diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f6e489f..eb9faed1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,17 @@
 
 <!-- Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0 -->
 
+## 0.2.43 — 2026-10-24
+
+- Allocate command ordinals durably across service instances and restored graphs. Preserve exact explicit replay, unknown-effect holds and run-lifetime command budgets.
+- Restore fully completed command history through canonical native WAL and consume receipts. Keep changed source, authority, runtime contracts and interrupted effects blocked.
+- Compress accumulated native checkpoint history losslessly within an explicit 8 MiB raw bound while preserving the 192 KiB snapshot and 256 KiB WAL limits. Scan decoded records against current credential custody, including generic journal reads.
+- Stage complete branding files with a compact manifest, send the composed brief once, and retain the nine granted static checkpoint tools and exact frozen wireframe descriptors.
+- Preserve verified GitHub delivery links and bind finite maintenance communication to the exact new native creation receipt. Lifecycle notices and owner answers grant no resume or new execution authority.
+- Stream checkpoint identity from tracked Git source, including ignored tracked assets, and nonignored untracked source. Generated ignored dependencies no longer turn a host checkpoint into a transport-archive failure; runner archive transfer remains separately guarded.
+- Page source listing and text search explicitly, classify binary source, and hash every eligible file completely for manifests without the old 2,000-path or 1 MiB manifest cutoff.
+- Bind the V12 source profile to an explicit 35-module admission closure and 22 loader inputs with fresh same-source native/SQL measurements, retaining all seven historical profiles. Studio remains on its unchanged 0.2.42 assets and captures; see the [release notes](docs/release-notes.md#0243) for verification boundaries.
+
 ## 0.2.42 — 2026-10-24
 
 - Complete an uncertain remote Git checkpoint only through a new finite native request, preserving the original unknown request, retained review body, current permissions and exact branch checks.
diff --git a/docs/agent-tools.md b/docs/agent-tools.md
index 6fcdd945..bcf55b54 100644
--- a/docs/agent-tools.md
+++ b/docs/agent-tools.md
@@ -9,10 +9,10 @@ Firefly Agentic registers the tools allowed by the run's frozen role configurati
 
 | Tool | Scope and evidence |
 | --- | --- |
-| `list_files` | Up to 2,000 component source paths; skips dependency trees, credentials and symlinks. |
+| `list_files` | Versioned pages of component source paths, with a source-view digest and continuation cursor. A page is never the whole project unless its scope is complete. |
 | `read_file` | Bounded UTF-8 source with its SHA256 hash. |
 | `write_file` | Complete bounded source content in a relative component path. |
-| `search_text` | Literal text search with line numbers, file hashes and an explicit truncation flag. |
+| `search_text` | Complete selected text search with finite result pages, full-file hashes, explicit snippet truncation and binary/UTF-8 classification. |
 | `edit_lines` | Inclusive line replacement requiring the current file hash, rechecked on the open write descriptor. |
 | `git_diff` | A bounded component diff with external drivers, text conversion, filesystem monitors and hooks disabled. |
 | `execute_command` | Bounded argv execution through the frozen host or Docker policy. |
@@ -36,6 +36,20 @@ The table is a conditional native registry, not a promise that every provider re
 
 The separately qualified source-only Codex route has a different, measured contract: governed source list/read/search and source edits within its exact admitted workspace, plus only the utilities explicitly recorded in its supported profile. It does not inherit `execute_command`, browser tools, internet search or `read_run_evidence` from the ordinary native registry. The current binary, model metadata, package policy and runtime must match that qualified profile before dispatch. A configured provider, an available capability, a qualified source-only profile and a completed invocation are separate states; check the [tool prerequisites](tooling-prerequisites.md) and [source-only recovery requirements](recovery.md) for the applicable route. Owner guidance does not modify a call already in flight or become delivery authority for a sealed source-only invocation.
 
+## Continue through a large source tree
+
+The native `list_files` tool returns a version-one page with `files`, `view_sha256`, `next_cursor` and `complete`. Start without a cursor. If `complete` is false, send the returned cursor with the same prefix and page size. Keep going until the final page. The default page size is 100; up to 1,000 paths can be requested in one response. The admitted byte window can shorten a page further. These are response windows, not project file-count limits.
+
+Firefly Agentic uses `path_prefix`; the source-only CLI reader uses its existing `path` argument as the prefix. Both accept an optional `cursor`. The CLI also accepts `page_size` and requires a new unique `request_id` for each page. Reusing an ID reads its exact stored result; changing that ID's cursor or arguments is refused. Old requests without paging arguments remain valid and receive an explicit first page. Internal Python callers of `WorkspaceTools.list_files()` receive the complete eligible path list.
+
+A cursor binds the repository/component, prefix or search query, response options and complete filename/metadata view. A changed view is refused: start a new listing instead of combining pages from different source states. Cursor contents are navigation data, not execution or permission grants.
+
+Git workspaces select tracked files, including tracked files covered by ignore rules, plus nonignored untracked files. Ignored installed dependencies are not treated as product source. Selected private paths, unsafe links, aliases and conflicts refuse; they are not silently counted as inspected. Standalone non-Git callers keep confined source traversal. Present but malformed Git metadata never triggers a filesystem fallback.
+
+`search_text` applies the prefix before scanning and can find text in files larger than the ordinary whole-file read window. Its pages retain the full-file SHA256 and report `snippet_truncated` separately from result-page continuation. Binary and invalid-UTF8 files are counted explicitly; unreadable or changed source refuses the operation. `complete` means the selected text-search page sequence has reached its end, not that binary content was searched as text.
+
+Before and after a native command, the internal manifest streams all selected file bytes, including large and binary files, without using a reader page or a fixed aggregate byte cutoff. Source identity is rechecked before returning. This complete accounting does not remove the separate role, command, provider or host budgets. It also does not expand the existing whole-file write/edit window; large-file editing needs its own supported interface.
+
 ## Observe a Python workload
 
 Grant both `profile_python` and `execute_command` to the implementation role before creating the run. The repository runner must use an immutable Docker image, archive workspace transfer and network `none`, without a pool binding. Its image must already contain `python3` and the workload's dependencies. Host, bind-mount, network-enabled and pool profiles do not receive this optional tool. Readiness checks runner availability; the invocation still determines whether the image has a working Python interpreter. The default six source grants are unchanged.
diff --git a/docs/architecture.md b/docs/architecture.md
index 06990f73..16dba101 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -516,7 +516,9 @@ flowchart LR
 
 <p class="forge-flow-caption" id="original-result-flow-guide">Save the original checkpoint and intent before submitting to Bridge. If the result is uncertain, retain its identity, read or check the original result, then review one continuation. Continuing commits the one-use consume receipt before native parsing, followed by implementation and verification. On a narrow screen, scroll horizontally or focus the diagram and use the arrow keys.</p>
 
-The restore ticket binds the original checkpoint, intent and selected result record. The execution owner repeats authority, source, configuration and deadline checks before restoring native Agentic history with `prompt=None`. The selected response is consumed once before the SDK parser receives it. A failure after that commit cannot authorize replay. A later repair keeps its own task identity; its mutable task key cannot replace the original implementation receipt. Owner recovery retains a committed consume boundary and holds unfinished tickets for reconciliation. See the [operator recovery journey](recovery.md#review-a-held-result-in-studio) for supported file tools and current limits.
+The restore ticket binds the original checkpoint, intent and selected result record. The execution owner repeats authority, source, configuration and deadline checks before restoring native Agentic history with `prompt=None`. The selected response is consumed once before the SDK parser receives it. A failure after that commit cannot authorize replay. A later repair keeps its own task identity; its mutable task key cannot replace the original implementation receipt. Owner recovery retains a committed consume boundary and holds unfinished tickets for reconciliation. Static command, knowledge and evidence tools retain explicit grants. Command-enabled restoration verifies bounded native WAL against canonical, fully completed durable command records. Prior effects must precede the selected checkpoint; later command creation must follow the matching restore consume. Unknown, interrupted, orphaned or altered effects refuse. Fresh commands use the next durable ordinal and preserve lifetime budgets. The checkpoint runtime contract binds the restore implementation, preventing an older contract from silently gaining this behavior. See the [operator recovery journey](recovery.md#review-a-held-result-in-studio) for supported tools and current limits.
+
+Boundary snapshots retain lossless canonical native history within an explicit 8 MiB raw bound. New records above 64 KiB use zlib/base64 within the existing 192 KiB snapshot and 256 KiB WAL limits. Canonical envelope/base64, raw SHA-256, size, end-of-stream and trailing-data checks precede restoration. Current credential admission scans decoded records at capture, consume, restore and generic journal read without exposing raw history in returned WAL or logs. Generic journal reads suspend ambient unit bindings and inspect one bounded record at a time under current reader/configuration guards. Source admission V11 adds the decoder to its explicit 34-module closure; the checkpoint runtime contract binds custody producer and consumer.
 
 `BridgeProvider.execute()` creates a separate pending-request set for each invocation. Agentic task-graph children inherit that shared object through a context variable. Each completion tracks its own attempt before transport and clears it after a validated response, an exhausted stream or a known quota/pause response. Completing one request cannot clear another pending request. If the task graph unwraps a cancellation exception, the outer provider checks its own set before returning cancellation to the Engine. Both context tokens are reset when their scopes end. The Engine then records an unresolved submission against the original journal intent before finishing local cancellation. Regression controls cover the real `FireflyAgent` path, concurrent invocations on a shared provider, successive completions and restart through the native Store.
 
@@ -590,6 +592,10 @@ Source: [`api.py`](https://github.com/fireflyframework/firefly-forge/blob/main/s
 
 ## Agent roles, native tools and cited context
 
+Product branding enters implementation through a compact file manifest. Engine validates the frozen kit's digest and admits the complete assets against current credentials, then materializes them under `docs/brand/<digest>/` inside the selected component. Each manifest entry carries the component-relative path, UTF-8 byte count and SHA-256. Complete tokens, logos, styles and font-license text stay available through the governed file tools. Existing conflicting content refuses materialization; the file writer also checks the empty-file hash before creating a missing asset. Cancellation, ownership and current project authority are checked around effects.
+
+The manifest passes through the existing brand-instruction template. The complete assembled development brief appears once in the native user prompt; backend/frontend instructions, tool rules and frozen QA descriptors remain separate instructions. Embedded SVG and font CSS therefore stay in source files, while requirements and knowledge remain complete in the brief. This changes context representation without increasing checkpoint limits or silently cutting content. Engine and runtime changes require a newly measured source capability profile before native admission.
+
 <details class="forge-gallery" markdown="1">
 <summary>Inspect instructions, tool authority and knowledge scope</summary>
 
diff --git a/docs/recovery.md b/docs/recovery.md
index 123bb5e4..b1cbe560 100644
--- a/docs/recovery.md
+++ b/docs/recovery.md
@@ -427,7 +427,13 @@ Without explicit checkpoint selection this storage service remains unused by exe
 
 ### Explicit closed-text implementation continuation
 
-New Bridge implementations may select `checkpoints: required` together with `completion_recovery: required` in saved provider configuration or an implementation model profile. These optional fields freeze into the new run; absent fields leave historical snapshots and defaults unchanged. The initial slice requires an explicit static grant containing only `list_files`, `read_file`, `write_file`, `search_text`, `edit_lines` and `git_diff`. Unsupported grants, streaming, vision, QA state, deferred tools, retry state, dynamic instructions or dynamic tool catalogs refuse before completion submission. Direct API providers and independent review do not support required checkpoints; use a separate review profile with checkpoints disabled.
+New Bridge implementations may select `checkpoints: required` together with `completion_recovery: required` in saved provider configuration or an implementation model profile. These optional fields freeze into the new run; absent fields leave historical snapshots and defaults unchanged. The supported static text tools are `list_files`, `read_file`, `write_file`, `search_text`, `edit_lines`, `git_diff`, `execute_command`, `knowledge_lookup` and `read_run_evidence`. Each needs an explicit frozen role grant and its configured native executor. A grant does not create runner, knowledge or evidence access by itself. Unsupported grants, streaming, vision, QA state, deferred tools, retry state, dynamic instructions or dynamic tool catalogs refuse before completion submission. Direct API providers and independent review do not support required checkpoints; use a separate review profile with checkpoints disabled.
+
+Reviewed wireframe references may accompany those tools as textual descriptors. They must exactly match the native descriptors derived from the frozen design bundle, product review and frontend choice, including hashes and ordering. Missing or changed references are refused. The generator's Engine source joins the runtime contract, and both snapshots remain bound to the invocation. Descriptor text grants no image, browser or other QA tool access; active QA and multimodal checkpoint history remain unsupported.
+
+Commands keep their sandbox intents, receipts and lifetime budget. Completed text results and changed source paths enter the next closed checkpoint history. A command-enabled restore requires every retained execution to have a canonical durable v2 identity, matching native WAL, a completed result and confirmed cleanup under the frozen runner policy. Every prior effect must finish before the selected checkpoint. Pending, interrupted, orphaned, altered or unreconciled effects refuse restoration; explicit stage reconciliation does not silently make an interrupted command restorable.
+
+After the original result is consumed, later completed commands must have creation intents after that exact restore ticket and generation's consume record. Forge allocates their next durable ordinal; restoring a graph does not replay an earlier command, reset command or browser budgets, or expose a consumed result again. Read-only restoration retains its existing behavior. Runtime contract hashing includes the restore implementation, so this correction does not make older checkpoint contracts eligible. These checks require their own native SQL qualification before a runtime adopts them.
 
 In Studio, open **Connections → Coding AI → Bridge → Configure**. Under **Original model results**, select **Required: retain the original result**, then **Required: save implementation checkpoints**. Saving these settings does not test the connection or change an existing run. **Keep current default (unset)** omits the field from this save; it does not clear a saved value. Choose **Disabled** to stop requiring checkpoints. The other choices explicitly save `legacy`/`required` recovery or `disabled`/`required` checkpoints. The equivalent provider API is `PUT /api/v1/providers/bridge/configuration` with `values` containing the selected fields. Named implementation profiles use `PUT /api/v1/model-profiles/{id}`.
 
@@ -498,6 +504,11 @@ These controlled Studio fixtures show a saved result, an acknowledged review and
 
 The real Agentic implementation captures a closed native message history at the exact HTTP request boundary. Version-2 checkpoint envelopes bind the original composed instructions, runtime and prompt contracts, cumulative native usage and limits, absolute deadline, task attempt, file-tool state and retained owned workspace. The original Bridge intent and checkpoint commit together before POST. Both ordinary and restored results commit a consume receipt before reaching the native parser. Version-1 checkpoints and HTTP-only consume receipts retain their original semantics and cannot authorize restoration.
 
+Accumulated native history uses a lossless boundary codec. New canonical records above 64 KiB use a version-2 canonical JSON envelope containing standard zlib/base64 data, the exact raw byte count and SHA-256. Small records and legacy raw version-1 decoding retain their original encoding. The raw canonical record has an explicit **8 MiB** limit. Bounded decompression rejects truncated streams, trailing or concatenated data, size/hash mismatches and noncanonical envelopes. It never truncates messages, tool results, usage counters or file-tool state. The encoded snapshot remains bounded at **192 KiB**; its invocation binding, JSON escaping, WAL record and consume reserve must still fit **256 KiB**. Incompressible history or other exhausted custody/credential budgets remain held before dispatch. This is bounded checkpoint capacity, not unbounded enterprise history.
+
+Capture, consumption, restoration and authenticated generic journal reads inspect the full decoded canonical record against current credential custody. Generic reads check one record at a time outside native database units and return the original encoded WAL. A restored request must first match native model state and original wire bytes; it then reuses the original encoded snapshot and digest. Valid zlib streams do not require byte-identical recompression across library versions. This codec does not grant restoration authority to an outer version-1 WAL checkpoint or re-arm consumed results. Source profile V11 explicitly binds the Journal/decoder dependency and requires fresh qualification; earlier profiles retain their exact provenance.
+
+
 An authorized operator first selects an immutable original HTTP result or retains a successful original-result observation through the existing `POST /api/v1/runs/{run_id}/bridge-requests/{completion_request_id}/observations` route. Then POST `/api/v1/runs/{run_id}/agent-checkpoints/{completion_request_id}/restores` with a retained 32-character hexadecimal `request_id`, `expected_checkpoint_digest`, `expected_intent_digest` and a tagged `source`. An `http_response` source has its `record_digest`; a `bridge_observation` source also has `observation_id` and the original `terminal_digest`. The server does not accept an arbitrary response body. GET the same route with `/{request_id}` for exact readback; a missing or uncertain response never authorizes another admission. Each checkpoint permits one ticket, within a maximum of 50 restore tickets per run and the shared bounded worker queue.
 
 Discover completion request IDs through `GET /api/v1/runs/{run_id}/bridge-requests` and read the selected intent at `/{completion_request_id}`. The authenticated run journal (`GET /api/v1/runs/{run_id}/journal`) contains the matching `agent_checkpoint`, any `bridge_request_response` and their immutable record digests. Select the version-2 checkpoint whose idempotency key matches that request; its record digest is `expected_checkpoint_digest` and its payload binds `expected_intent_digest`. For an observation source, retain the observation POST response and its successful original terminal digest. Keep the client-generated restore request ID before POST, then read that exact ticket after a lost response; do not generate a replacement ID.
diff --git a/docs/release-notes.md b/docs/release-notes.md
index f252c366..93b3624a 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -5,6 +5,22 @@ description: Review firefly forge release changes, runtime requirements and the
 <!-- Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0 -->
 # firefly forge release notes
 
+## 0.2.43
+
+Command slots now come from a durable, atomic run/task/attempt cursor. Fresh service instances allocate a new invocation; an explicit ordinal retains exact replay semantics. Pending, unknown, interrupted or unowned effects hold further dispatch. Command-enabled graph restoration accepts canonical, fully completed durable v2 records only, checks their position before the selected checkpoint or after the matching consume, and preserves lifetime command and browser budgets.
+
+Accumulated native history uses a lossless, versioned canonical zlib/base64 envelope above 64 KiB. The raw record is limited to 8 MiB, the encoded snapshot to 192 KiB, and the complete WAL envelope and reserve to 256 KiB. Bounded decoding verifies the raw size and hash, canonical encoding, complete stream and absence of trailing data. Capture, consume, restore and generic journal reads scan the full decoded record against current credentials. A restored request retains its original encoded bytes and must match native history, usage, limits, state and wire identity. Unknown or consumed results are never re-armed.
+
+Complete branding assets are staged through ordinary workspace tools while the model receives their compact path/hash manifest and one composed brief. Checkpointed execution retains the nine explicitly granted static tools and exact frozen wireframe descriptors. GitHub status cards can preserve only verified native PR/commit links for the current repository; the existing path, credential, image, mention and length guards remain active.
+
+A native API configuration can bind finite maintenance communication to one exact server-owned creation receipt and checkpoint lineage. The configured issue can receive lifecycle and worker-question notices, and its mapped owner can answer through the existing native worker-response path. An answer does not resume execution, inherit a prior run's grants, reset a budget or launch another unit. Natural issue text does not create this maintenance binding or a new maintenance run. See [SCM setup](scm.md#bind-a-fresh-maintenance-unit-to-its-owners-issue).
+
+Checkpoint source identity streams tracked Git files, including ignored tracked assets, and nonignored untracked files through the current credential scanner. It binds source bytes, index, HEAD and the selected namespace without loading dependency trees into a TAR archive. Ignored generated output is outside this source fingerprint; it is not evidence of dependency integrity or successful installation. Docker and pool archive transport retain their independent byte limits, link rejection and publication checks.
+
+Source listing and search return explicit complete/continuation pages bound to the source view, scope and query. Internal manifests hash every eligible file completely, including binary and large files. Search scans complete UTF-8 source with bounded excerpts and explicit binary/invalid-UTF-8 classification. The exhaustive Python inventory remains available; response windows do not silently drop the rest of a repository.
+
+The V12 source profile binds an explicit 35-module admission closure and 22 loader inputs. It requires fresh same-source controlled native tool-boundary and PostgreSQL measurements, including the source-identity and paging cases. All seven historical profile literals and seals remain unchanged. Standard distribution payload checks, controlled transport tests and these qualifications remain separate from live model quality, completed generated-product delivery and GitHub acceptance. Backend 0.2.43 keeps the unchanged Studio 0.2.42 bundle and controlled captures; no screenshot version is relabeled.
+
 ## 0.2.42
 
 An explicitly reviewed remote-completion request can confirm a saved local checkpoint after an uncertain push or draft-review outcome. It retains the original unknown request, exact AI-written review text and local checkpoint; a new finite consent grants remote completion only. The execution owner checks current authority, source, credentials and the exact expected branch before any write. A newly confirmed receipt records recovery provenance rather than claiming the original write succeeded. A later unmatched intent remains visible as uncertain even when an earlier draft was confirmed.
diff --git a/docs/sandbox.md b/docs/sandbox.md
index 2741585a..c6b3fbed 100644
--- a/docs/sandbox.md
+++ b/docs/sandbox.md
@@ -25,6 +25,18 @@ After acquiring its run lock and execution capacity, the runner rechecks coordin
 
 Cleanup can still remove the invocation's owned containers and volumes after revocation or cancellation, with the existing ownership-label and coordinator checks. Removing execution permission must not prevent those resources from draining. Effects a command already performed remain part of its retained history and recovery process.
 
+## Preserve command identity across service restarts
+
+An omitted command ordinal represents a new invocation, even when its arguments match an earlier command. The factory allocates the next slot from canonical persisted run/task/attempt records and writes the create intent under the same database run lock. A fresh executor instance cannot restart that cursor or reset the total run budget. An explicit ordinal retains exact replay semantics: a matching completed result can be returned without executing the command again, while changed arguments are refused.
+
+Allocation checks the retained scalar identities, request payloads, effect receipts, and intact journal together. Missing or inconsistent projections, unknown creation/start/cleanup, interrupted effects, and uncertain workspace publication prevent fresh dispatch. An explicitly reconciled interruption or closed preparation can advance only after all command effects have known receipts and the original native task has a later explicit retry reconciliation. Merely increasing an attempt or restarting the service does not authorize another effect. Allocation and dispatch reject an ambient caller transaction; process and controller effects start after the factory's own intent transaction commits.
+
+Implementation checkpoint runtime contracts include the command allocator, executor, pool worker, and their policy/persistence modules. A checkpoint captured under different executor semantics cannot be restored silently. The conservative restore restriction and native source qualification gates still apply; this command identity contract does not by itself authorize command-enabled restoration.
+
+Checkpoint source identity is separate from command workspace transport. It streams every tracked Git file, including tracked assets matched by ignore rules, and every nonignored untracked file. A newly created, nonignored package lock is included. Ignored, untracked installed dependencies and generated outputs are outside this source identity; their presence does not prove a successful or reproducible installation. Selected private paths, source links, hard links, unreadable files, or concurrent source, index, HEAD, credential, or ignore-rule changes refuse the checkpoint. Complete file bytes are hashed and checked in bounded chunks without a total source-size or file-count truncation. Git metadata and the selected source are checked again before publishing the identity.
+
+The runner's archive transport retains its own explicit workspace byte budget and strict regular-file contract. Checkpoint source selection does not silently change transported files, import dependencies, or permit dependency links in an archive. A runner that needs installed dependencies must provide them through its configured workspace or image and retain the corresponding command receipts.
+
 ## Keep Python verification tied to current source
 
 Factory commands receive a fresh execution-owned Python cache namespace and `PYTHONDONTWRITEBYTECODE=1`. The namespace replaces inherited or caller-supplied `PYTHONPYCACHEPREFIX` values. This prevents normal Python imports from accepting an earlier timestamp-and-size cache after a same-size source edit. Disabling bytecode writes alone would still allow an existing stale cache to be read.
diff --git a/docs/scm.md b/docs/scm.md
index ad9b626f..ffffae1f 100644
--- a/docs/scm.md
+++ b/docs/scm.md
@@ -1023,3 +1023,55 @@ pipeline without a mention or copied identifier. Saving that answer does not
 renew source-only consent, resume execution, create a run or reset a budget.
 The separate current native continuation gates still apply. Controlled host and
 SQL fixtures are separate from real GitHub delivery acceptance.
+
+GitHub natural status replies can preserve PR and commit links from the current repository’s verified native delivery journal. The server binds these HTTPS links to the exact project, issue, actor, run, and checkpoint; model text cannot authorize another URL. This link rendering currently supports GitHub only. A local checkpoint alone does not establish a published PR or product acceptance. Credential, setting, private path, HTML, image, and mention guards still apply.
+
+### Bind a fresh maintenance unit to its owner's issue
+
+A maintenance unit created from a confirmed checkpoint has its own run, creation
+receipt, provider session and budgets. Its checkpoint parent supplies source
+provenance, not communication or execution authority. By default its issue
+lineage is read-only, just like a fresh checkpoint test. Neither a status request
+nor an ordinary project reader can upgrade it into a writable conversation.
+
+For a native administrator who can manage the project's members, the API offers
+explicit, finite setup at
+`POST /api/v1/projects/{project_id}/repositories/{repository_id}/maintain-ticket-bindings`.
+The strict version-1 request contains:
+
+- A new `request_id`, the maintain `run_id`, its `creation_request_id` and the
+  exact `expected_creation_digest` returned by run creation.
+- An actual API-observed owner message in `observed_receipt_id` and its
+  `expected_reference_digest`. The existing authenticated conversation must link
+  the checkpoint parent in the same repository, project and component.
+- `expected_previous_digest`, initially `null`, for an exact binding update.
+- A `lifetime_seconds` value from 60 through 3,600 and `max_notifications` from 1
+  through 32. These bound the new communication consent, not the run's coding
+  allowance.
+- Explicit `allowed_actions: ["status", "question", "answer"]` and
+  `acknowledge_native_communication: true`.
+
+Read the immutable result at the same base path plus
+`/requests/{request_id}`. Repeating the identical request recovers that result
+without extending its expiration. A new binding requires its own request and the
+current previous digest. An uncertain prior notification blocks replacement.
+
+After setup, the existing collaboration owner loop automatically posts lifecycle
+updates and supported pending worker questions to the confirmed issue. It checks
+current polling consent, repository scope, owner identity, project permissions,
+communication configuration and finite consent again before dispatch, including
+after waiting for the provider lock. Native configuration stores a clearly marked
+factory outbox; it does not invent an inbound GitHub event or modify
+`issue_context`, the parent's receipts, or the source-only question producer.
+
+A confirmed question comment lets its mapped owner reply naturally in the issue.
+The existing answer pipeline records the child's exact `worker_response` with
+current SCM attribution and leaves the child paused. There is no automatic
+resume, inherited parent grant, extra coding budget, or retry of an uncertain
+remote write. Unbound children, checkpoint tests and other project readers keep
+read-only lineage. Revoked or expired consent holds further notifications.
+
+This first setup path is native API configuration. The natural coordinator does
+not yet create a maintenance unit or its communication binding from an issue
+request. Controlled host/native tests and a real GitHub acceptance trial are
+separate evidence; configuring the API alone does not establish live delivery.
diff --git a/pyproject.toml b/pyproject.toml
index 26b73971..3674953c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "firefly-forge"
-version = "0.2.42"
+version = "0.2.43"
 description = "Firefly software factory: brief to verified product with interchangeable coding agents"
 readme = "README.md"
 requires-python = ">=3.13"
diff --git a/src/firefly_forge/__init__.py b/src/firefly_forge/__init__.py
index 056a1f1e..c0e8c016 100644
--- a/src/firefly_forge/__init__.py
+++ b/src/firefly_forge/__init__.py
@@ -1,4 +1,4 @@
 # Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
 """firefly forge software factory."""
 
