!(concat!(\"\", \"borrow.rs\"));\n").unwrap();
+    // Direct concat! includes are fingerprinted. Forwarding a computed expr
+    // through a local macro still requires a provisional compiler report.
+    std::fs::write(
+        &lib,
+        "macro_rules! include_file { ($path:expr) => { include!($path); }; }\ninclude_file!(concat!(\"bor\", \"row.rs\"));\n",
+    )
+    .unwrap();
     std::fs::write(
         root.join("src/borrow.rs"),
         "pub fn f() { let s = String::new(); let moved = s; println!(\"{}\", s); drop(moved); }\n",
diff --git a/crates/aft/tests/integration/lexical_rank_test.rs b/crates/aft/tests/integration/lexical_rank_test.rs
deleted file mode 100644
index 3316521245..0000000000
--- a/crates/aft/tests/integration/lexical_rank_test.rs
+++ /dev/null
@@ -1,74 +0,0 @@
-use std::fs;
-use std::path::Path;
-
-use aft::search_index::SearchIndex;
-use aft::semantic_index::is_semantic_indexed_extension;
-
-fn write_file(root: &Path, relative: &str, content: &str) -> std::path::PathBuf {
-    let path = root.join(relative);
-    fs::create_dir_all(path.parent().expect("parent")).expect("create parent");
-    fs::write(&path, content).expect("write file");
-    path
-}
-
-#[test]
-fn zero_posting_trigrams_do_not_collapse_candidate_union() {
-    let project = tempfile::tempdir().expect("create project");
-    let path = write_file(project.path(), "src/lib.rs", "alpha_token");
-    let mut index = SearchIndex::new();
-    index.index_file(&path, b"alpha_token");
-
-    let query = SearchIndex::query_trigrams_from_tokens(&["zzzzzz", "alpha_token"]);
-    let ranked = index.lexical_rank(&query, None, 10).unwrap();
-
-    assert_eq!(ranked.len(), 1);
-    assert_eq!(ranked[0].0, path);
-}
-
-#[test]
-fn three_or_more_trigrams_use_rarest_three_and_cap_at_200() {
-    let project = tempfile::tempdir().expect("create project");
-    let mut index = SearchIndex::new();
-    for i in 0..250 {
-        let path = write_file(project.path(), &format!("src/file{i}.rs"), "abcdefghij");
-        index.index_file(&path, b"abcdefghij");
-    }
-
-    let query = SearchIndex::query_trigrams_from_tokens(&["abcdefghij"]);
-    let ranked = index.lexical_rank(&query, None, 1_000).unwrap();
-
-    assert_eq!(ranked.len(), 200);
-}
-
-#[test]
-fn one_or_two_trigrams_use_all_remaining_and_cap_at_500() {
-    let project = tempfile::tempdir().expect("create project");
-    let mut index = SearchIndex::new();
-    for i in 0..550 {
-        let path = write_file(project.path(), &format!("src/file{i}.rs"), "abc");
-        index.index_file(&path, b"abc");
-    }
-
-    let query = SearchIndex::query_trigrams_from_tokens(&["abc"]);
-    let ranked = index.lexical_rank(&query, None, 1_000).unwrap();
-
-    assert_eq!(ranked.len(), 500);
-}
-
-#[test]
-fn candidate_filter_excludes_non_semantic_file_extensions() {
-    let project = tempfile::tempdir().expect("create project");
-    let rust_path = write_file(project.path(), "src/lib.rs", "uniqueIdentifier");
-    let readme_path = write_file(project.path(), "README.md", "uniqueIdentifier");
-    let mut index = SearchIndex::new();
-    index.index_file(&rust_path, b"uniqueIdentifier");
-    index.index_file(&readme_path, b"uniqueIdentifier");
-
-    let query = SearchIndex::query_trigrams_from_tokens(&["uniqueIdentifier"]);
-    let ranked = index
-        .lexical_rank(&query, Some(&is_semantic_indexed_extension), 10)
-        .unwrap();
-
-    assert!(ranked.iter().any(|(path, _)| path == &rust_path));
-    assert!(!ranked.iter().any(|(path, _)| path == &readme_path));
-}
diff --git a/crates/aft/tests/integration/main.rs b/crates/aft/tests/integration/main.rs
index 36eb8100e7..211c8c40b9 100644
--- a/crates/aft/tests/integration/main.rs
+++ b/crates/aft/tests/integration/main.rs
@@ -105,7 +105,6 @@ mod issue_824_edit_indentation_test;
 mod issue_827_828_repro_test;
 #[cfg(target_os = "linux")]
 mod landlock_storage_test;
-mod lexical_rank_test;
 mod lexical_score_test;
 mod locks_test;
 mod log_ctx_test;
diff --git a/crates/aft/tests/integration/sandbox_native_test.rs b/crates/aft/tests/integration/sandbox_native_test.rs
index 0e42f950b0..8879e83217 100644
--- a/crates/aft/tests/integration/sandbox_native_test.rs
+++ b/crates/aft/tests/integration/sandbox_native_test.rs
@@ -125,10 +125,23 @@ impl CortexkitFloorFixture {
         }
         std::fs::write(&connection, "daemon-token").unwrap();
         let shim_image = if copy_shim {
-            let bytes = std::fs::read(env!("CARGO_BIN_EXE_aft")).unwrap();
+            let bytes = std::fs::read(crate::test_helpers::aft_binary::source_binary()).unwrap();
+            #[cfg(target_os = "macos")]
+            let warm = crate::test_helpers::aft_binary::warm_fixture_image;
+            #[cfg(not(target_os = "macos"))]
+            let warm = |_: &Path| Ok(());
+            // macOS can delay a new inode's first execution beyond configure's
+            // two-second `gh-shim --shim-version` validation deadline. Warm it
+            // in setup, keeping mode 0755 so write-denial assertions still
+            // depend on the sandbox, not chmod.
             Some(
-                crate::test_helpers::executable_cache::cached_executable(&bytes)
-                    .expect("cache isolated shim image"),
+                crate::test_helpers::executable_cache::cached_executable_named_in_with_warmup(
+                    &std::env::temp_dir().join("aft-test-private-shims"),
+                    &bytes,
+                    "aft",
+                    warm,
+                )
+                .expect("cache and warm isolated shim image"),
             )
         } else {
             None
@@ -347,7 +360,14 @@ fn cortexkit_floor_shim_and_managed_hooks_execute_read_only() {
     // Executing a Mach-O image does not by itself prove file-read access on
     // Seatbelt. Check the managed bytes too, before exercising both consumers.
     let response = foreground(&mut f.aft, "governed-child", "cat \"$AFT_GH_SHIMS_DIR/gh\" > /dev/null && gh --status && cat \"$GIT_CONFIG_VALUE_0/prepare-commit-msg\" > /dev/null && git init -q --template= && printf tracked > tracked && git add tracked && git -c user.name='AFT Test' -c user.email=aft@example.invalid commit -qm initial && git log -1 --format=%B");
-    assert_eq!(response["status"], "completed", "{response:?}");
+    if response["status"] != "completed" {
+        let shim = f.storage.join("shims/gh");
+        let target = std::fs::read_link(&shim);
+        let (_, stderr) = f.aft.stderr_output();
+        panic!(
+            "governed child did not complete: {response:?}; shim target: {target:?}; daemon stderr:\n{stderr}"
+        );
+    }
     let output = response["output"].as_str().unwrap();
     assert!(output.contains("rung"), "shim status missing: {response:?}");
     assert!(
diff --git a/crates/aft/tests/integration/semantic_disk_test.rs b/crates/aft/tests/integration/semantic_disk_test.rs
index c5f1a08387..b0793f36c1 100644
--- a/crates/aft/tests/integration/semantic_disk_test.rs
+++ b/crates/aft/tests/integration/semantic_disk_test.rs
@@ -111,10 +111,11 @@ fn bench_semantic_refresh_persistence_writes() {
         fs::create_dir_all(&semantic_dir).expect("create copied artifact directory");
         let data_path = semantic_dir.join("semantic.bin");
         fs::write(&data_path, &artifact).expect("copy semantic artifact");
-        fs::File::open(&data_path)
-            .expect("open copied artifact")
-            .sync_all()
-            .expect("sync copied artifact");
+        aft_store::sync::sync_all(
+            &fs::File::open(&data_path).expect("open copied artifact"),
+            &data_path,
+        )
+        .expect("sync copied artifact");
 
         let mut index = SemanticIndex::read_from_disk(&storage, "measured", &root, false, None)
             .expect("load copied semantic artifact");
diff --git a/crates/aft/tests/integration/subc_bridge_test.rs b/crates/aft/tests/integration/subc_bridge_test.rs
index f84f7c08af..87722023ab 100644
--- a/crates/aft/tests/integration/subc_bridge_test.rs
+++ b/crates/aft/tests/integration/subc_bridge_test.rs
@@ -8382,6 +8382,48 @@ async fn read_raw_inventory_frame(stream: &mut tokio::net::TcpStream, label: &st
         .unwrap_or_else(|| panic!("EOF waiting for {label}"))
 }
 
+async fn accept_status_consumer(
+    listener: &TcpListener,
+    key: &[u8],
+    daemon_id: &[u8; subc_transport::DAEMON_ID_LEN],
+) -> (tokio::net::TcpStream, Frame) {
+    loop {
+        let (mut stream, _) = tokio::time::timeout(Duration::from_secs(5), listener.accept())
+            .await
+            .expect("fleet consumer connection timeout")
+            .expect("accept consumer");
+        authenticate_server(
+            &mut stream,
+            key,
+            daemon_id,
+            FAKE_DAEMON_VERSION,
+            Duration::from_secs(5),
+        )
+        .await
+        .expect("authenticate consumer");
+        let first = read_raw_inventory_frame(&mut stream, "consumer request").await;
+        if frame_operation(&first).as_deref() == Some("route.open") {
+            // The default-enabled GitHub shim also connects at startup. This
+            // daemon has no vault; refuse its manifest route, not the fleet dial.
+            let body: Value = serde_json::from_slice(&first.body).expect("manifest route body");
+            assert_eq!(first.header.ty, FrameType::Request);
+            assert_eq!(first.header.channel, 0);
+            assert_eq!(
+                body["target"],
+                json!({ "kind": "management_surface", "module_id": "claustrum" })
+            );
+            assert_eq!(
+                body["identity"],
+                json!({ "harness": "aft-manifest-sync", "session": "daemon" })
+            );
+            send_channel_zero_error(&mut stream, first.header.corr, "target_unavailable").await;
+            continue;
+        }
+        assert_eq!(frame_operation(&first).as_deref(), Some("catalog.list"));
+        return (stream, first);
+    }
+}
+
 fn frame_operation(frame: &Frame) -> Option<String> {
     serde_json::from_slice::<Value>(&frame.body)
         .ok()
@@ -8626,9 +8668,9 @@ async fn drive_discovered_status_line_surface_daemon(input: FakeDaemonInput) {
     // consumer actually connects. Finish each response before stopping so no
     // partial supervision-frame read is cancelled when the connection arrives.
     let (connected_tx, mut connected_rx) = tokio::sync::oneshot::channel();
-    let ((mut consumer_stream, _), ()) = tokio::join!(
+    let ((mut consumer_stream, catalog), ()) = tokio::join!(
         async {
-            let accepted = listener.accept().await.expect("accept fleet consumer");
+            let accepted = accept_status_consumer(&listener, &key, &daemon_id).await;
             connected_tx.send(()).expect("status signal driver active");
             accepted
         },
@@ -8664,17 +8706,6 @@ async fn drive_discovered_status_line_surface_daemon(input: FakeDaemonInput) {
             }
         }
     );
-    authenticate_server(
-        &mut consumer_stream,
-        &key,
-        &daemon_id,
-        FAKE_DAEMON_VERSION,
-        Duration::from_secs(30),
-    )
-    .await
-    .expect("authenticate fleet consumer");
-
-    let catalog = read_raw_inventory_frame(&mut consumer_stream, "catalog.list").await;
     assert_eq!(frame_operation(&catalog).as_deref(), Some("catalog.list"));
     send_frame(
         &mut consumer_stream,
@@ -8895,21 +8926,7 @@ impl FakeStatusHolder {
         daemon_id: &[u8; subc_transport::DAEMON_ID_LEN],
         root: &std::path::Path,
     ) -> Self {
-        let (mut consumer_stream, _) =
-            tokio::time::timeout(Duration::from_secs(5), listener.accept())
-                .await
-                .expect("fleet consumer connection timeout")
-                .expect("accept fleet consumer");
-        authenticate_server(
-            &mut consumer_stream,
-            key,
-            daemon_id,
-            FAKE_DAEMON_VERSION,
-            Duration::from_secs(5),
-        )
-        .await
-        .expect("authenticate fleet consumer");
-        let catalog = read_raw_inventory_frame(&mut consumer_stream, "catalog.list").await;
+        let (mut consumer_stream, catalog) = accept_status_consumer(listener, key, daemon_id).await;
         assert_eq!(frame_operation(&catalog).as_deref(), Some("catalog.list"));
         reply_to(&mut consumer_stream, &catalog, holder_catalog()).await;
         let route_open = read_raw_inventory_frame(&mut consumer_stream, "route.open").await;
diff --git a/crates/aft/tests/integration/worker_session_test.rs b/crates/aft/tests/integration/worker_session_test.rs
index b66c3c8608..b2d22a6a62 100644
--- a/crates/aft/tests/integration/worker_session_test.rs
+++ b/crates/aft/tests/integration/worker_session_test.rs
@@ -336,12 +336,19 @@ fn queue_gated_worker_wait(
         }
     };
     let command = if cfg!(windows) {
-        format!("Set-Content -Path '{}' -Value started; while (-not (Test-Path '{}')) {{ Start-Sleep -Milliseconds 10 }}; Write-Output done", quote(&marker), quote(&release.0))
+        format!(
+            "Set-Content -Path '{}' -Value started; {}; Write-Output done",
+            quote(&marker),
+            crate::test_helpers::test_gate::powershell_gate(&release.0.to_string_lossy(), 10)
+        )
     } else {
         format!(
-            "printf started > '{}'; until [ -e '{}' ]; do sleep 0.01; done; printf 'done\\n'",
+            "printf started > '{}'; {}; printf 'done\\n'",
             quote(&marker),
-            quote(&release.0)
+            crate::test_helpers::test_gate::gate_exists(
+                &format!("'{}'", quote(&release.0)),
+                "sleep 0.01"
+            )
         )
     };
     aft.send_silent(
diff --git a/crates/aft/tests/sandbox_launch_probe.rs b/crates/aft/tests/sandbox_launch_probe.rs
index 42c3a1b0c6..d417dca43e 100644
--- a/crates/aft/tests/sandbox_launch_probe.rs
+++ b/crates/aft/tests/sandbox_launch_probe.rs
@@ -1,6 +1,8 @@
 #![cfg(unix)]
 #[path = "helpers/context_storage.rs"]
 mod context_storage;
+#[path = "../src/test_gate.rs"]
+mod test_gate;
 
 #[cfg(target_os = "linux")]
 use aft::bash_background::persistence::resolve_task;
@@ -595,8 +597,8 @@ fn dangling_socket_deny_blocks_target_created_after_sandbox_start() {
     let release = root.join("release");
     let python = "import socket,sys,errno\nfor path in sys.argv[1:]:\n try:\n  socket.socket(socket.AF_UNIX).connect(path)\n except OSError as e:\n  assert e.errno in (errno.EPERM, errno.EACCES), e\n else:\n  raise AssertionError('socket connection escaped deny: ' + path)\nprint('BOTH_DENIED')";
     let script = format!(
-        "printf 'ready\\n'; while [ ! -e {} ]; do sleep 0.01; done; python3 -B -c {} {} {}",
-        shell_path(&release),
+        "printf 'ready\\n'; {}; python3 -B -c {} {} {}",
+        test_gate::gate_exists(&shell_path(&release), "sleep 0.01"),
         shell_path(Path::new(python)),
         shell_path(&alias),
         shell_path(&target),
@@ -1020,8 +1022,8 @@ fn read_deny_created_after_sandbox_start_remains_denied() {
     let mut inherited = InheritedProfile::new(&profile);
     inherited.rewind();
     let script = format!(
-        "printf 'ready\\n'; while [ ! -e {} ]; do sleep 0.01; done; cat {}",
-        shell_path(&release),
+        "printf 'ready\\n'; {}; cat {}",
+        test_gate::gate_exists(&shell_path(&release), "sleep 0.01"),
         shell_path(&secret_file)
     );
     let mut child = launcher_command(inherited.fd(), &["/bin/bash", "-c", &script])
@@ -1084,8 +1086,8 @@ fn home_directory_created_after_launch_remains_read_denied() {
     let late_dir = home.join("late-directory");
     let late_file = late_dir.join("value");
     let script = format!(
-        "printf 'ready\\n'; while [ ! -e {} ]; do sleep 0.01; done; cat {}",
-        shell_path(&release),
+        "printf 'ready\\n'; {}; cat {}",
+        test_gate::gate_exists(&shell_path(&release), "sleep 0.01"),
         shell_path(&late_file)
     );
     let mut child = launcher_command(inherited.fd(), &["/bin/bash", "-c", &script])
diff --git a/crates/aft/tests/scope_end_kill.rs b/crates/aft/tests/scope_end_kill.rs
index ffb2c9e19d..ac028d887f 100644
--- a/crates/aft/tests/scope_end_kill.rs
+++ b/crates/aft/tests/scope_end_kill.rs
@@ -647,14 +647,11 @@ fn gated_shell(root: &Path, key: Option<&str>) -> Value {
         .to_string()
         .replace('\\', "/");
     #[cfg(windows)]
-    let command = format!(
-        "while (-not (Test-Path -LiteralPath '{}')) {{ Start-Sleep -Milliseconds 50 }}",
-        release.replace('\'', "''")
-    );
+    let command = crate::test_helpers::test_gate::powershell_gate(&release, 50);
     #[cfg(not(windows))]
-    let command = format!(
-        "while [ ! -f '{}' ]; do sleep 0.05; done",
-        release.replace('\'', "'\\''")
+    let command = crate::test_helpers::test_gate::gate(
+        &format!("'{}'", release.replace('\'', "'\\''")),
+        "sleep 0.05",
     );
     call["arguments"]["command"] = json!(command);
     call
diff --git a/crates/aft/tests/tool_provider_conformance.rs b/crates/aft/tests/tool_provider_conformance.rs
index 9de48c764c..97e8bb5190 100644
--- a/crates/aft/tests/tool_provider_conformance.rs
+++ b/crates/aft/tests/tool_provider_conformance.rs
@@ -2406,9 +2406,9 @@ async fn restart_recovers_shell_once(hold_running_record: bool) {
     let gate = root.join("after-create-gate");
     let wait = if hold_running_record {
         std::fs::write(&gate, b"hold").unwrap();
-        format!(
-            "while [ ! -f '{}' ]; do sleep 0.01; done",
-            release.display().to_string().replace('\'', "'\\''")
+        crate::test_helpers::test_gate::gate(
+            &format!("'{}'", release.display().to_string().replace('\'', "'\\''")),
+            "sleep 0.01",
         )
     } else {
         "sleep 2".to_string()
diff --git a/crates/aft/tests/tool_provider_subc_e2e.rs b/crates/aft/tests/tool_provider_subc_e2e.rs
index 428c98e972..d68b28c107 100644
--- a/crates/aft/tests/tool_provider_subc_e2e.rs
+++ b/crates/aft/tests/tool_provider_subc_e2e.rs
@@ -50,7 +50,13 @@ impl HermeticDaemon {
         let task = tokio::spawn(subc_daemon::bootstrap::run_with_config(config));
         let deadline = Instant::now() + Duration::from_secs(60);
         while !connection_file.exists() {
-            assert!(!task.is_finished(), "embedded daemon exited during startup");
+            if task.is_finished() {
+                panic!(
+                    "embedded daemon exited during startup: {:?}\n{}",
+                    task.await,
+                    fixture_logs(&home.join("logs"))
+                );
+            }
             assert!(
                 Instant::now() < deadline,
                 "embedded daemon did not publish its connection file"
diff --git a/crates/aft/tests/worker_jail.rs b/crates/aft/tests/worker_jail.rs
index eff2307749..388495565c 100644
--- a/crates/aft/tests/worker_jail.rs
+++ b/crates/aft/tests/worker_jail.rs
@@ -31,6 +31,8 @@ const FAKE_DAEMON_VERSION: &str = "0.39.0";
 mod aft_binary;
 #[path = "helpers/executable_cache.rs"]
 mod executable_cache;
+#[path = "../src/test_gate.rs"]
+mod test_gate;
 #[path = "helpers/worker_gh_read.rs"]
 mod worker_gh_read;
 