-__version__ = "0.2.42"
+__version__ = "0.2.43"
diff --git a/src/firefly_forge/agent_checkpoint_models.py b/src/firefly_forge/agent_checkpoint_models.py
index 5e03a730..d08af7f1 100644
--- a/src/firefly_forge/agent_checkpoint_models.py
+++ b/src/firefly_forge/agent_checkpoint_models.py
@@ -35,7 +35,7 @@ class InvocationBinding(StrictRecord):
     frontend: str = Field(min_length=1, max_length=32)
     round: int = Field(ge=1, le=1000000)
     deadline_ms: int = Field(ge=1, le=2**53 - 1)
-    grants: list[str] = Field(max_length=6)
+    grants: list[str] = Field(max_length=9)
     contract: Digest
     run_cut: Digest
     workspace: dict[str, str] = Field(min_length=4, max_length=4)
diff --git a/src/firefly_forge/agent_checkpoints.py b/src/firefly_forge/agent_checkpoints.py
index 6f7ea25c..286767e4 100644
--- a/src/firefly_forge/agent_checkpoints.py
+++ b/src/firefly_forge/agent_checkpoints.py
@@ -46,6 +46,13 @@ def __init__(self, completions: BridgeCompletions) -> None:
         self.completions = completions
         self.store, self.journal = completions.store, completions.journal
 
+    @staticmethod
+    def credential_payload(checkpoint: Data) -> list[Any]:
+        _outside_unit()
+        payload = checkpoint["payload"]
+        captured = BoundaryCheckpoint.decode(payload["snapshot"].encode("utf-8"), payload["checkpoint_digest"])
+        return [checkpoint, captured.canonical_payload.decode("utf-8")]
+
     async def _budget(self, run_id: str, *, extra: int = 0, reserve: bool = False, consume: bool = False) -> None:
         budget = await self.journal.records.checkpoint_budget(identifier(run_id))
         if (
@@ -131,7 +138,11 @@ async def checkpoint_admit(raw: Data, body: bytes) -> Data:
                 raise ValueError("Checkpoint differs from the original wire request")
             snapshot = checkpoint.payload.decode("utf-8")
             invocation = await capture_context() if capture_context is not None else None
-            credential_payload = snapshot if invocation is None else {"snapshot": snapshot, "invocation": invocation}
+            credential_payload = {
+                "snapshot": snapshot,
+                "canonical_record": checkpoint.canonical_payload.decode("utf-8"),
+                "invocation": invocation,
+            }
             await self.store.admit_credentials(credential_payload)
             await current()
             self.store.reject_credentials(credential_payload)
@@ -226,7 +237,11 @@ async def _exact(self, run_id: str, request_id: str) -> Data:
                 raise ValueError("Checkpoint consume receipt has different immutable bindings")
             result = {"checkpoint": checkpoint, "consume": consumed}
         self._validate_checkpoint(checkpoint, intent)
-        return await self.completions._admitted_read(run_id, result, reader, scope)
+        credentials = self.credential_payload(checkpoint)
+        await self.store.admit_credentials(credentials)
+        value = await self.completions._admitted_read(run_id, result, reader, scope)
+        self.store.reject_credentials(credentials)
+        return value
 
     @staticmethod
     def _validate_checkpoint(checkpoint: Data, intent: Data) -> None:
@@ -276,7 +291,8 @@ async def _consume(
         async with self.store._unit():
             bundle = await self._bundle(run, intent, body)
         self._validate_checkpoint(bundle[1], bundle[0])
-        await self.store.admit_credentials(bundle)
+        credentials = (bundle, self.credential_payload(bundle[1]))
+        await self.store.admit_credentials(credentials)
         await current()
         async with self.store._unit():
             await self.completions._writer(run, reader)
@@ -305,9 +321,9 @@ async def _consume(
             if _size(consumed) > CONSUME_RESERVE:
                 raise ValueError("Checkpoint consumption exceeds its reserved envelope")
             await current()
-            self.store.reject_credentials(bundle)
+            self.store.reject_credentials(credentials)
         await current()
-        self.store.reject_credentials(bundle)
+        self.store.reject_credentials(credentials)
 
     async def restore_bundle(
         self, run_id: str, request_id: str, request: RestoreInput
@@ -364,7 +380,7 @@ async def restore_bundle(
             or any(c.finish_reason not in {"stop", "tool_calls"} for c in completion.choices)
         ):
             raise ValueError("Original result is not a supported successful completion")
-        self.store.reject_credentials([intent, checkpoint, record])
+        self.store.reject_credentials([intent, self.credential_payload(checkpoint), record])
         return intent, checkpoint, record, body
 
     async def consume_restored(
@@ -381,7 +397,8 @@ async def consume_restored(
         _outside_unit()
         with prepared_credential_rejection(self.store):
             bundle = await self.restore_bundle(run["id"], request_id, request)
-            await self.store.admit_credentials(bundle[:3])
+            credentials = (bundle[:3], self.credential_payload(bundle[1]))
+            await self.store.admit_credentials(credentials)
             await guard()
             if outside_guard is not None:
                 await outside_guard()
@@ -419,7 +436,7 @@ async def consume_restored(
                 if _size(record) > CONSUME_RESERVE:
                     raise ValueError("Restoration consume exceeds its reserved envelope")
                 await guard()
-                self.store.reject_credentials(bundle[:3])
+                self.store.reject_credentials(credentials)
             await guard()
-            self.store.reject_credentials(bundle[:3])
+            self.store.reject_credentials(credentials)
             return body
diff --git a/src/firefly_forge/agent_restores.py b/src/firefly_forge/agent_restores.py
index a53022b7..0a486cc3 100644
--- a/src/firefly_forge/agent_restores.py
+++ b/src/firefly_forge/agent_restores.py
@@ -6,10 +6,11 @@
 import asyncio
 import copy
 import hashlib
+import json
 import time
 import uuid
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, NoReturn, cast
 
 from pyfly.data.relational.sqlalchemy import LockMode
 from sqlalchemy import text
@@ -75,7 +76,9 @@ async def consume(self, checkpoint_digest: str, response_digest: str) -> None:
         if body != self.body:
             raise ValueError("Consumed result changed before exposure")
         await self.guard_source()
-        self.service.store.reject_credentials([self.record, self.body.decode("utf-8")])
+        self.service.store.reject_credentials(
+            [self.service.checkpoints.credential_payload(self.record), self.body.decode("utf-8")]
+        )
 
     async def receipt(self, engine: Any, key: str, evidence: dict[str, Any], checkpoint: dict[str, Any]) -> None:
         _outside_unit()
@@ -151,6 +154,103 @@ async def validate_db(
             or task.status not in ({"running"} if active else {"needs_reconciliation"})
         ):
             raise ValueError("Only the same unfinished implementation task attempt can restore")
+        await self._command_restore(run, context)
+
+    async def _command_restore(
+        self, run: dict[str, Any], context: InvocationBinding, *, ticket: dict[str, Any] | None = None
+    ) -> None:
+        if "execute_command" not in context.grants:
+            return
+        from firefly_forge.agent_checkpoint_models import ConsumePayloadV2
+        from firefly_forge.runner_factory_models import validate_factory_pool
+        from firefly_forge.sandbox import SandboxReconciliationRequired
+        from firefly_forge.sandbox_command_slots import COMMAND_CONTRACT, _canonical, _complete
+        from firefly_forge.sandbox_models import capture_sandbox, validate_sandbox_snapshot
+
+        def refuse() -> NoReturn:
+            raise ValueError("Prior runner custody or pending effects prevent command-enabled checkpoint restore")
+
+        async with self.store._unit():
+            entries = [
+                {**copy.deepcopy(row.data), "digest": row.digest}
+                for row in await self.journal.records.find_for_run(identifier(run["id"]))
+            ]
+            rows = await self.journal.sandboxes.for_run(identifier(run["id"]))
+            if len(entries) > 10000 or len(json.dumps(entries)) > 16 * 1024 * 1024 or len(rows) > 100:
+                refuse()
+            if not self.journal.verify_chain(entries):
+                refuse()
+            retained = {
+                entry["payload"].get("execution_id")
+                for entry in entries
+                if entry["kind"] in {"sandbox_intent", "sandbox_receipt", "sandbox_reconcile"}
+            }
+            if retained != {row.id.hex for row in rows} or len({row.id for row in rows}) != len(rows):
+                refuse()
+            if not rows:
+                return
+            checkpoints = [
+                entry
+                for entry in entries
+                if entry["kind"] == "agent_checkpoint"
+                and entry["payload"].get("invocation") == context.model_dump(mode="json")
+            ]
+            if len(checkpoints) != 1:
+                refuse()
+            checkpoint = checkpoints[0]
+            consumes = [
+                entry
+                for entry in entries
+                if entry["kind"] == "agent_consume" and entry["idempotency_key"] == checkpoint["idempotency_key"]
+            ]
+            consumed_at = None
+            if consumes:
+                if ticket is None or len(consumes) != 1:
+                    refuse()
+                consumed = ConsumePayloadV2.model_validate(consumes[0]["payload"])
+                if (
+                    consumed.restore_request_id != ticket["id"]
+                    or consumed.generation != ticket["generation"]
+                    or consumed.checkpoint_record_digest != checkpoint["digest"]
+                    or consumed.intent_digest != checkpoint["payload"].get("intent_digest")
+                    or consumes[0]["sequence"] <= checkpoint["sequence"]
+                ):
+                    refuse()
+                consumed_at = consumes[0]["sequence"]
+            snapshot = run.get("sandbox_snapshot") or capture_sandbox(None)
+            policy = (
+                validate_factory_pool(snapshot)
+                if snapshot.get("mode") == "pool"
+                else validate_sandbox_snapshot(snapshot)
+            )
+            if len(rows) > policy.command_limit:
+                refuse()
+            browser_calls = 0
+            for row in rows:
+                try:
+                    value = _canonical(row, entries, run["id"])
+                except (SandboxReconciliationRequired, KeyError, TypeError, ValueError):
+                    refuse()
+                if (
+                    value["request"].get("executor_contract") != COMMAND_CONTRACT
+                    or row.snapshot_digest != snapshot["digest"]
+                    or row.ordinal > policy.command_limit
+                    or not _complete(row, value)
+                ):
+                    refuse()
+                browser_calls += bool(value["request"]["request"].get("browser"))
+                effects = [
+                    entry["sequence"]
+                    for entry in entries
+                    if entry["kind"] in {"sandbox_intent", "sandbox_receipt", "sandbox_reconcile"}
+                    and entry["payload"].get("execution_id") == row.id.hex
+                ]
+                # Before exposure, every effect must already belong to the selected checkpoint cut.
+                if max(effects) >= checkpoint["sequence"] and (consumed_at is None or min(effects) <= consumed_at):
+                    refuse()
+            browser = getattr(policy, "browser", None)
+            if browser_calls and (browser is None or browser_calls > browser.max_calls):
+                refuse()
 
     async def request(self, run_id: str, completion_id: str, body: RestoreInput) -> dict[str, Any]:
         with prepared_credential_rejection(self.store):
@@ -183,7 +283,8 @@ async def _request(self, run_id: str, completion_id: str, body: RestoreInput) ->
             raise ValueError("Original checkpoint contract changed or deadline expired")
         if await workspace_cut(self.store, self.workspace(run_id)) != context.workspace:
             raise ValueError("Retained workspace drifted; no restore ticket admitted")
-        await self.store.admit_credentials([incoming, bundle[:3]])
+        credentials = [incoming, bundle[:3], self.checkpoints.credential_payload(bundle[1])]
+        await self.store.admit_credentials(credentials)
         if CURRENT_PRINCIPAL.get() != reader:
             raise AccessDenied("Restore caller changed during admission")
         async with self.store._unit() as session:
@@ -229,9 +330,9 @@ async def _request(self, run_id: str, completion_id: str, body: RestoreInput) ->
                 await self.requests.records.save(row)
                 await self.requests._event(row, "request_admitted", {"request_digest": data["request_digest"]})
             await self.access(current, actor)
-            self.store.reject_credentials([incoming, bundle[:3]])
+            self.store.reject_credentials(credentials)
         await self.access(await self.store.get_run(run_id), actor)
-        self.store.reject_credentials([incoming, bundle[:3]])
+        self.store.reject_credentials(credentials)
         return await self.get(run_id, completion_id, body.request_id)
 
     async def get(self, run_id: str, completion_id: str, request_id: str) -> dict[str, Any]:
@@ -328,6 +429,7 @@ async def guard(self, ticket: dict[str, Any]) -> None:
             task = await self.journal._effect_task(run["id"], intent["payload"]["task_key"])
             if task.status != "running" or task.attempt != intent["payload"]["task_attempt"]:
                 raise ValueError("Restore original task attempt changed")
+            await self._command_restore(run, context, ticket=ticket)
 
     async def execute(self, request_id: str) -> None:
         self.requests.runtime.require_execution()
diff --git a/src/firefly_forge/agentic_checkpoint_boundary.py b/src/firefly_forge/agentic_checkpoint_boundary.py
index c79b73f1..b6ae8300 100644
--- a/src/firefly_forge/agentic_checkpoint_boundary.py
+++ b/src/firefly_forge/agentic_checkpoint_boundary.py
@@ -3,10 +3,13 @@
 
 from __future__ import annotations
 
+import base64
+import binascii
 import dataclasses
 import hashlib
 import json
 import math
+import zlib
 from collections.abc import Awaitable, Callable, Iterator
 from contextlib import contextmanager
 from contextvars import ContextVar
@@ -16,7 +19,7 @@
 from typing import Any, Literal, cast
 
 from fireflyframework_agentic.model_utils import deserialize_model_messages, serialize_model_messages
-from pydantic import BaseModel, ConfigDict, TypeAdapter, field_validator
+from pydantic import BaseModel, ConfigDict, TypeAdapter, ValidationError, field_validator
 from pydantic_ai.capabilities import AbstractCapability
 from pydantic_ai.messages import (
     ModelMessage,
@@ -33,6 +36,8 @@
 from pydantic_ai.usage import RunUsage, UsageLimits
 
 MAX_PAYLOAD = 192 * 1024
+MAX_RAW_PAYLOAD = 8 * 1024 * 1024
+COMPRESSION_THRESHOLD = 64 * 1024
 MAX_COUNTER = 2**53 - 1
 USAGE = TypeAdapter(RunUsage)
 LIMITS = TypeAdapter(UsageLimits)
@@ -47,7 +52,10 @@ def _compatibility() -> dict[str, str]:
 
 
 def _native_round_trip(adapter: TypeAdapter[Any], value: dict[str, Any]) -> None:
-    restored = adapter.validate_json(_encoded(value))
+    try:
+        restored = adapter.validate_json(_encoded(value))
+    except ValidationError:
+        raise ValueError("Checkpoint usage or limits contain unsupported fields") from None
     if _encoded(adapter.dump_python(restored, mode="json")) != _encoded(value):
         raise ValueError("Checkpoint usage or limits contain unsupported fields")
 
@@ -169,6 +177,79 @@ def exact_version(cls, value: Any) -> Any:
         return value
 
 
+class _CompressedRecord(BaseModel):
+    model_config = ConfigDict(extra="forbid", strict=True)
+    version: Literal[2]
+    codec: Literal["zlib-base64"]
+    raw_bytes: int
+    raw_sha256: str
+    data: str
+
+    @field_validator("version", mode="before")
+    @classmethod
+    def exact_version(cls, value: Any) -> Any:
+        if type(value) is not int:
+            raise ValueError("Checkpoint envelope version must be an integer")
+        return value
+
+
+def _checkpoint_payload(raw: bytes) -> bytes:
+    if not 1 <= len(raw) <= MAX_RAW_PAYLOAD:
+        raise ValueError("Checkpoint raw record exceeds 8 MiB")
+    if len(raw) <= COMPRESSION_THRESHOLD:
+        return raw
+    return _encoded(
+        {
+            "version": 2,
+            "codec": "zlib-base64",
+            "raw_bytes": len(raw),
+            "raw_sha256": hashlib.sha256(raw).hexdigest(),
+            "data": base64.b64encode(zlib.compress(raw, level=9)).decode("ascii"),
+        }
+    )
+
+
+def _checkpoint_record(payload: bytes) -> bytes:
+    if not 1 <= len(payload) <= MAX_PAYLOAD:
+        raise ValueError("Checkpoint size differs")
+    try:
+        value = json.loads(payload)
+    except (ValueError, UnicodeDecodeError, RecursionError):
+        raise ValueError("Checkpoint JSON encoding differs") from None
+    if type(value) is not dict or value.get("version") != 2:
+        return payload
+    try:
+        envelope = _CompressedRecord.model_validate_json(payload)
+    except ValidationError:
+        raise ValueError("Checkpoint compression envelope schema differs") from None
+    if not 1 <= envelope.raw_bytes <= MAX_RAW_PAYLOAD:
+        raise ValueError("Checkpoint raw record exceeds 8 MiB")
+    try:
+        compressed = base64.b64decode(envelope.data, validate=True)
+        inflater = zlib.decompressobj()
+        raw = inflater.decompress(compressed, envelope.raw_bytes + 1)
+    except (binascii.Error, ValueError, zlib.error):
+        raise ValueError("Checkpoint compression encoding differs") from None
+    if (
+        len(raw) != envelope.raw_bytes
+        or not inflater.eof
+        or inflater.unused_data
+        or inflater.unconsumed_tail
+        or hashlib.sha256(raw).hexdigest() != envelope.raw_sha256
+        or base64.b64encode(compressed).decode("ascii") != envelope.data
+        or _encoded(envelope.model_dump(mode="json")) != payload
+    ):
+        raise ValueError("Checkpoint compression size, digest or canonical encoding differs")
+    return raw
+
+
+def _record(raw: bytes) -> _Record:
+    try:
+        return _Record.model_validate_json(raw)
+    except ValidationError:
+        raise ValueError("Checkpoint record schema differs") from None
+
+
 @dataclasses.dataclass(frozen=True)
 class BoundaryCheckpoint:
     payload: bytes
@@ -184,10 +265,14 @@ def decode(cls, payload: bytes, digest: str) -> BoundaryCheckpoint:
             raise ValueError("Checkpoint payload must be immutable bytes")
         if not 1 <= len(payload) <= MAX_PAYLOAD or hashlib.sha256(payload).hexdigest() != digest:
             raise ValueError("Checkpoint size or digest differs")
-        record = _Record.model_validate_json(payload)
-        if record.compatibility != _compatibility() or _encoded(record.model_dump(mode="json")) != payload:
+        raw = _checkpoint_record(payload)
+        record = _record(raw)
+        if record.compatibility != _compatibility() or _encoded(record.model_dump(mode="json")) != raw:
             raise ValueError("Checkpoint runtime or canonical encoding differs")
-        messages = deserialize_model_messages(record.history)
+        try:
+            messages = deserialize_model_messages(record.history)
+        except ValidationError:
+            raise ValueError("Checkpoint native history schema differs") from None
         _history(messages)
         if record.request_history != record.history:
             raise ValueError("Request-only history cannot restore the agent graph")
@@ -205,7 +290,12 @@ def decode(cls, payload: bytes, digest: str) -> BoundaryCheckpoint:
 
     @property
     def record(self) -> _Record:
-        return _Record.model_validate_json(self.payload)
+        return _record(_checkpoint_record(self.payload))
+
+    @property
+    def canonical_payload(self) -> bytes:
+        BoundaryCheckpoint.decode(self.payload, self.digest)
+        return _checkpoint_record(self.payload)
 
     @property
     def state(self) -> dict[str, Any]:
@@ -335,13 +425,19 @@ def capture(self, wire: bytes) -> BoundaryCheckpoint:
             wire_sha256=hashlib.sha256(wire).hexdigest(),
             wire_bytes=len(wire),
         )
-        if self.restore is not None and not invocation.restored:
+        retained = self.restore is not None and not invocation.restored
+        if retained:
+            assert self.restore is not None
             expected = self.restore.record.model_dump(mode="json")
             actual = record.model_dump(mode="json")
             changed = [field for field in expected if _encoded(actual[field]) != _encoded(expected[field])]
             if changed:
                 raise ValueError("Restored model state differs from the checkpoint: " + ", ".join(changed))
-        payload = _encoded(record.model_dump(mode="json"))
+        payload = (
+            self.restore.payload
+            if retained and self.restore is not None
+            else _checkpoint_payload(_encoded(record.model_dump(mode="json")))
+        )
         checkpoint = BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
         contract_bytes = _encoded(record.contract)
         if invocation.contract is not None and invocation.contract != contract_bytes:
diff --git a/src/firefly_forge/agentic_checkpoint_invocation.py b/src/firefly_forge/agentic_checkpoint_invocation.py
index 6ee084a2..f0b98924 100644
--- a/src/firefly_forge/agentic_checkpoint_invocation.py
+++ b/src/firefly_forge/agentic_checkpoint_invocation.py
@@ -18,13 +18,15 @@
 from firefly_forge.agent_checkpoints import AgentCheckpoints
 from firefly_forge.agentic_checkpoint_boundary import AgenticBoundary, BoundaryCheckpoint, OriginalCompletion
 from firefly_forge.bridge_completions import BridgeCompletions, _cut, _outside_unit
+from firefly_forge.checkpoint_source_identity import git_head_identity, source_identity
 from firefly_forge.git_workspace import git_environment, metadata_digest, trusted_git
 from firefly_forge.journal import digest
 from firefly_forge.process import checked
 from firefly_forge.prompts import prompt_catalog
-from firefly_forge.sandbox import pack_workspace
+from firefly_forge.source_snapshot import git_index_identity
 
 FILE_TOOLS = frozenset({"list_files", "read_file", "write_file", "search_text", "edit_lines", "git_diff"})
+STATIC_TOOLS = FILE_TOOLS | {"execute_command", "knowledge_lookup", "read_run_evidence"}
 _current: ContextVar[CheckpointInvocation | None] = ContextVar("agentic_checkpoint_invocation", default=None)
 
 
@@ -54,9 +56,26 @@ def runtime_contract() -> str:
                 name: hashlib.sha256((root / name).read_bytes()).hexdigest()
                 for name in (
                     "agentic_runtime.py",
+                    "agent_restores.py",
+                    "agent_checkpoints.py",
                     "agentic_checkpoint_boundary.py",
                     "agentic_checkpoint_invocation.py",
+                    "checkpoint_source_identity.py",
+                    "source_snapshot.py",
+                    "source_diff_admission.py",
+                    "git_workspace.py",
+                    "workspace_tools.py",
                     "providers.py",
+                    "sandbox.py",
+                    "sandbox_command_slots.py",
+                    "journal.py",
+                    "runner_pool_worker.py",
+                    "sandbox_models.py",
+                    "sandbox_persistence.py",
+                    "runner_backends.py",
+                    "runner_factory_models.py",
+                    "runner_pool_models.py",
+                    "engine.py",
                 )
             },
         }
@@ -93,9 +112,22 @@ async def workspace_cut(store: Any, workspace: Path) -> dict[str, str]:
         raise ValueError("The retained owned workspace is unavailable")
     metadata = metadata_digest(workspace)
     head = await checked(trusted_git(["git", "rev-parse", "HEAD"]), workspace, env=git_environment())
-    _, source = pack_workspace(workspace, 16_777_216, registry=store.credential_registry())
-    if metadata_digest(workspace) != metadata:
-        raise ValueError("Workspace Git metadata changed during inspection")
+    index = git_index_identity(workspace)
+    head_identity = git_head_identity(workspace)
+    scanner = await store.source_patch_scanner()
+
+    async def finalize() -> None:
+        current_head = await checked(trusted_git(["git", "rev-parse", "HEAD"]), workspace, env=git_environment())
+        await scanner.revalidate()
+        if (
+            current_head != head
+            or metadata_digest(workspace) != metadata
+            or git_index_identity(workspace) != index
+            or git_head_identity(workspace) != head_identity
+        ):
+            raise ValueError("Workspace Git metadata changed during inspection")
+
+    source = await source_identity(workspace, scanner, finalize=finalize)
     return {"path": str(workspace.resolve()), "head": head, "metadata": metadata, "source": source}
 
 
@@ -127,8 +159,18 @@ def attach(
         self, boundary: AgenticBoundary, brief: str, backend: str, frontend: str, context: Any, settings: Any
     ) -> Any:
         grants = context.allowed_tools
-        if grants is None or not grants or not set(grants) <= FILE_TOOLS or context.qa_references:
-            raise ValueError("Required checkpoints support only explicit static file-tool grants without QA state")
+        if grants is None or not grants or not set(grants) <= STATIC_TOOLS:
+            raise ValueError("Required checkpoints support only explicit static text-tool grants without QA state")
+        from firefly_forge.engine import Engine
+
+        try:
+            references_match = digest({"references": context.qa_references}) == digest(
+                {"references": Engine._qa_reference_descriptors(self.run)}
+            )
+        except (TypeError, ValueError):
+            references_match = False
+        if not references_match:
+            raise ValueError("Required checkpoints need the exact frozen textual QA reference descriptors")
         self.boundary = boundary
         if self.restored is not None:
             binding = self.restored.binding
diff --git a/src/firefly_forge/agentic_runtime.py b/src/firefly_forge/agentic_runtime.py
index dd54c924..f301145f 100644
--- a/src/firefly_forge/agentic_runtime.py
+++ b/src/firefly_forge/agentic_runtime.py
@@ -138,18 +138,7 @@ async def invoke(*args: Any, **kwargs: Any) -> Any:
         return invoke
 
     async def source_manifest() -> dict[str, str]:
-        manifest = {}
-        total = 0
-        for path in await tools.list_files():
-            try:
-                content = await tools.read_file(path)
-            except (ValueError, OSError, UnicodeDecodeError):
-                continue
-            total += len(content.encode("utf-8"))
-            if total > 16_000_000:
-                raise ValueError("Command source manifest exceeds 16 MB")
-            manifest[path] = hashlib.sha256(content.encode("utf-8")).hexdigest()
-        return manifest
+        return await tools.source_manifest()
 
     async def execute_command(argv: list[str], timeout: int = 300) -> dict[str, Any]:
 
@@ -163,7 +152,7 @@ async def execute_command(argv: list[str], timeout: int = 300) -> dict[str, Any]
         before = await source_manifest()
         result = await context.command_executor(argv, timeout)
         after = await source_manifest()
-        tools.files_written.update(path for path, digest in after.items() if before.get(path) != digest)
+        tools.files_written.update(path for path in before.keys() | after.keys() if before.get(path) != after.get(path))
         return {"exit_code": result.exit_code, "output": result.output}
 
     async def browser_check(
@@ -335,7 +324,7 @@ async def read_run_evidence(query: dict[str, Any]) -> dict[str, Any]:
         return await context.read_run_evidence(query)
 
     handlers: dict[str, Callable[..., Any]] = {
-        "list_files": tools.list_files,
+        "list_files": tools.list_files_page,
         "read_file": read_source,
         "write_file": write_source,
         "search_text": tools.search_text,
@@ -432,7 +421,7 @@ async def read_run_evidence(query: dict[str, Any]) -> dict[str, Any]:
     agent: FireflyAgent[None, RuntimeReport] = FireflyAgent(
         name="forge-builder",
         model=selected_model,
-        instructions=build_instruction(brief, backend, frontend)
+        instructions=build_instruction("", backend, frontend)
         + ("\n" + qa_instructions() if "browser_journey" in handlers else "")
         + (
             prompt_text(
@@ -452,7 +441,13 @@ async def read_run_evidence(query: dict[str, Any]) -> dict[str, Any]:
             else None
         ),
         tools=[
-            firefly_tool(name, description=prompt_text("tools/" + name), auto_register=False)(guarded(handler))
+            firefly_tool(
+                name,
+                description=prompt_text(
+                    "tools/" + name, version="1.0.1" if name in {"list_files", "search_text"} else "1.0.0"
+                ),
+                auto_register=False,
+            )(guarded(handler))
             for name, handler in handlers.items()
         ],
         capabilities=[ProcessHistory(image_history), *([boundary] if boundary is not None else [])],
diff --git a/src/firefly_forge/api.py b/src/firefly_forge/api.py
index 5a410803..32f07900 100644
--- a/src/firefly_forge/api.py
+++ b/src/firefly_forge/api.py
@@ -212,6 +212,7 @@
 from firefly_forge.scm_actor_authority import SCMActorAuthority
 from firefly_forge.scm_actor_authority_controllers import SCMActorAuthorityController
 from firefly_forge.scm_connections import SCMConnections
+from firefly_forge.scm_maintain_ticket_controllers import MaintainTicketController
 from firefly_forge.scm_natural_controllers import SCMNaturalController
 from firefly_forge.scm_poll_controllers import SCMPollController
 from firefly_forge.scm_poll_functional import SCMPollFunctionalAuthority
@@ -1254,6 +1255,7 @@ class Application:
         SCMPollResumeController,
         SCMPollFunctionalController,
         SCMNaturalController,
+        MaintainTicketController,
         SCMSourceEditController,
         SCMPollController,
         SCMProductChangeController,
diff --git a/src/firefly_forge/checkpoint_source_identity.py b/src/firefly_forge/checkpoint_source_identity.py
new file mode 100644
index 00000000..42b032ad
--- /dev/null
+++ b/src/firefly_forge/checkpoint_source_identity.py
@@ -0,0 +1,246 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Stream checkpoint source identity independently of runner transport archives."""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import os
+import stat
+import tempfile
+import time
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import BinaryIO
+
+from firefly_forge.sandbox import _directory_fd, _parent_fd, _regular_data
+from firefly_forge.source_diff_admission import SourceDiffAdmission
+from firefly_forge.source_snapshot import stream_git_bytes
+from firefly_forge.workspace_tools import _descriptor_path, _private_name
+
+
+def _stamp(value: os.stat_result) -> list[int]:
+    return [
+        getattr(value, "st_" + key) for key in ("dev", "ino", "uid", "mode", "nlink", "size", "mtime_ns", "ctime_ns")
+    ]
+
+
+def _parts(name: str) -> tuple[str, ...]:
+    parts = tuple(name.split("/"))
+    if not name or any(part in {"", ".", ".."} for part in parts) or "\x00" in name:
+        raise ValueError("Checkpoint source requires exact relative Git paths")
+    if any(_private_component(part) for part in parts):
+        raise ValueError("Checkpoint source cannot include selected private paths")
+    return parts
+
+
+def _private_component(name: str) -> bool:
+    return _private_name(name) or name.casefold() in {".aws", ".azure", ".docker", ".forge-sandbox-results"}
+
+
+def _remember(records: BinaryIO, path: str, info: os.stat_result) -> None:
+    records.write(json.dumps([path, _stamp(info)], separators=(",", ":")).encode() + b"\n")
+
+
+def _parents(root: int, parts: tuple[str, ...], records: BinaryIO) -> int:
+    current = os.dup(root)
+    try:
+        _remember(records, "", os.fstat(current))
+        for ordinal, name in enumerate(parts[:-1], 1):
+            child = _directory_fd(name, parent=current)
+            os.close(current)
+            current = child
+            if os.fstat(current).st_uid != os.geteuid():
+                raise ValueError("Checkpoint source directories require current ownership")
+            _remember(records, "/".join(parts[:ordinal]), os.fstat(current))
+        return current
+    except BaseException:
+        os.close(current)
+        raise
+
+
+def _revalidate(root: int, records: BinaryIO, deadline: float) -> None:
+    records.seek(0)
+    for record in records:
+        if time.monotonic() >= deadline:
+            raise TimeoutError("Checkpoint source inspection exceeded its finite time budget")
+        name, expected = json.loads(record)
+        parts = tuple(name.split("/")) if name else ()
+        parent = _parent_fd(root, parts) if parts else os.dup(root)
+        try:
+            actual = os.stat(parts[-1], dir_fd=parent, follow_symlinks=False) if parts else os.fstat(parent)
+            if _stamp(actual) != expected:
+                raise ValueError("Checkpoint source changed during final admission")
+        except OSError:
+            raise ValueError("Checkpoint source changed during final admission") from None
+        finally:
+            os.close(parent)
+
+
+async def _directory_witnesses(directory: int, prefix: tuple[str, ...], records: BinaryIO) -> None:
+    _remember(records, "/".join(prefix), os.fstat(directory))
+    with os.scandir(directory) as entries:
+        for entry in entries:
+            if _private_component(entry.name):
+                continue
+            if entry.is_dir(follow_symlinks=False):
+                child = _directory_fd(entry.name, parent=directory)
+                try:
+                    await _directory_witnesses(child, (*prefix, entry.name), records)
+                finally:
+                    os.close(child)
+            await asyncio.sleep(0)
+
+
+def git_head_identity(workspace: Path) -> str:
+    directory = _directory_fd(workspace / ".git")
+    try:
+        head, _ = _regular_data(directory, "HEAD", 1024)
+        result = hashlib.sha256(head)
+        if head.startswith(b"ref: "):
+            name = head[5:].rstrip(b"\n").decode("ascii")
+            parts = tuple(name.split("/"))
+            if not name.startswith("refs/") or any(part in {"", ".", ".."} for part in parts):
+                raise ValueError("Checkpoint source HEAD reference is invalid")
+            parent = None
+            try:
+                parent = _parent_fd(directory, parts)
+                os.stat(parts[-1], dir_fd=parent, follow_symlinks=False)
+            except FileNotFoundError:
+                result.update(b"packed-ref")
+            else:
+                data, _ = _regular_data(parent, parts[-1], 1024)
+                result.update(data)
+            finally:
+                if parent is not None:
+                    os.close(parent)
+        return result.hexdigest()
+    finally:
+        os.close(directory)
+
+
+@dataclass(frozen=True)
+class SourceEntry:
+    path: str
+    mode: str | None
+    object_id: str | None
+
+
+async def stream_source_entries(
+    workspace: Path, consume: Callable[[SourceEntry], Awaitable[None]], *, timeout_seconds: int = 300
+) -> None:
+    """Enumerate tracked source, including ignored paths, then nonignored new files."""
+    for tracked in (True, False):
+        tail = b""
+
+        async def receive(chunk: bytes, *, tracked: bool = tracked) -> None:
+            nonlocal tail
+            values = (tail + chunk).split(b"\0")
+            tail = values.pop()
+            if len(tail) > 65536:
+                raise ValueError("Checkpoint source path exceeds the Git name window")
+            for value in values:
+                mode = object_id = None
+                if tracked:
+                    prefix, tab, value = value.partition(b"\t")
+                    fields = prefix.split(b" ")
+                    if not tab or len(fields) != 3 or fields[0] not in {b"100644", b"100755"} or fields[2] != b"0":
+                        raise ValueError("Checkpoint source index requires regular files without links or conflicts")
+                    mode, object_id = fields[0].decode(), fields[1].decode("ascii")
+                try:
+                    name = value.decode("utf-8", errors="strict")
+                except UnicodeDecodeError:
+                    raise ValueError("Checkpoint source requires exact UTF-8 Git paths") from None
+                _parts(name)
+                await consume(SourceEntry(name, mode, object_id))
+
+        args = ["git", "ls-files", "--stage"] if tracked else ["git", "ls-files", "--others", "--exclude-standard"]
+        await stream_git_bytes(workspace, [*args, "-z", "--"], receive, timeout_seconds=timeout_seconds)
+        if tail:
+            raise ValueError("Checkpoint source inventory ended without an exact path boundary")
+
+
+async def source_identity(
+    workspace: Path,
+    scanner: SourceDiffAdmission,
+    *,
+    finalize: Callable[[], Awaitable[None]],
+    timeout_seconds: int = 300,
+) -> str:
+    """Hash complete selected source using bounded chunks and temporary metadata only."""
+    root = _directory_fd(workspace)
+    deadline = time.monotonic() + timeout_seconds
+    try:
+        if os.fstat(root).st_uid != os.geteuid():
+            raise ValueError("Checkpoint source requires current workspace ownership")
+        canonical = _descriptor_path(root)
+        with tempfile.TemporaryFile(mode="w+b") as records:
+            async with asyncio.timeout(timeout_seconds):
+                first = await _capture(canonical, root, scanner, records, timeout_seconds)
+                records.seek(0)
+                records.truncate()
+                await _directory_witnesses(root, (), records)
+                second = await _capture(canonical, root, scanner, records, timeout_seconds)
+                if first != second:
+                    raise ValueError("Checkpoint source selection or contents changed during capture")
+                await scanner(b"", True)
+                await finalize()
+                _revalidate(root, records, deadline)
+                if _stamp(os.stat(workspace, follow_symlinks=False)) != _stamp(os.fstat(root)):
+                    raise ValueError("Checkpoint source root changed during capture")
+                return "git-source-v1:" + second
+    finally:
+        os.close(root)
+
+
+async def _capture(
+    workspace: Path, root: int, scanner: SourceDiffAdmission, records: BinaryIO, timeout_seconds: int
+) -> str:
+    result = hashlib.sha256(b"forge-checkpoint-git-source-v1\0")
+    _remember(records, "", os.fstat(root))
+
+    async def consume(entry: SourceEntry) -> None:
+        parts = _parts(entry.path)
+        raw = json.dumps([entry.path, entry.mode, entry.object_id], ensure_ascii=False, separators=(",", ":")).encode()
+        await scanner(entry.path.encode(), False)
+        scanner.finish_document()
+        result.update(len(raw).to_bytes(8, "big") + raw)
+        parent = descriptor = None
+        try:
+            parent = _parents(root, parts, records)
+            descriptor = os.open(parts[-1], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
+            before = os.fstat(descriptor)
+            if not stat.S_ISREG(before.st_mode) or before.st_nlink != 1 or before.st_uid != os.geteuid():
+                raise ValueError("Checkpoint source requires owned unaliased regular files without links")
+            if _descriptor_path(descriptor).relative_to(workspace) != Path(entry.path):
+                raise ValueError("Checkpoint source path differs from its opened descriptor")
+            content, size = hashlib.sha256(), 0
+            while chunk := os.read(descriptor, 65536):
+                size += len(chunk)
+                content.update(chunk)
+                await scanner(chunk, False)
+            scanner.finish_document()
+            after = os.fstat(descriptor)
+            named = os.stat(parts[-1], dir_fd=parent, follow_symlinks=False)
+            if _stamp(before) != _stamp(after) or _stamp(before) != _stamp(named) or size != before.st_size:
+                raise ValueError("Checkpoint source changed while reading a regular file")
+            if _descriptor_path(descriptor).relative_to(workspace) != Path(entry.path):
+                raise ValueError("Checkpoint source path changed during its read")
+            _remember(records, entry.path, after)
+            result.update(b"file\0" + str(stat.S_IMODE(after.st_mode)).encode() + b"\0")
+            result.update(size.to_bytes(8, "big") + content.digest())
+        except FileNotFoundError:
+            if entry.mode is None:
+                raise ValueError("Checkpoint source changed during inventory") from None
+            result.update(b"deleted\0")
+        except OSError:
+            raise ValueError("Checkpoint source requires regular files and directories without links") from None
+        finally:
+            for fd in (descriptor, parent):
+                if fd is not None:
+                    os.close(fd)
+
+    await stream_source_entries(workspace, consume, timeout_seconds=timeout_seconds)
+    return result.hexdigest()
diff --git a/src/firefly_forge/coding_check_transport.py b/src/firefly_forge/coding_check_transport.py
index 59dc13bf..033e3a50 100644
--- a/src/firefly_forge/coding_check_transport.py
+++ b/src/firefly_forge/coding_check_transport.py
@@ -205,9 +205,21 @@ async def invoke(request: ConfiguredCheckRequest | SourceReadRequest) -> dict[st
 
         if self.source_callback is not None:
 
-            @server.tool(description=prompt_text("coding-runtime/source-list", version="1.0.1"))
-            async def list_files(request_id: Annotated[str, Field(pattern=r"^[a-f0-9]{32}$")]) -> dict[str, Any]:
-                return await invoke(SourceReadRequest(tool="list_files", request_id=request_id))
+            @server.tool(description=prompt_text("coding-runtime/source-list", version="1.0.2"))
+            async def list_files(
+                request_id: Annotated[str, Field(pattern=r"^[a-f0-9]{32}$")],
+                path: Annotated[str, Field(max_length=1000)] = "",
+                cursor: Annotated[str | None, Field(max_length=2048)] = None,
+                page_size: Annotated[int, Field(ge=1, le=1000)] = 100,
+            ) -> dict[str, Any]:
+                options: dict[str, Any] = {}
+                if path:
+                    options["path"] = path
+                if cursor is not None:
+                    options["cursor"] = cursor
+                if page_size != 100:
+                    options["page_size"] = page_size
+                return await invoke(SourceReadRequest(tool="list_files", request_id=request_id, **options))
 
             @server.tool(description=prompt_text("coding-runtime/source-read", version="1.0.1"))
             async def read_file(
@@ -216,16 +228,23 @@ async def read_file(
             ) -> dict[str, Any]:
                 return await invoke(SourceReadRequest(tool="read_file", path=path, request_id=request_id))
 
-            @server.tool(description=prompt_text("coding-runtime/source-search", version="1.0.1"))
+            @server.tool(description=prompt_text("coding-runtime/source-search", version="1.0.2"))
             async def search_text(
                 text: Annotated[str, Field(min_length=1, max_length=500)],
                 request_id: Annotated[str, Field(pattern=r"^[a-f0-9]{32}$")],
                 path: Annotated[str, Field(max_length=1000)] = "",
                 max_results: Annotated[int, Field(ge=1, le=100)] = 50,
+                cursor: Annotated[str | None, Field(max_length=2048)] = None,
             ) -> dict[str, Any]:
+                options: dict[str, Any] = {"cursor": cursor} if cursor is not None else {}
                 return await invoke(
                     SourceReadRequest(
-                        tool="search_text", text=text, path=path, max_results=max_results, request_id=request_id
+                        tool="search_text",
+                        text=text,
+                        path=path,
+                        max_results=max_results,
+                        request_id=request_id,
+                        **options,
                     )
                 )
         else:
diff --git a/src/firefly_forge/collaboration.py b/src/firefly_forge/collaboration.py
index ccd72193..4685472e 100644
--- a/src/firefly_forge/collaboration.py
+++ b/src/firefly_forge/collaboration.py
@@ -396,6 +396,7 @@ async def settings(self, repository_id: str) -> Data:
             data.pop("_scm_source_edit_used_v1", None)
             data.pop("_scm_product_change_authority_v1", None)
             data.pop("_scm_product_intake_v1", None)
+            data.pop("_maintain_ticket_v1", None)
             return {
                 **data,
                 "repository_id": repository_id,
@@ -451,6 +452,7 @@ async def configure(self, repository_id: str, request: CollaborationSettings) ->
                 "_scm_product_change_authority_v1",
                 "_scm_product_intake_v1",
                 "_github_poll_v1",
+                "_maintain_ticket_v1",
             ):
                 if row is not None and key in row.data:
                     data[key] = copy.deepcopy(row.data[key])
@@ -1647,6 +1649,7 @@ async def _remote_write(
         issue: Data | None = None,
         *,
         before_write: Callable[[], Awaitable[None]] | None = None,
+        before_dispatch: Callable[[], Awaitable[None]] | None = None,
     ) -> Data:
         provider = str(repo["connection_provider"])
         ownership_required = self.store.execution_ownership_acquired or (
@@ -1673,11 +1676,13 @@ async def _remote_write(
         ):
             await self.store.assert_ownership()
         self.store.reject_credentials(payload)
+        dispatch = {"before_dispatch": before_dispatch} if before_dispatch is not None else {}
         response = await self.scm._request(
             "POST",
             api + self._issue_path(provider, repo, issue),
             headers={"Authorization": "Bearer " + token, "Accept": "application/json"},
             json=payload,
+            **dispatch,
         )
         result: Data = response.json()
         return {
@@ -1700,9 +1705,16 @@ async def _feedback_head(self, data: Data, *, proactive: bool) -> bool:
             for peer in peers
         ):
             return False
+        if data.get("maintain_ticket") is not None:
+            peers = [peer for peer in peers if peer.get("maintain_ticket") is not None]
         return not proactive or not peers or peers[0]["id"] == data["id"]
 
     async def _feedback_authority(self, data: Data, *, local: bool = False) -> None:
+        if data.get("maintain_ticket") is not None:
+            from firefly_forge.scm_maintain_tickets import MaintainTickets
+
+            await MaintainTickets(self).authorize_feedback(data, remote=not local)
+            return
         from firefly_forge.project_access import CURRENT_PRINCIPAL, AccessDenied, ProjectAccess
         from firefly_forge.scm_actor_authority import SCMActorAuthority
 
@@ -1781,6 +1793,11 @@ async def _feedback_authority(self, data: Data, *, local: bool = False) -> None:
             raise AccessDenied("Current repository collaboration permission is required for feedback")
 
     async def _feedback_context(self, data: Data, run: Data) -> Data:
+        if data.get("maintain_ticket") is not None:
+            from firefly_forge.scm_maintain_tickets import MaintainTickets
+
+            await MaintainTickets(self).authorize_feedback(data)
+            return {"_feedback_origin": self.browser_origin, "_feedback_actions": []}
         from firefly_forge.project_access import ProjectAccess
         from firefly_forge.scm_actor_authority import SCMActorAuthority
 
@@ -1821,6 +1838,9 @@ async def _feedback_context(self, data: Data, run: Data) -> Data:
         return {"_feedback_origin": self.browser_origin, "_feedback_actions": actions}
 
     async def feedback(self, receipt_id: str) -> None:
+        from firefly_forge.scm_connections import ProviderDispatchRefused
+        from firefly_forge.scm_maintain_tickets import MaintainNotificationNotDispatched, MaintainTickets
+
         initial = await self.receipt(receipt_id)
         if initial.get("native_question") is not None:
             from firefly_forge.native_question_publications import NativeQuestionPublications
@@ -1918,7 +1938,7 @@ def native_card(current_run: Data) -> str:
                 if data.get("natural_turn") is not None:
                     from firefly_forge.scm_natural_feedback import natural_card
 
-                    return natural_card(data, public_text)
+                    return natural_card(data, public_text, repository=repo, host=host)
                 message = feedback_card(data, current_run, repo, host, public_text)
                 if not conversation or (current_run and data["command"]["language"] != "es"):
                     return message
@@ -2135,12 +2155,52 @@ async def retained_before_write() -> None:
                     raise DeferredFeedbackChanged("The deferred feedback authority or route changed") from None
 
             write_started = True
+            dispatch_check: Callable[[], Awaitable[None]] | None = None
+            if data.get("maintain_ticket") is not None:
+
+                async def maintain_dispatch_check() -> None:
+                    from pyfly.data.transaction import current_unit_of_work
+
+                    from firefly_forge.project_access import AccessDenied
+
+                    if current_unit_of_work() is not None:
+                        raise ValueError("Admit maintain notifications outside a writer transaction")
+                    await self.store.assert_ownership()
+                    tickets = MaintainTickets(self)
+                    try:
+                        context = await tickets.authorize_feedback(data)
+                        if (
+                            milestone_key(context["run"]) != intent["key"]
+                            or content_digest(communication_facts(context["run"]))
+                            != intent["communication"]["facts_sha256"]
+                        ):
+                            raise MaintainNotificationNotDispatched("The exact maintain notification facts changed")
+                        self.store.reject_credentials(public_values)
+                        self.communication_writer.assert_current(intent["communication"])
+                        tickets.confirm_local_cut(context)
+                    except (AccessDenied, KeyError, ValueError) as error:
+                        raise MaintainNotificationNotDispatched(
+                            "Current native maintain publication was refused before HTTP"
+                        ) from error
+
+                dispatch_check = maintain_dispatch_check
+
             remote = await self._remote_write(
                 repo,
                 payload,
                 data["issue"],
                 before_write=retained_before_write if retained is not None else before_write,
+                before_dispatch=dispatch_check,
             )
+            if data.get("maintain_ticket") is not None:
+                from firefly_forge.scm_maintain_ticket_models import confirmed_remote
+
+                confirmed_remote(remote, self._ticket_url(repo, data["issue"]))
+        except (MaintainNotificationNotDispatched, ProviderDispatchRefused):
+            async with self.store._unit():
+                row = await self.inbox.find_by_id(identifier(receipt_id), lock=LockMode.PESSIMISTIC_WRITE)
+                assert row is not None
+                await self._write_row(row, feedback_status="held", reason="native_maintain_authority_changed")
         except DeferredFeedbackChanged:
             async with self.store._unit():
                 row = await self.inbox.find_by_id(identifier(receipt_id), lock=LockMode.PESSIMISTIC_WRITE)
diff --git a/src/firefly_forge/collaboration_feedback.py b/src/firefly_forge/collaboration_feedback.py
index 06229dde..3b22362b 100644
--- a/src/firefly_forge/collaboration_feedback.py
+++ b/src/firefly_forge/collaboration_feedback.py
@@ -34,7 +34,14 @@ def _text(value: object, safe: Callable[[str], str], limit: int = 1200, *, prese
     if preserve_word_slashes:
         path_pattern = r"(?<!\w)" + path_pattern
     value = re.sub(path_pattern, _copy()["redactions"]["path"], value)
-    value = re.sub(r"\b[A-Z][A-Z0-9_]*=\S+", _copy()["redactions"]["setting"], value)
+    return _escaped_text(_redact_settings(value), limit)
+
+
+def _redact_settings(value: str) -> str:
+    return re.sub(r"\b[A-Z][A-Z0-9_]*=\S+", _copy()["redactions"]["setting"], value)
+
+
+def _escaped_text(value: str, limit: int) -> str:
     result = []
     length = 0
     for character in " ".join(value.split()):
diff --git a/src/firefly_forge/engine.py b/src/firefly_forge/engine.py
index 0c3ce6fd..53f6379d 100644
--- a/src/firefly_forge/engine.py
+++ b/src/firefly_forge/engine.py
@@ -858,9 +858,8 @@ async def read_run_evidence(query: dict[str, Any]) -> dict[str, Any]:
 
                     source_brief += customer_instruction(run["product_definition"])
                 if run.get("branding_snapshot"):
-                    branding = run["branding_snapshot"]
                     source_brief += prompt_text(
-                        "implementation/brand", files=json.dumps(branding["files"], ensure_ascii=False)
+                        "implementation/brand", files=json.dumps(self._branding_manifest(run["branding_snapshot"]))
                     )
                 if run.get("design_snapshot"):
                     if run["design_snapshot"]["method"] == "process_map" or run["frontend"] == "none":
@@ -973,6 +972,7 @@ async def read_run_evidence(query: dict[str, Any]) -> dict[str, Any]:
                     await self.store.update(identifier, implementation_pending=True)
                     if restoration is None:
                         await self._materialize_design(identifier, workspace)
+                        await self._materialize_branding(identifier, workspace, settings)
                     if contains_known_credential(brief, {**settings, **self.credential_registry()}):
                         raise ValueError(
                             "The composed worker context contains a configured credential; execution blocked"
@@ -1791,6 +1791,97 @@ async def _resolve_qa_reference(
         )
         return approved, evidence
 
+    @staticmethod
+    def _branding_manifest(branding: dict[str, Any]) -> dict[str, Any]:
+        files = branding.get("files")
+        if (
+            not isinstance(files, dict)
+            or not files
+            or any(
+                type(name) is not str
+                or not name
+                or name.startswith(".")
+                or any(character in name for character in ("/", "\\", "\x00"))
+                or type(content) is not str
+                for name, content in files.items()
+            )
+        ):
+            raise ValueError("Frozen product branding needs complete named text files")
+        expected = hashlib.sha256(json.dumps(files, sort_keys=True).encode()).hexdigest()
+        if branding.get("digest") != expected:
+            raise ValueError("Frozen product branding failed its content digest")
+        return {
+            "revision": branding["revision"],
+            "digest": expected,
+            "scope": "component",
+            "files": [
+                {
+                    "path": "docs/brand/" + expected + "/" + name,
+                    "bytes": len(files[name].encode("utf-8")),
+                    "sha256": hashlib.sha256(files[name].encode("utf-8")).hexdigest(),
+                }
+                for name in sorted(files)
+            ],
+        }
+
+    async def _materialize_branding(self, identifier: str, workspace: Path, settings: dict[str, str]) -> None:
+        run = await self.store.get_run(identifier)
+        branding = run.get("branding_snapshot")
+        if not branding:
+            return
+        from firefly_forge.agentic_runtime import WorkspaceTools
+        from firefly_forge.project_access import ProjectAccess
+
+        manifest = self._branding_manifest(branding)
+        await self.store.admit_credentials(branding)
+        if contains_known_credential(branding, {**settings, **self.credential_registry()}):
+            raise ValueError("Frozen product branding contains a configured credential")
+
+        async def guard() -> dict[str, Any]:
+            await self.assert_ownership()
+            current = await self.store.get_run(identifier)
+            if current.get("cancel_request", {}).get("status") == "requested":
+                raise asyncio.CancelledError()
+            if current.get("branding_snapshot") != branding:
+                raise ValueError("Frozen product branding changed before materialization")
+            await ProjectAccess(self.store).authorize_execution(current)
+            self.store.reject_credentials(branding)
+            return current
+
+        await guard()
+        tools = WorkspaceTools(self.component_directory(run, workspace, create=True))
+        missing = []
+        for item in manifest["files"]:
+            content = branding["files"][item["path"].rsplit("/", 1)[1]]
+            try:
+                existing = await tools.read_file(item["path"])
+            except FileNotFoundError:
+                existing = None
+            except ValueError as error:
+                if not isinstance(error.__cause__, FileNotFoundError):
+                    raise
+                existing = None
+            if existing is not None and existing != content:
+                raise ValueError("Materialized product branding conflicts with existing source")
+            if existing is None:
+                missing.append((item["path"], content))
+        for path, content in missing:
+            await guard()
+            # A late nonempty file must not be overwritten after the absence check.
+            await tools.write_file(path, content, expected_sha256=hashlib.sha256(b"").hexdigest())
+            if await tools.read_file(path) != content:
+                raise ValueError("Materialized product branding differs from its manifest")
+        prefix = run.get("component_snapshot", {}).get("path", ".") if run.get("component_snapshot") else "."
+        paths = [item["path"] if prefix == "." else prefix + "/" + item["path"] for item in manifest["files"]]
+        current = await guard()
+        if (
+            current.get("branding_materialized_digest") != manifest["digest"]
+            or current.get("branding_materialized_paths") != paths
+        ):
+            await self.store.update(
+                identifier, branding_materialized_digest=manifest["digest"], branding_materialized_paths=paths
+            )
+
     async def _materialize_design(self, identifier: str, workspace: Path) -> None:
         run = await self.store.get_run(identifier)
         bundle = run.get("design_snapshot")
diff --git a/src/firefly_forge/journal.py b/src/firefly_forge/journal.py
index c45621eb..9099ea7f 100644
--- a/src/firefly_forge/journal.py
+++ b/src/firefly_forge/journal.py
@@ -27,7 +27,7 @@
 from firefly_forge.profiles import build_instruction
 from firefly_forge.prompts import prompt_text
 from firefly_forge.sandbox_persistence import ForgeSandboxRepository
-from firefly_forge.store import TERMINAL, Store, identifier, now
+from firefly_forge.store import TERMINAL, Store, identifier, now, prepared_credential_rejection
 
 if TYPE_CHECKING:
     from firefly_forge.scm_source_edit_models import SealedSourceEditAdmission
@@ -364,14 +364,31 @@ async def entries(self, run_id: str) -> list[Data]:
         if not protected:
             return entries
 
-        async def admitted() -> None:
-            await self.store.admit_credentials(protected)
+        checkpoint_payloads = [entry["payload"] for entry in entries if entry["kind"] == "agent_checkpoint"]
+        if len(checkpoint_payloads) > 100:
+            raise ValueError("Journal checkpoint history exceeds its retained bound")
+
+        async def checked(value: Any) -> None:
             async with self.store._unit():
                 current = await self.store.get_run(run_id)
                 if self._worker_scope(current) != scope:
                     raise AccessDenied("Journal run scope changed during credential admission")
                 await self._diagnostic_reader(current, reader)
-                self.store.reject_credentials(protected)
+                self.store.reject_credentials(value)
+
+        async def admitted() -> None:
+            from firefly_forge.agentic_checkpoint_boundary import BoundaryCheckpoint
+
+            with prepared_credential_rejection(self.store):
+                await self.store.admit_credentials(protected)
+                await checked(protected)
+                for payload in checkpoint_payloads:
+                    checkpoint = BoundaryCheckpoint.decode(
+                        payload["snapshot"].encode("utf-8"), payload["checkpoint_digest"]
+                    )
+                    canonical = checkpoint.canonical_payload.decode("utf-8")
+                    await self.store.admit_credentials(canonical)
+                    await checked(canonical)
 
         if caller is None:
             await admitted()
@@ -2284,6 +2301,36 @@ async def ready_retries(self) -> list[str]:
         async with self.store._unit():
             return [row.id.hex for row in await self.store.run_records.find_ready_retries(time.time())]
 
+    async def sandbox_command_intent(
+        self,
+        run_id: str,
+        task_id: str,
+        attempt: int,
+        snapshot: Data,
+        payload: Callable[[int, str, Data | None], Data],
+        *,
+        ordinal: int | None = None,
+    ) -> Data:
+        from firefly_forge.sandbox_command_slots import command_intent
+
+        return await command_intent(self, run_id, task_id, attempt, snapshot, payload, ordinal=ordinal)
+
+    async def sandbox_command_replay(
+        self,
+        run_id: str,
+        task_id: str,
+        attempt: int,
+        snapshot: Data,
+        payload: Callable[[int, str, Data | None], Data],
+        *,
+        ordinal: int,
+    ) -> Data:
+        from firefly_forge.sandbox_command_slots import command_intent
+
+        return await command_intent(
+            self, run_id, task_id, attempt, snapshot, payload, ordinal=ordinal, replay_only=True
+        )
+
     async def sandbox_effect_intent(
         self, run_id: str, task_id: str, execution_id: str, *, effect: str, payload: Data
     ) -> Data:
diff --git a/src/firefly_forge/resources/prompts/v1/coding-runtime/source-list-1.0.2.yaml b/src/firefly_forge/resources/prompts/v1/coding-runtime/source-list-1.0.2.yaml
new file mode 100644
index 00000000..4dce432a
--- /dev/null
+++ b/src/firefly_forge/resources/prompts/v1/coding-runtime/source-list-1.0.2.yaml
@@ -0,0 +1,12 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+{
+  "name": "coding-runtime/source-list",
+  "version": "1.0.2",
+  "description": "Versioned complete source traversal with bounded reader pages.",
+  "system_template": "",
+  "user_template": "List one version 1 page of confined component source paths. Optional path is a component-relative prefix of 0 to 1000 characters; page_size is an integer from 1 to 1000, default 100. Supply next_cursor unchanged on the next page using the same prefix and page size until complete=true. A page is not the entire project. A changed source view or cursor scope is refused; start a fresh listing. Response windows are bounded independently of project size. No credentials, Git metadata, commands or new authority. Supply a unique request_id of exactly 32 lowercase hexadecimal characters (0-9 and a-f); repeated IDs read exact source-bound receipts. Only declared fields are accepted.",
+  "required_variables": [],
+  "metadata": {
+    "defaults": {}
+  }
+}
diff --git a/src/firefly_forge/resources/prompts/v1/coding-runtime/source-search-1.0.2.yaml b/src/firefly_forge/resources/prompts/v1/coding-runtime/source-search-1.0.2.yaml
new file mode 100644
index 00000000..c0165fdf
--- /dev/null
+++ b/src/firefly_forge/resources/prompts/v1/coding-runtime/source-search-1.0.2.yaml
@@ -0,0 +1,12 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+{
+  "name": "coding-runtime/source-search",
+  "version": "1.0.2",
+  "description": "Versioned complete source traversal with bounded reader pages.",
+  "system_template": "",
+  "user_template": "Search all selected source within a component-relative path prefix, returning one finite version 1 result page. text has 1 to 500 characters on one line, path has 0 to 1000 characters, max_results is an integer from 1 to 100, default 50. Supply next_cursor unchanged with the same query, prefix and max_results to continue until complete=true. Each snippet has an explicit snippet_truncated flag; full-file SHA256 binds its source. Binary and invalid-UTF8 files are classified explicitly; unreadable or changed source is refused. No commands or new authority. Supply a unique request_id of exactly 32 lowercase hexadecimal characters (0-9 and a-f); repeated IDs only read exact source-bound receipts. Only declared fields are accepted.",
+  "required_variables": [],
+  "metadata": {
+    "defaults": {}
+  }
+}
diff --git a/src/firefly_forge/resources/prompts/v1/manifest.json b/src/firefly_forge/resources/prompts/v1/manifest.json
index fc52278f..0f4779a8 100644
--- a/src/firefly_forge/resources/prompts/v1/manifest.json
+++ b/src/firefly_forge/resources/prompts/v1/manifest.json
@@ -77,6 +77,14 @@
       "field": "user",
       "variables": {}
     },
+    {
+      "id": "coding-runtime/source-list",
+      "version": "1.0.2",
+      "path": "coding-runtime/source-list-1.0.2.yaml",
+      "sha256": "85376d131679dd2220b1556fac1caba1d45fead764c6f87319b185f33a99e107",
+      "field": "user",
+      "variables": {}
+    },
     {
       "id": "coding-runtime/source-read",
       "version": "1.0.0",
@@ -109,6 +117,14 @@
       "field": "user",
       "variables": {}
     },
+    {
+      "id": "coding-runtime/source-search",
+      "version": "1.0.2",
+      "path": "coding-runtime/source-search-1.0.2.yaml",
+      "sha256": "83bbd8df12bfd4414803601e0c97005c97216d97a8f9468f7518b738a2dc9544",
+      "field": "user",
+      "variables": {}
+    },
     {
       "id": "collaboration/action",
       "version": "1.0.0",
@@ -2616,6 +2632,14 @@
       "field": "user",
       "variables": {}
     },
+    {
+      "id": "tools/list_files",
+      "version": "1.0.1",
+      "path": "tools/list_files-1.0.1.yaml",
+      "sha256": "d795c6b4b4126571dade971a40708ba5099a0c570a0e4bacb393b8f5aa2be843",
+      "field": "user",
+      "variables": {}
+    },
     {
       "id": "tools/profile_php",
       "version": "1.0.0",
@@ -2664,6 +2688,14 @@
       "field": "user",
       "variables": {}
     },
+    {
+      "id": "tools/search_text",
+      "version": "1.0.1",
+      "path": "tools/search_text-1.0.1.yaml",
+      "sha256": "e4b5b619960bd8737791b9775620d6856e830678857bbdcd258d1c6b670089c0",
+      "field": "user",
+      "variables": {}
+    },
     {
       "id": "tools/trace_python",
       "version": "1.0.0",
diff --git a/src/firefly_forge/resources/prompts/v1/tools/list_files-1.0.1.yaml b/src/firefly_forge/resources/prompts/v1/tools/list_files-1.0.1.yaml
new file mode 100644
index 00000000..c33d7566
--- /dev/null
+++ b/src/firefly_forge/resources/prompts/v1/tools/list_files-1.0.1.yaml
@@ -0,0 +1,12 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+{
+  "name": "tools/list_files",
+  "version": "1.0.1",
+  "description": "Versioned complete source traversal with bounded reader pages.",
+  "system_template": "",
+  "user_template": "List a bounded version 1 page of project source paths. Use path_prefix to select a component-relative subtree and page_size from 1 to 1000 (default 100). The response includes files, view_sha256, next_cursor and complete. Continue next_cursor with the same options until complete=true; never call a partial page the whole project. A changed source view or cursor scope is refused. Source is selected by the native Git inventory, including tracked ignored files; credentials, unsafe links and aliases remain unavailable. No new tool or execution authority.",
+  "required_variables": [],
+  "metadata": {
+    "defaults": {}
+  }
+}
diff --git a/src/firefly_forge/resources/prompts/v1/tools/search_text-1.0.1.yaml b/src/firefly_forge/resources/prompts/v1/tools/search_text-1.0.1.yaml
new file mode 100644
index 00000000..86890f0f
--- /dev/null
+++ b/src/firefly_forge/resources/prompts/v1/tools/search_text-1.0.1.yaml
@@ -0,0 +1,12 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+{
+  "name": "tools/search_text",
+  "version": "1.0.1",
+  "description": "Versioned complete source traversal with bounded reader pages.",
+  "system_template": "",
+  "user_template": "Search the complete selected source within path_prefix, including large valid UTF-8 files. max_results bounds one page from 1 to 100 (default 50), not total project matches. Continue next_cursor using the same query/options until complete=true. Snippets disclose snippet_truncated and full-file SHA256; binary and invalid-UTF8 classifications are explicit. Unreadable, changed or unsafe source refuses. No commands or new authority.",
+  "required_variables": [],
+  "metadata": {
+    "defaults": {}
+  }
+}
diff --git a/src/firefly_forge/runner_pool_worker.py b/src/firefly_forge/runner_pool_worker.py
index 17421947..3fea53fc 100644
--- a/src/firefly_forge/runner_pool_worker.py
+++ b/src/firefly_forge/runner_pool_worker.py
@@ -9,7 +9,7 @@
 from contextlib import suppress
 from pathlib import Path
 from typing import Any
-from uuid import NAMESPACE_URL, UUID, uuid5
+from uuid import UUID
 