@@ -297,10 +299,7 @@ fn worker_jail_teardown_kills_recorded_sandbox_process_groups() {
     let data = temp.path().join("data");
     let release = temp.path().join("release");
     let mut child = Command::new("/bin/sh")
-        .args([
-            "-c",
-            &format!("while ! test -f {}; do sleep .02; done", quote(&release)),
-        ])
+        .args(["-c", &test_gate::gate(&quote(&release), "sleep .02")])
         .process_group(0)
         .spawn()
         .unwrap();
@@ -344,10 +343,7 @@ fn worker_jail_teardown_skips_reused_process_group() {
     let data = temp.path().join("data");
     let release = temp.path().join("release");
     let mut child = Command::new("/bin/sh")
-        .args([
-            "-c",
-            &format!("while ! test -f {}; do sleep .02; done", quote(&release)),
-        ])
+        .args(["-c", &test_gate::gate(&quote(&release), "sleep .02")])
         .process_group(0)
         .spawn()
         .unwrap();
@@ -394,10 +390,7 @@ fn worker_jail_teardown_skips_terminal_process_group() {
     let data = temp.path().join("data");
     let release = temp.path().join("release");
     let mut child = Command::new("/bin/sh")
-        .args([
-            "-c",
-            &format!("while ! test -f {}; do sleep .02; done", quote(&release)),
-        ])
+        .args(["-c", &test_gate::gate(&quote(&release), "sleep .02")])
         .process_group(0)
         .spawn()
         .unwrap();
@@ -3154,7 +3147,7 @@ async fn worker_jail_temp_denies_other_task_directory() {
     // when its scratch is retained for its own session.
     let ready = jail.bash("true").await;
     let first_corr = jail.submit_tool("bash", json!({
-        "command": format!("printf original > \"$TMPDIR/sentinel\" && printf '%s' \"$TMPDIR\" > {}; while [ ! -f {} ]; do sleep 0.05; done", quote(&recorded), quote(&release)),
+        "command": format!("printf original > \"$TMPDIR/sentinel\" && printf '%s' \"$TMPDIR\" > {}; {}", quote(&recorded), test_gate::gate(&quote(&release), "sleep 0.05")),
         "timeout": 30_000,
     })).await;
     let deadline = std::time::Instant::now() + Duration::from_secs(10);
@@ -3496,9 +3489,9 @@ async fn worker_jail_teardown_kills_sandboxed_shell_groups_during_unwind() {
     let release = jail.worktree.join("teardown-release");
     jail.submit_held_bash(json!({
         "command": format!(
-            "printf '%s\\n' \"$TMPDIR\" > {}; while ! test -f {}; do sleep .02; done",
+            "printf '%s\\n' \"$TMPDIR\" > {}; {}",
             quote(&ready),
-            quote(&release),
+            test_gate::gate(&quote(&release), "sleep .02"),
         ),
         "background": true,
         "timeout": 60_000,
@@ -3688,7 +3681,12 @@ async fn worker_gh_read_t8_live_scope_rebind_refuses_before_upstream() {
     let ready = jail.worktree.join("broker-ready");
     let go = jail.worktree.join("broker-go");
     let outcome = jail.worktree.join("broker-outcome");
-    let command = format!("echo ready > {}; while ! test -f {}; do sleep 0.02; done; gh api repos/cortexkit/aft > /dev/null 2>&1; echo $? > {}", quote(&ready), quote(&go), quote(&outcome));
+    let command = format!(
+        "echo ready > {}; {}; gh api repos/cortexkit/aft > /dev/null 2>&1; echo $? > {}",
+        quote(&ready),
+        test_gate::gate(&quote(&go), "sleep 0.02"),
+        quote(&outcome)
+    );
     let corr = jail
         .submit_held_bash(json!({"command":command,"background":true,"timeout":30_000}))
         .await;
@@ -3841,8 +3839,8 @@ async fn cross_command_broker_isolation(profile: &str) {
     let paths = jail.worktree.join("broker-a-paths");
     let finish = jail.worktree.join("broker-a-finish");
     let corr = jail.submit_held_bash(json!({"command":format!(
-        "printf '%s\\n%s\\n%s\\n' \"$AFT_GH_READ_SOCKET\" \"$AFT_GH_READ_CAPABILITY_FILE\" \"$$\" > {}.tmp && mv {}.tmp {}; while ! test -f {}; do sleep 0.02; done",
-        quote(&paths), quote(&paths), quote(&paths), quote(&finish)),"background":true,"timeout":30_000})).await;
+        "printf '%s\\n%s\\n%s\\n' \"$AFT_GH_READ_SOCKET\" \"$AFT_GH_READ_CAPABILITY_FILE\" \"$$\" > {}.tmp && mv {}.tmp {}; {}",
+        quote(&paths), quote(&paths), quote(&paths), test_gate::gate(&quote(&finish), "sleep 0.02")),"background":true,"timeout":30_000})).await;
     // The file is renamed into place whole: the test polls for it and must
     // never read a partly written list of three lines.
     let paths = wait_test_file(&paths).await;
@@ -4190,8 +4188,8 @@ PY
         );
         if mode != "end" {
             command.push_str(&format!(
-                "while ! test -f {}; do sleep .02; done; echo finished > {}\n",
-                quote(&finish),
+                "{}; echo finished > {}\n",
+                test_gate::gate(&quote(&finish), "sleep .02"),
                 quote(&parent_done)
             ));
         }
@@ -4251,7 +4249,7 @@ async fn worker_gh_read_t12_malformed_peer_reply_and_endpoint_replacement_fail_c
         return;
     }
     let mut jail = gh_read_jail().await;
-    let reply = jail.bash(r#"set -eu
+    let reply = jail.bash(&r#"set -eu
 if rm "$AFT_GH_READ_SOCKET" 2>/dev/null; then echo ENDPOINT_REPLACED; exit 91; fi
 python3 - "$TMPDIR/malformed.sock" <<'PY' &
 import socket, struct, sys
@@ -4269,7 +4267,7 @@ if len(header) == 4:
 c.close(); s.close()
 PY
 peer=$!
-while ! test -S "$TMPDIR/malformed.sock"; do sleep .02; done
+__AFT_SOCKET_GATE__
 rm -f "$AFT_GH_SHIM_STATE_DIR/read-session-lookup.json"
 if AFT_GH_READ_SOCKET="$TMPDIR/malformed.sock" gh api repos/cortexkit/aft >/dev/null 2>&1; then exit 92; fi
 wait "$peer"
@@ -4279,7 +4277,7 @@ with open(sys.argv[1]) as f: record = json.load(f)
 assert record['outcome'] == 'unavailable' and record['reason'] == 'worker read broker reply malformed', record
 PY
 echo MALFORMED_BROKER_REPLY_REFUSED
-"#).await;
+"#.replace("__AFT_SOCKET_GATE__", &test_gate::gate_socket("\"$TMPDIR/malformed.sock\"", "sleep .02"))).await;
     assert!(reply.contains("MALFORMED_BROKER_REPLY_REFUSED"), "{reply}");
     assert!(jail.read_holder.lock().unwrap().calls.is_empty());
     assert!(!jail.worktree.join("native-gh.log").exists());
@@ -4342,7 +4340,7 @@ async fn gh_shim_router_host_v1_background_reply_is_terminal_and_model_only() {
         .tool_reply_on_channel(2, "bash", json!({"command":"true"}))
         .await;
     jail.assert_bash_completed("head-session", &warm);
-    let corr = jail.submit_tool_on_channel(2, "bash", json!({"command":format!("echo ready > {}; while ! test -f {}; do sleep .02; done", quote(&ready), quote(&release)),"background":true,"timeout":10_000})).await;
+    let corr = jail.submit_tool_on_channel(2, "bash", json!({"command":format!("echo ready > {}; {}", quote(&ready), test_gate::gate(&quote(&release), "sleep .02")),"background":true,"timeout":10_000})).await;
     wait_test_file(&ready).await;
     let frame = {
         let pending = jail.reply_frame(2, corr);
@@ -4390,7 +4388,7 @@ async fn worker_gh_read_t10_promotion_keeps_the_original_command_grant() {
     let ready = jail.worktree.join("promotion-ready");
     let release = jail.worktree.join("promotion-release");
     let output = jail.worktree.join("promotion-read");
-    jail.submit_held_bash(json!({"command":format!("gh api repos/cortexkit/aft >/dev/null; printf '%s' \"$TMPDIR\" > {}; while ! test -f {}; do sleep .02; done; gh api repos/cortexkit/aft > {}", quote(&ready), quote(&release), quote(&output)),"background":false,"timeout":30_000})).await;
+    jail.submit_held_bash(json!({"command":format!("gh api repos/cortexkit/aft >/dev/null; printf '%s' \"$TMPDIR\" > {}; {}; gh api repos/cortexkit/aft > {}", quote(&ready), test_gate::gate(&quote(&release), "sleep .02"), quote(&output)),"background":false,"timeout":30_000})).await;
     let temp = wait_test_file(&ready).await;
     let (task, metadata) = worker_gh_read::observe_task(Path::new(&temp));
     assert!(
@@ -4606,7 +4604,7 @@ async fn worker_gh_read_revocation_suppresses_reply_to_surviving_observer() {
     jail.read_holder.lock().unwrap().hold_reads = Some(hold.clone());
     let ready = jail.worktree.join("observer-ready");
     let finish = jail.worktree.join("observer-finish");
-    let corr=jail.submit_held_bash(json!({"command":format!("printf '%s' \"$TMPDIR\" > {}; while ! test -f {}; do sleep .02; done",quote(&ready),quote(&finish)),"timeout":30_000})).await;
+    let corr=jail.submit_held_bash(json!({"command":format!("printf '%s' \"$TMPDIR\" > {}; {}",quote(&ready),test_gate::gate(&quote(&finish), "sleep .02")),"timeout":30_000})).await;
     let temp = wait_test_file(&ready).await;
     let socket = Path::new(&temp).with_file_name(format!(
         "{}.gh-read.sock",
diff --git a/crates/secret-rules/src/location.rs b/crates/secret-rules/src/location.rs
index 8c1882a696..5a8b33e526 100644
--- a/crates/secret-rules/src/location.rs
+++ b/crates/secret-rules/src/location.rs
@@ -16,6 +16,11 @@ mod json;
 
 pub use json::is_json_content_type;
 
+/// Validate JSON structure without selecting a deposit location or holding a key.
+pub fn validate_json_request(request: &RequestView<'_>) -> Result<(), RequestRefusal> {
+    json::evaluate(request, &[], &[]).map(|_| ())
+}
+
 use crate::material::{check_admissible, encode_for_location, MaterialRefusal};
 use crate::placeholder::{is_label, parse_exact, PLACEHOLDER_PREFIX};
 use crate::target::{authority_matches_connect, ConnectAuthority, RuleTarget, TargetRefusal};
@@ -71,7 +76,7 @@ pub fn location_kind_token(location: &Location) -> String {
     }
 }
 
-/// A label's rule, as resolved by the vault (V1).
+/// The location and concrete target authorized for one request.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LabelRule {
     pub label: String,
@@ -79,9 +84,6 @@ pub struct LabelRule {
     pub port: u16,
     pub path_prefix: String,
     pub location: Location,
-    /// Opaque grant identifier; the vault compares it, the crate never parses
-    /// it.
-    pub grant_id: String,
 }
 
 /// Why a request is refused (P2, P4, and the target rules it depends on).
diff --git a/crates/secret-rules/tests/audit_location.rs b/crates/secret-rules/tests/audit_location.rs
index f38127bf7f..015ee8bad4 100644
--- a/crates/secret-rules/tests/audit_location.rs
+++ b/crates/secret-rules/tests/audit_location.rs
@@ -21,7 +21,6 @@ fn rule(label: &str, location: Location) -> LabelRule {
         port: 443,
         path_prefix: "/v1".to_string(),
         location,
-        grant_id: "grant".to_string(),
     }
 }
 
@@ -94,7 +93,6 @@ fn redirect_authority_is_decided_per_label() {
             port: 443,
             path_prefix: "/v1".to_string(),
             location: Location::Query("key".to_string()),
-            grant_id: "grant".to_string(),
         },
     ];
     let hop = RequestTarget {
diff --git a/crates/secret-rules/tests/audit_r2.rs b/crates/secret-rules/tests/audit_r2.rs
index 4af324b604..d7c17b3c05 100644
--- a/crates/secret-rules/tests/audit_r2.rs
+++ b/crates/secret-rules/tests/audit_r2.rs
@@ -23,7 +23,6 @@ fn rule(label: &str, location: Location) -> LabelRule {
         port: 443,
         path_prefix: "/v1".to_string(),
         location,
-        grant_id: "grant".to_string(),
     }
 }
 
diff --git a/crates/secret-rules/tests/location_rules.rs b/crates/secret-rules/tests/location_rules.rs
index 5517bb5b6f..4ce2f7a01e 100644
--- a/crates/secret-rules/tests/location_rules.rs
+++ b/crates/secret-rules/tests/location_rules.rs
@@ -15,7 +15,6 @@ fn rule(location: Location) -> LabelRule {
         port: 443,
         path_prefix: "/v1".to_string(),
         location,
-        grant_id: "grant-1".to_string(),
     }
 }
 
diff --git a/crates/secret-rules/tests/target_rules.rs b/crates/secret-rules/tests/target_rules.rs
index 829af01253..582d5aa7a0 100644
--- a/crates/secret-rules/tests/target_rules.rs
+++ b/crates/secret-rules/tests/target_rules.rs
@@ -232,7 +232,6 @@ fn a_redirect_hop_to_another_host_scheme_or_port_is_not_authorized() {
         port: 443,
         path_prefix: "/v1".to_string(),
         location: Location::Query("key".to_string()),
-        grant_id: "g".to_string(),
     };
     let rules = [rule];
     let same = request("api.example.com", 443, "https", "/v1/next");
diff --git a/crates/secret-rules/tests/vectors.rs b/crates/secret-rules/tests/vectors.rs
index 0d39933584..98e223478a 100644
--- a/crates/secret-rules/tests/vectors.rs
+++ b/crates/secret-rules/tests/vectors.rs
@@ -165,7 +165,6 @@ fn case_rule(value: &Value) -> Result<LabelRule, String> {
             .map(support::string)
             .unwrap_or_else(|| "/v1".to_string()),
         location,
-        grant_id: "grant".to_string(),
     })
 }
 
diff --git a/docs/config.md b/docs/config.md
index dd44d686bf..afa38eb0f0 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -37,6 +37,8 @@ On Linux, user config may set `bash.linux_scope: true` to launch non-PTY tool sh
 
 `bash.memory_limit_mib` optionally caps aggregate memory for each local command, including foreground, background, and PTY commands. It is off by default; set a positive integer in MiB (for example, `4096` for 4 GiB; maximum `4294967295`) in user config. Projects may tighten the cap, never raise or remove it. Changes affect future commands; there is no per-call override. Remote `runon` jobs use the build server's own limits and are not covered.
 
+On Linux, local agent shells always raise their `oom_score_adj` to `1000` before running the command, so the kernel prefers them and their descendants over AFT and desktop processes during an out-of-memory event; this has no setting and does not change AFT's own value. If the adjustment cannot be verified, the command still runs, AFT logs one warning per process, and the `bash_oom_priority_failures` health counter records the failures.
+
 - **Linux:** cgroup v2 `memory.max` (using a delegated transient systemd user scope when needed); if unavailable, the result explicitly names the process-group RSS watcher fallback.
 - **Windows:** a job-object aggregate memory limit refuses allocations; AFT stops the job when a limit notification or peak accounting confirms the cap was hit.
 - **macOS:** a physical-footprint process-group watcher samples every 500 ms. Fast allocations can overshoot for a fraction of a second, and processes that leave the group are not counted. The Linux watcher has the same limits. Watcher scans are bounded to 4096 processes and stop the command explicitly if accounting cannot complete.
@@ -161,6 +163,53 @@ Top inclusive running symbols:
 
 Raw sampler output is withheld unless native `aft profile --raw` is explicitly requested.
 