 import httpx
 from pyfly.container import service
@@ -224,8 +224,11 @@ async def execute(
         timeout: int,
         task_id: str,
         *,
-        ordinal: int,
+        ordinal: int | None = None,
     ) -> ProcessResult:
+        from firefly_forge.sandbox_command_slots import assert_command_boundary
+
+        assert_command_boundary()
         bounded_argv(argv)
         if type(timeout) is not int or timeout < 1:
             raise ValueError("Command timeout must be a positive integer")
@@ -236,10 +239,9 @@ async def execute(
             run, attempt = scope["run"], scope["attempt"]
             snapshot = run.get("sandbox_snapshot")
             policy = validate_factory_pool(snapshot or {})
-            if type(ordinal) is not int or not 1 <= ordinal <= policy.command_limit:
+            if ordinal is not None and (type(ordinal) is not int or not 1 <= ordinal <= policy.command_limit):
                 raise ValueError("Frozen command budget is exhausted")
             relative = self._workspace(run, workspace, cwd)
-            execution_id = uuid5(NAMESPACE_URL, f"forge:sandbox:{run_id}:{task_id}:{attempt}:{ordinal}").hex
             command = {
                 "argv": argv,
                 "cwd": relative,
@@ -247,18 +249,25 @@ async def execute(
                 "workspace": str(workspace),
                 "snapshot_digest": snapshot["digest"],
             }
-            records = await self.journal.sandbox_executions(run_id)
-            previous = next((row for row in records if row["execution_id"] == execution_id), None)
-            if previous is not None:
-                if previous["request"]["command"] != command:
+
+            def retained_command(number: int, identity: str, previous: dict[str, Any] | None) -> dict[str, Any]:
+                assert previous is not None
+                retained = previous["request"]
+                if retained["command"] != command:
                     raise ValueError("Frozen Factory invocation command changed")
-                evidence = previous["effects"].get("start", {}).get("evidence", {})
-                if previous["status"] == "removed" and evidence.get("workspace_import") == "complete":
-                    await self._current(run_id, task_id, scope)
-                    return self._result(argv, evidence["exit_code"], evidence["output"])
-                raise RuntimeError("Existing Factory invocation requires reconciliation; it cannot be resubmitted")
-            if len(records) >= policy.command_limit:
-                raise ValueError("Frozen total command budget is exhausted")
+                return dict(retained)
+
+            if ordinal is not None:
+                replay = await self.journal.sandbox_command_replay(
+                    run_id, task_id, attempt, snapshot, retained_command, ordinal=ordinal
+                )
+                if replay["disposition"] != "absent":
+                    previous = replay["execution"]
+                    evidence = previous["effects"].get("start", {}).get("evidence", {})
+                    if previous["status"] == "removed" and evidence.get("workspace_import") == "complete":
+                        await self._current(run_id, task_id, scope)
+                        return self._result(argv, evidence["exit_code"], evidence["output"])
+                    raise RuntimeError("Existing Factory invocation requires reconciliation; it cannot be resubmitted")
             await self.probe(snapshot)
             await self._current(run_id, task_id, scope)
             source, _ = pack_workspace(
@@ -266,43 +275,65 @@ async def execute(
             )
             metadata = await self.git_snapshot.build(source, self.artifacts.directory, policy.workspace_max_bytes)
             archive, bundle = frame_project_archives(source, metadata, policy.workspace_max_bytes)
-            invocation = RunnerProjectInvocation(
-                execution_id=execution_id,
-                profile_id=policy.profile.profile_id,
-                profile_revision=policy.profile.revision,
-                project_id=run.get("project_id"),
-                repository_id=run["repository_id"],
-                run_id=UUID(run_id),
-                image=policy.image,
-                argv=tuple(argv),
-                cwd=relative,
-                source_digest=bundle.source_digest,
-                archive_digest=bundle.archive_digest,
-                source_bytes=len(archive),
-                bundle=bundle,
-                cpus=policy.cpus,
-                memory_mb=policy.memory_mb,
-                pids_limit=policy.pids_limit,
-                timeout=min(timeout, policy.timeout),
-                max_output_bytes=policy.max_output_bytes,
-            )
-            self.artifacts.retain(policy.profile, invocation, "source", archive)
-            payload = {
-                "parent_attempt": attempt,
-                "factory_fence": scope["fence"].model_dump(mode="json"),
-                "ordinal": ordinal,
-                "container_name": "pool-" + execution_id,
-                "snapshot_digest": snapshot["digest"],
-                "command": command,
-                "request_digest": pool_digest(invocation.model_dump(mode="json")),
-                "request": invocation.model_dump(mode="json"),
-            }
+
+            def prepare(number: int, identity: str, previous: dict[str, Any] | None) -> dict[str, Any]:
+                if previous is not None:
+                    retained = previous["request"]
+                    if retained["command"] != command:
+                        raise ValueError("Frozen Factory invocation command changed")
+                    return dict(retained)
+                invocation = RunnerProjectInvocation(
+                    execution_id=identity,
+                    profile_id=policy.profile.profile_id,
+                    profile_revision=policy.profile.revision,
+                    project_id=run.get("project_id"),
+                    repository_id=run["repository_id"],
+                    run_id=UUID(run_id),
+                    image=policy.image,
+                    argv=tuple(argv),
+                    cwd=relative,
+                    source_digest=bundle.source_digest,
+                    archive_digest=bundle.archive_digest,
+                    source_bytes=len(archive),
+                    bundle=bundle,
+                    cpus=policy.cpus,
+                    memory_mb=policy.memory_mb,
+                    pids_limit=policy.pids_limit,
+                    timeout=min(timeout, policy.timeout),
+                    max_output_bytes=policy.max_output_bytes,
+                )
+                payload = {
+                    "parent_attempt": attempt,
+                    "factory_fence": scope["fence"].model_dump(mode="json"),
+                    "ordinal": number,
+                    "container_name": "pool-" + identity,
+                    "snapshot_digest": snapshot["digest"],
+                    "command": command,
+                    "request_digest": pool_digest(invocation.model_dump(mode="json")),
+                    "request": invocation.model_dump(mode="json"),
+                }
+                return payload
+
             await self._current(run_id, task_id, scope)
-            created = await self.journal.sandbox_effect_intent(
-                run_id, task_id, execution_id, effect="create", payload=payload
+            current_source, _ = pack_workspace(
+                workspace, policy.workspace_max_bytes, registry=self.artifacts.credential_registry()
+            )
+            if hashlib.sha256(current_source).hexdigest() != bundle.source_archive_digest:
+                raise ValueError("Command source changed during pool preparation")
+            created = await self.journal.sandbox_command_intent(
+                run_id, task_id, attempt, snapshot, prepare, ordinal=ordinal
             )
-            if created["disposition"] != "execute":
-                raise RuntimeError("Factory preparation already exists; reconciliation required")
+            execution_id = created["execution"]["execution_id"]
+            payload = created["execution"]["request"]
+            invocation = RunnerProjectInvocation.model_validate(payload["request"])
+            if not created["fresh"]:
+                previous = created["execution"]
+                evidence = previous["effects"].get("start", {}).get("evidence", {})
+                if previous["status"] == "removed" and evidence.get("workspace_import") == "complete":
+                    await self._current(run_id, task_id, scope)
+                    return self._result(argv, evidence["exit_code"], evidence["output"])
+                raise RuntimeError("Existing Factory invocation requires reconciliation; it cannot be resubmitted")
+            self.artifacts.retain(policy.profile, invocation, "source", archive)
             await self.journal.sandbox_effect_receipt(
                 run_id,
                 task_id,
diff --git a/src/firefly_forge/sandbox.py b/src/firefly_forge/sandbox.py
index 00582ee9..6ad7ca4c 100644
--- a/src/firefly_forge/sandbox.py
+++ b/src/firefly_forge/sandbox.py
@@ -471,7 +471,6 @@ def __init__(self, store: Store, journal: Journal, backends: RunnerBackends | No
         self.transfer_image = pinned_image(transfer_image) if transfer_image else None
         self._capacity = asyncio.Semaphore(2)
         self._run_locks: dict[str, asyncio.Lock] = defaultdict(asyncio.Lock)
-        self._ordinals: dict[tuple[str, str, int], int] = defaultdict(int)
 
     def _safe_result(self, result: ProcessResult, *, browser: bool = False) -> ProcessResult:
         if browser and contains_known_credential(result.output, self.credential_registry()):
@@ -835,6 +834,9 @@ async def execute(
         _receipt_sink: Callable[[dict[str, Any]], None] | None = None,
         _invocation_guard: Callable[[], Awaitable[None]] | None = None,
     ) -> ProcessResult:
+        from firefly_forge.sandbox_command_slots import assert_command_boundary
+
+        assert_command_boundary()
         if task_id not in {"implement", "verify"}:
             raise ValueError("Runner commands must belong to an implementation or verification stage")
         if not argv or len(argv) > 64 or type(timeout) is not int or timeout < 1:
@@ -880,11 +882,6 @@ async def admit() -> dict[str, Any]:
                     raise RuntimeError("Factory pool worker is not configured; execution cannot fall back")
                 if _browser or _browser_input is not None:
                     raise ValueError("Pool browser execution requires a separately qualified browser profile")
-                stage = next(item for item in (await self.journal.plan(run_id))["tasks"] if item["id"] == task_id)
-                if ordinal is None:
-                    slot = (run_id, task_id, stage["attempt"])
-                    self._ordinals[slot] += 1
-                    ordinal = self._ordinals[slot]
                 return await self.pool_worker.execute(
                     run_id, workspace, directory, argv, timeout, task_id, ordinal=ordinal
                 )
@@ -897,33 +894,15 @@ async def admit() -> dict[str, Any]:
             output_limit = 8_300_000 if _browser else config.max_output_bytes
             planned = next(item for item in (await self.journal.plan(run_id))["tasks"] if item["id"] == task_id)
             attempt = planned["attempt"]
-            slot = (run_id, task_id, attempt)
-            if ordinal is None:
-                self._ordinals[slot] += 1
-                ordinal = self._ordinals[slot]
-            if type(ordinal) is not int or not 1 <= ordinal <= config.command_limit:
-                raise ValueError("Frozen command budget is exhausted")
-            execution_id = uuid.uuid5(uuid.NAMESPACE_URL, f"forge:sandbox:{run_id}:{task_id}:{attempt}:{ordinal}").hex
-            execution_identity = execution_id
-            records = await self.journal.sandbox_executions(run_id)
-            existing = next((record for record in records if record["execution_id"] == execution_id), None)
-            if run.get("source_edit_continuation"):
-                from firefly_forge.source_edit_continuations import assert_source_final_budget
-
-                await assert_source_final_budget(self.store, self.journal, run, task_id, execution_id)
-            if existing is None and len(records) >= config.command_limit:
-                raise ValueError("Frozen total command budget is exhausted; resume and handoff do not reset it")
-            if _browser and existing is None:
-                assert config.browser is not None
-                browser_calls = sum(bool(row["request"]["request"].get("browser", False)) for row in records)
-                if browser_calls >= config.browser.max_calls:
-                    raise ValueError("Frozen browser call budget is exhausted; resume and handoff do not reset it")
-            labels = {
-                "org.firefly.forge.owner": self.owner,
-                "org.firefly.forge.execution": execution_id,
-                "org.firefly.forge.run": run_id,
-                "org.firefly.forge.snapshot": snapshot["digest"],
-            }
+            explicit_id = (
+                uuid.uuid5(uuid.NAMESPACE_URL, f"forge:sandbox:{run_id}:{task_id}:{attempt}:{ordinal}").hex
+                if ordinal is not None
+                else None
+            )
+            retained = next(
+                (row for row in await self.journal.sandbox_executions(run_id) if row["execution_id"] == explicit_id),
+                None,
+            )
             request: dict[str, Any] = {
                 "browser": _browser,
                 "output_limit": output_limit,
@@ -940,21 +919,47 @@ async def admit() -> dict[str, Any]:
                     raise ValueError("Archive execution requires an administrator-configured pinned transfer image")
                 request["transfer_image"] = self.transfer_image
                 request["workspace_digest"] = (
-                    existing["request"]["request"]["workspace_digest"]
-                    if existing
+                    retained["request"]["request"]["workspace_digest"]
+                    if retained
                     else pack_workspace(workspace, config.workspace_max_bytes, registry=self.credential_registry())[1]
                 )
-            payload = {
-                "parent_attempt": attempt,
-                "ordinal": ordinal,
-                "container_name": "forge-sandbox-" + execution_id,
-                "snapshot_digest": snapshot["digest"],
-                "request_digest": digest(request),
-                "request": request,
+
+            def prepare(number: int, identity: str, previous: dict[str, Any] | None) -> dict[str, Any]:
+                frozen_request = dict(request)
+                if previous and SandboxInput.model_validate(previous["request"]["request"]["configuration"]) == config:
+                    frozen_request["configuration"] = previous["request"]["request"]["configuration"]
+                value = {
+                    "parent_attempt": attempt,
+                    "ordinal": number,
+                    "container_name": "forge-sandbox-" + identity,
+                    "snapshot_digest": snapshot["digest"],
+                    "request_digest": digest(frozen_request),
+                    "request": frozen_request,
+                }
+                if previous and "executor_contract" in previous["request"]:
+                    value["executor_contract"] = previous["request"]["executor_contract"]
+                return value
+
+            await admit()
+            if config.workspace_transport == "archive" and retained is None:
+                current_digest = pack_workspace(
+                    workspace, config.workspace_max_bytes, registry=self.credential_registry()
+                )[1]
+                if current_digest != request["workspace_digest"]:
+                    raise ValueError("Command source changed during archive preparation")
+            created = await self.journal.sandbox_command_intent(
+                run_id, task_id, attempt, snapshot, prepare, ordinal=ordinal
+            )
+            payload = created["execution"]["request"]
+            execution_id = created["execution"]["execution_id"]
+            execution_identity = execution_id
+            labels = {
+                "org.firefly.forge.owner": self.owner,
+                "org.firefly.forge.execution": execution_id,
+                "org.firefly.forge.run": run_id,
+                "org.firefly.forge.snapshot": snapshot["digest"],
             }
-            if existing and SandboxInput.model_validate(existing["request"]["request"]["configuration"]) == config:
-                request["configuration"] = existing["request"]["request"]["configuration"]
-                payload["request_digest"] = digest(request)
+            existing = None if created["fresh"] else created["execution"]
             if existing is not None:
                 if existing["request"] != payload:
                     raise SandboxReconciliationRequired("Durable runner invocation differs from the requested command")
@@ -983,9 +988,6 @@ async def admit() -> dict[str, Any]:
                         "Interrupted runner invocation requires explicit stage recovery"
                     )
             await admit()
-            created = await self.journal.sandbox_effect_intent(
-                run_id, task_id, execution_id, effect="create", payload=payload
-            )
             if config.mode == "host":
                 if created["disposition"] == "needs_reconciliation":
                     raise SandboxReconciliationRequired("Unknown host command outcome cannot be replayed")
diff --git a/src/firefly_forge/sandbox_command_slots.py b/src/firefly_forge/sandbox_command_slots.py
new file mode 100644
index 00000000..aadd5230
--- /dev/null
+++ b/src/firefly_forge/sandbox_command_slots.py
@@ -0,0 +1,294 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Allocate a new command identity and its create WAL atomically under the run writer."""
+
+from __future__ import annotations
+
+import copy
+import hashlib
+import json
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Any
+from uuid import NAMESPACE_URL, uuid5
+
+from firefly_forge.journal import digest
+from firefly_forge.project_access import ProjectAccess
+from firefly_forge.runner_factory_models import validate_factory_pool
+from firefly_forge.runner_pool_models import pool_digest
+from firefly_forge.sandbox_models import capture_sandbox, validate_sandbox_snapshot
+
+if TYPE_CHECKING:
+    from firefly_forge.journal import Journal
+
+Data = dict[str, Any]
+COMMAND_CONTRACT = "forge-command-ordinal/v2"
+
+
+def assert_command_boundary() -> None:
+    from pyfly.data.transaction import current_unit_of_work
+
+    if current_unit_of_work() is not None:
+        raise ValueError("Command allocation and dispatch require no ambient transaction")
+
+
+def _refuse() -> None:
+    from firefly_forge.sandbox import SandboxReconciliationRequired
+
+    raise SandboxReconciliationRequired("Durable command identity or effect requires reconciliation")
+
+
+def _canonical(row: Any, entries: list[Data], run_id: str) -> Data:
+    identity = uuid5(NAMESPACE_URL, f"forge:sandbox:{run_id}:{row.task_id}:{row.parent_attempt}:{row.ordinal}").hex
+    if (
+        row.run_id.hex != run_id
+        or row.task_id not in {"implement", "verify"}
+        or type(row.parent_attempt) is not int
+        or not 1 <= row.parent_attempt <= 100
+        or type(row.ordinal) is not int
+        or not 1 <= row.ordinal <= 100
+        or row.id.hex != identity
+        or row.container_name not in {"forge-sandbox-" + identity, "pool-" + identity}
+        or set(row.data) != {"request", "effects"}
+    ):
+        _refuse()
+    request, effects = row.data["request"], row.data["effects"]
+    if (
+        not isinstance(request, dict)
+        or not isinstance(effects, dict)
+        or "create" not in effects
+        or set(effects) - {"create", "start", "cleanup"}
+        or type(request.get("parent_attempt")) is not int
+        or type(request.get("ordinal")) is not int
+        or request.get("executor_contract", COMMAND_CONTRACT) != COMMAND_CONTRACT
+        or request.get("parent_attempt") != row.parent_attempt
+        or request.get("ordinal") != row.ordinal
+        or request.get("container_name") != row.container_name
+        or request.get("snapshot_digest") != row.snapshot_digest
+        or not isinstance(request.get("request"), dict)
+        or request.get("request_digest")
+        != (pool_digest(request["request"]) if row.container_name.startswith("pool-") else digest(request["request"]))
+    ):
+        _refuse()
+    for effect, state in effects.items():
+        intents = [
+            entry
+            for entry in entries
+            if entry["kind"] == "sandbox_intent"
+            and entry["payload"].get("execution_id") == identity
+            and entry["payload"].get("effect") == effect
+        ]
+        outcomes = [
+            entry
+            for entry in entries
+            if entry["kind"] in {"sandbox_receipt", "sandbox_reconcile"}
+            and entry["payload"].get("execution_id") == identity
+            and entry["payload"].get("effect") == effect
+        ]
+        if (
+            not isinstance(state, dict)
+            or state.get("status") not in {"intent", "done"}
+            or len(intents) != 1
+            or intents[0]["task_id"] != row.task_id
+            or intents[0]["payload"].get("request") != request
+        ):
+            _refuse()
+        if state["status"] == "intent":
+            if outcomes:
+                _refuse()
+            continue
+        evidence = copy.deepcopy(state.get("evidence"))
+        if not isinstance(evidence, dict) or len(outcomes) != 1 or outcomes[0]["sequence"] <= intents[0]["sequence"]:
+            _refuse()
+        if isinstance(evidence.get("output"), str):
+            output = evidence.pop("output")
+            evidence.update(
+                output_sha256=hashlib.sha256(output.encode()).hexdigest(),
+                output_bytes=len(output.encode()),
+                output_excerpt=output[:2000],
+            )
+        if outcomes[0]["payload"].get("evidence") != evidence or outcomes[0]["task_id"] != row.task_id:
+            _refuse()
+    related = [
+        entry
+        for entry in entries
+        if entry["kind"] in {"sandbox_intent", "sandbox_receipt", "sandbox_reconcile"}
+        and entry["payload"].get("execution_id") == identity
+    ]
+    if {entry["payload"].get("effect") for entry in related if entry["kind"] == "sandbox_intent"} != set(effects):
+        _refuse()
+    last = related[-1]
+    expected_status = (
+        {"create": "creating", "start": "running", "cleanup": "cleaning"}
+        if last["kind"] == "sandbox_intent"
+        else {"create": "created", "start": "finished", "cleanup": "removed"}
+    )[last["payload"]["effect"]]
+    if last["payload"].get("evidence", {}).get("outcome") == "interrupted":
+        expected_status = "interrupted"
+    if row.status != expected_status:
+        _refuse()
+    if row.container_name.startswith("pool-"):
+        from firefly_forge.runner_pool_models import RunnerProjectInvocation
+
+        invocation = RunnerProjectInvocation.model_validate(request["request"])
+        if invocation.execution_id != identity or invocation.run_id.hex != run_id:
+            _refuse()
+    return {"execution_id": identity, "request": copy.deepcopy(request), "effects": copy.deepcopy(effects)}
+
+
+def _complete(row: Any, value: Data) -> bool:
+    effects = value["effects"]
+    start = effects.get("start", {})
+    evidence = start.get("evidence", {})
+    return (
+        row.status == "removed"
+        and set(effects) == {"create", "start", "cleanup"}
+        and all(
+            state.get("status") == "done" and state.get("evidence", {}).get("outcome") != "interrupted"
+            for state in effects.values()
+        )
+        and type(evidence.get("exit_code")) is int
+        and isinstance(evidence.get("output"), str)
+        and evidence.get("workspace_import") != "requires_reconciliation"
+        and (not row.container_name.startswith("pool-") or evidence.get("workspace_import") == "complete")
+    )
+
+
+def _recovered(row: Any, value: Data, entries: list[Data], tasks: list[Any]) -> bool:
+    effects = value["effects"]
+    if (
+        not {"create", "cleanup"} <= set(effects)
+        or any(state.get("status") != "done" for state in effects.values())
+        or any(
+            state.get("evidence", {}).get("workspace_import") == "requires_reconciliation" for state in effects.values()
+        )
+        or (
+            "start" in effects
+            and not any(state.get("evidence", {}).get("outcome") == "interrupted" for state in effects.values())
+        )
+    ):
+        return False
+    for effect, state in effects.items():
+        if state.get("evidence", {}).get("outcome") == "interrupted" and not any(
+            entry["kind"] == "sandbox_reconcile"
+            and entry["payload"].get("execution_id") == row.id.hex
+            and entry["payload"].get("effect") == effect
+            for entry in entries
+        ):
+            return False
+    task = next((item for item in tasks if item.task_id == row.task_id), None)
+    if task is None or task.attempt <= row.parent_attempt:
+        return False
+    key = uuid5(NAMESPACE_URL, f"forge:{row.run_id.hex}:{row.task_id}:{row.parent_attempt}").hex
+    last_effect = max(
+        entry["sequence"]
+        for entry in entries
+        if entry["kind"] in {"sandbox_intent", "sandbox_receipt", "sandbox_reconcile"}
+        and entry["payload"].get("execution_id") == row.id.hex
+    )
+    return any(
+        entry["kind"] == "reconciliation"
+        and entry["task_id"] == row.task_id
+        and entry["idempotency_key"] == key
+        and entry["payload"].get("outcome") == "retry"
+        and entry["payload"].get("evidence")
+        and entry["sequence"] > last_effect
+        for entry in entries
+    )
+
+
+async def command_intent(
+    journal: Journal,
+    run_id: str,
+    task_id: str,
+    attempt: int,
+    snapshot: Data,
+    payload: Callable[[int, str, Data | None], Data],
+    *,
+    ordinal: int | None = None,
+    replay_only: bool = False,
+) -> Data:
+    assert_command_boundary()
+    if task_id not in {"implement", "verify"} or type(attempt) is not int or not 1 <= attempt <= 100:
+        raise ValueError("Command allocation requires an exact native task attempt")
+    policy = validate_factory_pool(snapshot) if snapshot.get("mode") == "pool" else validate_sandbox_snapshot(snapshot)
+    if ordinal is not None and (type(ordinal) is not int or not 1 <= ordinal <= policy.command_limit):
+        raise ValueError("Frozen command budget is exhausted")
+    await journal.store.assert_ownership()
+    async with journal.store._unit():
+        run = await journal._run(run_id)
+        task = await journal._task(run_id, task_id)
+        current = {**copy.deepcopy(run.data), "id": run.id.hex}
+        if (run.data.get("sandbox_snapshot") or capture_sandbox(None)) != snapshot or task.attempt != attempt:
+            raise ValueError("Frozen command configuration or task attempt changed")
+        if task.status != "running":
+            raise ValueError("Command allocation requires the active native stage")
+        if run.data.get("cancel_request", {}).get("status") == "requested":
+            import asyncio
+
+            raise asyncio.CancelledError()
+        await ProjectAccess(journal.store).authorize_execution(current)
+        entries = [
+            {**copy.deepcopy(row.data), "digest": row.digest} for row in await journal.records.find_for_run(run.id)
+        ]
+        if len(entries) > 10000 or len(json.dumps(entries)) > 16 * 1024 * 1024 or not journal.verify_chain(entries):
+            _refuse()
+        rows = await journal.sandboxes.for_run(run.id)
+        if len(rows) > 100:
+            _refuse()
+        retained_ids = {
+            entry["payload"].get("execution_id")
+            for entry in entries
+            if entry["kind"] in {"sandbox_intent", "sandbox_receipt", "sandbox_reconcile"}
+        }
+        if retained_ids != {row.id.hex for row in rows}:
+            _refuse()
+        values = {row.id.hex: _canonical(row, entries, run_id) for row in rows}
+        if ordinal is None:
+            ordinal = 1 + max(
+                (row.ordinal for row in rows if row.task_id == task_id and row.parent_attempt == attempt), default=0
+            )
+        if ordinal > policy.command_limit:
+            raise ValueError("Frozen command budget is exhausted")
+        execution_id = uuid5(NAMESPACE_URL, f"forge:sandbox:{run_id}:{task_id}:{attempt}:{ordinal}").hex
+        existing = values.get(execution_id)
+        if existing is None:
+            tasks = await journal.tasks.find_for_run(run.id)
+            if any(
+                not _complete(row, values[row.id.hex]) and not _recovered(row, values[row.id.hex], entries, tasks)
+                for row in rows
+            ):
+                _refuse()
+            if len(rows) >= policy.command_limit:
+                raise ValueError("Frozen total command budget is exhausted; attempts do not reset it")
+        if replay_only and existing is None:
+            return {"disposition": "absent"}
+        request = payload(ordinal, execution_id, existing)
+        if existing is None and request.get("request", {}).get("browser"):
+            browser = getattr(policy, "browser", None)
+            if (
+                browser is None
+                or sum(bool(value["request"]["request"].get("browser")) for value in values.values())
+                >= browser.max_calls
+            ):
+                raise ValueError("Frozen browser call budget is exhausted")
+        if existing is None:
+            request = {**request, "executor_contract": COMMAND_CONTRACT}
+        inner = request.get("request")
+        prefix = "pool-" if snapshot.get("mode") == "pool" else "forge-sandbox-"
+        if (
+            type(request.get("parent_attempt")) is not int
+            or type(request.get("ordinal")) is not int
+            or request.get("parent_attempt") != attempt
+            or request.get("ordinal") != ordinal
+            or request.get("snapshot_digest") != snapshot["digest"]
+            or request.get("container_name") != prefix + execution_id
+            or not isinstance(inner, dict)
+            or request.get("request_digest") != (pool_digest(inner) if prefix == "pool-" else digest(inner))
+        ):
+            raise ValueError("Command payload differs from its canonical allocated slot")
+        if current.get("source_edit_continuation"):
+            from firefly_forge.source_edit_continuations import assert_source_final_budget
+
+            await assert_source_final_budget(journal.store, journal, current, task_id, execution_id)
+        await journal.store.assert_ownership()
+        result = await journal.sandbox_effect_intent(run_id, task_id, execution_id, effect="create", payload=request)
+        return {**result, "fresh": existing is None}
diff --git a/src/firefly_forge/scm_connections.py b/src/firefly_forge/scm_connections.py
index 7651a55c..63032b2f 100644
--- a/src/firefly_forge/scm_connections.py
+++ b/src/firefly_forge/scm_connections.py
@@ -60,6 +60,10 @@
 }
 