+### Release symbols
+
+GitHub release assets include separate symbol archives for both `x64` and `arm64`:
+`aft-darwin-<arch>-dsym.zip` on macOS, `aft-linux-<arch>-debug.zip` on Linux, and
+`aft-windows-<arch>-pdb.zip` on Windows. Always use the archive from the **same
+release and architecture** as the executable that produced the stack or dump.
+These archives are not installed by npm and are not runtime dependencies. The
+executables retain only the small debuglink (Linux) or PDB reference (Windows),
+not the debug payload. The release build checks ELF build IDs and Windows PDB
+GUID/age pairs before uploading the archives.
+
+On Linux, unpack the archive and compare the `Build ID` printed for the shipped
+executable and `aft.debug`, then resolve an address with GNU binutils:
+
+```sh
+unzip aft-linux-x64-debug.zip -d symbols/linux-x64
+readelf -n ./aft-linux-x64
+readelf -n symbols/linux-x64/aft.debug
+addr2line -e symbols/linux-x64/aft.debug -f -C 0xADDRESS
+```
+
+Use an ELF-relative address, not an ASLR-relocated process address: subtract the
+image's load bias using the crash/core mappings first. For ARM64, use the ARM64
+archive and an architecture-capable tool such as `aarch64-linux-gnu-addr2line`.
+The shipped executable's optional `.gnu_debuglink` names `aft.debug`; the program
+still runs when the debug file is absent. A detached debug ELF may make some
+`readelf` versions warn about its absent program interpreter; its build ID remains
+readable and must match.
+
+On Windows, unpack `aft-windows-x64-pdb.zip` (or the ARM64 archive) into a symbol
+directory, retaining the PDB's archived filename. Cargo may name the original PDB
+with a hash; the archive preserves the name referenced by the executable. Open
+the crash dump in WinDbg with the matching release executable available, then:
+
+```text
+.sympath+ C:\symbols\aft
+.reload /f
+lmv m aft*
+kv
+```
+
+WinDbg checks the PDB GUID and age against the executable's CodeView reference;
+do not force-load a mismatched PDB. `lmv` shows symbol-loading status and `kv`
+prints the symbolized stack. In Visual Studio, the Modules window's **Load
+Symbols** command can point at the same extracted directory. Release symbols
+contain function names and line tables, not full local-variable/type information.
+
 ## Config Options
 
 ```jsonc
diff --git a/packages/aft-bridge/src/__tests__/bash-format.test.ts b/packages/aft-bridge/src/__tests__/bash-format.test.ts
new file mode 100644
index 0000000000..b65c01e1c7
--- /dev/null
+++ b/packages/aft-bridge/src/__tests__/bash-format.test.ts
@@ -0,0 +1,23 @@
+import { expect, test } from "bun:test";
+import { formatUnknownPtyExit } from "../bash-format.js";
+
+test("PTY lost exit header uses approved words without changing other unknown fates or kills", () => {
+  expect(
+    formatUnknownPtyExit("bash-lost", {
+      status: "fate_unknown",
+      status_reason: "AFT could not read how it ended",
+    }),
+  ).toBe("Task bash-lost: exit status unknown (AFT could not read how it ended)");
+  expect(
+    formatUnknownPtyExit("bash-killed", {
+      status: "killed",
+      status_reason: "AFT could not read how it ended",
+    }),
+  ).toBeUndefined();
+  expect(
+    formatUnknownPtyExit("bash-remote", {
+      status: "fate_unknown",
+      status_reason: "remote connection lost",
+    }),
+  ).toBeUndefined();
+});
diff --git a/packages/aft-bridge/src/bash-format.ts b/packages/aft-bridge/src/bash-format.ts
index 5f583edbe4..362127454a 100644
--- a/packages/aft-bridge/src/bash-format.ts
+++ b/packages/aft-bridge/src/bash-format.ts
@@ -4,6 +4,17 @@ import { isTerminalBashStatus } from "./protocol.js";
 
 export { TERMINAL_BG_TASK_STATUSES } from "./protocol.js";
 
+/** Only a lost PTY wait status means the process ended without an observed exit code. */
+export function formatUnknownPtyExit(
+  taskId: string,
+  data: { status?: unknown; status_reason?: unknown },
+): string | undefined {
+  if (data.status !== "fate_unknown" || data.status_reason !== "AFT could not read how it ended") {
+    return undefined;
+  }
+  return `Task ${taskId}: exit status unknown (AFT could not read how it ended)`;
+}
+
 /** Render a millisecond duration as a compact seconds string (8000 -> "8s", 5500 -> "5.5s"). */
 export function formatSeconds(ms: number): string {
   return `${Number((ms / 1000).toFixed(1))}s`;
diff --git a/packages/aft-bridge/src/index.ts b/packages/aft-bridge/src/index.ts
index a9d5cf6daa..6dd506d278 100644
--- a/packages/aft-bridge/src/index.ts
+++ b/packages/aft-bridge/src/index.ts
@@ -24,6 +24,7 @@ export {
 export {
   formatForegroundResult,
   formatSeconds,
+  formatUnknownPtyExit,
   isLiveBackgroundTaskReply,
   isTerminalStatus,
   monotonicNowMs,
diff --git a/packages/aft-cli/src/__tests__/sanitize.test.ts b/packages/aft-cli/src/__tests__/sanitize.test.ts
index b4980fd28e..52748de8c6 100644
--- a/packages/aft-cli/src/__tests__/sanitize.test.ts
+++ b/packages/aft-cli/src/__tests__/sanitize.test.ts
@@ -12,7 +12,13 @@ const sharedRedactionCases = JSON.parse(
     new URL("../../../../crates/aft/tests/fixtures/log_redaction_cases.json", import.meta.url),
     "utf8",
   ),
-) as { masked: Array<{ input: string; expected: string }>; untouched: string[] };
+) as {
+  masked: Array<{ input: string; expected: string }>;
+  untouched: string[];
+  command_masked: Array<{ input: string; expected: string }>;
+  command_untouched: string[];
+  command_logs: Array<{ input: string; expected: string }>;
+};
 
 describe("redactSecrets shared fixture", () => {
   test("masks every shared case exactly as the Rust redactor does", () => {
@@ -28,6 +34,22 @@ describe("redactSecrets shared fixture", () => {
       expect(redactSecrets(input)).toBe(input);
     }
   });
+
+  test("masks shared command shapes without masking structured fields", () => {
+    const prefix = "bash spawned task=bgb_test session=ses_abcDEF0123456789 cmd=";
+    expect(sharedRedactionCases.command_masked.length).toBeGreaterThan(0);
+    for (const { input, expected } of sharedRedactionCases.command_masked) {
+      expect(redactSecrets(input)).toBe(input);
+      expect(redactSecrets(`${prefix}${input}`)).toBe(`${prefix}${expected}`);
+    }
+    for (const command of sharedRedactionCases.command_untouched) {
+      expect(redactSecrets(`${prefix}${command}`)).toBe(`${prefix}${command}`);
+    }
+    for (const { input, expected } of sharedRedactionCases.command_logs) {
+      expect(redactSecrets(input)).toBe(expected);
+      expect(sanitizeContent(input)).toBe(expected);
+    }
+  });
 });
 
 describe("sanitizeContent", () => {
@@ -134,6 +156,20 @@ describe("sanitizeContent", () => {
     expect(out).toContain("aws access key id <REDACTED_SECRET>");
   });
 
+  test("redacts inline passwords in historical bash spawn logs", () => {
+    const secret = "Ab3dEfGhIjKlMnOpQrStUvWxYz0123456789-_aBcDe";
+    expect(secret.length).toBe(43);
+    const prefix = "bash spawned task=bgb_test cmd=cd /work/x/opencode ";
+    const suffix = ' curl -s -u "opencode:$PW" http://127.0.0.1:4599/api/status';
+    expect(sanitizeContent(`${prefix}PW=${secret}${suffix}`)).toBe(
+      `${prefix}PW=<REDACTED_SECRET>${suffix}`,
+    );
+    expect(sanitizeContent(`${prefix}PASS=small DB_PW=small DB_PASS=small X=${secret}`)).toBe(
+      `${prefix}PASS=<REDACTED_SECRET> DB_PW=<REDACTED_SECRET> DB_PASS=<REDACTED_SECRET> X=<REDACTED_SECRET>`,
+    );
+    expect(sanitizeContent("PWD=/tmp/x ?key=src_main_rs")).toBe("PWD=/tmp/x ?key=src_main_rs");
+  });
+
   test("redacts env-style sensitive keys", () => {
     const input = [
       "OPENCODE_SERVER_PASSWORD=swordfish",
diff --git a/packages/aft-cli/src/lib/sanitize.ts b/packages/aft-cli/src/lib/sanitize.ts
index dfc7030f2c..0576e3b04f 100644
--- a/packages/aft-cli/src/lib/sanitize.ts
+++ b/packages/aft-cli/src/lib/sanitize.ts
@@ -19,6 +19,7 @@ const KEY_NAME = "[A-Za-z_][A-Za-z0-9_.-]*";
 const SENSITIVE_KEY_WORD = /(?:token|password|secret|api[_-]?key|passwd|pwd|credential)/i;
 const SEGMENTED_KEY_WORD = /(?:^|[_.-])key(?:$|[_.-])/i;
 const CAMEL_CASE_KEY_WORD = /[a-z0-9]Key(?:$|[A-Z_.-])/;
+const SHORT_PASSWORD_NAME = /(?:^|_)(?:pw|pass)$/i;
 const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
 const AWS_ACCESS_KEY_ID_PATTERN = /\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}\b/g;
 // Credential query parameters inside a URL. The generic key/value passes below
@@ -47,6 +48,16 @@ function looksLikeSecret(value: string): boolean {
   );
 }
 
+// Keep assignment paths and URLs readable, but allow base64 slashes inside
+// tokens. Identical to looks_like_assignment_secret in the Rust log redactor.
+function looksLikeAssignmentSecret(value: string): boolean {
+  return (
+    !["/", "~/", "./", "../"].some((prefix) => value.startsWith(prefix)) &&
+    !value.includes("://") &&
+    looksLikeSecret(value)
+  );
+}
+
 const quotedSensitiveKeyValuePattern = new RegExp(
   String.raw`((['"])(${KEY_NAME})\2[^\S\r\n]*:[^\S\r\n]*)(['"])([^'"\r\n]+)\4`,
   "gi",
@@ -56,16 +67,69 @@ const unquotedSensitiveKeyValuePattern = new RegExp(
   "gi",
 );
 const bareSensitiveKeyValuePattern = new RegExp(
-  String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&'"]+)`,
+  String.raw`\b((${KEY_NAME})[^\S\r\n]*[=:][^\S\r\n]*)([^\s,;&|<>()'"]+)`,
   "gi",
 );
 
 function isSensitiveKeyName(keyName: string): boolean {
   return (
-    SENSITIVE_KEY_WORD.test(keyName) ||
-    SEGMENTED_KEY_WORD.test(keyName) ||
-    CAMEL_CASE_KEY_WORD.test(keyName)
+    keyName !== "PWD" &&
+    (SENSITIVE_KEY_WORD.test(keyName) ||
+      SEGMENTED_KEY_WORD.test(keyName) ||
+      CAMEL_CASE_KEY_WORD.test(keyName) ||
+      SHORT_PASSWORD_NAME.test(keyName))
+  );
+}
+
+function shouldRedactAssignment(
+  prefix: string,
+  keyName: string,
+  value: string,
+  offset: number,
+  content: string,
+  commandContext: boolean,
+): boolean {
+  // The query-specific pass already decided whether a generic key is secret.
+  if (keyName.toLowerCase() === "key" && /[?&]/.test(content[offset - 1] ?? "")) {
+    return false;
+  }
+  return (
+    isSensitiveKeyName(keyName) ||
+    (commandContext && prefix.trimEnd().endsWith("=") && looksLikeAssignmentSecret(value))
+  );
+}
+
+function redactAssignments(content: string, commandContext: boolean): string {
+  let sanitized = content.replace(
+    unquotedSensitiveKeyValuePattern,
+    (
+      match: string,
+      prefix: string,
+      keyName: string,
+      valueQuote: string,
+      value: string,
+      offset: number,
+      input: string,
+    ) =>
+      shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext)
+        ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}`
+        : match,
+  );
+  sanitized = sanitized.replace(
+    bareSensitiveKeyValuePattern,
+    (
+      match: string,
+      prefix: string,
+      keyName: string,
+      value: string,
+      offset: number,
+      input: string,
+    ) =>
+      shouldRedactAssignment(prefix, keyName, value, offset, input, commandContext)
+        ? `${prefix}${SECRET_PLACEHOLDER}`
+        : match,
   );
+  return sanitized;
 }
 
 /**
@@ -101,24 +165,21 @@ export function redactSecrets(content: string): string {
         ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}`
         : match,
   );
-  sanitized = sanitized.replace(
-    unquotedSensitiveKeyValuePattern,
-    (match: string, prefix: string, keyName: string, valueQuote: string) =>
-      isSensitiveKeyName(keyName)
-        ? `${prefix}${valueQuote}${SECRET_PLACEHOLDER}${valueQuote}`
-        : match,
-  );
-  sanitized = sanitized.replace(
-    bareSensitiveKeyValuePattern,
-    (match: string, prefix: string, keyName: string) =>
-      isSensitiveKeyName(keyName) ? `${prefix}${SECRET_PLACEHOLDER}` : match,
-  );
+  sanitized = redactAssignments(sanitized, false);
   sanitized = sanitized.replace(
     /\b([a-z][a-z0-9+.-]*:\/\/)[^@\s/?#]+@/gi,
     `$1${URL_CREDENTIAL_PLACEHOLDER}@`,
   );
   sanitized = sanitized.replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "<EMAIL>");
 
+  // Session and request IDs often look like tokens. Only the shell command
+  // after cmd= is eligible for value-shape masking, not the log metadata.
+  sanitized = sanitized.replace(
+    /^([^\r\n]*\bbash spawned task=[^\r\n]*? cmd=)([^\r\n]*)/gm,
+    (_match: string, prefix: string, command: string) =>
+      `${prefix}${redactAssignments(command, true)}`,
+  );
+
   return sanitized;
 }
 
diff --git a/packages/opencode-plugin/src/__tests__/bash.test.ts b/packages/opencode-plugin/src/__tests__/bash.test.ts
index faae23e166..ded964dcaf 100644
--- a/packages/opencode-plugin/src/__tests__/bash.test.ts
+++ b/packages/opencode-plugin/src/__tests__/bash.test.ts
@@ -1668,6 +1668,29 @@ describe("bash_status tool", () => {
     }
   });
 
+  test("PTY lost exit status uses the approved line and real kills stay killed", async () => {
+    for (const [status, exitCode, reason, expected] of [
+      [
+        "fate_unknown",
+        null,
+        "AFT could not read how it ended",
+        "Task bash-lost: exit status unknown (AFT could not read how it ended)",
+      ],
+      ["killed", 137, "bash_kill", "Task bash-lost: killed (exit 137) 1s"],
+    ] as const) {
+      const { statusTool } = makeCtx(() => ({
+        success: true,
+        status,
+        mode: "pty",
+        exit_code: exitCode,
+        duration_ms: 1000,
+        status_reason: reason,
+      }));
+      const text = await statusTool.execute({ taskId: "bash-lost" }, createMockSdkContext());
+      expect(text).toBe(expected);
+    }
+  });
+
   test("bash_kill preserves its outcome and appends the durable-revocation warning", async () => {
     const warning =
       "bot_write_revocation_not_durable: the block on this command's bot writes was not saved and lasts only until AFT restarts; check the command's state.";
diff --git a/packages/opencode-plugin/src/__tests__/bg-notifications.test.ts b/packages/opencode-plugin/src/__tests__/bg-notifications.test.ts
index b22f1ef0cd..80d42771f4 100644
--- a/packages/opencode-plugin/src/__tests__/bg-notifications.test.ts
+++ b/packages/opencode-plugin/src/__tests__/bg-notifications.test.ts
@@ -115,6 +115,34 @@ function findTraceEvent(eventName: string): Record<string, unknown> | undefined
 }
 
 describe("OpenCode background notifications", () => {
+  test("PTY lost exit completion uses the approved line and real kills stay killed", () => {
+    const text = formatSystemReminder([
+      {
+        task_id: "bash-lost",
+        command: "interactive",
+        status: "fate_unknown",
+        exit_code: null,
+        duration_ms: 1000,
+        status_reason: "AFT could not read how it ended",
+      },
+    ]);
+    expect(text.split("\n")).toContain(
+      "Task bash-lost: exit status unknown (AFT could not read how it ended)",
+    );
+    expect(text).not.toContain("exit 137");
+    expect(text).not.toContain("killed");
+    expect(
+      formatSystemReminder([
+        {
+          task_id: "bash-killed",
+          command: "interactive",
+          status: "killed",
+          exit_code: 137,
+        },
+      ]),
+    ).toContain("- task bash-killed (killed)");
+  });
+
   test("failed memory-cap completion shows its reason without a capture warning", () => {
     const reason = "Command stopped: exceeded the 64 MiB memory cap (test enforcement).";
     expect(
diff --git a/packages/opencode-plugin/src/__tests__/e2e/edit-write-toolcall.test.ts b/packages/opencode-plugin/src/__tests__/e2e/edit-write-toolcall.test.ts
index 7149daae36..fcedbb0156 100644
--- a/packages/opencode-plugin/src/__tests__/e2e/edit-write-toolcall.test.ts
+++ b/packages/opencode-plugin/src/__tests__/e2e/edit-write-toolcall.test.ts
@@ -15,6 +15,7 @@ import {
   type PreparedBinary,
   prepareBinary,
   readTextFile,
+  withoutTrailingStatusBar,
 } from "./helpers.js";
 
 type MutationToolResult = {
@@ -62,7 +63,8 @@ function asMutationResult(result: ToolResult): MutationToolResult {
   if (typeof result === "string") {
     throw new Error(`expected object ToolResult, got string: ${result}`);
   }
-  return result as MutationToolResult;
+  const mutation = result as MutationToolResult;
+  return { ...mutation, output: withoutTrailingStatusBar(mutation.output) };
 }
 
 async function executeEdit(
diff --git a/packages/opencode-plugin/src/__tests__/e2e/helpers.ts b/packages/opencode-plugin/src/__tests__/e2e/helpers.ts
index 6ab6b5812e..79da35f924 100644
--- a/packages/opencode-plugin/src/__tests__/e2e/helpers.ts
+++ b/packages/opencode-plugin/src/__tests__/e2e/helpers.ts
@@ -691,6 +691,12 @@ export async function readTextFile(filePath: string): Promise<string> {
   return readFile(filePath, "utf8");
 }
 
+// Session count updates may append a status bar after the tool's own footer.
+// Content assertions choose the original renderer's trailing-newline shape.
+export function withoutTrailingStatusBar(text: string, trailingNewline: "" | "\n" = ""): string {
+  return text.replace(/\n*\[AFT [^\]\n]*\]\s*$/, trailingNewline);
+}
+
 export function lineNumberText(text: string): string {
   return lineNumberRangeText(text, 1);
 }
diff --git a/packages/opencode-plugin/src/__tests__/e2e/honest-reporting.test.ts b/packages/opencode-plugin/src/__tests__/e2e/honest-reporting.test.ts
index c25ea86b59..f9869a2472 100644
--- a/packages/opencode-plugin/src/__tests__/e2e/honest-reporting.test.ts
+++ b/packages/opencode-plugin/src/__tests__/e2e/honest-reporting.test.ts
@@ -18,11 +18,21 @@ import {
   harnessPool,
   type PreparedBinary,
   prepareBinary,
+  withoutTrailingStatusBar,
 } from "./helpers.js";
 
 const initialBinary = await prepareBinary();
 const maybeDescribe = describe.skipIf(!initialBinary.binaryPath);
 
+test("content assertions strip only an optional trailing status bar", () => {
+  const body = "shown 200 of ≥200 files (walk) · narrow: path";
+  expect(withoutTrailingStatusBar(`${body}\n\n[AFT E? W? | T0]`)).toBe(body);
+  expect(withoutTrailingStatusBar(`${body}\n`)).toBe(`${body}\n`);
+  expect(withoutTrailingStatusBar(`${body}\n[AFT E? W? | T0]`, "\n")).toBe(`${body}\n`);
+  const internal = "[AFT E? W? | T0]\nsource content";
+  expect(withoutTrailingStatusBar(internal)).toBe(internal);
+});
+
 function createMockClient(): any {
   return {
     lsp: { status: async () => ({ data: [] }) },
@@ -151,7 +161,7 @@ export function runHonestReportingSuite(
       expect(() => JSON.parse(output)).toThrow();
       expect(output).toContain("file-000.ts");
       expect(output).toContain(" files (walk) · narrow: path");
-      expect(output.trimEnd().split("\n").at(-1)).toMatch(
+      expect(withoutTrailingStatusBar(output).trimEnd().split("\n").at(-1)).toMatch(
         /^shown \d+ of ≥200 files \(walk\) · narrow: path$/,
       );
     });
diff --git a/packages/opencode-plugin/src/__tests__/e2e/read.test.ts b/packages/opencode-plugin/src/__tests__/e2e/read.test.ts
index 3a44eef5a2..93ef4fdd36 100644
--- a/packages/opencode-plugin/src/__tests__/e2e/read.test.ts
+++ b/packages/opencode-plugin/src/__tests__/e2e/read.test.ts
@@ -18,6 +18,7 @@ import {
   prepareBinary,
   readTextFile,
   sendReadLikePlugin,
+  withoutTrailingStatusBar,
 } from "./helpers.js";
 
 type ReadObjectResult = {
@@ -214,20 +215,26 @@ maybeDescribe("e2e read command", () => {
 
     const plainPath = h.path("sample.ts");
     const plain = await executeReadTool(h, { filePath: "sample.ts" });
-    expect(plain.output).toBe(lineNumberText(await readTextFile(plainPath)));
+    expect(withoutTrailingStatusBar(plain.output, "\n")).toBe(
+      lineNumberText(await readTextFile(plainPath)),
+    );
     expect(plain.title).toBe("sample.ts");
     expect(plain.metadata).toEqual({ title: "sample.ts" });
 
     const ranged = await executeReadTool(h, { filePath: "sample.ts", startLine: 4, endLine: 7 });
-    expect(ranged.output).toBe(lineNumberRangeText(await readTextFile(plainPath), 4, 7));
+    expect(withoutTrailingStatusBar(ranged.output, "\n")).toBe(
+      lineNumberRangeText(await readTextFile(plainPath), 4, 7),
+    );
     expect(ranged.output).not.toContain("Use startLine/endLine");
 
     const directory = await executeReadTool(h, { filePath: "directory" });
-    expect(directory.output).toBe("alpha.ts\nbeta.ts\ngamma.ts");
+    expect(withoutTrailingStatusBar(directory.output)).toBe("alpha.ts\nbeta.ts\ngamma.ts");
     expect(directory.title).toBe("directory");
 
     const binary = await executeReadTool(h, { filePath: "binary.bin" });
-    expect(binary.output).toBe("Binary file (8 bytes), cannot display as text");
+    expect(withoutTrailingStatusBar(binary.output)).toBe(
+      "Binary file (8 bytes), cannot display as text",
+    );
     expect(binary.title).toBe("binary.bin");
   });
 
@@ -254,7 +261,9 @@ maybeDescribe("e2e read command", () => {
       offset: 4,
       limit: 4,
     });
-    expect(paged.output).toBe(lineNumberRangeText(await readTextFile(h.path("sample.ts")), 4, 7));
+    expect(withoutTrailingStatusBar(paged.output, "\n")).toBe(
+      lineNumberRangeText(await readTextFile(h.path("sample.ts")), 4, 7),
+    );
   });
 
   test("hoisted read tool preserves the server footer for default truncated reads", async () => {
@@ -282,7 +291,9 @@ maybeDescribe("e2e read command", () => {
     await writeFile(h.path("doc.pdf"), pdfBytes);
 
     const image = await executeReadTool(h, { filePath: "pixel.png" });
-    expect(image.output).toBe(`Read image attachment (image/png, 1×1, ${pngBytes.length} bytes).`);
+    expect(withoutTrailingStatusBar(image.output)).toBe(
+      `Read image attachment (image/png, 1×1, ${pngBytes.length} bytes).`,
+    );
     expect(image.attachments).toEqual([
       {
         type: "file",
@@ -296,7 +307,9 @@ maybeDescribe("e2e read command", () => {
     expect(image.metadata?.isPdf).toBe(false);
 
     const pdf = await executeReadTool(h, { filePath: "doc.pdf" });
-    expect(pdf.output).toBe(`Read PDF attachment (${pdfBytes.length} bytes).`);
+    expect(withoutTrailingStatusBar(pdf.output)).toBe(
+      `Read PDF attachment (${pdfBytes.length} bytes).`,
+    );
     expect(pdf.attachments).toEqual([
       {
         type: "file",
diff --git a/packages/opencode-plugin/src/__tests__/fixtures/render-status-frame.tsx b/packages/opencode-plugin/src/__tests__/fixtures/render-status-frame.tsx
new file mode 100644
index 0000000000..b6f73d6a31
--- /dev/null
+++ b/packages/opencode-plugin/src/__tests__/fixtures/render-status-frame.tsx
@@ -0,0 +1,39 @@
+/** @jsxImportSource @opentui/solid */
+import { testRender } from "@opentui/solid";
+import { coerceAftStatus } from "../../shared/status.js";
+import { StatusDialog } from "../../tui/index.tsx";
+
+const palette = {
+  text: "#ffffff",
+  textMuted: "#888888",
+  success: "#00ff00",
+  warning: "#ffff00",
+  error: "#ff0000",
+  accent: "#0088ff",
+  background: "#000000",
+  border: "#444444",
+};
+const status = coerceAftStatus({
+  cache_role: "main",
+  checkpoints_total: null,
+  session: { checkpoints: null },
+});
+const setup = await testRender(
+  () => (
+    <StatusDialog
+      api={{ theme: { current: palette } } as never}
+      client={{} as never}
+      directory="/project"
+      sessionID="session"
+      initial={status}
+      initialError={null}
+    />
+  ),
+  { width: 100, height: 100 },
+);
+try {
+  await setup.renderOnce();
+  process.stdout.write(setup.captureCharFrame());
+} finally {
+  setup.renderer.destroy();
+}
diff --git a/packages/opencode-plugin/src/__tests__/shared-status.test.ts b/packages/opencode-plugin/src/__tests__/shared-status.test.ts
index e8042887fd..213306e03c 100644
--- a/packages/opencode-plugin/src/__tests__/shared-status.test.ts
+++ b/packages/opencode-plugin/src/__tests__/shared-status.test.ts
@@ -47,6 +47,37 @@ const baseResponse = Object.freeze({
 });
 
 describe("coerceAftStatus", () => {
+  test("preserves known checkpoint counts and keeps null or missing counts unknown", () => {
+    for (const [input, expected] of [
+      [7, 7],
+      [0, 0],
+      [null, null],
+      [undefined, null],
+    ] as const) {
+      const status = coerceAftStatus({
+        ...baseResponse,
+        checkpoints_total: input,
+        session: { checkpoints: input },
+      });
+      expect(status.checkpoints_total).toBe(expected);
+      expect(status.session.checkpoints).toBe(expected);
+    }
+    const missing = coerceAftStatus(baseResponse);
+    expect(missing.checkpoints_total).toBeNull();
+    expect(missing.session.checkpoints).toBeNull();
+  });
+
+  test("renders unknown checkpoint counts in the text dialog", () => {
+    const status = coerceAftStatus({
+      ...baseResponse,
+      checkpoints_total: null,
+      session: { checkpoints: null },
+    });
+    const dialog = formatStatusDialogMessage(status);
+    expect(dialog).toContain("- checkpoints: —");
+    expect(dialog).toContain("- project checkpoints (all sessions): —");
+  });
+
   test("off inspect categories survive status parsing and never show stale counts", () => {
     const status = coerceAftStatus({
       ...baseResponse,
diff --git a/packages/opencode-plugin/src/__tests__/status-dialog-checkpoints.test.ts b/packages/opencode-plugin/src/__tests__/status-dialog-checkpoints.test.ts
new file mode 100644
index 0000000000..a0526a7d03
--- /dev/null
+++ b/packages/opencode-plugin/src/__tests__/status-dialog-checkpoints.test.ts
@@ -0,0 +1,22 @@
+import { expect, test } from "bun:test";
+import { join } from "node:path";
+
+test("TUI renders unknown current and project checkpoint counts", async () => {
+  const child = Bun.spawn(
+    [
+      process.execPath,
+      "--preload",
+      "@opentui/solid/preload",
+      join(import.meta.dir, "fixtures/render-status-frame.tsx"),
+    ],
+    { cwd: join(import.meta.dir, "../.."), stdout: "pipe", stderr: "pipe" },
+  );
+  const [frame, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  expect({ exitCode, stderr }).toEqual({ exitCode: 0, stderr: "" });
+  expect(frame).toMatch(/Checkpoints\s+—/);
+  expect(frame).toMatch(/All-session checkpoints\s+—/);
+}, 30_000);
diff --git a/packages/opencode-plugin/src/bg-notifications.ts b/packages/opencode-plugin/src/bg-notifications.ts
index bf79bdf9cd..734f02bd9e 100644
--- a/packages/opencode-plugin/src/bg-notifications.ts
+++ b/packages/opencode-plugin/src/bg-notifications.ts
@@ -10,6 +10,7 @@ import {
   bashAckTargetFromKey,
   bashAckTargets,
   bashPatternAckTarget,
+  formatUnknownPtyExit,
   formatWatchLineBatch,
   mergeWatchLineBatches,
   resolveBridgeForNudge,
@@ -2500,7 +2501,9 @@ function shorten(value: string, limit: number): string {
 function formatCompletion(completion: BgCompletion): string {
   const status = formatStatus(completion);
   const duration = formatDuration(completion);
-  const header = `- task ${completion.task_id} (${status}${duration ? `, ${duration}` : ""})`;
+  const header =
+    formatUnknownPtyExit(completion.task_id, completion) ??
+    `- task ${completion.task_id} (${status}${duration ? `, ${duration}` : ""})`;
   const previewBlock = formatOutputPreview(completion);
   const descendantWarning = completion.live_descendants_summary
     ? `    ${completion.live_descendants_summary}`
diff --git a/packages/opencode-plugin/src/shared/status.ts b/packages/opencode-plugin/src/shared/status.ts
index 01e85dd435..ab0c75c791 100644
--- a/packages/opencode-plugin/src/shared/status.ts
+++ b/packages/opencode-plugin/src/shared/status.ts
@@ -143,12 +143,12 @@ export interface AftStatusSnapshot {
   };
   storage_dir: string | null;
   /** Total checkpoints across all sessions sharing this bridge. */
-  checkpoints_total: number;
+  checkpoints_total: number | null;
   /** Current session's own slice of undo/checkpoint state. */
   session: {
     id: string;
     tracked_files: number;
-    checkpoints: number;
+    checkpoints: number | null;
   };
   /** Compression aggregate passthrough; rendering is added separately. */
   compression?: StatusCompression;
@@ -403,11 +403,11 @@ export function coerceAftStatus(response: Record<string, unknown>): AftStatusSna
       warm_entries: readNumber(symbolCache.warm_entries),
     },
     storage_dir: readNullableString(response.storage_dir),
-    checkpoints_total: readNumber(response.checkpoints_total),
+    checkpoints_total: readOptionalNumber(response.checkpoints_total),
     session: {
       id: readString(session.id, "__default__"),
       tracked_files: readNumber(session.tracked_files),
-      checkpoints: readNumber(session.checkpoints),
+      checkpoints: readOptionalNumber(session.checkpoints),
     },
     compression: readCompression(response.compression),
     status_bar: readStatusBar(response.status_bar),
diff --git a/packages/opencode-plugin/src/tools/bash.ts b/packages/opencode-plugin/src/tools/bash.ts
index e84ecf27f9..67880377a5 100644
--- a/packages/opencode-plugin/src/tools/bash.ts
+++ b/packages/opencode-plugin/src/tools/bash.ts
@@ -10,6 +10,7 @@ import {
   coerceBoolean,
   escalationAskText,
   formatBashOutputPages,
+  formatUnknownPtyExit,
   groupBashPermissionAsks,
   isLiveBackgroundTaskReply,
   LONGEST_TIMER_DELAY_MS,
@@ -924,7 +925,7 @@ async function formatBashStatusText(
   const exit = typeof data.exit_code === "number" ? ` (exit ${data.exit_code})` : "";
   const dur =
     typeof data.duration_ms === "number" ? ` ${Math.round(data.duration_ms / 1000)}s` : "";
-  let text = `Task ${taskId}: ${status}${exit}${dur}`;
+  let text = formatUnknownPtyExit(taskId, data) ?? `Task ${taskId}: ${status}${exit}${dur}`;
   if (typeof data.live_descendants_summary === "string") {
     text += ` · ${data.live_descendants_summary}`;
   }
diff --git a/packages/opencode-plugin/src/tui/index.tsx b/packages/opencode-plugin/src/tui/index.tsx
index 64def79e61..b8d8838a74 100644
--- a/packages/opencode-plugin/src/tui/index.tsx
+++ b/packages/opencode-plugin/src/tui/index.tsx
@@ -155,7 +155,7 @@ function statusAcceptGate(directory: string): (result: unknown) => boolean {
   };
 }
 
-const StatusDialog = (props: StatusDialogProps) => {
+export const StatusDialog = (props: StatusDialogProps) => {
   const theme = createMemo(() => (props.api as any).theme.current as TuiThemeCurrent);
   const t = () => theme();
 
@@ -426,11 +426,15 @@ const StatusDialog = (props: StatusDialogProps) => {
               </text>
             </box>
             <R theme={t()} label="Tracked files" value={String(status()!.session.tracked_files)} />
-            <R theme={t()} label="Checkpoints" value={String(status()!.session.checkpoints)} />
+            <R
+              theme={t()}
+              label="Checkpoints"
+              value={status()!.session.checkpoints?.toString() ?? "—"}
+            />
             <R
               theme={t()}
               label="All-session checkpoints"
-              value={String(status()!.checkpoints_total)}
+              value={status()!.checkpoints_total?.toString() ?? "—"}
               tone="muted"
             />
           </box>
diff --git a/packages/pi-plugin/src/__tests__/aft-status-compression.test.ts b/packages/pi-plugin/src/__tests__/aft-status-compression.test.ts
index 7ac3e9e8e2..2c4f25559c 100644
--- a/packages/pi-plugin/src/__tests__/aft-status-compression.test.ts
+++ b/packages/pi-plugin/src/__tests__/aft-status-compression.test.ts
@@ -32,6 +32,15 @@ function status(compression: Record<string, unknown> | undefined) {
 }
 
 describe("Pi aft-status compression rendering", () => {
+  test("renders unknown current and all-session checkpoint counts", () => {
+    const snapshot = status(undefined);
+    snapshot.session.checkpoints = null;
+    snapshot.checkpoints_total = null;
+    const lines = renderStatusDialogInnerForTest(snapshot, null, theme, 100);
+    expect(lines.some((line) => /checkpoints:\s+—/.test(line))).toBe(true);
+    expect(lines.some((line) => /all-session:\s+—/.test(line))).toBe(true);
+  });
+
   test("pi_status_renders_compression_when_project_events_present", () => {
     const lines = renderStatusDialogInnerForTest(
       status({
diff --git a/packages/pi-plugin/src/__tests__/bash.test.ts b/packages/pi-plugin/src/__tests__/bash.test.ts
index 72b0009dce..f3f526c95f 100644
--- a/packages/pi-plugin/src/__tests__/bash.test.ts
+++ b/packages/pi-plugin/src/__tests__/bash.test.ts
@@ -2147,6 +2147,32 @@ describe("bash tool adapter", () => {
     expect(toolText(result)).toContain(reason);
   });
 
+  test("PTY lost exit status uses the approved line and real kills stay killed", async () => {
+    for (const [status, exitCode, reason, expected] of [
+      [
+        "fate_unknown",
+        null,
+        "AFT could not read how it ended",
+        "Task bash-lost: exit status unknown (AFT could not read how it ended)",
+      ],
+      ["killed", 137, "bash_kill", "Task bash-lost: killed (exit 137) 1s"],
+    ] as const) {
+      const tools = new Map<string, MockToolDef>();
+      const { bridge } = makeTrackableMockBridge({
+        status,
+        mode: "pty",
+        exit_code: exitCode,
+        duration_ms: 1000,
+        status_reason: reason,
+      });
+      registerBashTool(makeMockApi(tools), makeMockContext(bridge));
+      const result = await tools
+        .get("bash_status")!
+        .execute("call", { task_id: "bash-lost" }, undefined, undefined, { cwd: projectRoot });
+      expect(toolText(result)).toBe(expected);
+    }
+  });
+
   test("running bash_status shows the full assigned remote job ID", async () => {
     const jobId = "0192a64a-1234-7000-8000-000000000001";
     const tools = new Map<string, MockToolDef>();
diff --git a/packages/pi-plugin/src/__tests__/bg-notifications.test.ts b/packages/pi-plugin/src/__tests__/bg-notifications.test.ts
index 7625b316a9..ee5b64a3d5 100644
--- a/packages/pi-plugin/src/__tests__/bg-notifications.test.ts
+++ b/packages/pi-plugin/src/__tests__/bg-notifications.test.ts
@@ -59,6 +59,34 @@ afterEach(() => {
 });
 
 describe("Pi background notifications", () => {
+  test("PTY lost exit completion uses the approved line and real kills stay killed", () => {
+    const text = formatSystemReminder([
+      {
+        task_id: "bash-lost",
+        command: "interactive",
+        status: "fate_unknown",
+        exit_code: null,
+        duration_ms: 1000,
+        status_reason: "AFT could not read how it ended",
+      },
+    ]);
+    expect(text.split("\n")).toContain(
+      "Task bash-lost: exit status unknown (AFT could not read how it ended)",
+    );
+    expect(text).not.toContain("exit 137");
+    expect(text).not.toContain("killed");
+    expect(
+      formatSystemReminder([
+        {
+          task_id: "bash-killed",
+          command: "interactive",
+          status: "killed",
+          exit_code: 137,
+        },
+      ]),
+    ).toContain("- task bash-killed (killed)");
+  });
+
   test("PTY incomplete capture completion reminder preserves exit code and shows warning", () => {
     const reason = "PTY output may be incomplete: output capture failed before EOF";
     for (const exitCode of [0, 17]) {
diff --git a/packages/pi-plugin/src/__tests__/e2e/helpers.ts b/packages/pi-plugin/src/__tests__/e2e/helpers.ts
index da236afe55..4e81409468 100644
--- a/packages/pi-plugin/src/__tests__/e2e/helpers.ts
+++ b/packages/pi-plugin/src/__tests__/e2e/helpers.ts
@@ -458,6 +458,12 @@ function flattenText(result: AgentToolResultLike): string {
     .join("\n");
 }
 
+// Session count updates may append a status bar after the tool's own footer.
+// Content assertions choose the original renderer's trailing-newline shape.
+export function withoutTrailingStatusBar(text: string, trailingNewline: "" | "\n" = ""): string {
+  return text.replace(/\n*\[AFT [^\]\n]*\]\s*$/, trailingNewline);
+}
+
 // ExtensionAPI has 20+ methods tests don't exercise; any is intentional here
 // (test overrides in biome.json permit noExplicitAny).
 type AnyExtensionApi = any;
diff --git a/packages/pi-plugin/src/__tests__/e2e/hoisted.test.ts b/packages/pi-plugin/src/__tests__/e2e/hoisted.test.ts
index 4faeb84f49..4f6b135361 100644
--- a/packages/pi-plugin/src/__tests__/e2e/hoisted.test.ts
+++ b/packages/pi-plugin/src/__tests__/e2e/hoisted.test.ts
@@ -10,7 +10,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { readFile } from "node:fs/promises";
-import { createHarness, type Harness, prepareBinary } from "./helpers.js";
+import { createHarness, type Harness, prepareBinary, withoutTrailingStatusBar } from "./helpers.js";
 
 const initialBinary = await prepareBinary();
 const maybeDescribe = initialBinary.binaryPath ? describe : describe.skip;
@@ -140,7 +140,7 @@ maybeDescribe("hoisted tools (real bridge)", () => {
     });
     // The status bar follows when a count changed since the session's last
     // result, for example once the first TODO count lands, so drop it here.
-    const text = harness.text(result).replace(/\n*\[AFT [^\]\n]*\]\s*$/, "");
+    const text = withoutTrailingStatusBar(harness.text(result));
     expect(text).toBe("Edited (+3/-3).");
     expect((result as { details?: { editsApplied?: number } }).details?.editsApplied).toBe(1);
 
diff --git a/packages/pi-plugin/src/__tests__/e2e/reading.test.ts b/packages/pi-plugin/src/__tests__/e2e/reading.test.ts
index cd198009cb..52c0c8d210 100644
--- a/packages/pi-plugin/src/__tests__/e2e/reading.test.ts
+++ b/packages/pi-plugin/src/__tests__/e2e/reading.test.ts
@@ -9,11 +9,20 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { createServer, type Server } from "node:http";
 import type { AddressInfo } from "node:net";
 import { resolve } from "node:path";
-import { createHarness, type Harness, prepareBinary } from "./helpers.js";
+import { createHarness, type Harness, prepareBinary, withoutTrailingStatusBar } from "./helpers.js";
 
 const initialBinary = await prepareBinary();
 const maybeDescribe = initialBinary.binaryPath ? describe : describe.skip;
 
+test("content assertions strip only an optional trailing status bar", () => {
+  const body = "shown 200 of ≥200 files (walk) · narrow: path";
+  expect(withoutTrailingStatusBar(`${body}\n\n[AFT E? W? | T0]`)).toBe(body);
+  expect(withoutTrailingStatusBar(`${body}\n`)).toBe(`${body}\n`);
+  expect(withoutTrailingStatusBar(`${body}\n[AFT E? W? | T0]`, "\n")).toBe(`${body}\n`);
+  const internal = "[AFT E? W? | T0]\nsource content";
+  expect(withoutTrailingStatusBar(internal)).toBe(internal);
+});
+
 maybeDescribe("aft_outline + aft_zoom (real bridge)", () => {
   let harness: Harness;
 
@@ -97,7 +106,7 @@ maybeDescribe("aft_outline + aft_zoom (real bridge)", () => {
       // last saw it, for example when the background TODO count first arrives
       // mid-test. That is timing, not outline structure; the bar has its own
       // tests.
-      const text = harness.text(result).replace(/\n*\[AFT [^\]\n]*\]\s*$/, "\n");
+      const text = withoutTrailingStatusBar(harness.text(result), "\n");
       expect(text).toBe(golden);
       expect(result.details).toMatchObject({ success: true, complete: true });
     }
@@ -186,7 +195,7 @@ maybeDescribe("aft_outline + aft_zoom (real bridge)", () => {
     expect(response.walk_truncated).toBe(true);
     expect(Array.isArray(response.skipped_files)).toBe(true);
     expect(harness.text(result)).toContain("file-000.ts");
-    expect(harness.text(result).trimEnd().split("\n").at(-1)).toMatch(
+    expect(withoutTrailingStatusBar(harness.text(result)).trimEnd().split("\n").at(-1)).toMatch(
       /^shown \d+ of ≥200 files \(walk\) · narrow: path$/,
     );
   });
diff --git a/packages/pi-plugin/src/__tests__/shared-status.test.ts b/packages/pi-plugin/src/__tests__/shared-status.test.ts
index ba66cf56ca..e465d69d00 100644
--- a/packages/pi-plugin/src/__tests__/shared-status.test.ts
+++ b/packages/pi-plugin/src/__tests__/shared-status.test.ts
@@ -21,6 +21,22 @@ import {