 
+class ProviderDispatchRefused(ValueError):
+    """An opt-in local admission failed before provider HTTP dispatch."""
+
+
 @service
 class SCMConnections:
     def __init__(self, store: Store, directory: Path | None = None, *, client: httpx.AsyncClient | None = None) -> None:
@@ -320,6 +324,7 @@ async def configure(self, provider: str, body: Data) -> Data:
     async def _request(self, method: str, url: str, **kwargs: Any) -> httpx.Response:
         allowed_statuses = kwargs.pop("allowed_statuses", (200, 201))
         response_limit = kwargs.pop("response_limit", None)
+        before_dispatch = kwargs.pop("before_dispatch", None)
         provider = next(
             (
                 name
@@ -358,7 +363,12 @@ async def perform(client: httpx.AsyncClient) -> httpx.Response:
 
         async with guard:
             if self._record(provider) != record:
-                raise ValueError("Application settings changed before provider dispatch; repeat with the current grant")
+                refusal = ProviderDispatchRefused if before_dispatch is not None else ValueError
+                raise refusal("Application settings changed before provider dispatch; repeat with the current grant")
+            if before_dispatch is not None:
+                await before_dispatch()
+                if self._record(provider) != record:
+                    raise ProviderDispatchRefused("Application settings changed during provider admission")
             try:
                 async with asyncio.timeout(20):
                     if self._client is not None:
diff --git a/src/firefly_forge/scm_conversations.py b/src/firefly_forge/scm_conversations.py
index 82d72350..e6a5775e 100644
--- a/src/firefly_forge/scm_conversations.py
+++ b/src/firefly_forge/scm_conversations.py
@@ -118,7 +118,11 @@ async def references(self, delivery: Data, scopes: list[Data], *, durable: bool
                 )
                 if scope is None or run.get("repository_id") != delivery["repository_id"]:
                     continue
-                if previous.get("native_question") is not None:
+                if previous.get("maintain_ticket") is not None:
+                    from firefly_forge.scm_maintain_tickets import MaintainTickets
+
+                    await MaintainTickets(self.collaboration).authorize_reference(previous, run, delivery, scopes)
+                elif previous.get("native_question") is not None:
                     from firefly_forge.native_question_publications import NativeQuestionPublications
 
                     await NativeQuestionPublications(self.collaboration).authorize_reference(previous, run)
diff --git a/src/firefly_forge/scm_maintain_ticket_controllers.py b/src/firefly_forge/scm_maintain_ticket_controllers.py
new file mode 100644
index 00000000..e2b5bf35
--- /dev/null
+++ b/src/firefly_forge/scm_maintain_ticket_controllers.py
@@ -0,0 +1,30 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Finite native setup for one maintain child's automatic GitHub communication."""
+
+from typing import Any
+
+from pyfly.container import rest_controller
+from pyfly.web import Body, PathVar, get_mapping, post_mapping, request_mapping
+
+from firefly_forge.collaboration import Collaboration
+from firefly_forge.scm_maintain_ticket_models import MaintainTicketInput
+from firefly_forge.scm_maintain_tickets import MaintainTickets
+
+
+@rest_controller
+@request_mapping("/api/v1/projects/{project_id}/repositories/{repository_id}/maintain-ticket-bindings")
+class MaintainTicketController:
+    def __init__(self, collaboration: Collaboration) -> None:
+        self.tickets = MaintainTickets(collaboration)
+
+    @post_mapping("", status_code=201)
+    async def configure(
+        self, project_id: PathVar[str], repository_id: PathVar[str], body: Body[MaintainTicketInput]
+    ) -> dict[str, Any]:
+        return await self.tickets.configure(project_id, repository_id, body)
+
+    @get_mapping("/requests/{request_id}")
+    async def read(
+        self, project_id: PathVar[str], repository_id: PathVar[str], request_id: PathVar[str]
+    ) -> dict[str, Any]:
+        return await self.tickets.read(project_id, repository_id, request_id)
diff --git a/src/firefly_forge/scm_maintain_ticket_models.py b/src/firefly_forge/scm_maintain_ticket_models.py
new file mode 100644
index 00000000..f117bcce
--- /dev/null
+++ b/src/firefly_forge/scm_maintain_ticket_models.py
@@ -0,0 +1,108 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Explicit finite communication consent binds one native maintain creation."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Literal
+
+from pydantic import Field, field_validator, model_validator
+
+from firefly_forge.collaboration_feedback import MAX_FEEDBACK
+from firefly_forge.journal import digest
+from firefly_forge.scm_authority_models import Digest, NativeID, StrictContract
+
+
+class MaintainTicketInput(StrictContract):
+    version: Literal[1]
+    request_id: NativeID
+    run_id: NativeID
+    creation_request_id: NativeID
+    expected_creation_digest: Digest
+    observed_receipt_id: NativeID
+    expected_reference_digest: Digest
+    expected_previous_digest: Digest | None
+    lifetime_seconds: int = Field(ge=60, le=3600)
+    max_notifications: int = Field(ge=1, le=MAX_FEEDBACK)
+    allowed_actions: list[Literal["status", "question", "answer"]] = Field(min_length=1, max_length=3)
+    acknowledge_native_communication: Literal[True]
+
+    @field_validator("acknowledge_native_communication", mode="before")
+    @classmethod
+    def explicit_boolean(cls, value: object) -> object:
+        if type(value) is not bool:
+            raise ValueError("Native communication consent must be an explicit boolean")
+        return value
+
+    @model_validator(mode="after")
+    def exact_actions(self) -> MaintainTicketInput:
+        if len(set(self.allowed_actions)) != len(self.allowed_actions) or set(self.allowed_actions) != {
+            "status",
+            "question",
+            "answer",
+        }:
+            raise ValueError("This native binding requires explicit status, question and answer consent")
+        return self
+
+
+class MaintainTicketMarker(StrictContract):
+    version: Literal[1]
+    kind: Literal["native_maintain_ticket_v1"]
+    project_id: NativeID
+    request_id: NativeID
+    run_id: NativeID
+    binding_digest: Digest
+
+
+class MaintainTicketReceipt(StrictContract):
+    version: Literal[1]
+    event_id: NativeID
+    project_id: NativeID
+    repository_id: NativeID
+    run_id: NativeID
+    binding_key: NativeID
+    revision: int = Field(ge=1, le=100)
+    previous_digest: Digest | None
+    request: MaintainTicketInput
+    request_digest: Digest
+    admin_snapshot: dict[str, Any]
+    creation_digest: Digest
+    parent_reference: dict[str, Any]
+    parent_observation: dict[str, Any]
+    observation: dict[str, Any]
+    polling_scope: dict[str, Any]
+    owner: dict[str, Any]
+    outbox_id: NativeID
+    prepared_at_ms: int = Field(ge=1)
+    expires_at_ms: int = Field(ge=1)
+    policy_digest: Digest
+    digest: Digest
+
+    @model_validator(mode="after")
+    def exact_binding(self) -> MaintainTicketReceipt:
+        value = self.model_dump(mode="json")
+        if (
+            self.request_digest != request_digest(self.request)
+            or self.run_id != self.request.run_id
+            or self.binding_key != self.request.run_id
+            or self.creation_digest != self.request.expected_creation_digest
+            or self.previous_digest != self.request.expected_previous_digest
+            or self.expires_at_ms != self.prepared_at_ms + self.request.lifetime_seconds * 1000
+            or digest({k: v for k, v in value.items() if k != "digest"}) != self.digest
+        ):
+            raise ValueError("The immutable maintain ticket receipt changed")
+        return self
+
+
+def request_digest(request: MaintainTicketInput) -> str:
+    return digest(request.model_dump(mode="json"))
+
+
+def confirmed_remote(remote: dict[str, Any], ticket_url: str) -> dict[str, str]:
+    value = remote.get("id")
+    if type(value) not in {int, str} or re.fullmatch(r"[1-9][0-9]{0,39}", str(value)) is None:
+        raise ValueError("The maintain notification has no exact remote comment identity")
+    url = ticket_url + "#issuecomment-" + str(value)
+    if remote.get("url") != url:
+        raise ValueError("The maintain notification belongs to another issue or comment")
+    return {"id": str(value), "url": url}
diff --git a/src/firefly_forge/scm_maintain_tickets.py b/src/firefly_forge/scm_maintain_tickets.py
new file mode 100644
index 00000000..4005f05a
--- /dev/null
+++ b/src/firefly_forge/scm_maintain_tickets.py
@@ -0,0 +1,376 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Native communication bindings for independently admitted checkpoint maintenance."""
+
+from __future__ import annotations
+
+import copy
+import json
+from time import time
+from typing import Any
+from uuid import uuid4
+
+from pyfly.data.transaction import current_unit_of_work
+
+from firefly_forge.checkpoint_test_models import frozen_checkpoint_source
+from firefly_forge.collaboration_persistence import ForgeWebhookInboxEntity
+from firefly_forge.journal import digest
+from firefly_forge.project_access import CURRENT_PRINCIPAL, AccessDenied, ProjectAccess
+from firefly_forge.run_creation_requests import RunCreationRequests
+from firefly_forge.scm_conversations import SCMConversations, observation_cut
+from firefly_forge.scm_maintain_ticket_models import (
+    MaintainTicketInput,
+    MaintainTicketMarker,
+    MaintainTicketReceipt,
+    request_digest,
+)
+from firefly_forge.scm_poll_models import PollPointer
+from firefly_forge.scm_polling import MAX_BYTES, inbox_size
+from firefly_forge.store import identifier, now
+
+Data = dict[str, Any]
+STATE_KEY = "_maintain_ticket_v1"
+KIND = "native_maintain_ticket_v1"
+
+
+def clock_ms() -> int:
+    return int(time() * 1000)
+
+
+class MaintainNotificationNotDispatched(AccessDenied):
+    """Current local authority refused this notification before HTTP dispatch."""
+
+
+def state_of(data: Data) -> Data:
+    value = copy.deepcopy(data.get(STATE_KEY, {"version": 1, "requests": {}, "heads": {}}))
+    if (
+        set(value) != {"version", "requests", "heads"}
+        or type(value["version"]) is not int
+        or value["version"] != 1
+        or type(value["requests"]) is not dict
+        or type(value["heads"]) is not dict
+        or len(value["requests"]) > 100
+        or len(value["heads"]) > 100
+        or len(json.dumps(value).encode()) > MAX_BYTES
+    ):
+        raise ValueError("The native maintain communication state changed")
+    for pointer in [*value["requests"].values(), *value["heads"].values()]:
+        PollPointer.model_validate(pointer)
+    return dict(value)
+
+
+def creation_scope(run: Data, receipt: Data) -> None:
+    if (
+        receipt.get("run_id") != run["id"]
+        or receipt.get("source_checkpoint") != run.get("source_checkpoint_snapshot")
+        or run.get("operation") != "maintain"
+        or run.get("publish") is not False
+        or receipt.get("input", {}).get("operation") != "maintain"
+        or receipt.get("input", {}).get("publish", False) is not False
+        or any(receipt.get(k) != run.get(k) for k in ("repository_id", "project_id", "component_id"))
+    ):
+        raise AccessDenied("The ticket requires one exact native maintain creation")
+    frozen_checkpoint_source(run, {"id": run["repository_id"]})
+
+
+class MaintainTickets:
+    def __init__(self, collaboration: Any) -> None:
+        self.c, self.store, self.polling = collaboration, collaboration.store, collaboration.polling
+
+    async def _creation(self, request_id: str) -> Data:
+        async with self.store._unit():
+            receipt = await RunCreationRequests(self.store)._load(request_id)
+        if receipt is None:
+            raise AccessDenied("The exact native creation receipt is unavailable")
+        return receipt
+
+    async def _load(self, pointer: Data, project: str, repository: str) -> Data:
+        value = await self.polling._event(pointer, KIND, project, repository)
+        return MaintainTicketReceipt.model_validate(value).model_dump(mode="json")
+
+    async def _target(self, source: Data, project: str, repository: str, *, remote: bool) -> tuple[Data, Data, Data]:
+        scope = await self.polling.conversation_scope(source, remote=remote)
+        if scope["project_id"] != project or scope["repository_id"] != repository:
+            raise AccessDenied("The current observed owner belongs to another project or repository")
+        head = await self.polling._head(project, repository, scope["binding_key"])
+        if not {"status", "respond"}.issubset(head["request"]["allowed_actions"]):
+            raise AccessDenied("Current status and owner-answer consent are required")
+        async with self.store._unit():
+            user = await self.polling.users.find_by_id(identifier(scope["native_user_id"]))
+            if user is None or not user.enabled:
+                raise AccessDenied("The mapped maintain owner is unavailable")
+            identity = digest({"id": user.id.hex, "issuer": user.issuer, "subject": user.subject})
+        await ProjectAccess(self.store).authorize_actor(
+            {"user_id": scope["native_user_id"], "authentication_method": "oidc_bearer"}, project, "execute"
+        )
+        return scope, head, {"user_id": scope["native_user_id"], "identity_digest": identity}
+
+    async def configure(self, project: str, repository: str, request: MaintainTicketInput) -> Data:
+        if current_unit_of_work() is not None:
+            raise ValueError("Configure maintain communication outside a caller transaction")
+        actor = CURRENT_PRINCIPAL.get()
+        await self.polling.authority._reader(actor, project, repository, admin=True)
+        assert actor is not None
+        incoming = request.model_dump(mode="json")
+        await self.store.admit_credentials(incoming)
+        async with self.store._unit():
+            row, _ = await self.polling._state(repository)
+            state = state_of(row.data)
+        request_key = project + ":" + request.request_id
+        if pointer := state["requests"].get(request_key):
+            kept = await self._load(pointer, project, repository)
+            if kept["request"] != incoming or kept["admin_snapshot"]["user_id"] != actor.id.hex:
+                raise AccessDenied("The native communication request identity belongs to another input or actor")
+            return kept
+        run = await self.store.get_run(request.run_id)
+        receipt = await self._creation(request.creation_request_id)
+        creation_scope(run, receipt)
+        if receipt["digest"] != request.expected_creation_digest or (run["project_id"], run["repository_id"]) != (
+            project,
+            repository,
+        ):
+            raise AccessDenied("The reviewed maintain creation or scope changed")
+        source = await self.polling._observation(project, repository, request.observed_receipt_id)
+        if source.get("source_conflict") or digest(source["verification"]) != request.expected_reference_digest:
+            raise AccessDenied("The real GitHub owner observation changed")
+        scope, head, owner = await self._target(source, project, repository, remote=True)
+        references, _ = await SCMConversations(self.c).references(source, [scope], durable=True)
+        parent_id = run["source_checkpoint_snapshot"]["reference"]["run_id"]
+        parents = [value for value in references if value["run_id"] == parent_id]
+        if len(parents) != 1 or run["component_id"] not in scope["component_ids"]:
+            raise AccessDenied("The observed ticket has no exact authenticated checkpoint parent")
+        parent = await self.c.receipt(parents[0]["receipt_id"])
+        parent_cut = observation_cut(parent)
+        await self.store.admit_credentials({"request": incoming, "source": observation_cut(source)})
+        async with self.polling._locked(project, repository, [actor.id.hex, owner["user_id"]]):
+            await self.polling.authority._reader(actor, project, repository, admin=True)
+            current_scope, current_head, current_owner = await self._target(source, project, repository, remote=False)
+            if (current_scope, current_head, current_owner) != (scope, head, owner):
+                raise AccessDenied("The maintain communication owner or current consent changed")
+            current_receipt = await self._creation(request.creation_request_id)
+            current_run = await self.store.get_run(request.run_id)
+            creation_scope(current_run, current_receipt)
+            if current_receipt != receipt or observation_cut(await self.c.receipt(parent["id"])) != parent_cut:
+                raise AccessDenied("The retained maintain creation or ticket parent changed")
+            row, _ = await self.polling._state(repository)
+            state = state_of(row.data)
+            if pointer := state["requests"].get(request_key):
+                kept = await self._load(pointer, project, repository)
+                if kept["request"] != incoming or kept["admin_snapshot"]["user_id"] != actor.id.hex:
+                    raise AccessDenied("The concurrent maintain request identity changed")
+                return kept
+            old_pointer = state["heads"].get(request.run_id)
+            old = await self._load(old_pointer, project, repository) if old_pointer else None
+            if (old["digest"] if old else None) != request.expected_previous_digest:
+                raise ValueError("Maintain communication conflict; retain this native request identity")
+            if old is not None:
+                prior = await self.c.inbox.find_by_id(identifier(old["outbox_id"]))
+                if prior is not None and prior.data.get("feedback_status") in {"writing", "needs_reconciliation"}:
+                    raise AccessDenied("The prior notification outcome requires reconciliation")
+            if len(state["requests"]) >= 100:
+                raise ValueError("Native maintain communication retention is full")
+            prepared = clock_ms()
+            outbox_id = digest({"kind": KIND, "project": project, "request": incoming})[:32]
+            value = dict(
+                version=1,
+                event_id=uuid4().hex,
+                project_id=project,
+                repository_id=repository,
+                run_id=request.run_id,
+                binding_key=request.run_id,
+                revision=old["revision"] + 1 if old else 1,
+                previous_digest=request.expected_previous_digest,
+                request=incoming,
+                request_digest=request_digest(request),
+                admin_snapshot=ProjectAccess.actor_snapshot(actor),
+                creation_digest=receipt["digest"],
+                parent_reference=parents[0],
+                parent_observation=parent_cut,
+                observation=observation_cut(source),
+                polling_scope=scope,
+                owner=owner,
+                outbox_id=outbox_id,
+                prepared_at_ms=prepared,
+                expires_at_ms=prepared + request.lifetime_seconds * 1000,
+            )
+            from firefly_forge.scm_natural_tasks import natural_policy_digest
+
+            value["policy_digest"] = natural_policy_digest()
+            value["digest"] = digest(value)
+            value = MaintainTicketReceipt.model_validate(value).model_dump(mode="json")
+            pointer = await self.polling._save_event(KIND, value)
+            state["requests"][request_key] = pointer
+            state["heads"][request.run_id] = pointer
+            state_of({STATE_KEY: state})
+            marker = {
+                "version": 1,
+                "kind": KIND,
+                "project_id": project,
+                "request_id": request.request_id,
+                "run_id": request.run_id,
+                "binding_digest": value["digest"],
+            }
+            data = {
+                key: copy.deepcopy(source[key])
+                for key in (
+                    "repository_id",
+                    "provider",
+                    "remote_id",
+                    "actor",
+                    "issue",
+                    "verification",
+                    "source_snapshot",
+                )
+            }
+            data.update(
+                id=outbox_id,
+                delivery_id="maintain-ticket:" + outbox_id,
+                digest=digest(marker),
+                status="processed",
+                action_status="completed",
+                reason=None,
+                run_id=request.run_id,
+                feedback_status="pending",
+                maintain_ticket=marker,
+                global_ingress=False,
+                command={"action": "status", "run_id": request.run_id, "language": "en"},
+                created_at=now(),
+                updated_at=now(),
+            )
+            count, retained = await inbox_size(self.store, repository)
+            if count >= 5000 or retained + len(json.dumps(data).encode()) > MAX_BYTES:
+                raise ValueError("Maintain notification retention is full")
+            self.store.reject_credentials(data)
+            await self.c.inbox.save(
+                ForgeWebhookInboxEntity(
+                    id=identifier(outbox_id),
+                    repository_id=identifier(repository),
+                    provider="github",
+                    delivery_id=data["delivery_id"],
+                    source_key=data["delivery_id"],
+                    status="processed",
+                    data=data,
+                )
+            )
+            row.data = {**row.data, STATE_KEY: state}
+            await self.polling.settings.save(row)
+            self.confirm_local_cut({"binding": value})
+        return copy.deepcopy(value)
+
+    async def read(self, project: str, repository: str, request_id: str) -> Data:
+        await self.polling.authority._reader(CURRENT_PRINCIPAL.get(), project, repository, admin=False)
+        async with self.store._unit():
+            row, _ = await self.polling._state(repository)
+            pointer = state_of(row.data)["requests"].get(project + ":" + request_id)
+        if pointer is None:
+            raise KeyError("The native maintain ticket request is unavailable")
+        return await self._load(pointer, project, repository)
+
+    async def current(self, data: Data, *, remote: bool = False, dispatch: bool = False) -> Data:
+        from firefly_forge.scm_natural_tasks import natural_policy_digest
+
+        marker = MaintainTicketMarker.model_validate(data.get("maintain_ticket")).model_dump(mode="json")
+        project, repository = marker["project_id"], data["repository_id"]
+        async with self.store._unit():
+            row, _ = await self.polling._state(repository)
+            state = state_of(row.data)
+            pointer = state["heads"].get(marker["run_id"])
+        if pointer is None or pointer.get("digest") != marker["binding_digest"]:
+            raise AccessDenied("The maintain ticket binding is no longer current")
+        value = await self._load(pointer, project, repository)
+        request = MaintainTicketInput.model_validate(value["request"])
+        async with self.store._unit():
+            administrator = await self.polling.users.find_by_id(identifier(value["admin_snapshot"]["user_id"]))
+            if administrator is None or not administrator.enabled:
+                raise AccessDenied("The maintain communication administrator is unavailable")
+        if not await ProjectAccess(self.store).authorize_actor(value["admin_snapshot"], project, "members"):
+            raise AccessDenied("Current factory administrator authority is required for maintain communication")
+        if (
+            value["request"]["request_id"] != marker["request_id"]
+            or await self.polling._latest(project, repository, KIND, request.run_id) != value["event_id"]
+            or value["policy_digest"] != natural_policy_digest()
+            or data["id"] != value["outbox_id"]
+            or data["digest"] != digest(marker)
+            or data["run_id"] != request.run_id
+        ):
+            raise AccessDenied("The native maintain notification lost its exact current receipt")
+        source = await self.polling._observation(project, repository, request.observed_receipt_id)
+        if observation_cut(source) != value["observation"] or source.get("source_conflict"):
+            raise AccessDenied("The native maintain observation changed")
+        for key in ("repository_id", "provider", "remote_id", "actor", "issue", "verification", "source_snapshot"):
+            if data.get(key) != source.get(key):
+                raise AccessDenied("The maintain notification destination changed")
+        if data.get("command") != {"action": "status", "run_id": request.run_id, "language": "en"}:
+            raise AccessDenied("A maintain notification cannot become an inbound command")
+        creation = await self._creation(request.creation_request_id)
+        run = await self.store.get_run(request.run_id)
+        creation_scope(run, creation)
+        if worker_request := run.get("worker_request"):
+            from firefly_forge.agent_roles import worker_feedback_model
+            from firefly_forge.native_question_publications import NativeQuestionPublications
+
+            entries = await NativeQuestionPublications(self.c)._entries(run["id"])
+            questions = [
+                entry
+                for entry in entries
+                if entry["kind"] == "worker_feedback"
+                and (entry["payload"].get("request") or {}).get("id") == worker_request.get("id")
+            ]
+            if len(questions) != 1:
+                raise AccessDenied("The maintain question requires one exact immutable worker feedback")
+            payload = questions[0]["payload"]
+            feedback = worker_feedback_model(payload).model_validate(payload)
+            if feedback.request is None or worker_request != {
+                **feedback.request.model_dump(),
+                "status": worker_request.get("status"),
+                "role_id": feedback.role_id,
+                "task_id": feedback.task_id,
+                "attempt": feedback.attempt,
+            }:
+                raise AccessDenied("The maintain question changed from its native feedback")
+        if creation["digest"] != value["creation_digest"]:
+            raise AccessDenied("The maintain child creation changed")
+        parent = await self.c.receipt(value["parent_reference"]["receipt_id"])
+        if observation_cut(parent) != value["parent_observation"]:
+            raise AccessDenied("The exact native parent ticket provenance changed")
+        scope, _, owner = await self._target(source, project, repository, remote=remote)
+        if (
+            scope != value["polling_scope"]
+            or owner != value["owner"]
+            or run["component_id"] not in scope["component_ids"]
+        ):
+            raise AccessDenied("The current maintain owner or native scope changed")
+        if dispatch:
+            async with self.store._unit():
+                row = await self.c.inbox.find_by_id(identifier(data["id"]))
+            if row is None or row.data.get("feedback_status") not in {"pending", "writing", "sent"}:
+                raise AccessDenied("An unknown maintain notification cannot be retried")
+            if len(row.data.get("feedback_history") or []) >= request.max_notifications:
+                raise AccessDenied("The explicit maintain notification allowance is exhausted")
+        context = {"binding": value, "run": run, "source": source, "scope": scope}
+        self.confirm_local_cut(context)
+        return context
+
+    @staticmethod
+    def confirm_local_cut(context: Data) -> None:
+        from firefly_forge.scm_natural_tasks import natural_policy_digest
+
+        value = context["binding"]
+        if value["policy_digest"] != natural_policy_digest() or clock_ms() >= value["expires_at_ms"]:
+            raise MaintainNotificationNotDispatched("The maintain communication policy or finite consent expired")
+
+    async def authorize_feedback(self, data: Data, *, remote: bool = False) -> Data:
+        try:
+            return await self.current(data, remote=remote, dispatch=True)
+        except (AccessDenied, KeyError, ValueError) as error:
+            raise MaintainNotificationNotDispatched(
+                "Current native maintain communication was refused before HTTP"
+            ) from error
+
+    async def authorize_reference(self, data: Data, run: Data, delivery: Data, scopes: list[Data]) -> None:
+        context = await self.current(data)
+        if (
+            context["run"]["id"] != run["id"]
+            or delivery["actor"] != data["actor"]
+            or not any(scope["native_user_id"] == context["binding"]["owner"]["user_id"] for scope in scopes)
+        ):
+            raise AccessDenied("Another project reader retains only checkpoint status access")
diff --git a/src/firefly_forge/scm_natural_effects.py b/src/firefly_forge/scm_natural_effects.py
index 2b36addb..b49df10e 100644
--- a/src/firefly_forge/scm_natural_effects.py
+++ b/src/firefly_forge/scm_natural_effects.py
@@ -309,9 +309,11 @@ async def review(self, receipt_id: str, *, remote: bool = True) -> Data:
         resume = self.collaboration.poll_resume_authority
         grant = (
             await resume._grant(context["scope"]["project_id"], parent["repository_id"], key=scopes[0]["binding_key"])
-            if resume
+            if resume and current.get("answer_only") is not True
             else None
         )
+        if current.get("answer_only") is True and resolution["state"] != "answer":
+            raise AccessDenied("Native maintain communication authorizes answers without continuation")
         native_cut = None
         if grant and grant["request"]["active"] and current["question_status"] == "answered":
             binding = await resume._binding(
diff --git a/src/firefly_forge/scm_natural_feedback.py b/src/firefly_forge/scm_natural_feedback.py
index 140c556f..bf789f08 100644
--- a/src/firefly_forge/scm_natural_feedback.py
+++ b/src/firefly_forge/scm_natural_feedback.py
@@ -8,11 +8,14 @@
 from typing import Any
 
 from firefly_forge.collaboration_feedback import _text
+from firefly_forge.scm_natural_links import delivery_links
 from firefly_forge.scm_natural_render import reply_quote
 from firefly_forge.scm_natural_runtime import catalog
 
 
-def natural_card(data: dict[str, Any], safe: Callable[[str], str]) -> str:
+def natural_card(
+    data: dict[str, Any], safe: Callable[[str], str], *, repository: dict[str, Any] | None = None, host: str = ""
+) -> str:
     turn = data["natural_turn"]
     language = (turn.get("decision") or {}).get("language") or data["command"].get("language", "en")
     copy = json.loads(catalog().text("scm-natural/copy", version="1.0.1"))[language]
@@ -22,7 +25,9 @@ def natural_card(data: dict[str, Any], safe: Callable[[str], str]) -> str:
     outcome = copy.get(state, copy["waiting"])
     message = str(turn.get("reply") or "")
     questions = (turn.get("decision") or {}).get("questions", [])
-    quote = reply_quote(message, questions, safe) if message else ""
+    quote = (
+        reply_quote(message, questions, safe, trusted_links=delivery_links(data, repository, host)) if message else ""
+    )
     resolution = turn.get("resolution") or {}
     if resolution.get("state") == "waiting" and len(resolution.get("candidates", [])) > 1:
         options = [
diff --git a/src/firefly_forge/scm_natural_links.py b/src/firefly_forge/scm_natural_links.py
new file mode 100644
index 00000000..9237b4f7
--- /dev/null
+++ b/src/firefly_forge/scm_natural_links.py
@@ -0,0 +1,117 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Internal delivery hrefs from already verified native status context, never model authority."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Literal
+from urllib.parse import urlsplit, urlunsplit
+
+from pydantic import Field, model_validator
+
+from firefly_forge.collaboration_feedback import _link
+from firefly_forge.scm_authority_models import Digest, NativeID, StrictContract
+from firefly_forge.scm_natural_models import SCOPE_FIELDS
+
+Data = dict[str, Any]
+
+
+class NativeDeliveryLinkV1(StrictContract):
+    version: Literal[1] = 1
+    kind: Literal["pull_request", "commit"]
+    href: str = Field(min_length=1, max_length=600)
+    run_id: NativeID
+    repository_id: NativeID
+    project_id: NativeID
+    checkpoint_revision: str = Field(pattern=r"^(?:[a-f0-9]{40}|[a-f0-9]{64})$")
+    checkpoint_digest: Digest
+
+    @model_validator(mode="after")
+    def canonical_delivery_path(self) -> NativeDeliveryLinkV1:
+        parsed = urlsplit(self.href)
+        suffix = r"pull/[1-9][0-9]{0,19}" if self.kind == "pull_request" else "commit/" + self.checkpoint_revision
+        if (
+            not self.href.isascii()
+            or parsed.scheme != "https"
+            or not parsed.netloc
+            or parsed.username
+            or parsed.password
+            or "?" in self.href
+            or "#" in self.href
+            or not re.fullmatch(r"/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/" + suffix, parsed.path)
+            or re.search(r"[\s<>\\\[\](){}]", self.href)
+        ):
+            raise ValueError("A native delivery href must have its exact canonical HTTPS SCM path")
+        return self
+
+
+def delivery_links(data: Data, repository: Data | None, host: str) -> tuple[NativeDeliveryLinkV1, ...]:
+    # This producer consumes server-owned context after native feedback authority checks.
+    # DTO construction alone does not verify a journal or confer a project read grant.
+    if (
+        repository is None
+        or data.get("provider") != "github"
+        or (repository.get("connection_provider") or repository.get("provider")) != "github"
+        or urlsplit(host).scheme != "https"
+    ):
+        return ()
+    turn = data.get("natural_turn") or {}
+    context = turn.get("context") or {}
+    scope = context.get("scope") or {}
+    candidates = context.get("candidates") or []
+    if (
+        (turn.get("decision") or {}).get("intent") != "status"
+        or set(scope) != set(SCOPE_FIELDS)
+        or any(scope.get(key) != data.get(key) for key in ("repository_id", "actor", "issue"))
+        or scope.get("repository_id") != repository.get("id")
+        or not isinstance(candidates, list)
+        or len(candidates) > 200
+    ):
+        return ()
+    links: dict[str, NativeDeliveryLinkV1] = {}
+    for row in candidates:
+        if not isinstance(row, dict) or any(row.get(key) != scope.get(key) for key in SCOPE_FIELDS):
+            continue
+        delivery = row.get("delivery") or {}
+        checkpoint, remote = delivery.get("checkpoint") or {}, delivery.get("remote") or {}
+        if (
+            delivery.get("evidence") != "verified_native_journal"
+            or delivery.get("product_acceptance") != "not_established_by_checkpoint"
+            or remote.get("status") not in {"draft", "ready"}
+        ):
+            continue
+        review = _link(remote.get("pr_url"), host, repository)
+        if not review:
+            continue
+        parsed = urlsplit(review)
+        if not re.fullmatch(r"/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/pull/[1-9][0-9]{0,19}", parsed.path):
+            continue
+        try:
+            shared = {
+                "run_id": row.get("run_id"),
+                "repository_id": scope.get("repository_id"),
+                "project_id": scope.get("project_id"),
+                "checkpoint_revision": checkpoint.get("revision"),
+                "checkpoint_digest": checkpoint.get("checkpoint_digest"),
+            }
+            pull = NativeDeliveryLinkV1.model_validate({"kind": "pull_request", "href": review, **shared})
+            commit = NativeDeliveryLinkV1.model_validate(
+                {
+                    "kind": "commit",
+                    "href": urlunsplit(
+                        (
+                            "https",
+                            parsed.netloc,
+                            parsed.path.rsplit("/pull/", 1)[0] + "/commit/" + pull.checkpoint_revision,
+                            "",
+                            "",
+                        )
+                    ),
+                    **shared,
+                }
+            )
+        except (TypeError, ValueError):
+            continue
+        for link in (pull, commit):
+            links.setdefault(link.href, link)
+    return tuple(links.values())
diff --git a/src/firefly_forge/scm_natural_models.py b/src/firefly_forge/scm_natural_models.py
index 266621e9..b9ebdd85 100644
--- a/src/firefly_forge/scm_natural_models.py
+++ b/src/firefly_forge/scm_natural_models.py
@@ -33,13 +33,13 @@ class NaturalDecision(BaseModel):
 
     @model_validator(mode="after")
     def unreviewed_dialogue(self) -> NaturalDecision:
-        from firefly_forge.scm_natural_render import reply_quote
+        from firefly_forge.scm_natural_render import validate_reply_quote
 
         if self.intent == "product" and self.questions:
             raise ValueError("A product handoff leaves architectural follow-up questions to the native product service")
         if any(not question.strip() for question in self.questions):
             raise ValueError("Typed questions cannot be empty")
-        reply_quote(self.message, self.questions, lambda text: text)
+        validate_reply_quote(self.message, self.questions)
         if self.proposal is not None:
             from firefly_forge.collaboration import ProductDefinition
 
@@ -201,6 +201,8 @@ def resolve_task(
     row = rows[choice - 1]
     if row.get("read_only") is True and decision.intent != "status":
         return result.model_copy(update={"reason": "read_only_reference"})
+    if row.get("answer_only") is True and decision.intent == "resume":
+        return result.model_copy(update={"reason": "answer_only_reference"})
     if row.get("origin") in {"product_assistant_turn", "natural_turn"}:
         if decision.intent == "resume":
             return result.model_copy(update={"reason": "product_answer_has_no_execution_authority"})
diff --git a/src/firefly_forge/scm_natural_render.py b/src/firefly_forge/scm_natural_render.py
index d3b930b9..8b4c3aae 100644
--- a/src/firefly_forge/scm_natural_render.py
+++ b/src/firefly_forge/scm_natural_render.py
@@ -1,18 +1,68 @@
 # Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
-"""Bound the complete escaped AI quote before accepting its typed response."""
+"""Bound complete AI quotations and preserve only server-verified delivery hrefs."""
 
+import re
 from collections.abc import Callable
 
-from firefly_forge.collaboration_feedback import _text
+from firefly_forge.collaboration_feedback import _escaped_text, _redact_settings, _text
+from firefly_forge.scm_natural_links import NativeDeliveryLinkV1
 
+_URL = r"https://[^\s<>\"\\()\[\]{}]+"
+_LINK = re.compile(
+    r"(?P<image>!?)\[(?P<label>[^\[\]\r\n]{1,200})\]\((?P<marked>" + _URL + r")\)|(?P<bare>" + _URL + r")"
+)
 
-def reply_quote(message: str, questions: list[str], safe: Callable[[str], str]) -> str:
-    def line(value: str) -> str:
-        return _text(value, safe, 6 * len(value) + 100, preserve_word_slashes=True)
 
+def _quote(message: str, questions: list[str], line: Callable[[str], str]) -> str:
     quote = "> " + "\n> ".join(line(value) for value in message.splitlines())
     if questions:
         quote += "\n>\n> " + "\n> ".join(f"{index}. {line(value)}" for index, value in enumerate(questions, 1))
     if len(quote) > 4000:
         raise ValueError("The complete reply and typed questions exceed the bounded public quote")
     return quote
+
+
+def validate_reply_quote(message: str, questions: list[str]) -> None:
+    def line(value: str) -> str:
+        # Count unredacted escaped text and possible bare-URL autolink delimiters.
+        # A restored native href cannot make the public quote exceed this bound.
+        return _escaped_text(value, 6 * len(value) + 100) + "xx" * value.count("https://")
+
+    _quote(message, questions, line)
+
+
+def reply_quote(
+    message: str,
+    questions: list[str],
+    safe: Callable[[str], str],
+    *,
+    trusted_links: tuple[NativeDeliveryLinkV1, ...] = (),
+) -> str:
+    allowed = {link.href for link in trusted_links if safe(link.href) == link.href}
+
+    def plain(value: str) -> str:
+        rendered = _text(value, lambda text: text, 6 * len(value) + 100, preserve_word_slashes=True)
+        if not rendered:
+            return " " if value else ""
+        return (" " if value.startswith(" ") else "") + rendered + (" " if value.endswith(" ") else "")
+
+    def line(value: str) -> str:
+        value = " ".join(_redact_settings(safe(value)).split())
+        if not allowed:
+            return plain(value)
+        result, cursor = [], 0
+        for match in _LINK.finditer(value):
+            result.append(plain(value[cursor : match.start()]))
+            raw = match["marked"] or match["bare"]
+            href = raw if match["marked"] else raw.rstrip(".,;!:")
+            if href not in allowed or match["image"]:
+                result.append(plain(match[0]))
+            elif match["marked"]:
+                result.append("[" + plain(match["label"]) + "](" + href + ")")
+            else:
+                result.append("<" + href + ">" + plain(raw[len(href) :]))
+            cursor = match.end()
+        result.append(plain(value[cursor:]))
+        return "".join(result)
+
+    return _quote(message, questions, line)
diff --git a/src/firefly_forge/scm_natural_tasks.py b/src/firefly_forge/scm_natural_tasks.py
index a8520467..d86eee39 100644
--- a/src/firefly_forge/scm_natural_tasks.py
+++ b/src/firefly_forge/scm_natural_tasks.py
@@ -49,11 +49,16 @@ def natural_policy_digest() -> str:
         "scm_poll_models.py",
         "scm_natural_feedback.py",
         "scm_natural_render.py",
+        "scm_natural_links.py",
+        "collaboration_feedback.py",
         "scm_natural_questions.py",
         "scm_natural_replies.py",
         "scm_natural_controllers.py",
         "scm_conversations.py",
         "scm_conversation_models.py",
+        "scm_maintain_ticket_models.py",
+        "scm_maintain_tickets.py",
+        "scm_maintain_ticket_controllers.py",
         "checkpoint_test_models.py",
         "run_creation_models.py",
         "run_creation_requests.py",
@@ -218,6 +223,8 @@ async def _context(self, delivery: Data, scopes: list[Data]) -> Data:
             )
             if question is not None:
                 candidates[-1].update(origin="worker_journal", publication=projection["publication"])
+                if original.get("maintain_ticket") is not None:
+                    candidates[-1]["answer_only"] = True
             elif checkpoint_source:
                 source = run["source_checkpoint_snapshot"]
                 candidates[-1].update(
@@ -285,6 +292,7 @@ async def _context(self, delivery: Data, scopes: list[Data]) -> Data:
         for original in previous:
             if (
                 original.get("natural_turn")
+                and original["natural_turn"].get("classifier_outcome") == "confirmed_valid"
                 and original.get("feedback_status") == "sent"
                 and original.get("actor") == delivery["actor"]
                 and original["natural_turn"]["context"]["scope"] == scope
diff --git a/src/firefly_forge/source_budget_allowances.py b/src/firefly_forge/source_budget_allowances.py
index 1b4b9347..a117d759 100644
--- a/src/firefly_forge/source_budget_allowances.py
+++ b/src/firefly_forge/source_budget_allowances.py
@@ -230,6 +230,9 @@ def admission_contract_digest() -> str:
                 "verification_source_preparation.py",
                 "verification_models.py",
                 "verification_handoffs.py",
+                "sandbox_command_slots.py",
+                "agentic_checkpoint_boundary.py",
+                "checkpoint_source_identity.py",
             )
         }
     )
diff --git a/src/firefly_forge/source_edit_continuations.py b/src/firefly_forge/source_edit_continuations.py
index 01ce2eb0..10011113 100644
--- a/src/firefly_forge/source_edit_continuations.py
+++ b/src/firefly_forge/source_edit_continuations.py
@@ -316,14 +316,15 @@ async def read() -> Data:
                 scope,
                 repository_root=workspace,
                 max_file_bytes=max(1, receipt["candidate"]["source_edit"]["max_result_bytes"] - 2048),
+                max_page_bytes=min(64000, max(1, receipt["candidate"]["source_edit"]["max_result_bytes"] - 2048)),
             )
             value: Data
             if request.tool == "list_files":
-                value = {"files": await tools.list_files()}
+                value = await tools.list_files_page(request.path, request.cursor, request.page_size)
             elif request.tool == "read_file":
                 value = {"path": request.path, "content": await tools.read_file(request.path)}
             else:
-                value = await tools.search_text(request.text, request.path, request.max_results)
+                value = await tools.search_text(request.text, request.path, request.max_results, request.cursor)
             await guard()
             return {**value, "source_digest": cut["source_digest"]}
 
diff --git a/src/firefly_forge/source_edit_models.py b/src/firefly_forge/source_edit_models.py
index dc346125..d7057025 100644
--- a/src/firefly_forge/source_edit_models.py
+++ b/src/firefly_forge/source_edit_models.py
@@ -39,13 +39,15 @@ class SourceReadRequest(BaseModel):
     path: str = Field(default="", max_length=1000)
     text: str = Field(default="", max_length=500)
     max_results: int = Field(default=50, ge=1, le=100)
+    cursor: str | None = Field(default=None, max_length=2048)
+    page_size: int = Field(default=100, ge=1, le=1000)
 
     @model_validator(mode="after")
     def exact_tool_arguments(self) -> "SourceReadRequest":
         allowed = {"request_id", "tool"} | {
-            "list_files": set(),
+            "list_files": {"path", "cursor", "page_size"},
             "read_file": {"path"},
-            "search_text": {"text", "path", "max_results"},
+            "search_text": {"text", "path", "max_results", "cursor"},
         }[self.tool]
         if self.model_fields_set - allowed or (self.tool == "read_file" and not self.path):
             raise ValueError("Select only the exact source reader arguments")
diff --git a/src/firefly_forge/source_edit_qualification.py b/src/firefly_forge/source_edit_qualification.py
index 9c47db74..db61f63b 100644
--- a/src/firefly_forge/source_edit_qualification.py
+++ b/src/firefly_forge/source_edit_qualification.py
@@ -14,8 +14,8 @@
 from firefly_forge.journal import digest
 from firefly_forge.source_edit_models import READ_TOOLS
 
-REGISTRY_VERSION = 8
-LOADER_PROFILE = "codex-exec-restricted-source/v9"
+REGISTRY_VERSION = 11
+LOADER_PROFILE = "codex-exec-restricted-source/v12"
 LOADER_MODULES = (
     "source_budget_allowances.py",
     "source_budget_output.py",
@@ -35,9 +35,10 @@
     "assurance.py",
     "prompts.py",
     "resources/prompts/v1/manifest.json",
-    "resources/prompts/v1/coding-runtime/source-list-1.0.1.yaml",
+    "resources/prompts/v1/coding-runtime/source-list-1.0.2.yaml",
     "resources/prompts/v1/coding-runtime/source-read-1.0.1.yaml",
-    "resources/prompts/v1/coding-runtime/source-search-1.0.1.yaml",
+    "resources/prompts/v1/coding-runtime/source-search-1.0.2.yaml",
+    "checkpoint_source_identity.py",
 )
 NATIVE_CAPABILITIES = (
     ("apply_patch", "custom"),
@@ -122,6 +123,7 @@ class CapabilityProfile:
     configuration_tools: tuple[tuple[str, bool], ...]
     proof: NativeQualificationProof
     source_budget_limits: tuple[tuple[str, int], ...] = ()
+    admission_contract_digest: str = ""
 
 
 def _profiles() -> tuple[CapabilityProfile, ...]:
@@ -186,6 +188,10 @@ def policy_digest() -> str:
 