 } from "../shared/status.js";
 
 describe("shared status helpers", () => {
+  test("preserves known checkpoint counts and keeps null or missing counts unknown", () => {
+    for (const [input, expected] of [
+      [7, 7],
+      [0, 0],
+      [null, null],
+      [undefined, null],
+    ] as const) {
+      const status = coerceAftStatus({ checkpoints_total: input, session: { checkpoints: input } });
+      expect(status.checkpoints_total).toBe(expected);
+      expect(status.session.checkpoints).toBe(expected);
+    }
+    const missing = coerceAftStatus({});
+    expect(missing.checkpoints_total).toBeNull();
+    expect(missing.session.checkpoints).toBeNull();
+  });
+
   test("off inspect categories survive status parsing and never show stale counts", () => {
     const status = coerceAftStatus({
       status_bar: null,
diff --git a/packages/pi-plugin/src/bg-notifications.ts b/packages/pi-plugin/src/bg-notifications.ts
index 2e96ab2f96..a877135523 100644
--- a/packages/pi-plugin/src/bg-notifications.ts
+++ b/packages/pi-plugin/src/bg-notifications.ts
@@ -9,6 +9,7 @@ import {
   bashAckTargetFromKey,
   bashAckTargets,
   bashPatternAckTarget,
+  formatUnknownPtyExit,
   formatWatchLineBatch,
   mergeWatchLineBatches,
   resolveBridgeForNudge,
@@ -1467,7 +1468,9 @@ function isBgCompletion(value: unknown): value is BgCompletion {
 function formatCompletion(completion: BgCompletion): string {
   const status = formatStatus(completion);
   const duration = formatDuration(completion);
-  const header = `- task ${completion.task_id} (${status}${duration ? `, ${duration}` : ""})`;
+  const header =
+    formatUnknownPtyExit(completion.task_id, completion) ??
+    `- task ${completion.task_id} (${status}${duration ? `, ${duration}` : ""})`;
   const previewBlock = formatOutputPreview(completion);
   const descendantWarning = completion.live_descendants_summary
     ? `    ${completion.live_descendants_summary}`
diff --git a/packages/pi-plugin/src/dialogs/status-dialog.ts b/packages/pi-plugin/src/dialogs/status-dialog.ts
index 9dbbf290de..f4ee017f8a 100644
--- a/packages/pi-plugin/src/dialogs/status-dialog.ts
+++ b/packages/pi-plugin/src/dialogs/status-dialog.ts
@@ -254,8 +254,8 @@ function renderInner(
 
   right2.push(theme.fg("muted", "Current session"));
   right2.push(kv("tracked files", String(s.session.tracked_files), theme));
-  right2.push(kv("checkpoints", String(s.session.checkpoints), theme));
-  right2.push(kv("all-session", String(s.checkpoints_total), theme));
+  right2.push(kv("checkpoints", s.session.checkpoints?.toString() ?? "—", theme));
+  right2.push(kv("all-session", s.checkpoints_total?.toString() ?? "—", theme));
 
   for (const line of renderColumns(left2, right2, colWidth)) lines.push(line);
   lines.push("");
diff --git a/packages/pi-plugin/src/shared/status.ts b/packages/pi-plugin/src/shared/status.ts
index 07c5b1e873..d01f60fe5a 100644
--- a/packages/pi-plugin/src/shared/status.ts
+++ b/packages/pi-plugin/src/shared/status.ts
@@ -121,12 +121,12 @@ export interface AftStatusSnapshot {
   };
   storage_dir: string | null;
   /** Total checkpoints across all sessions sharing this bridge. */
-  checkpoints_total: number;
+  checkpoints_total: number | null;
   /** Current session's own slice of undo/checkpoint state. */
   session: {
     id: string;
     tracked_files: number;
-    checkpoints: number;
+    checkpoints: number | null;
   };
   /** Compression aggregate passthrough; rendering is added separately. */
   compression?: StatusCompression;
@@ -329,11 +329,11 @@ export function coerceAftStatus(response: Record<string, unknown>): AftStatusSna
       warm_entries: readNumber(symbolCache.warm_entries),
     },
     storage_dir: readNullableString(response.storage_dir),
-    checkpoints_total: readNumber(response.checkpoints_total),
+    checkpoints_total: readOptionalNumber(response.checkpoints_total),
     session: {
       id: readString(session.id, "__default__"),
       tracked_files: readNumber(session.tracked_files),
-      checkpoints: readNumber(session.checkpoints),
+      checkpoints: readOptionalNumber(session.checkpoints),
     },
     compression: readCompression(response.compression),
     status_bar: readStatusBar(response.status_bar ?? response.status_bar_values),
diff --git a/packages/pi-plugin/src/tools/bash.ts b/packages/pi-plugin/src/tools/bash.ts
index 3f21e9f5ca..850ace6b65 100644
--- a/packages/pi-plugin/src/tools/bash.ts
+++ b/packages/pi-plugin/src/tools/bash.ts
@@ -12,6 +12,7 @@ import {
   coerceBoolean,
   escalationAskText,
   formatBashOutputPages,
+  formatUnknownPtyExit,
   formatWatchWaited,
   interruptedWatchTail,
   isBridgeTransportTimeout,
@@ -2097,7 +2098,8 @@ async function formatBashStatus(
   const exit = typeof details.exit_code === "number" ? ` (exit ${details.exit_code})` : "";
   const dur =
     typeof details.duration_ms === "number" ? ` ${Math.round(details.duration_ms / 1000)}s` : "";
-  let text = `Task ${taskId}: ${details.status}${exit}${dur}`;
+  let text =
+    formatUnknownPtyExit(taskId, details) ?? `Task ${taskId}: ${details.status}${exit}${dur}`;
   if (details.live_descendants_summary) {
     text += ` · ${details.live_descendants_summary}`;
   }
diff --git a/scripts/ci-real-daemon-test-runner.sh b/scripts/ci-real-daemon-test-runner.sh
new file mode 100644
index 0000000000..8d23abe523
--- /dev/null
+++ b/scripts/ci-real-daemon-test-runner.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+
+# nextest invokes the Cargo runner separately for each test process. Isolate the
+# embedded daemon too, not just the AFT children whose fixture sets HOME/XDG.
+root="${AFT_REAL_DAEMON_RUN_ROOT:?set AFT_REAL_DAEMON_RUN_ROOT}"
+mkdir -p "$root"
+fixture="$(mktemp -d "$root/test.XXXXXXXX")"
+trap 'rm -rf "$fixture"' EXIT
+
+export HOME="$fixture/home"
+export XDG_RUNTIME_DIR="$fixture/runtime"
+export XDG_CONFIG_HOME="$fixture/config"
+export XDG_DATA_HOME="$fixture/data"
+export XDG_STATE_HOME="$fixture/state"
+export XDG_CACHE_HOME="$fixture/cache"
+export TMPDIR="$fixture/tmp"
+mkdir -p "$HOME" "$XDG_RUNTIME_DIR" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" \
+  "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$TMPDIR"
+chmod 700 "$XDG_RUNTIME_DIR"
+
+"$@"
diff --git a/scripts/ci-real-daemon-tests.sh b/scripts/ci-real-daemon-tests.sh
new file mode 100644
index 0000000000..3fe03fdc75
--- /dev/null
+++ b/scripts/ci-real-daemon-tests.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Connection-file admission rejects group-writable parent directories.
+umask 077
+
+repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo"
+base="${RUNNER_TEMP:-$repo/target/ci-real-daemon}"
+mkdir -p "$base"
+run_root="$(mktemp -d "$base/aft-real-daemon.XXXXXXXX")"
+chmod 700 "$run_root"
+heartbeat=""
+cleanup() {
+  if [[ -n "$heartbeat" ]]; then
+    kill "$heartbeat" 2>/dev/null || true
+    wait "$heartbeat" 2>/dev/null || true
+  fi
+  rm -rf "$run_root"
+}
+trap cleanup EXIT
+
+export TMPDIR="$run_root/tmp"
+mkdir -p "$TMPDIR"
+printf '==> Daemon fixture directory ancestry (mode owner:group path):\n'
+ancestor="$TMPDIR"
+insecure=0
+while :; do
+  stat -L -c '%a %u:%g %n' "$ancestor"
+  mode="$(stat -L -c '%a' "$ancestor")"
+  # Sticky system temp directories are safe; writable non-sticky parents are not.
+  if (( (8#$mode & 0022) != 0 && (8#$mode & 01000) == 0 )); then
+    printf 'Insecure daemon fixture ancestor: %s (mode %s)\n' "$ancestor" "$mode" >&2
+    insecure=1
+  fi
+  [[ "$ancestor" == / ]] && break
+  ancestor="$(dirname "$ancestor")"
+done
+if (( insecure != 0 )); then
+  exit 1
+fi
+
+log="$run_root/real-daemon-tests.log"
+export AFT_REAL_DAEMON_RUN_ROOT="$TMPDIR/real-daemon-homes"
+export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER="bash $repo/scripts/ci-real-daemon-test-runner.sh"
+
+cargo nextest --version
+printf '==> Building and running ignored real-daemon tool-provider tests\n'
+: > "$log"
+(
+  while sleep 60; do
+    printf '==> Real-daemon gate still running; recent output:\n'
+    tail -n 5 "$log"
+  done
+) &
+heartbeat=$!
+
+# The real daemon is the dev-only subc-daemon dependency pinned in Cargo.toml.
+# fetch-subc-core.sh supplies a different daemon for the plugin suites, not these tests.
+# The filter names the whole module rather than a test-name prefix: every
+# ignored test there needs the real daemon, and a prefix silently skips tests
+# named differently (the runner_notice_real_daemon_* tests).
+rc=0
+timeout 15m cargo nextest run -p agent-file-tools --test rest \
+  --features test-hooks,test-scope-owner --profile gate --no-fail-fast \
+  --run-ignored only --test-threads 2 --failure-output final \
+  --status-level pass --final-status-level fail \
+  -E 'test(/^tool_provider_subc_e2e::/)' > "$log" 2>&1 || rc=$?
+if (( rc != 0 )); then
+  printf '==> Real-daemon gate FAILED (rc=%s); failing test names:\n' "$rc" >&2
+  grep -E '(FAIL|TIMEOUT|LEAK) \[' "$log" >&2 || true
+fi
+tail -n 60 "$log"
+exit "$rc"
diff --git a/scripts/lib/test_release_debug_symbols.py b/scripts/lib/test_release_debug_symbols.py
new file mode 100644
index 0000000000..8a34e5e34f
--- /dev/null
+++ b/scripts/lib/test_release_debug_symbols.py
@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""Detached release symbols: identity checks and a real Linux split rehearsal."""
+
+import importlib.util
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+import unittest
+import zipfile
+
+ROOT = Path(__file__).resolve().parents[2]
+SPEC = importlib.util.spec_from_file_location("release_debug_symbols", ROOT / "scripts/release-debug-symbols.py")
+assert SPEC is not None and SPEC.loader is not None
+symbols = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(symbols)
+
+
+def pe_fixture(guid, age, name="aft-hash.pdb"):
+    data = bytearray(1024)
+    data[:2] = b"MZ"
+    struct.pack_into("<I", data, 0x3C, 128)
+    data[128:132] = b"PE\0\0"
+    struct.pack_into("<H", data, 134, 1)
+    struct.pack_into("<H", data, 148, 240)
+    struct.pack_into("<H", data, 152, 0x20B)
+    struct.pack_into("<II", data, 152 + 112 + 48, 0x1000, 28)
+    struct.pack_into("<IIII", data, 152 + 240 + 8, 512, 0x1000, 512, 512)
+    reference = b"RSDS" + guid + struct.pack("<I", age) + b"C:\\build\\" + name.encode() + b"\0"
+    struct.pack_into("<IIII", data, 512 + 12, 2, len(reference), 0x1020, 544)
+    data[544:544 + len(reference)] = reference
+    return data
+
+
+def pdb_fixture(guid, age):
+    data = bytearray(512 * 5)
+    data[:32] = b"Microsoft C/C++ MSF 7.00\r\n\x1aDS\0\0\0"
+    struct.pack_into("<6I", data, 32, 512, 1, 5, 16, 0, 2)
+    struct.pack_into("<I", data, 512 * 2, 3)
+    struct.pack_into("<4I", data, 512 * 3, 2, 0xFFFFFFFF, 28, 4)
+    struct.pack_into("<III", data, 512 * 4, 20000404, 0, age)
+    data[512 * 4 + 12:512 * 4 + 28] = guid
+    return data
+
+
+class ReleaseDebugSymbolsTests(unittest.TestCase):
+    def setUp(self):
+        scratch = ROOT / "target/scratch"
+        scratch.mkdir(parents=True, exist_ok=True)
+        self.temp = tempfile.TemporaryDirectory(dir=scratch)
+        self.addCleanup(self.temp.cleanup)
+        self.directory = Path(self.temp.name)
+
+    def test_windows_packages_pdb_under_executable_reference_name(self):
+        guid = bytes(range(16))
+        binary = self.directory / "aft.exe"
+        pdb = self.directory / "aft.pdb"
+        binary.write_bytes(pe_fixture(guid, 7))
+        pdb.write_bytes(pdb_fixture(guid, 7))
+        original = binary.read_bytes()
+        archive = self.directory / "aft-windows-x64-pdb.zip"
+        symbols.package_windows(binary, pdb, archive)
+        with zipfile.ZipFile(archive) as output:
+            self.assertEqual(output.namelist(), ["aft-hash.pdb"])
+            self.assertEqual(output.read("aft-hash.pdb"), pdb.read_bytes())
+        self.assertEqual(binary.read_bytes(), original)
+
+    def test_windows_rejects_mismatched_pdb_guid_and_age(self):
+        guid = bytes(range(16))
+        binary = self.directory / "aft.exe"
+        pdb = self.directory / "aft.pdb"
+        binary.write_bytes(pe_fixture(guid, 7))
+        for other_guid, other_age in ((bytes(16), 7), (guid, 8)):
+            with self.subTest(guid=other_guid, age=other_age):
+                pdb.write_bytes(pdb_fixture(other_guid, other_age))
+                with self.assertRaisesRegex(ValueError, "GUID/age"):
+                    symbols.package_windows(binary, pdb, self.directory / "bad.zip")
+        self.assertFalse((self.directory / "bad.zip").exists())
+
+    def test_windows_rejects_missing_executable_pdb_reference(self):
+        data = pe_fixture(bytes(16), 1)
+        data[544:548] = b"NONE"
+        with self.assertRaisesRegex(ValueError, "no CodeView"):
+            symbols.pe_pdb_reference(data)
+
+    @unittest.skipUnless(sys.platform == "linux" and shutil.which("rustc"), "requires Linux rustc and binutils")
+    def test_linux_split_preserves_code_and_symbolizes_without_runtime_debug_dependency(self):
+        source = self.directory / "probe.rs"
+        source.write_text(
+            '#[no_mangle]\n#[inline(never)]\npub extern "C" fn release_symbol_probe(value: u64) -> u64 {\n'
+            '    value * 3\n}\n'
+            'fn main() { println!("{}", release_symbol_probe(7)); }\n'
+        )
+        binary = self.directory / "aft"
+        subprocess.run([
+            "rustc", "--edition=2021", str(source), "-o", str(binary), "-C", "opt-level=3",
+            "-C", "lto=true", "-C", "codegen-units=1", "-C", "debuginfo=line-tables-only",
+            "-C", "split-debuginfo=off", "-C", "strip=none",
+        ], check=True)
+        original_id = symbols.build_id(binary)
+        dynamic = subprocess.check_output(["readelf", "-d", str(binary)])
+        text = self.directory / "text.bin"
+        subprocess.run(["objcopy", "--only-section=.text", "-O", "binary", str(binary), str(text)], check=True)
+        original_code = text.read_bytes()
+        baseline = self.directory / "baseline"
+        subprocess.run(["objcopy", "--strip-all", str(binary), str(baseline)], check=True)
+        archive = self.directory / "symbols/aft-linux-x64-debug.zip"
+        symbols.package_linux(binary, archive, "objcopy")
+        debug = archive.parent / "aft.debug"
+        self.assertEqual(symbols.build_id(debug), original_id)
+        with zipfile.ZipFile(archive) as output:
+            self.assertEqual(output.namelist(), ["aft.debug"])
+        names = subprocess.check_output(["nm", "--defined-only", str(debug)], text=True)
+        address = next(line.split()[0] for line in names.splitlines() if line.endswith(" T release_symbol_probe"))
+        location = subprocess.check_output(["addr2line", "-f", "-e", str(debug), address], text=True)
+        print(f"addr2line: {location.strip()}")
+        self.assertIn("release_symbol_probe", location)
+        self.assertIn("probe.rs:4", location)
+        subprocess.run(["objcopy", "--only-section=.text", "-O", "binary", str(binary), str(text)], check=True)
+        self.assertEqual(text.read_bytes(), original_code)
+        self.assertEqual(subprocess.check_output(["readelf", "-d", str(binary)]), dynamic)
+        self.assertLessEqual(binary.stat().st_size, baseline.stat().st_size + 128)
+        print(f"stripped sizes: baseline={baseline.stat().st_size}, debuglink={binary.stat().st_size}")
+        shutil.rmtree(archive.parent)
+        self.assertEqual(subprocess.check_output([str(binary)], text=True).strip(), "21")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/lib/test_workflow_gates.py b/scripts/lib/test_workflow_gates.py
index 3b49588cec..4b3e6e4e66 100644
--- a/scripts/lib/test_workflow_gates.py
+++ b/scripts/lib/test_workflow_gates.py
@@ -40,6 +40,62 @@ def workflow_job(job_id: str) -> str:
     return match.group(1)
 
 
+class ReleaseDebugArtifactWorkflowTests(unittest.TestCase):
+    def setUp(self):
+        path = Path(__file__).resolve().parents[2] / ".github/workflows/release.yml"
+        self.jobs = workflow_gates.parse_workflow(str(path))["jobs"]
+
+    def test_linux_detaches_and_verifies_debug_before_shipping(self):
+        for arch, target in (("x64", "x86_64"), ("arm64", "aarch64")):
+            with self.subTest(arch=arch):
+                steps = self.jobs[f"build-linux-{arch}"]["steps"]
+                build = next(step for step in steps if step.get("name") == "Build")
+                self.assertIn(f"cross build --release --target {target}-unknown-linux-gnu", build["run"])
+                self.assertIn("profile.release.strip=false", build["run"])
+                self.assertIn('profile.release.split-debuginfo="off"', build["run"])
+                split_index = next(i for i, step in enumerate(steps) if step.get("name") == "Split and verify Linux debug symbols")
+                self.assertIn("scripts/release-debug-symbols.py linux", steps[split_index]["run"])
+                self.assertIn(f"aft-linux-{arch}-debug.zip", steps[split_index]["run"])
+                uploads = [(i, step["with"]) for i, step in enumerate(steps) if step.get("uses") == "actions/upload-artifact@v4"]
+                self.assertTrue(all(i > split_index for i, _ in uploads))
+                debug = next(config for _, config in uploads if config["name"] == f"linux-{arch}-debug")
+                self.assertEqual(debug["if-no-files-found"], "error")
+                binary = next(config for _, config in uploads if "debug" not in config["name"])
+                self.assertNotIn("debug", binary["path"])
+
+    def test_windows_verifies_pdb_identity_before_shipping(self):
+        for arch, target in (("x64", "x86_64"), ("arm64", "aarch64")):
+            with self.subTest(arch=arch):
+                steps = self.jobs[f"build-win32-{arch}"]["steps"]
+                builds = [step for step in steps if "cargo build --release" in step.get("run", "")]
+                self.assertTrue(builds)
+                self.assertTrue(all("profile.release.strip=false" in step["run"] for step in builds))
+                verify_index = next(i for i, step in enumerate(steps) if step.get("name") == "Verify and package Windows PDB")
+                command = steps[verify_index]["run"]
+                self.assertIn("scripts/release-debug-symbols.py windows", command)
+                self.assertIn(f"{target}-pc-windows-msvc/release/aft.exe", command)
+                self.assertIn(f"$env:AFT_CI_TARGET_DIR/{target}-pc-windows-msvc/release/aft.pdb", command)
+                self.assertIn(f"aft-windows-{arch}-pdb.zip", command)
+                uploads = [(i, step["with"]) for i, step in enumerate(steps) if step.get("uses") == "actions/upload-artifact@v4"]
+                self.assertTrue(all(i > verify_index for i, _ in uploads))
+                pdb = next(config for _, config in uploads if config["name"] == f"windows-{arch}-pdb")
+                self.assertEqual(pdb["if-no-files-found"], "error")
+
+    def test_debug_archives_go_only_to_github_release_not_npm(self):
+        steps = self.jobs["github-release"]["steps"]
+        downloads = [step["with"] for step in steps if step.get("uses") == "actions/download-artifact@v4"]
+        for pattern in ("linux-*-debug", "windows-*-pdb"):
+            config = next(config for config in downloads if config.get("pattern") == pattern)
+            self.assertEqual(config["path"], "release-assets")
+            self.assertTrue(config["merge-multiple"])
+        for job in ("publish-npm", "rehearse-publish"):
+            for step in self.jobs[job]["steps"]:
+                config = step.get("with", {})
+                if step.get("uses") == "actions/download-artifact@v4":
+                    self.assertNotIn("debug", config.get("name", ""))
+                    self.assertNotIn("pdb", config.get("name", ""))
+
+
 class CacheSaveRefGateTests(unittest.TestCase):
     """A main-only cache write is policy; a main-only check or job is dead code."""
 