 def profile_payload(profile: CapabilityProfile) -> dict[str, Any]:
     value = asdict(profile)
+    if profile.version < 9:
+        if profile.admission_contract_digest:
+            raise ValueError("Historical native profiles cannot acquire a new admission closure")
+        value.pop("admission_contract_digest")
     if profile.version == 4 and profile.loader_profile == "codex-exec-restricted-source/v5":
         if profile.source_budget_limits or profile.proof.budget_checks or profile.proof.budget_limits:
             raise ValueError("Historical native profiles cannot acquire new budget authority")
@@ -204,6 +210,9 @@ def historical_profile_seal(profile: CapabilityProfile) -> dict[str, Any]:
             (5, "codex-exec-restricted-source/v6"),
             (6, "codex-exec-restricted-source/v7"),
             (7, "codex-exec-restricted-source/v8"),
+            (8, "codex-exec-restricted-source/v9"),
+            (9, "codex-exec-restricted-source/v10"),
+            (10, "codex-exec-restricted-source/v11"),
         }
         or profile.proof.contract_digest != profile_contract_digest(profile)
     ):
@@ -247,6 +256,7 @@ def require_profile(profile: CapabilityProfile) -> None:
         or not isinstance(profile.proof, NativeQualificationProof)
     ):
         raise ValueError("Source-only execution requires a registered qualified native profile")
+    from firefly_forge.source_budget_allowances import admission_contract_digest
     from firefly_forge.source_edit_cli_policy import DISABLED_FEATURES
     from firefly_forge.source_edit_filesystem_policy import FILESYSTEM_POLICY_VERSION
     from firefly_forge.source_edit_model_catalog import model_catalog_sha256
@@ -261,6 +271,9 @@ def require_profile(profile: CapabilityProfile) -> None:
     hashes = (profile.executable_sha256, proof.artifact_sha256, *(row[2] for row in profile.catalog))
     if (
         profile.version != REGISTRY_VERSION
+        or not isinstance(profile.admission_contract_digest, str)
+        or re.fullmatch(r"[a-f0-9]{64}", profile.admission_contract_digest) is None
+        or profile.admission_contract_digest != admission_contract_digest()
         or proof.contract_digest != profile_contract_digest(profile)
         or not re.fullmatch(r"[a-z0-9_-]{1,100}", profile.profile_id)
         or any(re.fullmatch(r"[a-f0-9]{64}", value) is None for value in hashes)
diff --git a/src/firefly_forge/source_edit_supported_profiles.py b/src/firefly_forge/source_edit_supported_profiles.py
index 428b32a1..0e4205fb 100644
--- a/src/firefly_forge/source_edit_supported_profiles.py
+++ b/src/firefly_forge/source_edit_supported_profiles.py
@@ -800,4 +800,497 @@
         ),
         source_budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
     ),
+    CapabilityProfile(
+        version=9,
+        profile_id="codex-0163-darwin-arm64-source-v10",
+        executable_sha256="8813367285524ac798dd96d1b071aea30d58708c7226fd236cd275cf1cfdee31",
+        executable_size=249952688,
+        system="Darwin",
+        machine="arm64",
+        model="gpt-6-astra",
+        model_catalog_sha256="0321266b8a9e1812c9fdc11d64cd36201a4d070d93ca3808186fada2cd149094",
+        native_provider="openai",
+        policy_digest="fedc682612c2d2ae34225ced0a2abe7e55ac32cae312a638ae2da1b19a3e585e",
+        loader_profile="codex-exec-restricted-source/v10",
+        loader_hashes=(
+            ("source_budget_allowances.py", "07b43f0cf43686cbef1ce289e1f07f41a3ff1a2aab40f154a540aa8970da94a2"),
+            ("source_budget_output.py", "2e6abe9d002bac3fcac9e6434d163b9010bb099dccff76807851934dfa7da004"),
+            ("source_tool_budget.py", "d010387f2bad64d473b73aa85707a50683c0f1fb4725324c62aeb6eedfc33a18"),
+            ("tool_broker.py", "88801fc17d678e0abbf99a37e97d8a11987306cb8e800b1e3717f2947acb2dc9"),
+            ("providers.py", "ee46280539838b282ab97fc179190103d316e284d50d5a6d29a0e0c235d98556"),
+            ("source_edit_cli_policy.py", "684d6b2e408de53a666f7c44342960e63df71e16d5abd7818e181177a0d78f44"),
+            ("coding_cli_channel.py", "e510b988d7b6794e9b663b97fb51824a774988b3a401e487367fbcdfbe0a5fdd"),
+            ("coding_check_transport.py", "ebb2aa78acce9d88ffd63e5d27f3b965639c59780fb02adc3bb800ad4b88354f"),
+            ("source_edit_models.py", "1519bc30b3e0730646c863c2cb513da7a817b9be18841d24660791c96ad8b50a"),
+            ("native_configuration_rpc.py", "23253c99e0f2484f1edb417b6d34cd81ba46840008bdf57f22f8978085bbf865"),
+            ("source_edit_filesystem_policy.py", "0225171b52d666fb557ab8c3690b64ba4a7f728ede23174246c2e37a9319e906"),
+            ("workspace_tools.py", "f8470dff0ea4e3ef22b83f07e7b871f2c69ca1f3ada2bafaf746c6cc3061ec70"),
+            ("source_edit_continuations.py", "aa036d6f13b3d76ff5af5d8dce15664fab3cdcf33100bdb021ce8a03f4adb01a"),
+            ("source_edit_model_catalog.py", "64caf6244169f2333596ab336f809ba39d46780519d8b95530eacbdcb9483cb0"),
+            ("verification_models.py", "ca07c065197756acfa604d72ae8406904830bda4df116f342fc3ad69edf6070f"),
+            ("assurance.py", "8a37fefb061e6f9d1d07a25d0d05e95c3a053ce5e24612b7304063ef1dbbab76"),
+            ("prompts.py", "35ae376d746c1dab0d1e2c4a1258db0407d643972901f8370a4ee38408746377"),
+            ("resources/prompts/v1/manifest.json", "224074d5a007d53e5ccf8d286dac5fe00a9a0a0952d1a45093cee47129d5ee43"),
+            (
+                "resources/prompts/v1/coding-runtime/source-list-1.0.1.yaml",
+                "8a3ef3eadff60c42583726263aa6e8a1cb5c78723bc062864effec876d97ec2f",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-read-1.0.1.yaml",
+                "b03731ba6352795909d5981e753a2d0c537b64963c3eea42515349eeb96c185c",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-search-1.0.1.yaml",
+                "c50ae29419f7aeb72fd39dcfccd2ec779bdebdc7a80ec47a3f316b714a0b5084",
+            ),
+        ),
+        runtime_versions=(("python", "3.13.13"), ("mcp", "2.3.0"), ("pydantic", "2.14.1")),
+        catalog=(
+            ("apply_patch", "custom", "5947b870d79e16bddc34946a4afb6200ff14a97f8419a2d23f8e5040af9a7154"),
+            ("clock.curr_time", "function", "edaec0f2ab8a7e6b6b7529df3b536a4646074b132531aeaebbd4d907bb8c7c71"),
+            ("forge_coding.list_files", "function", "54cf7b388b34f9e89295e952141155327984696049fd154e211392dbe95a984c"),
+            ("forge_coding.read_file", "function", "65296b12fed74b8f4cae6272d97e3aa3f0819dc103d3dea1481d46d132c42b27"),
+            (
+                "forge_coding.search_text",
+                "function",
+                "6bc915447ecf8c2d2ac90f1446bd601af16c78ca38bb31e78712bb0acd833459",
+            ),
+            (
+                "list_mcp_resource_templates",
+                "function",
+                "7f87264594875ab2a6f833c1b92164f6a75641ea1dcb2d2fab4facb35c3f7dfe",
+            ),
+            ("list_mcp_resources", "function", "5aef64ff99b28c2c096ea2dc4e5673502a4c291736d64132dc9e4e939f509f6e"),
+            ("read_mcp_resource", "function", "23f2d43fece9ce15ecf4d9b3e283cd56d1f9dd14b5ee54455e9aca97a7accd9f"),
+        ),
+        configuration_features=(
+            ("agent_message_board", False),
+            ("api_key_cyber_access_programs", True),
+            ("api_key_model_discovery", True),
+            ("apps", False),
+            ("auth_elicitation", True),
+            ("background_paginated_rollout_migration", False),
+            ("browser_use", False),
+            ("browser_use_external", False),
+            ("browser_use_full_cdp_access", False),
+            ("code_mode", False),
+            ("codex_apps_mcp_2026_07_28", False),
+            ("computer_use", False),
+            ("deferred_executor", False),
+            ("goals", False),
+            ("hooks", False),
+            ("image_generation", False),
+            ("mcp_2026_07_28", False),
+            ("memories", False),
+            ("mentions_v2", True),
+            ("multi_agent", False),
+            ("multi_agent_v2", False),
+            ("multi_agent_v2_dynamic_tools", False),
+            ("network_proxy", None),
+            ("plugins", False),
+            ("remote_control", False),
+            ("remote_plugin", False),
+            ("request_permissions_tool", False),
+            ("send_message_to_user_async", False),
+            ("shell_tool", False),
+            ("skill_env_var_dependency_prompt", False),
+            ("skill_mcp_dependency_install", False),
+            ("skill_search", False),
+            ("skip_host_skill_discovery", True),
+            ("sleep_tool", False),
+            ("token_budget", False),
+            ("tool_suggest", False),
+            ("view_image", False),
+            ("windows_sandbox_service", False),
+        ),
+        configuration_tools=(("update_plan", False), ("experimental_request_user_input", False)),
+        proof=NativeQualificationProof(
+            artifact_sha256="fce2552bb4e16b77fe206c7ffbc0c477181bb6ea73144d263cfb7710ebcce15e",
+            contract_digest="c7933a48e71cb9b83963daf4535cd70cc9ecd6411fdb34278faa109c86108fb7",
+            exit_code=0,
+            requests=251,
+            outcome_checks=(
+                "list_files",
+                "read_file",
+                "search_text",
+                "apply_patch",
+                "curr_time",
+                "list_mcp_resources",
+                "list_mcp_resource_templates",
+                "file_resource_denied",
+                "https_resource_denied",
+                "unknown_server_read_denied",
+                "unknown_server_list_denied",
+                "unknown_server_templates_denied",
+                "exec_command_denied",
+                "exec_alias_denied",
+                "collaboration_tools_denied",
+                "tool_search_denied",
+                "source_reader_bounds_enforced",
+            ),
+            reader_calls=("list_files", "read_file", "search_text"),
+            group_absent=True,
+            streams_drained=True,
+            real_model_calls=0,
+            filesystem_policy_version=2,
+            filesystem_checks=(
+                "patch_add",
+                "patch_update",
+                "patch_move",
+                "patch_delete",
+                "private_read_denied",
+                "private_write_denied",
+                "outside_read_denied",
+                "outside_write_denied",
+                "case_alias_read_denied",
+                "case_alias_write_denied",
+                "public_env_example_allowed",
+                "filesystem_groups_absent",
+                "filesystem_streams_drained",
+            ),
+            budget_checks=(
+                "legacy_read_limit10",
+                "amended_read_limit",
+                "shared_total_limit30",
+                "definite_refusal_no_effect",
+                "remaining_capabilities_exact",
+                "unamended_activation_limit4",
+                "amended_canonical_activation",
+                "unknown_never_replayed",
+                "known_completed_output_finite_activation",
+            ),
+            budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        ),
+        source_budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        admission_contract_digest="43ea128557edad65492e54bec5db40db9b163a52aa68217c04c96651cb11c603",
+    ),
+    CapabilityProfile(
+        version=10,
+        profile_id="codex-0163-darwin-arm64-source-v11",
+        executable_sha256="8813367285524ac798dd96d1b071aea30d58708c7226fd236cd275cf1cfdee31",
+        executable_size=249952688,
+        system="Darwin",
+        machine="arm64",
+        model="gpt-6-astra",
+        model_catalog_sha256="0321266b8a9e1812c9fdc11d64cd36201a4d070d93ca3808186fada2cd149094",
+        native_provider="openai",
+        policy_digest="fedc682612c2d2ae34225ced0a2abe7e55ac32cae312a638ae2da1b19a3e585e",
+        loader_profile="codex-exec-restricted-source/v11",
+        loader_hashes=(
+            ("source_budget_allowances.py", "9dbed6c512df24c23b62a363d0a4cf83ccd8fb0b1068ab41b0c56172e9c49266"),
+            ("source_budget_output.py", "2e6abe9d002bac3fcac9e6434d163b9010bb099dccff76807851934dfa7da004"),
+            ("source_tool_budget.py", "d010387f2bad64d473b73aa85707a50683c0f1fb4725324c62aeb6eedfc33a18"),
+            ("tool_broker.py", "88801fc17d678e0abbf99a37e97d8a11987306cb8e800b1e3717f2947acb2dc9"),
+            ("providers.py", "ee46280539838b282ab97fc179190103d316e284d50d5a6d29a0e0c235d98556"),
+            ("source_edit_cli_policy.py", "684d6b2e408de53a666f7c44342960e63df71e16d5abd7818e181177a0d78f44"),
+            ("coding_cli_channel.py", "e510b988d7b6794e9b663b97fb51824a774988b3a401e487367fbcdfbe0a5fdd"),
+            ("coding_check_transport.py", "ebb2aa78acce9d88ffd63e5d27f3b965639c59780fb02adc3bb800ad4b88354f"),
+            ("source_edit_models.py", "1519bc30b3e0730646c863c2cb513da7a817b9be18841d24660791c96ad8b50a"),
+            ("native_configuration_rpc.py", "23253c99e0f2484f1edb417b6d34cd81ba46840008bdf57f22f8978085bbf865"),
+            ("source_edit_filesystem_policy.py", "0225171b52d666fb557ab8c3690b64ba4a7f728ede23174246c2e37a9319e906"),
+            ("workspace_tools.py", "f8470dff0ea4e3ef22b83f07e7b871f2c69ca1f3ada2bafaf746c6cc3061ec70"),
+            ("source_edit_continuations.py", "aa036d6f13b3d76ff5af5d8dce15664fab3cdcf33100bdb021ce8a03f4adb01a"),
+            ("source_edit_model_catalog.py", "64caf6244169f2333596ab336f809ba39d46780519d8b95530eacbdcb9483cb0"),
+            ("verification_models.py", "ca07c065197756acfa604d72ae8406904830bda4df116f342fc3ad69edf6070f"),
+            ("assurance.py", "8a37fefb061e6f9d1d07a25d0d05e95c3a053ce5e24612b7304063ef1dbbab76"),
+            ("prompts.py", "35ae376d746c1dab0d1e2c4a1258db0407d643972901f8370a4ee38408746377"),
+            ("resources/prompts/v1/manifest.json", "224074d5a007d53e5ccf8d286dac5fe00a9a0a0952d1a45093cee47129d5ee43"),
+            (
+                "resources/prompts/v1/coding-runtime/source-list-1.0.1.yaml",
+                "8a3ef3eadff60c42583726263aa6e8a1cb5c78723bc062864effec876d97ec2f",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-read-1.0.1.yaml",
+                "b03731ba6352795909d5981e753a2d0c537b64963c3eea42515349eeb96c185c",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-search-1.0.1.yaml",
+                "c50ae29419f7aeb72fd39dcfccd2ec779bdebdc7a80ec47a3f316b714a0b5084",
+            ),
+        ),
+        runtime_versions=(("python", "3.13.13"), ("mcp", "2.3.0"), ("pydantic", "2.14.1")),
+        catalog=(
+            ("apply_patch", "custom", "5947b870d79e16bddc34946a4afb6200ff14a97f8419a2d23f8e5040af9a7154"),
+            ("clock.curr_time", "function", "edaec0f2ab8a7e6b6b7529df3b536a4646074b132531aeaebbd4d907bb8c7c71"),
+            ("forge_coding.list_files", "function", "54cf7b388b34f9e89295e952141155327984696049fd154e211392dbe95a984c"),
+            ("forge_coding.read_file", "function", "65296b12fed74b8f4cae6272d97e3aa3f0819dc103d3dea1481d46d132c42b27"),
+            (
+                "forge_coding.search_text",
+                "function",
+                "6bc915447ecf8c2d2ac90f1446bd601af16c78ca38bb31e78712bb0acd833459",
+            ),
+            (
+                "list_mcp_resource_templates",
+                "function",
+                "7f87264594875ab2a6f833c1b92164f6a75641ea1dcb2d2fab4facb35c3f7dfe",
+            ),
+            ("list_mcp_resources", "function", "5aef64ff99b28c2c096ea2dc4e5673502a4c291736d64132dc9e4e939f509f6e"),
+            ("read_mcp_resource", "function", "23f2d43fece9ce15ecf4d9b3e283cd56d1f9dd14b5ee54455e9aca97a7accd9f"),
+        ),
+        configuration_features=(
+            ("agent_message_board", False),
+            ("api_key_cyber_access_programs", True),
+            ("api_key_model_discovery", True),
+            ("apps", False),
+            ("auth_elicitation", True),
+            ("background_paginated_rollout_migration", False),
+            ("browser_use", False),
+            ("browser_use_external", False),
+            ("browser_use_full_cdp_access", False),
+            ("code_mode", False),
+            ("codex_apps_mcp_2026_07_28", False),
+            ("computer_use", False),
+            ("deferred_executor", False),
+            ("goals", False),
+            ("hooks", False),
+            ("image_generation", False),
+            ("mcp_2026_07_28", False),
+            ("memories", False),
+            ("mentions_v2", True),
+            ("multi_agent", False),
+            ("multi_agent_v2", False),
+            ("multi_agent_v2_dynamic_tools", False),
+            ("network_proxy", None),
+            ("plugins", False),
+            ("remote_control", False),
+            ("remote_plugin", False),
+            ("request_permissions_tool", False),
+            ("send_message_to_user_async", False),
+            ("shell_tool", False),
+            ("skill_env_var_dependency_prompt", False),
+            ("skill_mcp_dependency_install", False),
+            ("skill_search", False),
+            ("skip_host_skill_discovery", True),
+            ("sleep_tool", False),
+            ("token_budget", False),
+            ("tool_suggest", False),
+            ("view_image", False),
+            ("windows_sandbox_service", False),
+        ),
+        configuration_tools=(("update_plan", False), ("experimental_request_user_input", False)),
+        proof=NativeQualificationProof(
+            artifact_sha256="39f009210fb36e7c00ce4cf28d5e9d4bbf05032661052f4af228c02d932e42bc",
+            contract_digest="066ff03949022fac15b06e85afc81e33a0a3d56a2b7274266122d073b42a7086",
+            exit_code=0,
+            requests=251,
+            outcome_checks=(
+                "list_files",
+                "read_file",
+                "search_text",
+                "apply_patch",
+                "curr_time",
+                "list_mcp_resources",
+                "list_mcp_resource_templates",
+                "file_resource_denied",
+                "https_resource_denied",
+                "unknown_server_read_denied",
+                "unknown_server_list_denied",
+                "unknown_server_templates_denied",
+                "exec_command_denied",
+                "exec_alias_denied",
+                "collaboration_tools_denied",
+                "tool_search_denied",
+                "source_reader_bounds_enforced",
+            ),
+            reader_calls=("list_files", "read_file", "search_text"),
+            group_absent=True,
+            streams_drained=True,
+            real_model_calls=0,
+            filesystem_policy_version=2,
+            filesystem_checks=(
+                "patch_add",
+                "patch_update",
+                "patch_move",
+                "patch_delete",
+                "private_read_denied",
+                "private_write_denied",
+                "outside_read_denied",
+                "outside_write_denied",
+                "case_alias_read_denied",
+                "case_alias_write_denied",
+                "public_env_example_allowed",
+                "filesystem_groups_absent",
+                "filesystem_streams_drained",
+            ),
+            budget_checks=(
+                "legacy_read_limit10",
+                "amended_read_limit",
+                "shared_total_limit30",
+                "definite_refusal_no_effect",
+                "remaining_capabilities_exact",
+                "unamended_activation_limit4",
+                "amended_canonical_activation",
+                "unknown_never_replayed",
+                "known_completed_output_finite_activation",
+            ),
+            budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        ),
+        source_budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        admission_contract_digest="4650001652321308f9b26ab32f08da06b23d74700c63d3bfe2615b1feeba7850",
+    ),
+    CapabilityProfile(
+        version=11,
+        profile_id="codex-0163-darwin-arm64-source-v12",
+        executable_sha256="8813367285524ac798dd96d1b071aea30d58708c7226fd236cd275cf1cfdee31",
+        executable_size=249952688,
+        system="Darwin",
+        machine="arm64",
+        model="gpt-6-astra",
+        model_catalog_sha256="0321266b8a9e1812c9fdc11d64cd36201a4d070d93ca3808186fada2cd149094",
+        native_provider="openai",
+        policy_digest="fedc682612c2d2ae34225ced0a2abe7e55ac32cae312a638ae2da1b19a3e585e",
+        loader_profile="codex-exec-restricted-source/v12",
+        loader_hashes=(
+            ("source_budget_allowances.py", "164a23834c78f0a5e57ec9eff821a313d9daa89805b6deaa56a5584ed295818e"),
+            ("source_budget_output.py", "2e6abe9d002bac3fcac9e6434d163b9010bb099dccff76807851934dfa7da004"),
+            ("source_tool_budget.py", "d010387f2bad64d473b73aa85707a50683c0f1fb4725324c62aeb6eedfc33a18"),
+            ("tool_broker.py", "88801fc17d678e0abbf99a37e97d8a11987306cb8e800b1e3717f2947acb2dc9"),
+            ("providers.py", "ee46280539838b282ab97fc179190103d316e284d50d5a6d29a0e0c235d98556"),
+            ("source_edit_cli_policy.py", "684d6b2e408de53a666f7c44342960e63df71e16d5abd7818e181177a0d78f44"),
+            ("coding_cli_channel.py", "e510b988d7b6794e9b663b97fb51824a774988b3a401e487367fbcdfbe0a5fdd"),
+            ("coding_check_transport.py", "fc57de181fa450c8725d1968538c88d9760d978b78aa8a420d9444f693c46b1f"),
+            ("source_edit_models.py", "547da792c5b7338980043fb845d845825cad8b5bbd4c246af6440f1669bfbdaa"),
+            ("native_configuration_rpc.py", "23253c99e0f2484f1edb417b6d34cd81ba46840008bdf57f22f8978085bbf865"),
+            ("source_edit_filesystem_policy.py", "0225171b52d666fb557ab8c3690b64ba4a7f728ede23174246c2e37a9319e906"),
+            ("workspace_tools.py", "53d9977ebcb050abcda6592baf09cf3de96f26fb6b3ce40fddbec2a2236d2dce"),
+            ("source_edit_continuations.py", "2ea1f6934b72c035e3922e724de7b17575000f28df000ab69a5e67751bed995e"),
+            ("source_edit_model_catalog.py", "64caf6244169f2333596ab336f809ba39d46780519d8b95530eacbdcb9483cb0"),
+            ("verification_models.py", "ca07c065197756acfa604d72ae8406904830bda4df116f342fc3ad69edf6070f"),
+            ("assurance.py", "8a37fefb061e6f9d1d07a25d0d05e95c3a053ce5e24612b7304063ef1dbbab76"),
+            ("prompts.py", "35ae376d746c1dab0d1e2c4a1258db0407d643972901f8370a4ee38408746377"),
+            ("resources/prompts/v1/manifest.json", "e1b38a749ce669c863dfc3fad3c88a402d72219ce8a9d7b992998535155a4bca"),
+            (
+                "resources/prompts/v1/coding-runtime/source-list-1.0.2.yaml",
+                "85376d131679dd2220b1556fac1caba1d45fead764c6f87319b185f33a99e107",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-read-1.0.1.yaml",
+                "b03731ba6352795909d5981e753a2d0c537b64963c3eea42515349eeb96c185c",
+            ),
+            (
+                "resources/prompts/v1/coding-runtime/source-search-1.0.2.yaml",
+                "83bbd8df12bfd4414803601e0c97005c97216d97a8f9468f7518b738a2dc9544",
+            ),
+            ("checkpoint_source_identity.py", "7389ab1749f3f8ef0c93b15a907e36b0448a60223b880a097cfaa482d1500a73"),
+        ),
+        runtime_versions=(("python", "3.13.13"), ("mcp", "2.3.0"), ("pydantic", "2.14.1")),
+        catalog=(
+            ("apply_patch", "custom", "5947b870d79e16bddc34946a4afb6200ff14a97f8419a2d23f8e5040af9a7154"),
+            ("clock.curr_time", "function", "edaec0f2ab8a7e6b6b7529df3b536a4646074b132531aeaebbd4d907bb8c7c71"),
+            ("forge_coding.list_files", "function", "81f9e4284aa7c7caae29cdbc689bf633836f867cf385553ff1fc2e520c66615f"),
+            ("forge_coding.read_file", "function", "65296b12fed74b8f4cae6272d97e3aa3f0819dc103d3dea1481d46d132c42b27"),
+            (
+                "forge_coding.search_text",
+                "function",
+                "491a60f4a27fca5cda18477fab8be4d623d24c2818db2bd2a89fadd572b2c6a1",
+            ),
+            (
+                "list_mcp_resource_templates",
+                "function",
+                "7f87264594875ab2a6f833c1b92164f6a75641ea1dcb2d2fab4facb35c3f7dfe",
+            ),
+            ("list_mcp_resources", "function", "5aef64ff99b28c2c096ea2dc4e5673502a4c291736d64132dc9e4e939f509f6e"),
+            ("read_mcp_resource", "function", "23f2d43fece9ce15ecf4d9b3e283cd56d1f9dd14b5ee54455e9aca97a7accd9f"),
+        ),
+        configuration_features=(
+            ("agent_message_board", False),
+            ("api_key_cyber_access_programs", True),
+            ("api_key_model_discovery", True),
+            ("apps", False),
+            ("auth_elicitation", True),
+            ("background_paginated_rollout_migration", False),
+            ("browser_use", False),
+            ("browser_use_external", False),
+            ("browser_use_full_cdp_access", False),
+            ("code_mode", False),
+            ("codex_apps_mcp_2026_07_28", False),
+            ("computer_use", False),
+            ("deferred_executor", False),
+            ("goals", False),
+            ("hooks", False),
+            ("image_generation", False),
+            ("mcp_2026_07_28", False),
+            ("memories", False),
+            ("mentions_v2", True),
+            ("multi_agent", False),
+            ("multi_agent_v2", False),
+            ("multi_agent_v2_dynamic_tools", False),
+            ("network_proxy", None),
+            ("plugins", False),
+            ("remote_control", False),
+            ("remote_plugin", False),
+            ("request_permissions_tool", False),
+            ("send_message_to_user_async", False),
+            ("shell_tool", False),
+            ("skill_env_var_dependency_prompt", False),
+            ("skill_mcp_dependency_install", False),
+            ("skill_search", False),
+            ("skip_host_skill_discovery", True),
+            ("sleep_tool", False),
+            ("token_budget", False),
+            ("tool_suggest", False),
+            ("view_image", False),
+            ("windows_sandbox_service", False),
+        ),
+        configuration_tools=(("update_plan", False), ("experimental_request_user_input", False)),
+        proof=NativeQualificationProof(
+            artifact_sha256="828563d006bf0ac8e12aa4e5aaaad224ba446fd56fd9a621f75d0b6d77ede0e8",
+            contract_digest="c91dcf4930810f550d6c843f25f82e9c5a8436bf182ca58297cf98536550b88c",
+            exit_code=0,
+            requests=251,
+            outcome_checks=(
+                "list_files",
+                "read_file",
+                "search_text",
+                "apply_patch",
+                "curr_time",
+                "list_mcp_resources",
+                "list_mcp_resource_templates",
+                "file_resource_denied",
+                "https_resource_denied",
+                "unknown_server_read_denied",
+                "unknown_server_list_denied",
+                "unknown_server_templates_denied",
+                "exec_command_denied",
+                "exec_alias_denied",
+                "collaboration_tools_denied",
+                "tool_search_denied",
+                "source_reader_bounds_enforced",
+            ),
+            reader_calls=("list_files", "read_file", "search_text"),
+            group_absent=True,
+            streams_drained=True,
+            real_model_calls=0,
+            filesystem_policy_version=2,
+            filesystem_checks=(
+                "patch_add",
+                "patch_update",
+                "patch_move",
+                "patch_delete",
+                "private_read_denied",
+                "private_write_denied",
+                "outside_read_denied",
+                "outside_write_denied",
+                "case_alias_read_denied",
+                "case_alias_write_denied",
+                "public_env_example_allowed",
+                "filesystem_groups_absent",
+                "filesystem_streams_drained",
+            ),
+            budget_checks=(
+                "legacy_read_limit10",
+                "amended_read_limit",
+                "shared_total_limit30",
+                "definite_refusal_no_effect",
+                "remaining_capabilities_exact",
+                "unamended_activation_limit4",
+                "amended_canonical_activation",
+                "unknown_never_replayed",
+                "known_completed_output_finite_activation",
+            ),
+            budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        ),
+        source_budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 6)),
+        admission_contract_digest="479e4e4d36834d0fb02b0e54913e155ac27099be682c606993f86457b77daaac",
+    ),
 )
diff --git a/src/firefly_forge/workspace_tools.py b/src/firefly_forge/workspace_tools.py
index 2d5ad778..c458c50e 100644
--- a/src/firefly_forge/workspace_tools.py
+++ b/src/firefly_forge/workspace_tools.py
@@ -3,15 +3,19 @@
 
 from __future__ import annotations
 
+import asyncio
+import base64
+import codecs
 import hashlib
+import json
 import os
 import stat
 import sys
-from collections.abc import Awaitable, Callable
-from contextlib import suppress
+from collections.abc import Awaitable, Callable, Iterator
+from contextlib import contextmanager, suppress
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, BinaryIO
 
 from firefly_forge.process import ProcessResult, execute
 from firefly_forge.prompts import prompt_text
@@ -94,9 +98,31 @@ def _directory_path(path: Path) -> Path:
         os.close(fd)
 
 
+def _source_stamp(info: os.stat_result) -> tuple[int, ...]:
+    return tuple(
+        getattr(info, "st_" + key) for key in ("dev", "ino", "uid", "mode", "nlink", "size", "mtime_ns", "ctime_ns")
+    )
+
+
+def _source_root_identity(root: Path) -> tuple[int, int, int]:
+    info = root.lstat()
+    if not stat.S_ISDIR(info.st_mode) or root.is_symlink() or info.st_uid != os.geteuid():
+        raise ValueError("Workspace must retain its owned directory identity")
+    return info.st_dev, info.st_ino, info.st_uid
+
+
+def _page_json(value: Any) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+
+
 class WorkspaceTools:
     def __init__(
-        self, workspace: Path, *, repository_root: Path | None = None, max_file_bytes: int = 1_000_000
+        self,
+        workspace: Path,
+        *,
+        repository_root: Path | None = None,
+        max_file_bytes: int = 1_000_000,
+        max_page_bytes: int = 64000,
     ) -> None:
         if workspace.is_symlink() or not workspace.is_dir():
             raise ValueError("Workspace must be a real directory")
@@ -107,6 +133,10 @@ def __init__(
         self.repository_root = _directory_path(repository)
         if not self.root.is_relative_to(self.repository_root):
             raise ValueError("Workspace must be confined to the repository")
+        self._source_root = _source_root_identity(self.root)
+        if type(max_page_bytes) is not int or max_page_bytes < 1:
+            raise ValueError("Source response window must be a positive byte budget")
+        self.max_page_bytes = max_page_bytes
         self.max_file_bytes = max_file_bytes
         self.files_written: set[str] = set()
 
@@ -197,55 +227,343 @@ async def write_file(self, path: str, content: str, *, expected_sha256: str | No
         finally:
             os.close(parent)
 
-    async def list_files(self) -> list[str]:
-        """List at most 2000 project source paths; exclude dependencies, credentials and symlinks."""
-        output: list[str] = []
-        skipped = {".git", ".env", ".npmrc", ".ssh", ".venv", "node_modules", "vendor", "__pycache__", "dist", "build"}
-        for directory, folders, files in os.walk(self.root, followlinks=False):
-            base = Path(directory)
-            folders[:] = sorted(
-                p for p in folders if p not in skipped and not _private_name(p) and not (base / p).is_symlink()
+    @contextmanager
+    def _source_file(self, path: str, expected: tuple[int, ...] | None = None) -> Iterator[BinaryIO]:
+        parts = self._parts(path)
+        parent = self._parent_fd(parts, create=False)
+        try:
+            try:
+                fd = os.open(parts[-1], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=parent)
+            except OSError:
+                raise ValueError("Selected source is unreadable or linked") from None
+            with os.fdopen(fd, "rb") as source:
+                info = os.fstat(source.fileno())
+                if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
+                    raise ValueError("Selected source requires regular files without links or aliases")
+                if info.st_uid != os.geteuid():
+                    raise ValueError("Selected source ownership changed")
+                self._check_descriptor(source.fileno())
+                if _descriptor_path(source.fileno()).as_posix() != (self.root / path).as_posix():
+                    raise ValueError("Selected source has a case or path alias")
+                before = _source_stamp(info)
+                if expected is not None and before != expected:
+                    raise ValueError("Selected source changed before reading")
+                yield source
+                if _source_stamp(os.fstat(source.fileno())) != before:
+                    raise ValueError("Selected source changed while reading")
+        finally:
+            os.close(parent)
+
+    def _source_absence(self, path: str) -> tuple[str, tuple[int, ...]] | None:
+        parts = self._parts(path)
+        parent = os.open(self.root, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        try:
+            self._check_descriptor(parent)
+            for ordinal, name in enumerate(parts):
+                try:
+                    os.stat(name, dir_fd=parent, follow_symlinks=False)
+                except FileNotFoundError:
+                    return "/".join(parts[: ordinal + 1]), _source_stamp(os.fstat(parent))
+                if ordinal == len(parts) - 1:
+                    return None
+                child = os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=parent)
+                os.close(parent)
+                parent = child
+                if os.fstat(parent).st_uid != os.geteuid():
+                    raise ValueError("Selected source directory ownership changed")
+                self._check_descriptor(parent)
+                if _descriptor_path(parent) != self.root.joinpath(*parts[: ordinal + 1]):
+                    raise ValueError("Selected source directory has a case or path alias")
+        except OSError:
+            raise ValueError("Selected source is unreadable or linked") from None
+        finally:
+            os.close(parent)
+        return None
+
+    async def _inventory(self, prefix: str = "") -> tuple[list[tuple[str, tuple[int, ...]]], str]:
+        prefix = "/".join(self._parts(prefix)) if prefix else ""
+        if _source_root_identity(self.root) != self._source_root:
+            raise ValueError("Workspace identity changed")
+        selected: dict[str, tuple[int, ...]] = {}
+        absent: dict[str, tuple[str, str | None, tuple[str, tuple[int, ...]]]] = {}
+        rule_hash = hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
+
+        async def accept(path: str) -> None:
+            if prefix and path != prefix and not path.startswith(prefix + "/"):
+                return
+            if path in selected:
+                raise ValueError("Selected source contains duplicate paths")
+            with self._source_file(path) as source:
+                selected[path] = _source_stamp(os.fstat(source.fileno()))
+            await asyncio.sleep(0)
+
+        metadata = self.repository_root / ".git"
+        if metadata.exists() or metadata.is_symlink():
+            if metadata.is_symlink() or not (metadata.is_dir() or metadata.is_file()):
+                raise ValueError("Git metadata is unavailable; filesystem fallback is forbidden")
+            from firefly_forge import checkpoint_source_identity
+
+            rule_hash += hashlib.sha256(Path(checkpoint_source_identity.__file__).read_bytes()).hexdigest()
+
+            async def receive(entry: checkpoint_source_identity.SourceEntry) -> None:
+                if prefix and entry.path != prefix and not entry.path.startswith(prefix + "/"):
+                    return
+                if entry.path in selected or entry.path in absent:
+                    raise ValueError("Selected source contains duplicate paths")
+                if entry.mode is not None:
+                    witness = self._source_absence(entry.path)
+                    if witness is not None:
+                        absent[entry.path] = (entry.mode, entry.object_id, witness)
+                        await asyncio.sleep(0)
+                        return
+                await accept(entry.path)
+
+            await checkpoint_source_identity.stream_source_entries(self.root, receive)
+            for absent_path, (_, _, missing_witness) in absent.items():
+                if self._source_absence(absent_path) != missing_witness:
+                    raise ValueError("Tracked source absence changed during inventory")
+        else:
+            skipped = {".git", ".venv", "node_modules", "vendor", "__pycache__", "dist", "build"}
+
+            def unreadable_directory(error: OSError) -> None:
+                raise ValueError("Selected source directory is unreadable") from None
+
+            for directory, folders, files in os.walk(self.root, followlinks=False, onerror=unreadable_directory):
+                base = Path(directory)
+                folders[:] = sorted(
+                    name
+                    for name in folders
+                    if name.casefold() not in skipped and not _private_name(name) and not (base / name).is_symlink()
+                )
+                for name in sorted(files):
+                    path = base / name
+                    if name.casefold() not in skipped and not _private_name(name) and not path.is_symlink():
+                        await accept(path.relative_to(self.root).as_posix())
+        rows = sorted(selected.items())
+        view = hashlib.sha256()
+        view.update(json.dumps([self._scope_id(), prefix, rule_hash], separators=(",", ":")).encode())
+        for row in rows:
+            view.update(json.dumps(row, ensure_ascii=True, separators=(",", ":")).encode() + b"\n")
+        for absent_path, absence_record in sorted(absent.items()):
+            view.update(
+                json.dumps(["deleted", absent_path, absence_record], ensure_ascii=True, separators=(",", ":")).encode()
+                + b"\n"
             )
-            for name in sorted(files):
-                path = base / name
-                if name not in skipped and not _private_name(name) and not path.is_symlink():
-                    output.append(str(path.relative_to(self.root)))
-                    if len(output) >= 2000:
-                        return output
-        return output
-
-    async def search_text(self, text: str, path_prefix: str = "", max_results: int = 50) -> dict[str, Any]:
-        """Search literal text, returning bounded source lines and content hashes."""
+        if _source_root_identity(self.root) != self._source_root:
+            raise ValueError("Workspace identity changed")
+        return rows, view.hexdigest()
+
+    def _scope_id(self) -> str:
+        value = [
+            _source_root_identity(self.repository_root),
+            self._source_root,
+            self.root.relative_to(self.repository_root).as_posix(),
+        ]
+        return hashlib.sha256(json.dumps(value, separators=(",", ":")).encode()).hexdigest()
+
+    def _page_position(self, cursor: str | None, kind: str, query: Any, view: str) -> int:
+        if cursor is None:
+            return 0
+        if type(cursor) is not str or len(cursor) > 4096:
+            raise ValueError("Invalid source page cursor")
+        try:
+            raw = base64.b64decode(cursor.encode("ascii"), altchars=b"-_", validate=True)
+            value = json.loads(raw)
+            if base64.urlsafe_b64encode(_page_json(value)).decode() != cursor:
+                raise ValueError
+            if set(value) != {"version", "kind", "scope", "query", "view", "position"}:
+                raise ValueError
+            if (
+                type(value["version"]) is not int
+                or value["version"] != 1
+                or value["kind"] != kind
+                or value["scope"] != self._scope_id()
+            ):
+                raise ValueError
+            if value["query"] != hashlib.sha256(_page_json(query)).hexdigest():
+                raise ValueError
+            if type(value["position"]) is not int or not 0 <= value["position"] <= 2**53 - 1:
+                raise ValueError
+        except (ValueError, TypeError, KeyError, UnicodeError):
+            raise ValueError("Source page cursor or scope differs") from None
+        if value["view"] != view:
+            raise ValueError("Source page view changed; start a fresh cursor")
+        return int(value["position"])
+
+    def _page_cursor(self, kind: str, query: Any, view: str, position: int) -> str:
+        value = {
+            "version": 1,
+            "kind": kind,
+            "scope": self._scope_id(),
+            "query": hashlib.sha256(_page_json(query)).hexdigest(),
+            "view": view,
+            "position": position,
+        }
+        return base64.urlsafe_b64encode(_page_json(value)).decode()
+
+    async def list_files(self) -> list[str]:
+        """Return the exhaustive internal source inventory; model callers use explicit pages."""
+        rows, _ = await self._inventory()
+        return [name for name, _ in rows]
+
+    async def list_files_page(
+        self, path_prefix: str = "", cursor: str | None = None, page_size: int = 100
+    ) -> dict[str, Any]:
+        """Read a bounded source page; continue its cursor until complete is true."""
+        if type(page_size) is not int or not 1 <= page_size <= 1000:
+            raise ValueError("Source page size must be an integer from 1 to 1000")
+        rows, view = await self._inventory(path_prefix)
+        query = [path_prefix, page_size, self.max_page_bytes]
+        position = self._page_position(cursor, "list", query, view)
+        if position > len(rows):
+            raise ValueError("Source page cursor exceeds its view")
+
+        def result(files: list[str]) -> dict[str, Any]:
+            end = position + len(files)
+            return {
+                "version": 1,
+                "files": files,
+                "view_sha256": view,
+                "complete": end == len(rows),
+                "next_cursor": self._page_cursor("list", query, view, end) if end < len(rows) else None,
+            }
+
+        files: list[str] = []
+        for name, _ in rows[position : position + page_size]:
+            candidate = [*files, name]
+            if len(json.dumps(result(candidate)).encode()) > self.max_page_bytes:
+                if not files:
+                    raise ValueError("Selected filename and cursor exceed one source response window")
+                break
+            files = candidate
+        value = result(files)
+        if (await self._inventory(path_prefix))[1] != view:
+            raise ValueError("Source page selection changed while listing")
+        if len(json.dumps(value).encode()) > self.max_page_bytes:
+            raise ValueError("Source page metadata exceeds the response window")
+        return value
+
+    async def source_manifest(self) -> dict[str, str]:
+        """Hash all eligible bytes, including binary and large files, without a page or text cutoff."""
+        rows, view = await self._inventory()
+        manifest: dict[str, str] = {}
+        for name, expected in rows:
+            digest = hashlib.sha256()
+            with self._source_file(name, expected) as source:
+                while chunk := source.read(65536):
+                    digest.update(chunk)
+                    await asyncio.sleep(0)
+            manifest[name] = digest.hexdigest()
+        if (await self._inventory())[1] != view:
+            raise ValueError("Source manifest selection changed while hashing")
+        return manifest
+
+    async def _search_file(
+        self, path: str, expected: tuple[int, ...], text: str, skip: int, window: int
+    ) -> tuple[list[dict[str, Any]], int, str]:
+        digest, decoder = hashlib.sha256(), codecs.getincrementaldecoder("utf-8")("strict")
+        classification = "text"
+        matches: list[dict[str, Any]] = []
+        count, number, length = 0, 1, 0
+        found, tail, snippet = False, "", ""
+
+        def line() -> None:
+            nonlocal count, number, length, found, tail, snippet
+            if found:
+                if count >= skip and len(matches) < window:
+                    matches.append(
+                        {"path": path, "line": number, "snippet": snippet, "snippet_truncated": length > 300}
+                    )
+                count += 1
+            number += 1
+            length, found, tail, snippet = 0, False, "", ""
+
+        def consume(value: str) -> None:
+            nonlocal length, found, tail, snippet
+            pieces = value.split("\n")
+            for i, piece in enumerate(pieces):
+                if i:
+                    line()
+                candidate = tail + piece
+                found = found or text in candidate
+                tail = candidate[-(len(text) - 1) :] if len(text) > 1 else ""
+                snippet += piece[: max(0, 300 - len(snippet))]
+                length += len(piece)
+
+        with self._source_file(path, expected) as source:
+            while chunk := source.read(65536):
+                digest.update(chunk)
+                if b"\x00" in chunk:
+                    classification = "binary"
+                if classification == "text":
+                    try:
+                        consume(decoder.decode(chunk))
+                    except UnicodeDecodeError:
+                        classification = "invalid_utf8"
+                await asyncio.sleep(0)
+            if classification == "text":
+                try:
+                    consume(decoder.decode(b"", final=True))
+                    line()
+                except UnicodeDecodeError:
+                    classification = "invalid_utf8"
+        if classification != "text":
+            return [], 0, classification
+        for match in matches:
+            match["sha256"] = digest.hexdigest()
+        return matches, count, classification
+
+    async def search_text(
+        self, text: str, path_prefix: str = "", max_results: int = 50, cursor: str | None = None
+    ) -> dict[str, Any]:
+        """Search complete selected UTF-8 source, with finite pages and explicit binary classification."""
         if not text or len(text) > 500 or "\x00" in text or "\n" in text:
             raise ValueError("Search text must contain 1..500 characters on one line")
         if type(max_results) is not int or not 1 <= max_results <= 100:
             raise ValueError("Search results must be bounded to 1..100")
-        prefix = "/".join(self._parts(path_prefix)) if path_prefix else ""
+        rows, view = await self._inventory(path_prefix)
+        query = [path_prefix, text, max_results, self.max_page_bytes]
+        position = self._page_position(cursor, "search", query, view)
         matches: list[dict[str, Any]] = []
-        total = 0
-        truncated = False
-        for path in await self.list_files():
-            if prefix and path != prefix and not path.startswith(prefix + "/"):
-                continue
-            try:
-                content = await self.read_file(path)
-            except (ValueError, OSError, UnicodeDecodeError):
-                continue
-            total += len(content.encode("utf-8"))
-            if total > 16_000_000:
-                truncated = True
-                break
-            digest = hashlib.sha256(content.encode("utf-8")).hexdigest()
-            for number, line in enumerate(content.splitlines(), 1):
-                if text not in line:
-                    continue
-                if len(matches) == max_results:
-                    truncated = True
-                    break
-                matches.append({"path": path, "line": number, "snippet": line[:300], "sha256": digest})
-            if truncated:
+        count = 0
+        classifications = {"text": 0, "binary": 0, "invalid_utf8": 0}
+        for name, expected in rows:
+            found, total, kind = await self._search_file(
+                name, expected, text, max(0, position - count), max_results - len(matches)
+            )
+            classifications[kind] += 1
+            count += total
+            matches.extend(found)
+        if position > count:
+            raise ValueError("Search cursor exceeds its source view")
+        if (await self._inventory(path_prefix))[1] != view:
+            raise ValueError("Search source view changed while reading")
+
+        def result(items: list[dict[str, Any]]) -> dict[str, Any]:
+            end = position + len(items)
+            more = end < count
+            return {
+                "version": 1,
+                "matches": items,
+                "truncated": more,
+                "complete": not more,
+                "classifications": classifications,
+                "view_sha256": view,
+                "next_cursor": self._page_cursor("search", query, view, end) if more else None,
+            }
+
+        bounded: list[dict[str, Any]] = []
+        for match in matches:
+            candidate = [*bounded, match]
+            if len(json.dumps(result(candidate)).encode()) > self.max_page_bytes:
+                if not bounded:
+                    raise ValueError("Selected match and cursor exceed one source response window")
                 break
-        return {"matches": matches, "truncated": truncated}
+            bounded = candidate
+        value = result(bounded)
+        if len(json.dumps(value).encode()) > self.max_page_bytes:
+            raise ValueError("Search page metadata exceeds the response window")
+        return value
 
     async def edit_lines(
         self, path: str, start_line: int, end_line: int, replacement: str, expected_sha256: str
@@ -318,10 +636,10 @@ async def git_diff(self) -> dict[str, Any]:
 