@@ -331,7 +387,7 @@ def test_nextest_has_one_shared_installer_for_every_workflow_site(self) -> None:
             for job in unit["jobs"].values()
             for step in job.get("steps", [])
         ]
-        self.assertEqual(uses.count("./.github/actions/setup-nextest"), 15)
+        self.assertEqual(uses.count("./.github/actions/setup-nextest"), 16)
         shard = workflow_gates.parse_workflow(str(github / "actions/integration-shard/action.yml"))
         self.assertEqual(
             sum(step.get("uses") == "./.github/actions/setup-nextest" for step in shard["runs"]["steps"]),
@@ -448,6 +504,74 @@ def setUp(self) -> None:
         root = Path(__file__).resolve().parents[2]
         self.jobs = workflow_gates.parse_workflow(str(root / ".github/workflows/_unit-suite.yml"))["jobs"]
 
+    def test_real_daemon_job_runs_ignored_tool_provider_tests_on_landing_events(self) -> None:
+        job = self.jobs["unit-linux-real-daemon"]
+        self.assertEqual(job["name"], "Real-daemon tool-provider tests (Linux)")
+        self.assertEqual(job["if"], "${{ github.event_name != 'pull_request' }}")
+        self.assertEqual(job["runs-on"], "ubuntu-24.04")
+        self.assertLess(int(job["timeout-minutes"]), 20)
+        self.assertNotIn("needs", job)
+        self.assertNotIn("continue-on-error", job)
+        self.assertIn({"uses": "./.github/actions/setup-nextest"}, job["steps"])
+        self.assertIn({"name": "Run ignored real-daemon tool-provider tests",
+                       "run": "bash scripts/ci-real-daemon-tests.sh"}, job["steps"])
+        root = Path(__file__).resolve().parents[2]
+        script = (root / "scripts/ci-real-daemon-tests.sh").read_text()
+        for required in (
+            "timeout 15m cargo nextest run -p agent-file-tools --test rest",
+            "--features test-hooks,test-scope-owner", "--run-ignored only",
+            "--no-fail-fast", "--failure-output final", "--status-level pass", "--final-status-level fail",
+            "-E 'test(/^tool_provider_subc_e2e::/)'",
+            "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER=",
+            "scripts/ci-real-daemon-test-runner.sh", "while sleep 60", 'tail -n 60 "$log"',
+            'mktemp -d "$base/aft-real-daemon.XXXXXXXX"', 'export TMPDIR="$run_root/tmp"',
+            "stat -L -c '%a %u:%g %n'", "Insecure daemon fixture ancestor:", "trap cleanup EXIT",
+        ):
+            with self.subTest(required=required):
+                self.assertIn(required, script)
+
+    def test_real_daemon_runner_isolates_each_test_process_and_cleans_up(self) -> None:
+        root = Path(__file__).resolve().parents[2]
+        runner = root / "scripts/ci-real-daemon-test-runner.sh"
+        keys = ("HOME", "XDG_RUNTIME_DIR", "XDG_CONFIG_HOME", "XDG_DATA_HOME",
+                "XDG_STATE_HOME", "XDG_CACHE_HOME", "TMPDIR")
+        with tempfile.TemporaryDirectory() as directory:
+            homes = []
+            for rc in (0, 7):
+                probe = "\n".join(f'printf \'%s\\n\' "${key}"' for key in keys)
+                probe += '\ntest "$(umask)" = "0077" || exit 99'
+                probe += f'\nmkdir -p "$TMPDIR/daemon-fixture/runtime"\nexit {rc}'
+                result = subprocess.run(
+                    ["bash", str(runner), "bash", "-c", probe],
+                    capture_output=True, text=True,
+                    env={**os.environ, "AFT_REAL_DAEMON_RUN_ROOT": directory},
+                )
+                self.assertEqual(result.returncode, rc, result.stderr)
+                paths = [Path(line) for line in result.stdout.splitlines()]
+                self.assertEqual(len(paths), len(keys))
+                self.assertEqual(len(set(paths)), len(keys))
+                fixture = paths[0].parent
+                self.assertEqual(fixture.parent, Path(directory))
+                self.assertTrue(all(path.parent == fixture for path in paths))
+                self.assertFalse(fixture.exists(), "runner must clean up even after a failure")
+                homes.append(paths[0])
+            self.assertNotEqual(*homes)
+
+    def test_real_daemon_gate_rejects_insecure_ancestors_before_running_tests(self) -> None:
+        root = Path(__file__).resolve().parents[2]
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory) / "writable"
+            base.mkdir(mode=0o777)
+            base.chmod(0o777)
+            result = subprocess.run(
+                ["bash", str(root / "scripts/ci-real-daemon-tests.sh")],
+                capture_output=True, text=True, env={**os.environ, "RUNNER_TEMP": str(base)},
+            )
+            self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+            self.assertIn(f"Insecure daemon fixture ancestor: {base} (mode 777)", result.stderr)
+            self.assertNotIn("Building and running", result.stdout)
+            self.assertEqual(list(base.iterdir()), [], "failed preflight must clean up its private directory")
+
     def test_linux_archive_covers_units_and_proves_the_uploaded_inventory(self) -> None:
         archive = self.jobs["unit-linux-nextest-archive"]
         commands = "\n".join(step.get("run", "") for step in archive["steps"])
diff --git a/scripts/release-debug-symbols.py b/scripts/release-debug-symbols.py
new file mode 100644
index 0000000000..48b6077b64
--- /dev/null
+++ b/scripts/release-debug-symbols.py
@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+"""Package detached release symbols and reject mismatched binary identities."""
+
+import argparse
+from pathlib import Path
+import re
+import struct
+import subprocess
+import uuid
+import zipfile
+
+
+def build_id(path):
+    notes = subprocess.check_output(["readelf", "-n", str(path)], text=True, stderr=subprocess.PIPE)
+    match = re.search(r"Build ID: ([0-9a-f]+)", notes)
+    if not match:
+        raise ValueError(f"{path}: missing ELF build ID")
+    return match[1]
+
+
+def package_linux(binary, archive, objcopy):
+    archive.parent.mkdir(parents=True, exist_ok=True)
+    debug = archive.parent / "aft.debug"
+    original_id = build_id(binary)
+    subprocess.run([objcopy, "--only-keep-debug", str(binary), str(debug)], check=True)
+    # GNU debuglink is optional at runtime; the executable still runs without it.
+    subprocess.run([objcopy, "--strip-all", str(binary)], check=True)
+    subprocess.run([objcopy, f"--add-gnu-debuglink={debug}", str(binary)], check=True)
+    if build_id(binary) != original_id or build_id(debug) != original_id:
+        raise ValueError("ELF executable and detached debug file have different build IDs")
+    sections = subprocess.check_output(["readelf", "-SW", str(binary)], text=True)
+    debug_sections = subprocess.check_output(["readelf", "-SW", str(debug)], text=True, stderr=subprocess.PIPE)
+    names = re.findall(r"\]\s+(\.\S+)", sections)
+    # GNU strip retains Rust's tiny GDB auto-loader; it is not DWARF payload.
+    embedded = [name for name in names if name == ".symtab" or (
+        name.startswith((".debug_", ".zdebug_")) and name != ".debug_gdb_scripts"
+    )]
+    if embedded:
+        raise ValueError(f"shipped ELF executable still contains debug sections: {embedded}")
+    if ".debug_line " not in debug_sections or ".gnu_debuglink " not in sections:
+        raise ValueError("missing detached line tables or executable debuglink")
+    with zipfile.ZipFile(archive, "w", zipfile.ZIP_DEFLATED) as output:
+        output.write(debug, "aft.debug")
+    print(f"Verified ELF build ID {original_id}: {binary} <-> {archive}")
+
+
+def pe_pdb_reference(data):
+    """Read the PE debug directory's PDB reference (GUID, age and filename)."""
+    if data[:2] != b"MZ":
+        raise ValueError("not a PE executable")
+    pe = struct.unpack_from("<I", data, 0x3C)[0]
+    if data[pe:pe + 4] != b"PE\0\0":
+        raise ValueError("missing PE signature")
+    count = struct.unpack_from("<H", data, pe + 6)[0]
+    optional_size = struct.unpack_from("<H", data, pe + 20)[0]
+    optional = pe + 24
+    magic = struct.unpack_from("<H", data, optional)[0]
+    if magic not in (0x10B, 0x20B):
+        raise ValueError("unsupported PE optional header")
+    directories = optional + (112 if magic == 0x20B else 96)
+    debug_rva, debug_size = struct.unpack_from("<II", data, directories + 6 * 8)
+    for index in range(count):
+        section = optional + optional_size + index * 40
+        virtual_size, rva, raw_size, raw_offset = struct.unpack_from("<IIII", data, section + 8)
+        if rva <= debug_rva < rva + max(virtual_size, raw_size):
+            offset = raw_offset + debug_rva - rva
+            for entry in range(offset, offset + debug_size, 28):
+                kind, size, _, pointer = struct.unpack_from("<IIII", data, entry + 12)
+                if kind == 2 and data[pointer:pointer + 4] == b"RSDS":
+                    guid = data[pointer + 4:pointer + 20]
+                    age = struct.unpack_from("<I", data, pointer + 20)[0]
+                    name = data[pointer + 24:pointer + size].split(b"\0", 1)[0].decode("utf-8")
+                    return guid, age, name.replace("\\", "/").rsplit("/", 1)[-1]
+    raise ValueError("executable has no CodeView RSDS PDB reference")
+
+
+def pdb_identity(data):
+    """Read GUID/age from stream 1 of an MSF 7.0 (modern MSVC) PDB."""
+    if data[:32] != b"Microsoft C/C++ MSF 7.00\r\n\x1aDS\0\0\0":
+        raise ValueError("not an MSF 7.0 PDB")
+    block_size, _, _, directory_size, _, block_map = struct.unpack_from("<6I", data, 32)
+    if block_size not in (512, 1024, 2048, 4096):
+        raise ValueError("unsupported PDB block size")
+
+    def read_blocks(blocks, size):
+        return b"".join(data[block * block_size:(block + 1) * block_size] for block in blocks)[:size]
+
+    def block_count(size):
+        return (size + block_size - 1) // block_size
+
+    directory_blocks = struct.unpack_from(f"<{block_count(directory_size)}I", data, block_map * block_size)
+    directory = read_blocks(directory_blocks, directory_size)
+    stream_count = struct.unpack_from("<I", directory)[0]
+    if stream_count < 2:
+        raise ValueError("PDB has no info stream")
+    sizes = struct.unpack_from(f"<{stream_count}I", directory, 4)
+    cursor = 4 + 4 * stream_count
+    for index, size in enumerate(sizes[:2]):
+        blocks = 0 if size == 0xFFFFFFFF else block_count(size)
+        if index == 1:
+            if size == 0xFFFFFFFF or size < 28:
+                raise ValueError("PDB info stream is missing or truncated")
+            info = read_blocks(struct.unpack_from(f"<{blocks}I", directory, cursor), size)
+            age = struct.unpack_from("<I", info, 8)[0]
+            return info[12:28], age
+        cursor += blocks * 4
+    raise ValueError("PDB info stream is missing")
+
+
+def package_windows(binary, pdb, archive):
+    guid, age, name = pe_pdb_reference(binary.read_bytes())
+    if not name.lower().endswith(".pdb") or name in (".pdb", "..pdb"):
+        raise ValueError(f"invalid CodeView PDB filename: {name}")
+    if pdb_identity(pdb.read_bytes()) != (guid, age):
+        raise ValueError("executable CodeView GUID/age does not match PDB info stream")
+    archive.parent.mkdir(parents=True, exist_ok=True)
+    with zipfile.ZipFile(archive, "w", zipfile.ZIP_DEFLATED) as output:
+        # Cargo copies a hash-named deps PDB to aft.pdb; debuggers need the name
+        # recorded by the linker, not the copy's filename.
+        output.write(pdb, name)
+    print(f"Verified PDB {uuid.UUID(bytes_le=guid)} age {age} ({name}): {binary} <-> {archive}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="platform", required=True)
+    linux = sub.add_parser("linux")
+    linux.add_argument("--objcopy", default="objcopy")
+    windows = sub.add_parser("windows")
+    windows.add_argument("--pdb", type=Path, required=True)
+    for command in (linux, windows):
+        command.add_argument("--binary", type=Path, required=True)
+        command.add_argument("--archive", type=Path, required=True)
+    args = parser.parse_args()
+    if args.platform == "linux":
+        package_linux(args.binary, args.archive, args.objcopy)
+    else:
+        package_windows(args.binary, args.pdb, args.archive)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/test-vectors/cingulate-secret-use-approval-v1.source.md b/test-vectors/cingulate-secret-use-approval-v1.source.md
new file mode 100644
index 0000000000..5804cbd9aa
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1.source.md
@@ -0,0 +1,6 @@
+# Vendored Cingulate requester samples
+
+`cingulate-secret-use-approval-v1/` is an untouched copy of Cingulate's
+`test-vectors/secret-use-approval-v1/` at source commit `56fa35f2`.
+Its twelve files are pinned by the accompanying `SHA256SUMS`. The keys and
+signatures are public deterministic test material, not live credentials.
diff --git a/test-vectors/cingulate-secret-use-approval-v1/README.md b/test-vectors/cingulate-secret-use-approval-v1/README.md
new file mode 100644
index 0000000000..04f13fa9ac
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/README.md
@@ -0,0 +1,40 @@
+# Secret-use approvals v1
+
+`secret-approval-v1.json` is copied byte for byte from Claustrum's
+`secret-approval-vectors-v1` tag, commit `cefc5c7041ffe93d17c4fcc80e5847260f3ad121`,
+at `crates/credentials-core/tests/vectors/secret-approval-v1.json`.
+Its SHA-256 is `efd4ba60641586e143bce81087e4f9f5aaf8a99ffede74190303da7d4495cc27`.
+These are public deterministic test keys, never production credentials.
+
+`single-phone-get.json` and `batch-phone-get.json` are untouched response bytes
+from Cingulate's real `consent.get` path on a stamped phone route advertising
+`clientFeatures: ["secret-use-approval"]`. They file the `approval` and
+`batch-omitted` statements respectively, at 1700000000000 ms, in fresh scratch
+stores. Phone records use `secretUse`; its nested vault items retain snake_case.
+The phone renders requested access from the statements, not the generic title.
+
+Filer samples are framed `consent.request` and `consent.await` calls filed as
+`reserved:aft` with the vault's `approval` statement (`batch-omitted` for the
+partial card), at 1700000000000 ms in fresh scratch stores. Each file holds the
+exact method, request params and handler reply envelope, so AFT and Cerebellum
+can build decoders against real replies. Filer records use `snake_case` with
+`secret_use` and `secret_use_answer`; refusals carry `code` and `message`.
+
+| File | What it shows |
+|---|---|
+| `secret-approval-v1.json` | Vault goldens copied byte for byte, never production credentials. |
+| `single-phone-get.json` | Phone `consent.get` for the `approval` statement. |
+| `batch-phone-get.json` | Phone `consent.get` for the `batch-omitted` statements. |
+| `filer-request.json` | Filer `consent.request` reply with the new `elicitation_id`. |
+| `filer-request-repeat.json` | Same filing repeated, returning the same `elicitation_id`. |
+| `filer-await-pending.json` | Filer `consent.await` with zero timeout before any answer, pending. |
+| `filer-await-allowed.json` | Filer `consent.await` after an allow envelope, with `secret_use_answer`. |
+| `filer-await-partial.json` | Filer `consent.await` for the batch card after its one-item envelope. |
+| `filer-await-declined.json` | Filer `consent.await` after a decline, every item declined. |
+| `filer-await-expired.json` | Filer `consent.await` after the earliest expiry passes on the test clock. |
+| `filer-refusals.json` | Four `consent.request` refusals: agent mismatch, non-canonical, id reuse, broca. |
+
+Regenerate with `cargo run -p cingulate-vectors --example generate_secret_use_vectors --locked`.
+Use `--check` to compare without writing. The `secret_use` integration tests
+regenerate and compare both served records byte for byte, exercise the three
+use-approval cases through filing/answering, and verify checksum coverage.
diff --git a/test-vectors/cingulate-secret-use-approval-v1/SHA256SUMS b/test-vectors/cingulate-secret-use-approval-v1/SHA256SUMS
new file mode 100644
index 0000000000..71bbad77ea
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/SHA256SUMS
@@ -0,0 +1,12 @@
+1e3997a231366c5892f2906cbd2b269664e68944edda60c4c1442b958ebe7058  README.md
+7c940c153cb0a6ab8e3f8062d6c027a95c4dc3368b19dd5a72629766714b3f59  batch-phone-get.json
+e5e665b918c4cb19750a8217457497c068eb4fb098df694da5f6dbd18511b286  filer-await-allowed.json
+f49061b64579f5601883bd466aea4d0951915fc4e121c3e1390830003acc0c84  filer-await-declined.json
+95eb5015d42f4e3d059729696f12ac0bfc2447a6f74b24c450bef36a39b0a6c4  filer-await-expired.json
+8ebc4ce81712071e97c1a53b471722c1ac83020ed468723b83fcb674785a6b99  filer-await-partial.json
+db39e1458276124efd66694d39f64e0ce34f0811c860b3ac4af2be6e6afbd0e6  filer-await-pending.json
+66740bda26d96c0abd25e22244965209fcdee04e120bcd4d7214644e0580fa65  filer-refusals.json
+be75724519b10547d1baacdee20095f753130251b1519c10342ab19ed42364c9  filer-request-repeat.json
+be75724519b10547d1baacdee20095f753130251b1519c10342ab19ed42364c9  filer-request.json
+efd4ba60641586e143bce81087e4f9f5aaf8a99ffede74190303da7d4495cc27  secret-approval-v1.json
+81794c4c98c77fb57813d8cb4c396c52da17bab4c1e8e7f56c113f4a521cb4a8  single-phone-get.json
diff --git a/test-vectors/cingulate-secret-use-approval-v1/batch-phone-get.json b/test-vectors/cingulate-secret-use-approval-v1/batch-phone-get.json
new file mode 100644
index 0000000000..bb49c19bbd
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/batch-phone-get.json
@@ -0,0 +1 @@
+{"result":{"createdAtMs":1700000000000,"default":"decline","elicitationId":"el_1","expiresAtMs":1700000600000,"facts":[],"kind":"secret_use","lateExecution":"notify_only","materialDamage":false,"onExpiry":"deny","options":[{"effect":"grant","id":"allow","label":"Allow"},{"effect":"decline","id":"decline","label":"Decline"}],"prompt":"Review the vault's requested access.","requesterLabel":"reserved:aft","requesterName":"AFT","scope":{},"secretUse":{"items":[{"request_id":"01HF7YAT000000000000000001","statement_b64url":"eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"},{"request_id":"01HF7YAT000000000000000002","statement_b64url":"eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMiIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"}]},"state":"pending","subject":{"agentId":"agent-A","headAgentId":"agent-A","label":"agent-A"},"target":{"kind":"secret_use","label":"Vault access"},"title":"Secret use approval","urgency":"normal"}}
\ No newline at end of file
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-await-allowed.json b/test-vectors/cingulate-secret-use-approval-v1/filer-await-allowed.json
new file mode 100644
index 0000000000..0db1c739e3
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-await-allowed.json
@@ -0,0 +1,69 @@
+{
+  "method": "consent.await",
+  "params": {
+    "elicitation_id": "el_1",
+    "timeout_ms": 0
+  },
+  "reply": {
+    "result": {
+      "answered_at_ms": 1700000000000,
+      "answered_choice_id": "allow",
+      "answered_device": "11111111111111111111111111111111",
+      "created_at_ms": 1700000000000,
+      "default": "decline",
+      "elicitation_id": "el_1",
+      "expires_at_ms": 1700000600000,
+      "facts": [],
+      "kind": "secret_use",
+      "late_execution": "notify_only",
+      "material_damage": false,
+      "on_expiry": "deny",
+      "options": [
+        {
+          "effect": "grant",
+          "id": "allow",
+          "label": "Allow"
+        },
+        {
+          "effect": "decline",
+          "id": "decline",
+          "label": "Decline"
+        }
+      ],
+      "prompt": "Review the vault's requested access.",
+      "requester_label": "reserved:aft",
+      "scope": {},
+      "secret_use": {
+        "items": [
+          {
+            "request_id": "01HF7YAT000000000000000001",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          }
+        ]
+      },
+      "secret_use_answer": {
+        "decision": "allow",
+        "duration": "hour",
+        "envelope_sha256": "7bcd68a3ec5698ad9c9d11e0efa1d67ef7e7aa6ee18c56d963d5f6b18014f180",
+        "items": [
+          {
+            "decision": "allow",
+            "request_id": "01HF7YAT000000000000000001"
+          }
+        ]
+      },
+      "state": "answered",
+      "subject": {
+        "agent_id": "agent-A",
+        "head_agent_id": "agent-A",
+        "label": "agent-A"
+      },
+      "target": {
+        "kind": "secret_use",
+        "label": "Vault access"
+      },
+      "title": "Secret use approval",
+      "urgency": "normal"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-await-declined.json b/test-vectors/cingulate-secret-use-approval-v1/filer-await-declined.json
new file mode 100644
index 0000000000..873b63f3e1
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-await-declined.json
@@ -0,0 +1,67 @@
+{
+  "method": "consent.await",
+  "params": {
+    "elicitation_id": "el_1",
+    "timeout_ms": 0
+  },
+  "reply": {
+    "result": {
+      "answered_at_ms": 1700000000000,
+      "answered_choice_id": "decline",
+      "answered_device": "11111111111111111111111111111111",
+      "created_at_ms": 1700000000000,
+      "default": "decline",
+      "elicitation_id": "el_1",
+      "expires_at_ms": 1700000600000,
+      "facts": [],
+      "kind": "secret_use",
+      "late_execution": "notify_only",
+      "material_damage": false,
+      "on_expiry": "deny",
+      "options": [
+        {
+          "effect": "grant",
+          "id": "allow",
+          "label": "Allow"
+        },
+        {
+          "effect": "decline",
+          "id": "decline",
+          "label": "Decline"
+        }
+      ],
+      "prompt": "Review the vault's requested access.",
+      "requester_label": "reserved:aft",
+      "scope": {},
+      "secret_use": {
+        "items": [
+          {
+            "request_id": "01HF7YAT000000000000000001",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          }
+        ]
+      },
+      "secret_use_answer": {
+        "decision": "decline",
+        "items": [
+          {
+            "decision": "decline",
+            "request_id": "01HF7YAT000000000000000001"
+          }
+        ]
+      },
+      "state": "answered",
+      "subject": {
+        "agent_id": "agent-A",
+        "head_agent_id": "agent-A",
+        "label": "agent-A"
+      },
+      "target": {
+        "kind": "secret_use",
+        "label": "Vault access"
+      },
+      "title": "Secret use approval",
+      "urgency": "normal"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-await-expired.json b/test-vectors/cingulate-secret-use-approval-v1/filer-await-expired.json
new file mode 100644
index 0000000000..bbb7dc9eee
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-await-expired.json
@@ -0,0 +1,56 @@
+{
+  "method": "consent.await",
+  "params": {
+    "elicitation_id": "el_1",
+    "timeout_ms": 0
+  },
+  "reply": {
+    "result": {
+      "answered_at_ms": 1700000600000,
+      "created_at_ms": 1700000000000,
+      "default": "decline",
+      "elicitation_id": "el_1",
+      "expires_at_ms": 1700000600000,
+      "facts": [],
+      "kind": "secret_use",
+      "late_execution": "notify_only",
+      "material_damage": false,
+      "on_expiry": "deny",
+      "options": [
+        {
+          "effect": "grant",
+          "id": "allow",
+          "label": "Allow"
+        },
+        {
+          "effect": "decline",
+          "id": "decline",
+          "label": "Decline"
+        }
+      ],
+      "prompt": "Review the vault's requested access.",
+      "requester_label": "reserved:aft",
+      "scope": {},
+      "secret_use": {
+        "items": [
+          {
+            "request_id": "01HF7YAT000000000000000001",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          }
+        ]
+      },
+      "state": "expired",
+      "subject": {
+        "agent_id": "agent-A",
+        "head_agent_id": "agent-A",
+        "label": "agent-A"
+      },
+      "target": {
+        "kind": "secret_use",
+        "label": "Vault access"
+      },
+      "title": "Secret use approval",
+      "urgency": "normal"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-await-partial.json b/test-vectors/cingulate-secret-use-approval-v1/filer-await-partial.json
new file mode 100644
index 0000000000..4358369bdc
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-await-partial.json
@@ -0,0 +1,77 @@
+{
+  "method": "consent.await",
+  "params": {
+    "elicitation_id": "el_1",
+    "timeout_ms": 0
+  },
+  "reply": {
+    "result": {
+      "answered_at_ms": 1700000000000,
+      "answered_choice_id": "allow",
+      "answered_device": "11111111111111111111111111111111",
+      "created_at_ms": 1700000000000,
+      "default": "decline",
+      "elicitation_id": "el_1",
+      "expires_at_ms": 1700000600000,
+      "facts": [],
+      "kind": "secret_use",
+      "late_execution": "notify_only",
+      "material_damage": false,
+      "on_expiry": "deny",
+      "options": [
+        {
+          "effect": "grant",
+          "id": "allow",
+          "label": "Allow"
+        },
+        {
+          "effect": "decline",
+          "id": "decline",
+          "label": "Decline"
+        }
+      ],
+      "prompt": "Review the vault's requested access.",
+      "requester_label": "reserved:aft",
+      "scope": {},
+      "secret_use": {
+        "items": [
+          {
+            "request_id": "01HF7YAT000000000000000001",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          },
+          {
+            "request_id": "01HF7YAT000000000000000002",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMiIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          }
+        ]
+      },
+      "secret_use_answer": {
+        "decision": "allow",
+        "duration": "hour",
+        "envelope_sha256": "7bcd68a3ec5698ad9c9d11e0efa1d67ef7e7aa6ee18c56d963d5f6b18014f180",
+        "items": [
+          {
+            "decision": "allow",
+            "request_id": "01HF7YAT000000000000000001"
+          },
+          {
+            "decision": "decline",
+            "request_id": "01HF7YAT000000000000000002"
+          }
+        ]
+      },
+      "state": "answered",
+      "subject": {
+        "agent_id": "agent-A",
+        "head_agent_id": "agent-A",
+        "label": "agent-A"
+      },
+      "target": {
+        "kind": "secret_use",
+        "label": "Vault access"
+      },
+      "title": "Secret use approval",
+      "urgency": "normal"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-await-pending.json b/test-vectors/cingulate-secret-use-approval-v1/filer-await-pending.json
new file mode 100644
index 0000000000..06b0e978a5
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-await-pending.json
@@ -0,0 +1,55 @@
+{
+  "method": "consent.await",
+  "params": {
+    "elicitation_id": "el_1",
+    "timeout_ms": 0
+  },
+  "reply": {
+    "result": {
+      "created_at_ms": 1700000000000,
+      "default": "decline",
+      "elicitation_id": "el_1",
+      "expires_at_ms": 1700000600000,
+      "facts": [],
+      "kind": "secret_use",
+      "late_execution": "notify_only",
+      "material_damage": false,
+      "on_expiry": "deny",
+      "options": [
+        {
+          "effect": "grant",
+          "id": "allow",
+          "label": "Allow"
+        },
+        {
+          "effect": "decline",
+          "id": "decline",
+          "label": "Decline"
+        }
+      ],
+      "prompt": "Review the vault's requested access.",
+      "requester_label": "reserved:aft",
+      "scope": {},
+      "secret_use": {
+        "items": [
+          {
+            "request_id": "01HF7YAT000000000000000001",
+            "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+          }
+        ]
+      },
+      "state": "pending",
+      "subject": {
+        "agent_id": "agent-A",
+        "head_agent_id": "agent-A",
+        "label": "agent-A"
+      },
+      "target": {
+        "kind": "secret_use",
+        "label": "Vault access"
+      },
+      "title": "Secret use approval",
+      "urgency": "normal"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-refusals.json b/test-vectors/cingulate-secret-use-approval-v1/filer-refusals.json
new file mode 100644
index 0000000000..0f67424cc0
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-refusals.json
@@ -0,0 +1,92 @@
+{
+  "cases": [
+    {
+      "method": "consent.request",
+      "name": "agent-mismatch",
+      "params": {
+        "kind": "secret_use",
+        "secret_use": {
+          "items": [
+            {
+              "request_id": "01HF7YAT000000000000000001",
+              "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+            }
+          ]
+        }
+      },
+      "reply": {
+        "error": {
+          "code": "elicitation_invalid_request",
+          "message": "secret use agent_id must match the stamped agent_id"
+        }
+      }
+    },
+    {
+      "method": "consent.request",
+      "name": "non-canonical",
+      "params": {
+        "kind": "secret_use",
+        "secret_use": {
+          "items": [
+            {
+              "request_id": "01HF7YAT000000000000000001",
+              "statement_b64url": "ewogICJhZ2VudF9pZCI6ICJhZ2VudC1BIiwKICAiY292ZXJhZ2UiOiAic2NvcGUiLAogICJkdXJhdGlvbnMiOiBbCiAgICAib25jZSIsCiAgICAiaG91ciIsCiAgICAic2Vzc2lvbiIsCiAgICAicGVybWFuZW50IgogIF0sCiAgIm1lbWJlcl9pZCI6ICJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLAogICJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOiAxNzAwMDAwNjAwMDAwLAogICJyZXF1ZXN0X2lkIjogIjAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxIiwKICAic2NvcGUiOiB7CiAgICAiZXBvY2giOiA3LAogICAgImtpbmQiOiAiaGVhZCIsCiAgICAib3duZXIiOiAicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwKICAgICJyZWYiOiAiSCIKICB9LAogICJzZWNyZXQiOiB7CiAgICAiaW5jYXJuYXRpb24iOiAiMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAxNDkiLAogICAgImtpbmQiOiAiYWdlbnRfYXBpX2tleSIsCiAgICAibmFtZSI6ICJrZXkiCiAgfSwKICAidXNlIjogewogICAgImhvc3QiOiAieC50ZXN0IiwKICAgICJsb2NhdGlvbiI6ICJoZWFkZXI6WC1BcGktS2V5IiwKICAgICJwYXRoX3ByZWZpeCI6ICIvcmVwb3MvYSIKICB9LAogICJ2IjogImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIgp9"
+            }
+          ]
+        }
+      },
+      "reply": {
+        "error": {
+          "code": "elicitation_invalid_request",
+          "message": "invalid secret approval statement or envelope"
+        }
+      }
+    },
+    {
+      "method": "consent.request",
+      "name": "request-conflict",
+      "params": {
+        "kind": "secret_use",
+        "secret_use": {
+          "items": [
+            {
+              "request_id": "01HF7YAT000000000000000001",
+              "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+            },
+            {
+              "request_id": "01HF7YAT000000000000000002",
+              "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMiIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+            }
+          ]
+        }
+      },
+      "reply": {
+        "error": {
+          "code": "elicitation_request_conflict",
+          "message": "elicitation_request_conflict: secret request id is already used"
+        }
+      }
+    },
+    {
+      "method": "consent.request",
+      "name": "broca-refused",
+      "params": {
+        "kind": "secret_use",
+        "secret_use": {
+          "items": [
+            {
+              "request_id": "01HF7YAT000000000000000001",
+              "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+            }
+          ]
+        }
+      },
+      "reply": {
+        "error": {
+          "code": "elicitation_requester_refused",
+          "message": "requester reserved:broca is refused"
+        }
+      }
+    }
+  ]
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-request-repeat.json b/test-vectors/cingulate-secret-use-approval-v1/filer-request-repeat.json
new file mode 100644
index 0000000000..c9d9c2fbf1
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-request-repeat.json
@@ -0,0 +1,19 @@
+{
+  "method": "consent.request",
+  "params": {
+    "kind": "secret_use",
+    "secret_use": {
+      "items": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+        }
+      ]
+    }
+  },
+  "reply": {
+    "result": {
+      "elicitation_id": "el_1"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/filer-request.json b/test-vectors/cingulate-secret-use-approval-v1/filer-request.json
new file mode 100644
index 0000000000..c9d9c2fbf1
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/filer-request.json
@@ -0,0 +1,19 @@
+{
+  "method": "consent.request",
+  "params": {
+    "kind": "secret_use",
+    "secret_use": {
+      "items": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"
+        }
+      ]
+    }
+  },
+  "reply": {
+    "result": {
+      "elicitation_id": "el_1"
+    }
+  }
+}
diff --git a/test-vectors/cingulate-secret-use-approval-v1/secret-approval-v1.json b/test-vectors/cingulate-secret-use-approval-v1/secret-approval-v1.json
new file mode 100644
index 0000000000..d09c69dfd4
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/secret-approval-v1.json
@@ -0,0 +1,111 @@
+{
+  "approval_private_key_hex": "0707070707070707070707070707070707070707070707070707070707070707",
+  "deposit": {
+    "aad_b64url": "GAAAAAAAAABjay1zZWNyZXQtZGVwb3NpdC1hYWQvdjEaAAAAAAAAADAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxLQAAAAAAAABmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIDAAAAAAAAAGtleQ0AAAAAAAAAYWdlbnRfYXBpX2tleQYAAAAAAAAAeC50ZXN0CAAAAAAAAAAvcmVwb3MvYRAAAAAAAAAAaGVhZGVyOlgtQXBpLUtleQ",
+    "ciphertext_b64url": "UDbNi7sJxIPNLrLaw9F7FEMCtsBZuuOAo1jddEYZzA3sSZRLP_kit4Rj7GBRsUKuWseHvzSgVV0R4RfyLEVrt04FUqZF0k4WQFuCbEbiroXg",
+    "deposit_digest": "f3630ed925db2cd603d12636bc105a6987817942c3872103f46904f9236eeea2",
+    "enc_b64url": "AI1P1sAGY5Vb9z3BUv5DvPE8l0U5JIckWKIp9GyAgBI",
+    "ephemeral_ikm_hex": "0404040404040404040404040404040404040404040404040404040404040404",
+    "phone_public_hex": "5dfedd3b6bd47f6fa28ee15d969d5bb0ea53774d488bdaf9df1c6e0124b3ef22",
+    "phone_scalar_hex": "0303030303030303030303030303030303030303030303030303030303030303",
+    "plaintext_b64url": "HgAAAAAAAABjay1zZWNyZXQtZGVwb3NpdC1wbGFpbnRleHQvdjETAAAAAAAAAGNraW9zLWZpeGVkLWFwaS1rZXk",
+    "recipient_public_hex": "57db4b359f23ae5e146e4e2512056704722506348c150c14753d0c933d04d421",
+    "recipient_scalar_hex": "0909090909090909090909090909090909090909090909090909090909090909"
+  },
+  "vectors": [
+    {
+      "case": "approval",
+      "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZGUzMTc0ZmViMTRjZjJlMjllYzczMDgwZGY3ODVlZTYxNTc0OWQ2MzhjYzgxYmVkOWFhZTQ4MDc5ZDBjYjgxYiJ9XSwidiI6ImNrLXNlY3JldC11c2UtZW52ZWxvcGUvdjEifQ",
+      "envelope_sha256": "7bcd68a3ec5698ad9c9d11e0efa1d67ef7e7aa6ee18c56d963d5f6b18014f180",
+      "results": [
+        {
+          "outcome": "granted",
+          "request_id": "01HF7YAT000000000000000001"
+        }
+      ],
+      "signature_b64url": "MEUCIQDKRJk3gvG7EYBPT0xIKvcZn5bmJpnOEmY3t5fkhlkPtAIgBxhQIWr_XOuoTrazb1NrM-ZJ4FLMQhENmjQPQyuSlZw",
+      "statements": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0",
+          "statement_sha256": "de3174feb14cf2e29ec73080df785ee615749d638cc81bed9aae48079d0cb81b"
+        }
+      ],
+      "tampered_envelope_b64url": "eiJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZGUzMTc0ZmViMTRjZjJlMjllYzczMDgwZGY3ODVlZTYxNTc0OWQ2MzhjYzgxYmVkOWFhZTQ4MDc5ZDBjYjgxYiJ9XSwidiI6ImNrLXNlY3JldC11c2UtZW52ZWxvcGUvdjEifQ",
+      "unlisted_pending": false
+    },
+    {
+      "case": "delete",
+      "envelope_b64url": "eyJkZWNpc2lvbiI6ImRlbGV0ZSIsImRldmljZV9maW5nZXJwcmludCI6IjExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExIiwiZHVyYXRpb24iOiJub25lIiwiZ3JhbnRfZXhwaXJlc19hdF9tcyI6MTcwMDAwMDYwMDAwMCwiaXNzdWVkX2F0X21zIjoxNzAwMDAwMDAwMDAwLCJpdGVtcyI6W3sicmVxdWVzdF9pZCI6IjAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxIiwic3RhdGVtZW50X3NoYTI1NiI6ImRmNjVhZDhjZDYzYjVlYmVlODBkNTg3ZDMwNWM4ZTE5NjExMjFhMzY3MWYxZDY2NTg0MjQyNTJhZTdiZmE1ZjIifV0sInYiOiJjay1zZWNyZXQtdXNlLWVudmVsb3BlL3YxIn0",
+      "envelope_sha256": "61f82b0a651cb8efc9af2fe001a5a051ff09833c6abc7ad365dc6f8b8e97967a",
+      "results": [
+        {
+          "outcome": "granted",
+          "request_id": "01HF7YAT000000000000000001"
+        }
+      ],
+      "signature_b64url": "MEUCIDo_hfKhCP8-j278u87PM-UKFEFb_AoGvVbbrjXugL8YAiEA6rbPE4zDISfvxqLF96TioYQoQ__NMZZ3mLqxLZdJyoU",
+      "statements": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNlY3JldCI6eyJpbmNhcm5hdGlvbiI6IjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMTQ5Iiwia2luZCI6ImFnZW50X2FwaV9rZXkiLCJuYW1lIjoia2V5In0sInYiOiJjay1zZWNyZXQtZGVsZXRlLXN0YXRlbWVudC92MSJ9",
+          "statement_sha256": "df65ad8cd63b5ebee80d587d305c8e1961121a3671f1d6658424252ae7bfa5f2"
+        }
+      ],
+      "tampered_envelope_b64url": "eiJkZWNpc2lvbiI6ImRlbGV0ZSIsImRldmljZV9maW5nZXJwcmludCI6IjExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExIiwiZHVyYXRpb24iOiJub25lIiwiZ3JhbnRfZXhwaXJlc19hdF9tcyI6MTcwMDAwMDYwMDAwMCwiaXNzdWVkX2F0X21zIjoxNzAwMDAwMDAwMDAwLCJpdGVtcyI6W3sicmVxdWVzdF9pZCI6IjAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxIiwic3RhdGVtZW50X3NoYTI1NiI6ImRmNjVhZDhjZDYzYjVlYmVlODBkNTg3ZDMwNWM4ZTE5NjExMjFhMzY3MWYxZDY2NTg0MjQyNTJhZTdiZmE1ZjIifV0sInYiOiJjay1zZWNyZXQtdXNlLWVudmVsb3BlL3YxIn0",
+      "unlisted_pending": false
+    },
+    {
+      "case": "batch-omitted",
+      "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZGUzMTc0ZmViMTRjZjJlMjllYzczMDgwZGY3ODVlZTYxNTc0OWQ2MzhjYzgxYmVkOWFhZTQ4MDc5ZDBjYjgxYiJ9XSwidiI6ImNrLXNlY3JldC11c2UtZW52ZWxvcGUvdjEifQ",
+      "envelope_sha256": "7bcd68a3ec5698ad9c9d11e0efa1d67ef7e7aa6ee18c56d963d5f6b18014f180",
+      "results": [
+        {
+          "outcome": "granted",
+          "request_id": "01HF7YAT000000000000000001"
+        }
+      ],
+      "signature_b64url": "MEUCIQDKRJk3gvG7EYBPT0xIKvcZn5bmJpnOEmY3t5fkhlkPtAIgBxhQIWr_XOuoTrazb1NrM-ZJ4FLMQhENmjQPQyuSlZw",
+      "statements": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0",
+          "statement_sha256": "de3174feb14cf2e29ec73080df785ee615749d638cc81bed9aae48079d0cb81b"
+        },
+        {
+          "request_id": "01HF7YAT000000000000000002",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMiIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0",
+          "statement_sha256": "40188343b0381787b1cce06184ac39209d964a50161cb05de515112e05fa7e91"
+        }
+      ],
+      "tampered_envelope_b64url": "eiJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZGUzMTc0ZmViMTRjZjJlMjllYzczMDgwZGY3ODVlZTYxNTc0OWQ2MzhjYzgxYmVkOWFhZTQ4MDc5ZDBjYjgxYiJ9XSwidiI6ImNrLXNlY3JldC11c2UtZW52ZWxvcGUvdjEifQ",
+      "unlisted_pending": true
+    },
+    {
+      "case": "batch-unknown",
+      "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCJ9LHsicmVxdWVzdF9pZCI6IjAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxIiwic3RhdGVtZW50X3NoYTI1NiI6ImRlMzE3NGZlYjE0Y2YyZTI5ZWM3MzA4MGRmNzg1ZWU2MTU3NDlkNjM4Y2M4MWJlZDlhYWU0ODA3OWQwY2I4MWIifV0sInYiOiJjay1zZWNyZXQtdXNlLWVudmVsb3BlL3YxIn0",
+      "envelope_sha256": "8a997bb7042e0796ae75bb25a3f82ff4f06fdfc38b61ed01399f70bc61c795ee",
+      "results": [
+        {
+          "code": "approval_invalid",
+          "outcome": "refused",
+          "request_id": "00000000000000000000000000"
+        },
+        {
+          "outcome": "granted",
+          "request_id": "01HF7YAT000000000000000001"
+        }
+      ],
+      "signature_b64url": "MEYCIQCOfR1DCmGX7lc7j_24wxQ1APCvQv_NLjTSlqDFWXgUdgIhAPCx_LZPeLvEBsovZcsSdgF00MFhsfbi4U5iwulUJvMY",
+      "statements": [
+        {
+          "request_id": "01HF7YAT000000000000000001",
+          "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0",
+          "statement_sha256": "de3174feb14cf2e29ec73080df785ee615749d638cc81bed9aae48079d0cb81b"
+        }
+      ],
+      "tampered_envelope_b64url": "eiJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6ImhvdXIiLCJncmFudF9leHBpcmVzX2F0X21zIjoxNzAwMDAzNjAwMDAwLCJpc3N1ZWRfYXRfbXMiOjE3MDAwMDAwMDAwMDAsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMCJ9LHsicmVxdWVzdF9pZCI6IjAxSEY3WUFUMDAwMDAwMDAwMDAwMDAwMDAxIiwic3RhdGVtZW50X3NoYTI1NiI6ImRlMzE3NGZlYjE0Y2YyZTI5ZWM3MzA4MGRmNzg1ZWU2MTU3NDlkNjM4Y2M4MWJlZDlhYWU0ODA3OWQwY2I4MWIifV0sInYiOiJjay1zZWNyZXQtdXNlLWVudmVsb3BlL3YxIn0",
+      "unlisted_pending": false
+    }
+  ]
+}
\ No newline at end of file
diff --git a/test-vectors/cingulate-secret-use-approval-v1/single-phone-get.json b/test-vectors/cingulate-secret-use-approval-v1/single-phone-get.json
new file mode 100644
index 0000000000..60934cefe8
--- /dev/null
+++ b/test-vectors/cingulate-secret-use-approval-v1/single-phone-get.json
@@ -0,0 +1 @@
+{"result":{"createdAtMs":1700000000000,"default":"decline","elicitationId":"el_1","expiresAtMs":1700000600000,"facts":[],"kind":"secret_use","lateExecution":"notify_only","materialDamage":false,"onExpiry":"deny","options":[{"effect":"grant","id":"allow","label":"Allow"},{"effect":"decline","id":"decline","label":"Decline"}],"prompt":"Review the vault's requested access.","requesterLabel":"reserved:aft","requesterName":"AFT","scope":{},"secretUse":{"items":[{"request_id":"01HF7YAT000000000000000001","statement_b64url":"eyJhZ2VudF9pZCI6ImFnZW50LUEiLCJjb3ZlcmFnZSI6InNjb3BlIiwiZHVyYXRpb25zIjpbIm9uY2UiLCJob3VyIiwic2Vzc2lvbiIsInBlcm1hbmVudCJdLCJtZW1iZXJfaWQiOiJmZWQtY29tcHV0ZXI6MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJyZXF1ZXN0X2V4cGlyZXNfYXRfbXMiOjE3MDAwMDA2MDAwMDAsInJlcXVlc3RfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInNjb3BlIjp7ImVwb2NoIjo3LCJraW5kIjoiaGVhZCIsIm93bmVyIjoicmVzZXJ2ZWQ6cHJlZnJvbnRhbC1jb3JlIiwicmVmIjoiSCJ9LCJzZWNyZXQiOnsiaW5jYXJuYXRpb24iOiIwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDE0OSIsImtpbmQiOiJhZ2VudF9hcGlfa2V5IiwibmFtZSI6ImtleSJ9LCJ1c2UiOnsiaG9zdCI6IngudGVzdCIsImxvY2F0aW9uIjoiaGVhZGVyOlgtQXBpLUtleSIsInBhdGhfcHJlZml4IjoiL3JlcG9zL2EifSwidiI6ImNrLXNlY3JldC11c2Utc3RhdGVtZW50L3YxIn0"}]},"state":"pending","subject":{"agentId":"agent-A","headAgentId":"agent-A","label":"agent-A"},"target":{"kind":"secret_use","label":"Vault access"},"title":"Secret use approval","urgency":"normal"}}
\ No newline at end of file
diff --git a/test-vectors/manifest-binding-v1.json b/test-vectors/manifest-binding-v1.json
new file mode 100644
index 0000000000..dffc5d8ae0
--- /dev/null
+++ b/test-vectors/manifest-binding-v1.json
@@ -0,0 +1,442 @@
+{
+  "format": "manifest-binding-v1",
+  "samples": {
+    "active_status.not_ready": {
+      "result": {
+        "computers": [
+          {
+            "member_id": "fed-computer:22222222222222222222222222222222",
+            "payload_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+            "reason": null,
+            "reported_at_ms": 1794355300123,
+            "verdict": "valid",
+            "version": 29
+          },
+          {
+            "member_id": "fed-computer:33333333333333333333333333333333",
+            "payload_sha256": null,
+            "reason": null,
+            "reported_at_ms": null,
+            "verdict": null,
+            "version": null
+          }
+        ],
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "ready": false,
+        "version": 29
+      }
+    },
+    "active_status.ready": {
+      "result": {
+        "computers": [
+          {
+            "member_id": "fed-computer:22222222222222222222222222222222",
+            "payload_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+            "reason": null,
+            "reported_at_ms": 1794355300123,
+            "verdict": "valid",
+            "version": 29
+          },
+          {
+            "member_id": "fed-computer:33333333333333333333333333333333",
+            "payload_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+            "reason": null,
+            "reported_at_ms": 1794355300123,
+            "verdict": "valid",
+            "version": 29
+          }
+        ],
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "ready": true,
+        "version": 29
+      }
+    },
+    "approve.reply": {
+      "result": {
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "proposal_id": "01HF7YAT000000000000000001",
+        "status": "approved",
+        "version": 29
+      }
+    },
+    "approve.request": {
+      "method": "manifest.approve",
+      "params": {
+        "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJpc3N1ZWRfYXRfbXMiOjE3OTQzNTUzMDAxMjMsInByb3Bvc2FsX2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZWFmNjA4ZmU2YWM5NDBkOTNmMjg5Yjg2YWUwNTE3YTM2ODM4YTVkOWQ4NGVlMTE5YmUxNDk1Y2YwZjViMTRlNiIsInYiOiJjay1tYW5pZmVzdC1iaW5kaW5nLWVudmVsb3BlL3YxIn0",
+        "signature_b64url": "MEQCIAZF7e1xy2QYfTHt43uKDjXtDfmdhMM9IVUPQ8Dw3H1pAiBZvyBy94PV9_AjDd9k8yMkXO9wuJQUo7G9FeqE63JWXg"
+      }
+    },
+    "approve.resend": {
+      "result": {
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "proposal_id": "01HF7YAT000000000000000001",
+        "status": "approved",
+        "version": 29
+      }
+    },
+    "cross.manifest_to_secret": {
+      "reply": {
+        "result": {
+          "error": {
+            "class": "permanent",
+            "code": "approval_invalid"
+          }
+        }
+      },
+      "request": {
+        "method": "secret.approve",
+        "params": {
+          "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJpc3N1ZWRfYXRfbXMiOjE3OTQzNTUzMDAxMjMsInByb3Bvc2FsX2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZWFmNjA4ZmU2YWM5NDBkOTNmMjg5Yjg2YWUwNTE3YTM2ODM4YTVkOWQ4NGVlMTE5YmUxNDk1Y2YwZjViMTRlNiIsInYiOiJjay1tYW5pZmVzdC1iaW5kaW5nLWVudmVsb3BlL3YxIn0",
+          "signature_b64url": "MEQCIAZF7e1xy2QYfTHt43uKDjXtDfmdhMM9IVUPQ8Dw3H1pAiBZvyBy94PV9_AjDd9k8yMkXO9wuJQUo7G9FeqE63JWXg"
+        }
+      }
+    },
+    "cross.secret_to_manifest": {
+      "reply": {
+        "result": {
+          "error": {
+            "class": "permanent",
+            "code": "approval_invalid"
+          }
+        }
+      },
+      "request": {
+        "method": "manifest.approve",
+        "params": {
+          "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJkdXJhdGlvbiI6Im9uY2UiLCJncmFudF9leHBpcmVzX2F0X21zIjowLCJpc3N1ZWRfYXRfbXMiOjE3OTQzNTUzMDAxMjMsIml0ZW1zIjpbeyJyZXF1ZXN0X2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZWFmNjA4ZmU2YWM5NDBkOTNmMjg5Yjg2YWUwNTE3YTM2ODM4YTVkOWQ4NGVlMTE5YmUxNDk1Y2YwZjViMTRlNiJ9XSwidiI6ImNrLXNlY3JldC11c2UtZW52ZWxvcGUvdjEifQ",
+          "signature_b64url": "MEYCIQDDDWb9MS6QQpePnL-LikCFsRQyD3aE2G8vX648DUMsAQIhAO2etZbnlxx-zUkWJhkm8noT5mGSGLtQd48RtMKwVFG9"
+        }
+      }
+    },
+    "envelope": {
+      "approval_public_key_sec1_hex": "041e18532fd4754c02f3041d9c75ceb33b83ffd81ac7ce4fe882ccb1c98bc5896ea46c311c4e2ff40dd96a3653e6e45445d32dfe486eced75c7a90c6a18881c0a3",
+      "envelope": {
+        "decision": "allow",
+        "device_fingerprint": "11111111111111111111111111111111",
+        "issued_at_ms": 1794355300123,
+        "proposal_id": "01HF7YAT000000000000000001",
+        "statement_sha256": "eaf608fe6ac940d93f289b86ae0517a36838a5d9d84ee119be1495cf0f5b14e6",
+        "v": "ck-manifest-binding-envelope/v1"
+      },
+      "envelope_b64url": "eyJkZWNpc2lvbiI6ImFsbG93IiwiZGV2aWNlX2ZpbmdlcnByaW50IjoiMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTEiLCJpc3N1ZWRfYXRfbXMiOjE3OTQzNTUzMDAxMjMsInByb3Bvc2FsX2lkIjoiMDFIRjdZQVQwMDAwMDAwMDAwMDAwMDAwMDEiLCJzdGF0ZW1lbnRfc2hhMjU2IjoiZWFmNjA4ZmU2YWM5NDBkOTNmMjg5Yjg2YWUwNTE3YTM2ODM4YTVkOWQ4NGVlMTE5YmUxNDk1Y2YwZjViMTRlNiIsInYiOiJjay1tYW5pZmVzdC1iaW5kaW5nLWVudmVsb3BlL3YxIn0",
+      "envelope_utf8": "{\"decision\":\"allow\",\"device_fingerprint\":\"11111111111111111111111111111111\",\"issued_at_ms\":1794355300123,\"proposal_id\":\"01HF7YAT000000000000000001\",\"statement_sha256\":\"eaf608fe6ac940d93f289b86ae0517a36838a5d9d84ee119be1495cf0f5b14e6\",\"v\":\"ck-manifest-binding-envelope/v1\"}",
+      "signature_b64url": "MEQCIAZF7e1xy2QYfTHt43uKDjXtDfmdhMM9IVUPQ8Dw3H1pAiBZvyBy94PV9_AjDd9k8yMkXO9wuJQUo7G9FeqE63JWXg",
+      "test_only_private_scalar_hex": "0707070707070707070707070707070707070707070707070707070707070707"
+    },
+    "latest.reply": {
+      "result": {
+        "envelope": {
+          "key_id": "56fae12f77164627",
+          "manifest_bytes": "{\n  \"artifact_id\": \"gh-routing-manifest\",\n  \"manifest_version\": 29,\n  \"schema_floor\": 1,\n  \"issued_at_unix_secs\": 1794355300,\n  \"detectors\": [\n    {\n      \"name\": \"café 🦀\",\n      \"enabled\": true,\n      \"fallback\": null,\n      \"weight\": 1.5\n    }\n  ],\n  \"tiers\": {\n    \"write\": [\n      \"push\"\n    ],\n    \"read\": []\n  },\n  \"api_rules\": [],\n  \"canonicalization\": {\n    \"z_last\": false,\n    \"a_first\": \"line\\nfeed\"\n  },\n  \"repository_sections\": [],\n  \"bindings\": {\n    \"Zulu/Existing\": \"agent_1111111111111111\",\n    \"Alpha/Other\": \"agent_2222222222222222\",\n    \"cortexkit/opencode-sidebar\": \"agent_3333333333333333\",\n    \"Octo-Owner/New-Repo\": \"agent_4444444444444444\"\n  },\n  \"worker_reads\": []\n}\n",
+          "signature": "iAD7y8ZFicBY9GkwqxcjiPE4QcROuTZ3Cc7NR5vILApdY5BR6jUEMCOzNTaZ5gCXuhWodNffXAUm8rAGa15dAQ=="
+        },
+        "version": 29
+      }
+    },
+    "propose.reply": {
+      "result": {
+        "expires_at_ms": 1794441700123,
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "manifest_version": 29,
+        "proposal_id": "01HF7YAT000000000000000001",
+        "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50XzQ0NDQ0NDQ0NDQ0NDQ0NDQiLCJhcHBfc2x1ZyI6InBsZXgtYWxmb25zbyIsImV4cGlyZXNfYXRfbXMiOjE3OTQ0NDE3MDAxMjMsImluc3RhbGxhdGlvbl9wZXJtaXNzaW9ucyI6eyJjb250ZW50cyI6InJlYWQiLCJpc3N1ZXMiOiJ3cml0ZSIsIm1ldGFkYXRhIjoicmVhZCIsInB1bGxfcmVxdWVzdHMiOiJ3cml0ZSJ9LCJtYW5pZmVzdF9zaGEyNTYiOiI5NGNmODk0ZTE3NDYyY2VjMDljNzM3YjA0MmUzZjJjNDJkYmRkOTVmZmRjYWUxMDdiN2IwMGJjN2Q5ZTZjOGYzIiwibWFuaWZlc3RfdmVyc2lvbiI6MjksInByaW9yX3NoYTI1NiI6IjkxMjQ0ODkxYzQ5OGIzZTUxOTk3NjA0ZTllZGYzMGY3NWI2YmYxMGVkZmQyMDIxYzVmZWZlZWY1MTgzODRiYjUiLCJwcmlvcl92ZXJzaW9uIjoyOCwicHJvcG9zYWxfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInJlcG8iOiJPY3RvLU93bmVyL05ldy1SZXBvIiwidiI6ImNrLW1hbmlmZXN0LWJpbmRpbmctc3RhdGVtZW50L3YxIn0",
+        "status": "approval_required"
+      }
+    },
+    "propose.request": {
+      "method": "manifest.propose_binding",
+      "params": {
+        "agent_id": "agent_4444444444444444",
+        "app_id": 4617236,
+        "app_slug": "plex-alfonso",
+        "repo": "octo-owner/new-repo"
+      }
+    },
+    "refusal.already_bound": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "already_bound",
+          "manifest_sha256": "3551b398de3c6bd38903c49abc3d7b975b716b9f6b69fb4f8ce5316caa50cdf4",
+          "version": 30
+        }
+      }
+    },
+    "refusal.approval_invalid": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "approval_invalid"
+        }
+      }
+    },
+    "refusal.bound_to_other_agent": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "bound_to_other_agent"
+        }
+      }
+    },
+    "refusal.expired": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "expired"
+        }
+      }
+    },
+    "refusal.github_unavailable": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "github_unavailable"
+        }
+      }
+    },
+    "refusal.home_unavailable": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "home_unavailable"
+        }
+      }
+    },
+    "refusal.identity_mismatch": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "identity_mismatch"
+        }
+      }
+    },
+    "refusal.identity_unavailable": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "identity_unavailable"
+        }
+      }
+    },
+    "refusal.installation_all": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "installation_all"
+        }
+      }
+    },
+    "refusal.installation_too_large": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "installation_too_large"
+        }
+      }
+    },
+    "refusal.installation_unusable": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "installation_unusable"
+        }
+      }
+    },
+    "refusal.invalid_params": {
+      "code": "invalid_params",
+      "message": "params not decodable: invalid manifest proposal parameters"
+    },
+    "refusal.manifest_setup_incomplete": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "manifest_setup_incomplete"
+        }
+      }
+    },
+    "refusal.not_found": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "not_found"
+        }
+      }
+    },
+    "refusal.not_installed": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "not_installed"
+        }
+      }
+    },
+    "refusal.not_reproducible": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "not_reproducible"
+        }
+      }
+    },
+    "refusal.one_tap_disabled": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "one_tap_disabled"
+        }
+      }
+    },
+    "refusal.pairing_unavailable": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "pairing_unavailable"
+        }
+      }
+    },
+    "refusal.phone_not_registered": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "phone_not_registered"
+        }
+      }
+    },
+    "refusal.remote_setup_incomplete": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "remote_setup_incomplete"
+        }
+      }
+    },
+    "refusal.remote_setup_incomplete.forwarded": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "remote_setup_incomplete"
+        }
+      }
+    },
+    "refusal.remote_setup_incomplete.forwarded_with_remedy": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "remote_setup_incomplete",
+          "remedy_member": "fed-computer:33333333333333333333333333333333"
+        }
+      }
+    },
+    "refusal.remote_setup_incomplete.with_remedy": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "remote_setup_incomplete",
+          "remedy_member": "fed-computer:33333333333333333333333333333333"
+        }
+      }
+    },
+    "refusal.secret_home_elsewhere": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "secret_home_elsewhere",
+          "remedy_member": "fed-computer:33333333333333333333333333333333"
+        }
+      }
+    },
+    "refusal.secret_setup_incomplete": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "secret_setup_incomplete"
+        }
+      }
+    },
+    "refusal.stale_base": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "stale_base"
+        }
+      }
+    },
+    "refusal.store_error": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "store_error"
+        }
+      }
+    },
+    "refusal.superseded": {
+      "result": {
+        "error": {
+          "class": "permanent",
+          "code": "superseded"
+        }
+      }
+    },
+    "refusal.unknown_version": {
+      "result": {
+        "error": {
+          "class": "transient",
+          "code": "unknown_version"
+        }
+      }
+    },
+    "report.reply": {
+      "result": {
+        "member_id": "fed-computer:22222222222222222222222222222222",
+        "status": "recorded",
+        "version": 29
+      }
+    },
+    "report.request": {
+      "method": "manifest.report_active",
+      "params": {
+        "payload_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "reason": null,
+        "verdict": "valid",
+        "version": 29
+      }
+    },
+    "statement": {
+      "statement": {
+        "agent_id": "agent_4444444444444444",
+        "app_slug": "plex-alfonso",
+        "expires_at_ms": 1794441700123,
+        "installation_permissions": {
+          "contents": "read",
+          "issues": "write",
+          "metadata": "read",
+          "pull_requests": "write"
+        },
+        "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+        "manifest_version": 29,
+        "prior_sha256": "91244891c498b3e51997604e9edf30f75b6bf10edfd2021c5fefeef518384bb5",
+        "prior_version": 28,
+        "proposal_id": "01HF7YAT000000000000000001",
+        "repo": "Octo-Owner/New-Repo",
+        "v": "ck-manifest-binding-statement/v1"
+      },
+      "statement_b64url": "eyJhZ2VudF9pZCI6ImFnZW50XzQ0NDQ0NDQ0NDQ0NDQ0NDQiLCJhcHBfc2x1ZyI6InBsZXgtYWxmb25zbyIsImV4cGlyZXNfYXRfbXMiOjE3OTQ0NDE3MDAxMjMsImluc3RhbGxhdGlvbl9wZXJtaXNzaW9ucyI6eyJjb250ZW50cyI6InJlYWQiLCJpc3N1ZXMiOiJ3cml0ZSIsIm1ldGFkYXRhIjoicmVhZCIsInB1bGxfcmVxdWVzdHMiOiJ3cml0ZSJ9LCJtYW5pZmVzdF9zaGEyNTYiOiI5NGNmODk0ZTE3NDYyY2VjMDljNzM3YjA0MmUzZjJjNDJkYmRkOTVmZmRjYWUxMDdiN2IwMGJjN2Q5ZTZjOGYzIiwibWFuaWZlc3RfdmVyc2lvbiI6MjksInByaW9yX3NoYTI1NiI6IjkxMjQ0ODkxYzQ5OGIzZTUxOTk3NjA0ZTllZGYzMGY3NWI2YmYxMGVkZmQyMDIxYzVmZWZlZWY1MTgzODRiYjUiLCJwcmlvcl92ZXJzaW9uIjoyOCwicHJvcG9zYWxfaWQiOiIwMUhGN1lBVDAwMDAwMDAwMDAwMDAwMDAwMSIsInJlcG8iOiJPY3RvLU93bmVyL05ldy1SZXBvIiwidiI6ImNrLW1hbmlmZXN0LWJpbmRpbmctc3RhdGVtZW50L3YxIn0",
+      "statement_sha256": "eaf608fe6ac940d93f289b86ae0517a36838a5d9d84ee119be1495cf0f5b14e6",
+      "statement_utf8": "{\"agent_id\":\"agent_4444444444444444\",\"app_slug\":\"plex-alfonso\",\"expires_at_ms\":1794441700123,\"installation_permissions\":{\"contents\":\"read\",\"issues\":\"write\",\"metadata\":\"read\",\"pull_requests\":\"write\"},\"manifest_sha256\":\"94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3\",\"manifest_version\":29,\"prior_sha256\":\"91244891c498b3e51997604e9edf30f75b6bf10edfd2021c5fefeef518384bb5\",\"prior_version\":28,\"proposal_id\":\"01HF7YAT000000000000000001\",\"repo\":\"Octo-Owner/New-Repo\",\"v\":\"ck-manifest-binding-statement/v1\"}"
+    },
+    "watch.empty": {
+      "epoch": "00112233445566778899aabbccddeeff",
+      "kind": "changed",
+      "manifest_sha256": null,
+      "seq": 1,
+      "version": null
+    },
+    "watch.stored": {
+      "epoch": "00112233445566778899aabbccddeeff",
+      "kind": "changed",
+      "manifest_sha256": "94cf894e17462cec09c737b042e3f2c42dbdd95ffdcae107b7b00bc7d9e6c8f3",
+      "seq": 1,
+      "version": 29
+    }
+  }
+}
diff --git a/test-vectors/manifest-binding-v1.provenance.md b/test-vectors/manifest-binding-v1.provenance.md
new file mode 100644
index 0000000000..a514faa160
--- /dev/null
+++ b/test-vectors/manifest-binding-v1.provenance.md
@@ -0,0 +1,25 @@
+# Manifest binding wire vectors
+
+`manifest-binding-v1.json` is copied byte-for-byte from claustrum:
+
+- Tag: `manifest-binding-vectors-v1`
+- Commit: `c2a9ce2eaf99da646160eeb0c73d6b11d9341cbf`
+- Path: `crates/credentials-module/tests/vectors/manifest-binding-v1.json`
+- SHA-256: `8c070db5272be78e6682714a53628453e5bf7fda5a43431d4e73b4d663218433`
+- Contract: `docs/wire-contract-v1.md`, section 17, SHA-256 `63aee2042c1565c47c4f3764f869b248a48a5db8a444cf0c34e2724909e731aa`
+
+AFT consumes latest, watch, report_active, and their applicable refusals. Approval,
+proposal, statement, cross-operation approval, and active_status samples belong to
+operations AFT does not call and are intentionally not used by its client.
+
+The 31 skipped sample names are: `active_status.not_ready`, `active_status.ready`,
+`approve.reply`, `approve.request`, `approve.resend`, `cross.manifest_to_secret`,
+`cross.secret_to_manifest`, `envelope`, `propose.reply`, `propose.request`,
+`refusal.already_bound`, `refusal.approval_invalid`, `refusal.bound_to_other_agent`,
+`refusal.expired`, `refusal.github_unavailable`, `refusal.identity_mismatch`,
+`refusal.identity_unavailable`, `refusal.installation_all`,
+`refusal.installation_too_large`, `refusal.installation_unusable`,
+`refusal.manifest_setup_incomplete`, `refusal.not_installed`,
+`refusal.not_reproducible`, `refusal.one_tap_disabled`, `refusal.pairing_unavailable`,
+`refusal.phone_not_registered`, `refusal.secret_home_elsewhere`,
+`refusal.stale_base`, `refusal.superseded`, `refusal.unknown_version`, `statement`.