 
 _TOOL_DESCRIPTIONS = {
-    "list_files": "List confined project source paths",
+    "list_files": prompt_text("tools/list_files", version="1.0.1"),
     "read_file": "Read bounded UTF-8 project source",
     "write_file": "Write confined project source",
-    "search_text": "Search literal source text with file hashes",
+    "search_text": prompt_text("tools/search_text", version="1.0.1"),
     "edit_lines": "Edit lines with an expected source hash",
     "git_diff": "Read the component source diff without Git effects",
     "execute_command": "Execute bounded commands through the selected execution profile",
diff --git a/tests/fixtures/prompt-model-inputs-v2.json b/tests/fixtures/prompt-model-inputs-v2.json
index af6c05d1..a9fed5f9 100644
--- a/tests/fixtures/prompt-model-inputs-v2.json
+++ b/tests/fixtures/prompt-model-inputs-v2.json
@@ -2,7 +2,7 @@
   "license": "Apache-2.0",
   "observed": {
     "builder_all": {
-      "instructions": "You are implementing a real software product inside an isolated factory workspace. Read existing files and repository AGENTS.md before editing; reuse existing patterns. Implement the arbitrary product brief fully as real runnable source code. A plan, architecture narrative, placeholder, canned recipe or assumed test success is insufficient. Do not commit, push, publish, deploy, alter git metadata, read credentials or edit outside this workspace. Do not delete unrelated work. Write meaningful behavioral tests, dependency manifests, a runnable entry point, a README with exact launch/verification instructions and .env.example where needed. Use environment configuration for secrets; never hardcode credentials. Install only declared project dependencies if the environment permits, then run actual build/tests/lint/type checks. Report failed checks and environmental limitations honestly. Do not turn live integrations into mock claims.\n\nUse pyfly 26.10.6 with Python >=3.13. Use pyfly.core.pyfly_application, PyFlyApplication, pyfly.container.rest_controller/service, pyfly.web mappings, and pyfly.web.adapters.starlette.create_app. Reuse PyFly CLI templates (web-api or hexagonal) where suitable. Obtain PyFly from its official GitHub Release wheel, not an assumed PyPI distribution. Write meaningful pytest tests; configure ruff and a type checker. Keep business logic in services and typed domain contracts. Depend directly on pyfly[web] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.06/pyfly-26.10.6-py3-none-any.whl in the manifest; this release URL is verified. Honor its dependency floors: Pydantic>=2.13.5, Starlette>=1.7.0, Uvicorn>=0.54.0. Do not pin incompatible older dependencies. PyFly lifecycle methods are await runtime.startup() and await runtime.shutdown(), not start()/close(). Pass runtime.context to create_app and wire lifecycle through ASGI lifespan. For browser mutations, forward the XSRF-TOKEN cookie as X-XSRF-TOKEN in the same-origin API client. Keep CSRF protection enabled and verify the real cookie/header flow, not just mocked fetch responses.\n\nDo not generate a browser frontend. Deliver the requested service or library with runnable entry points and documented API contracts.\n\nPRODUCT BRIEF:\nFictional Café {{ never_evaluate }}\n{% opaque owner data %}\nBrowser QA requires a declared journey plan before execution: name the user goal, initial route, expected states, bounded DOM locators and assertions. Exercise navigation and real JavaScript interactions, keyboard focus, validation errors, loading behavior, mobile layouts, both themes and zoom when applicable. Capture the actual DOM, focus and screenshots for observed states. Compare only a matching approved reference with its SHA256, state, viewport, theme and zoom; report reference_not_reviewed otherwise. When actual images are attached, inspect their visual content and tie every finding to an evidence ID, severity, path, expected result and observed result. DOM-only evidence must remain labeled dom_only. Record states not reviewed and remaining uncertainty. A visual judgment cannot override failing tests, source boundaries, independent review or delivery guards. Do not assert pixel perfection or universal approval.\nApproved reference descriptors (source hashes are not raster hashes): [{\"reference_id\":\"fictional-reference\",\"source_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"note\":\"{{ opaque reference }}\"}]\nUse only the available granted tools to implement the product. Write actual source and tests before returning the summary; the factory runs independent verification afterwards. If blocked or requiring a product decision, return typed worker_feedback with disposition blocked or clarification and an explicit request; do not claim that implementation is complete.",
+      "instructions": "You are implementing a real software product inside an isolated factory workspace. Read existing files and repository AGENTS.md before editing; reuse existing patterns. Implement the arbitrary product brief fully as real runnable source code. A plan, architecture narrative, placeholder, canned recipe or assumed test success is insufficient. Do not commit, push, publish, deploy, alter git metadata, read credentials or edit outside this workspace. Do not delete unrelated work. Write meaningful behavioral tests, dependency manifests, a runnable entry point, a README with exact launch/verification instructions and .env.example where needed. Use environment configuration for secrets; never hardcode credentials. Install only declared project dependencies if the environment permits, then run actual build/tests/lint/type checks. Report failed checks and environmental limitations honestly. Do not turn live integrations into mock claims.\n\nUse pyfly 26.10.6 with Python >=3.13. Use pyfly.core.pyfly_application, PyFlyApplication, pyfly.container.rest_controller/service, pyfly.web mappings, and pyfly.web.adapters.starlette.create_app. Reuse PyFly CLI templates (web-api or hexagonal) where suitable. Obtain PyFly from its official GitHub Release wheel, not an assumed PyPI distribution. Write meaningful pytest tests; configure ruff and a type checker. Keep business logic in services and typed domain contracts. Depend directly on pyfly[web] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.06/pyfly-26.10.6-py3-none-any.whl in the manifest; this release URL is verified. Honor its dependency floors: Pydantic>=2.13.5, Starlette>=1.7.0, Uvicorn>=0.54.0. Do not pin incompatible older dependencies. PyFly lifecycle methods are await runtime.startup() and await runtime.shutdown(), not start()/close(). Pass runtime.context to create_app and wire lifecycle through ASGI lifespan. For browser mutations, forward the XSRF-TOKEN cookie as X-XSRF-TOKEN in the same-origin API client. Keep CSRF protection enabled and verify the real cookie/header flow, not just mocked fetch responses.\n\nDo not generate a browser frontend. Deliver the requested service or library with runnable entry points and documented API contracts.\n\nPRODUCT BRIEF:\n\nBrowser QA requires a declared journey plan before execution: name the user goal, initial route, expected states, bounded DOM locators and assertions. Exercise navigation and real JavaScript interactions, keyboard focus, validation errors, loading behavior, mobile layouts, both themes and zoom when applicable. Capture the actual DOM, focus and screenshots for observed states. Compare only a matching approved reference with its SHA256, state, viewport, theme and zoom; report reference_not_reviewed otherwise. When actual images are attached, inspect their visual content and tie every finding to an evidence ID, severity, path, expected result and observed result. DOM-only evidence must remain labeled dom_only. Record states not reviewed and remaining uncertainty. A visual judgment cannot override failing tests, source boundaries, independent review or delivery guards. Do not assert pixel perfection or universal approval.\nApproved reference descriptors (source hashes are not raster hashes): [{\"reference_id\":\"fictional-reference\",\"source_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"note\":\"{{ opaque reference }}\"}]\nUse only the available granted tools to implement the product. Write actual source and tests before returning the summary; the factory runs independent verification afterwards. If blocked or requiring a product decision, return typed worker_feedback with disposition blocked or clarification and an explicit request; do not claim that implementation is complete.",
       "messages": [
         {
           "kind": "request",
@@ -17,10 +17,30 @@
       "tools": [
         {
           "name": "list_files",
-          "description": "List at most 2000 project source paths; exclude dependencies, credentials and symlinks.",
+          "description": "List a bounded version 1 page of project source paths. Use path_prefix to select a component-relative subtree and page_size from 1 to 1000 (default 100). The response includes files, view_sha256, next_cursor and complete. Continue next_cursor with the same options until complete=true; never call a partial page the whole project. A changed source view or cursor scope is refused. Source is selected by the native Git inventory, including tracked ignored files; credentials, unsafe links and aliases remain unavailable. No new tool or execution authority.",
           "schema": {
             "additionalProperties": false,
-            "properties": {},
+            "properties": {
+              "path_prefix": {
+                "default": "",
+                "type": "string"
+              },
+              "cursor": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              },
+              "page_size": {
+                "default": 100,
+                "type": "integer"
+              }
+            },
             "type": "object"
           }
         },
@@ -62,7 +82,7 @@
         },
         {
           "name": "search_text",
-          "description": "Search literal text, returning bounded source lines and content hashes.",
+          "description": "Search the complete selected source within path_prefix, including large valid UTF-8 files. max_results bounds one page from 1 to 100 (default 50), not total project matches. Continue next_cursor using the same query/options until complete=true. Snippets disclose snippet_truncated and full-file SHA256; binary and invalid-UTF8 classifications are explicit. Unreadable, changed or unsafe source refuses. No commands or new authority.",
           "schema": {
             "additionalProperties": false,
             "properties": {
@@ -76,6 +96,17 @@
               "max_results": {
                 "default": 50,
                 "type": "integer"
+              },
+              "cursor": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
               }
             },
             "required": [
@@ -640,7 +671,7 @@
       ]
     },
     "builder": {
-      "instructions": "You are implementing a real software product inside an isolated factory workspace. Read existing files and repository AGENTS.md before editing; reuse existing patterns. Implement the arbitrary product brief fully as real runnable source code. A plan, architecture narrative, placeholder, canned recipe or assumed test success is insufficient. Do not commit, push, publish, deploy, alter git metadata, read credentials or edit outside this workspace. Do not delete unrelated work. Write meaningful behavioral tests, dependency manifests, a runnable entry point, a README with exact launch/verification instructions and .env.example where needed. Use environment configuration for secrets; never hardcode credentials. Install only declared project dependencies if the environment permits, then run actual build/tests/lint/type checks. Report failed checks and environmental limitations honestly. Do not turn live integrations into mock claims.\n\nUse pyfly 26.10.6 with Python >=3.13. Use pyfly.core.pyfly_application, PyFlyApplication, pyfly.container.rest_controller/service, pyfly.web mappings, and pyfly.web.adapters.starlette.create_app. Reuse PyFly CLI templates (web-api or hexagonal) where suitable. Obtain PyFly from its official GitHub Release wheel, not an assumed PyPI distribution. Write meaningful pytest tests; configure ruff and a type checker. Keep business logic in services and typed domain contracts. Depend directly on pyfly[web] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.06/pyfly-26.10.6-py3-none-any.whl in the manifest; this release URL is verified. Honor its dependency floors: Pydantic>=2.13.5, Starlette>=1.7.0, Uvicorn>=0.54.0. Do not pin incompatible older dependencies. PyFly lifecycle methods are await runtime.startup() and await runtime.shutdown(), not start()/close(). Pass runtime.context to create_app and wire lifecycle through ASGI lifespan. For browser mutations, forward the XSRF-TOKEN cookie as X-XSRF-TOKEN in the same-origin API client. Keep CSRF protection enabled and verify the real cookie/header flow, not just mocked fetch responses.\n\nDo not generate a browser frontend. Deliver the requested service or library with runnable entry points and documented API contracts.\n\nPRODUCT BRIEF:\nFictional Café {{ never_evaluate }}\n{% opaque owner data %}\nUse only the available granted tools to implement the product. Write actual source and tests before returning the summary; the factory runs independent verification afterwards. If blocked or requiring a product decision, return typed worker_feedback with disposition blocked or clarification and an explicit request; do not claim that implementation is complete.",
+      "instructions": "You are implementing a real software product inside an isolated factory workspace. Read existing files and repository AGENTS.md before editing; reuse existing patterns. Implement the arbitrary product brief fully as real runnable source code. A plan, architecture narrative, placeholder, canned recipe or assumed test success is insufficient. Do not commit, push, publish, deploy, alter git metadata, read credentials or edit outside this workspace. Do not delete unrelated work. Write meaningful behavioral tests, dependency manifests, a runnable entry point, a README with exact launch/verification instructions and .env.example where needed. Use environment configuration for secrets; never hardcode credentials. Install only declared project dependencies if the environment permits, then run actual build/tests/lint/type checks. Report failed checks and environmental limitations honestly. Do not turn live integrations into mock claims.\n\nUse pyfly 26.10.6 with Python >=3.13. Use pyfly.core.pyfly_application, PyFlyApplication, pyfly.container.rest_controller/service, pyfly.web mappings, and pyfly.web.adapters.starlette.create_app. Reuse PyFly CLI templates (web-api or hexagonal) where suitable. Obtain PyFly from its official GitHub Release wheel, not an assumed PyPI distribution. Write meaningful pytest tests; configure ruff and a type checker. Keep business logic in services and typed domain contracts. Depend directly on pyfly[web] @ https://github.com/fireflyframework/fireflyframework-pyfly/releases/download/v26.10.06/pyfly-26.10.6-py3-none-any.whl in the manifest; this release URL is verified. Honor its dependency floors: Pydantic>=2.13.5, Starlette>=1.7.0, Uvicorn>=0.54.0. Do not pin incompatible older dependencies. PyFly lifecycle methods are await runtime.startup() and await runtime.shutdown(), not start()/close(). Pass runtime.context to create_app and wire lifecycle through ASGI lifespan. For browser mutations, forward the XSRF-TOKEN cookie as X-XSRF-TOKEN in the same-origin API client. Keep CSRF protection enabled and verify the real cookie/header flow, not just mocked fetch responses.\n\nDo not generate a browser frontend. Deliver the requested service or library with runnable entry points and documented API contracts.\n\nPRODUCT BRIEF:\n\nUse only the available granted tools to implement the product. Write actual source and tests before returning the summary; the factory runs independent verification afterwards. If blocked or requiring a product decision, return typed worker_feedback with disposition blocked or clarification and an explicit request; do not claim that implementation is complete.",
       "messages": [
         {
           "kind": "request",
@@ -655,10 +686,30 @@
       "tools": [
         {
           "name": "list_files",
-          "description": "List at most 2000 project source paths; exclude dependencies, credentials and symlinks.",
+          "description": "List a bounded version 1 page of project source paths. Use path_prefix to select a component-relative subtree and page_size from 1 to 1000 (default 100). The response includes files, view_sha256, next_cursor and complete. Continue next_cursor with the same options until complete=true; never call a partial page the whole project. A changed source view or cursor scope is refused. Source is selected by the native Git inventory, including tracked ignored files; credentials, unsafe links and aliases remain unavailable. No new tool or execution authority.",
           "schema": {
             "additionalProperties": false,
-            "properties": {},
+            "properties": {
+              "path_prefix": {
+                "default": "",
+                "type": "string"
+              },
+              "cursor": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              },
+              "page_size": {
+                "default": 100,
+                "type": "integer"
+              }
+            },
             "type": "object"
           }
         },
@@ -700,7 +751,7 @@
         },
         {
           "name": "search_text",
-          "description": "Search literal text, returning bounded source lines and content hashes.",
+          "description": "Search the complete selected source within path_prefix, including large valid UTF-8 files. max_results bounds one page from 1 to 100 (default 50), not total project matches. Continue next_cursor using the same query/options until complete=true. Snippets disclose snippet_truncated and full-file SHA256; binary and invalid-UTF8 classifications are explicit. Unreadable, changed or unsafe source refuses. No commands or new authority.",
           "schema": {
             "additionalProperties": false,
             "properties": {
@@ -714,6 +765,17 @@
               "max_results": {
                 "default": 50,
                 "type": "integer"
+              },
+              "cursor": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
               }
             },
             "required": [
@@ -785,6 +847,10 @@
   "reviewed_update": {
     "pyfly_release": "v26.10.06",
     "revision": "d5ebb028e785477025055e468a64291601837fc1",
-    "scope": "pyfly release instruction/dependency floors and pyfly/larafly display casing only; original v1 fixture retained"
+    "scope": "pyfly release instruction/dependency floors and pyfly/larafly display casing only; original v1 fixture retained",
+    "source_contract_followup": {
+      "source_freeze_sha256": "f9ff3e38da2748b0162e0d024dd4d4e66d0f0154c3a683638f0b9007bd33c7bf",
+      "scope": "Actual existing builder instructions and complete paged source-tool schemas; controlled FunctionModel inputs; original v1 fixture and prior release metadata retained"
+    }
   }
 }
diff --git a/tests/source_edit_qualification_fixtures.py b/tests/source_edit_qualification_fixtures.py
index 16af3fde..56fcd3e8 100644
--- a/tests/source_edit_qualification_fixtures.py
+++ b/tests/source_edit_qualification_fixtures.py
@@ -8,6 +8,7 @@
 from pathlib import Path
 
 from firefly_forge.provider_executable_adoption import executable_identity
+from firefly_forge.source_budget_allowances import admission_contract_digest
 from firefly_forge.source_edit_cli_policy import DISABLED_FEATURES, configuration_projection
 from firefly_forge.source_edit_model_catalog import model_catalog_sha256
 from firefly_forge.source_edit_models import READ_TOOLS
@@ -50,6 +51,7 @@ def fixture_profile(executable):
         + (("skip_host_skill_discovery", True),),
         configuration_tools=(("update_plan", False), ("experimental_request_user_input", False)),
         source_budget_limits=(("read_file_lifetime_limit", 20), ("activation_ceiling", 5)),
+        admission_contract_digest=admission_contract_digest(),
         proof=NativeQualificationProof(
             contract_digest="",
             artifact_sha256=hashlib.sha256(
diff --git a/tests/test_agentic_checkpoint_activation_host.py b/tests/test_agentic_checkpoint_activation_host.py
index 7162707f..1789c937 100644
--- a/tests/test_agentic_checkpoint_activation_host.py
+++ b/tests/test_agentic_checkpoint_activation_host.py
@@ -4,6 +4,7 @@
 import asyncio
 import hashlib
 import json
+import subprocess
 from contextlib import asynccontextmanager
 from types import SimpleNamespace
 from uuid import UUID
@@ -19,6 +20,7 @@
 
 from firefly_forge.bridge_completion_scope import bridge_completion_scope
 from firefly_forge.git_diff_models import GitDiffRefV1
+from firefly_forge.git_workspace import metadata_digest
 from firefly_forge.providers import BridgeProvider
 from firefly_forge.source_snapshot import SourceDiffSnapshotV1
 
@@ -66,7 +68,6 @@ async def activated(tmp_path, monkeypatch):
     from test_bridge_inflight_cancel import Rows
 
     from firefly_forge import agentic_checkpoint_invocation as invocation_module
-    from firefly_forge import engine as engine_module
     from firefly_forge.agent_restores import AgentRestores
     from firefly_forge.agent_roles import ProjectRoles, RoleRegistry
     from firefly_forge.configuration import ProviderConfiguration
@@ -135,25 +136,37 @@ async def events(self, key):
     engine = Engine(store, tmp_path / "owned", lambda _: provider, journal=journal)
     workspace = engine.workspaces / RUN
     workspace.mkdir()
-    (workspace / ".git").mkdir()
-    (workspace / ".git/HEAD").write_text("b" * 40)
+    subprocess.run(["git", "init", "-q"], cwd=workspace, check=True)
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "user.name=Controlled Source",
+            "-c",
+            "user.email=source@example.invalid",
+            "commit",
+            "--allow-empty",
+            "-qm",
+            "Seed source",
+        ],
+        cwd=workspace,
+        check=True,
+    )
+    subprocess.run(["git", "read-tree", "HEAD"], cwd=workspace, check=True)
+    revision = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=workspace).decode().strip()
+    store.run.data["git_metadata_digest"] = metadata_digest(workspace)
 
     async def head(argv, cwd, **kwargs):
         assert current_unit_of_work() is None
         assert argv[-2:] == ["rev-parse", "HEAD"]
-        return (cwd / ".git/HEAD").read_text()
+        return subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=cwd).decode().strip()
 
     monkeypatch.setattr(invocation_module, "checked", head)
 
     async def inspect(*args):
-        return {"base_revision": "b" * 40, "head": "b" * 40, "source_tree": "c" * 40}
-
-    async def checked(argv, *args, **kwargs):
-        assert current_unit_of_work() is None and argv == ["git", "ls-files", "-z"]
-        return ""
+        return {"base_revision": revision, "head": revision, "source_tree": "c" * 40}
 
     monkeypatch.setattr(engine, "_inspect_workspace", inspect)
-    monkeypatch.setattr(engine_module, "checked", checked)
     runtime = SimpleNamespace(require_execution=lambda: None)
     requests = ExecutionRequests(store, runtime, Requests(), Events())
     restores = AgentRestores(store, requests, engine)
@@ -391,7 +404,7 @@ async def test_restore_refuses_late_admission_drift_before_result_exposure(tmp_p
 
         async def late_change(value):
             await admit(value)
-            if not changed and isinstance(value, tuple) and len(value) == 3:
+            if not changed and value == "" and any(row.status == "executing" for row in env.requests.records.rows):
                 assert current_unit_of_work() is None
                 changed.append(drift)
                 if drift == "operator":
@@ -409,7 +422,7 @@ async def late_change(value):
         env.store.admit_credentials = late_change
         with models.override_allow_model_requests(False), mock_model_requests(env.model):
             await env.restores.execute(request.request_id)
-        assert changed == [drift]
+        assert changed == [drift], (await env.requests.get(request.request_id)).get("result")
         assert len(posts) == 2
         assert not any(
             r.kind == "agent_consume" and r.data["payload"]["version"] == 2 for r in env.journal.records.rows
diff --git a/tests/test_agentic_checkpoint_codec.py b/tests/test_agentic_checkpoint_codec.py
new file mode 100644
index 00000000..1c5ebcd0
--- /dev/null
+++ b/tests/test_agentic_checkpoint_codec.py
@@ -0,0 +1,503 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Lossless accumulated SDK history remains bounded at its encoded custody boundary."""
+
+import hashlib
+import json
+
+import httpx2
+import pytest
+from fireflyframework_agentic.agents import FireflyAgent
+from fireflyframework_agentic.config import FireflyAgenticConfig
+from fireflyframework_agentic.model_utils import serialize_model_messages
+from fireflyframework_agentic.tools import firefly_tool
+from pydantic_ai import models
+from pydantic_ai.usage import UsageLimits
+from test_agentic_checkpoint_boundary import CutAfterOriginalPost, completion
+from test_bridge_completion_native import mock_model_requests
+
+from firefly_forge.agentic_checkpoint_boundary import (
+    MAX_PAYLOAD,
+    AgenticBoundary,
+    BoundaryCheckpoint,
+    OriginalCompletion,
+)
+from firefly_forge.providers import BridgeProvider
+
+
+async def test_actual_sdk_third_frame_compresses_and_restores_exact_request_without_repeating_tools(monkeypatch):
+    reads, posts, captures, consumed = [], [], [], []
+    text = "Fictional retained tool source line.\n" * 1400
+
+    async def read_file(path: str) -> str:
+        reads.append(path)
+        return text
+
+    tool = firefly_tool("read_file", description="Read fictional source", auto_register=False)(read_file)
+
+    def agent(model, boundary):
+        return FireflyAgent(
+            name="elastic-history",
+            model=model,
+            tools=[tool],
+            auto_register=False,
+            config=FireflyAgenticConfig(default_temperature=None, rate_limit_max_retries=0),
+            capabilities=[boundary],
+        )
+
+    boundary = AgenticBoundary(lambda: {"files_written": []})
+    model = BridgeProvider({"FORGE_BRIDGE_URL": "http://localhost:19191", "FORGE_BRIDGE_TOKEN": "fictional"}).model()
+
+    def transport(request):
+        posts.append(request.content)
+        if len(posts) == 3:
+            raise CutAfterOriginalPost()
+        return httpx2.Response(
+            200,
+            content=completion(
+                {
+                    "content": None,
+                    "tool_calls": [
+                        {
+                            "id": "read-" + str(len(posts)),
+                            "type": "function",
+                            "function": {
+                                "name": "read_file",
+                                "arguments": json.dumps({"path": str(len(posts)) + ".py"}),
+                            },
+                        }
+                    ],
+                },
+                tokens=11,
+                finish="tool_calls",
+            ),
+        )
+
+    model.client._client._transport = httpx2.MockTransport(transport)
+    model.client._client._mounts = {}
+    send = model.client._send_request
+
+    async def capture(request, **kwargs):
+        captures.append(boundary.capture(await request.aread()))
+        return await send(request, **kwargs)
+
+    monkeypatch.setattr(model.client, "_send_request", capture)
+    try:
+        with (
+            models.override_allow_model_requests(False),
+            mock_model_requests(model),
+            boundary.invocation(),
+            pytest.raises(CutAfterOriginalPost),
+        ):
+            await agent(model, boundary).run(
+                "Fictional product brief. " * 900, usage_limits=UsageLimits(request_limit=4, tool_calls_limit=2)
+            )
+        assert reads == ["1.py", "2.py"] and len(posts) == 3
+        import base64
+        import zlib
+
+        envelope = json.loads(captures[-1].payload)
+        envelope["data"] = base64.b64encode(
+            zlib.compress(zlib.decompress(base64.b64decode(envelope["data"])), 1)
+        ).decode()
+        checkpoint = BoundaryCheckpoint.decode(*reseal_envelope(envelope))
+        raw = json.dumps(
+            checkpoint.record.model_dump(mode="json"), sort_keys=True, separators=(",", ":"), ensure_ascii=False
+        ).encode()
+        assert len(raw) > MAX_PAYLOAD and len(checkpoint.payload) <= MAX_PAYLOAD
+        assert json.loads(checkpoint.payload)["version"] == 2
+        assert checkpoint.usage.requests == checkpoint.usage.tool_calls == 2
+        assert checkpoint.record.wire_bytes == len(posts[-1])
+        assert checkpoint.wire_sha256 == hashlib.sha256(posts[-1]).hexdigest()
+        restored = AgenticBoundary(lambda: {"files_written": []}, restore=checkpoint)
+        restored_model = BridgeProvider(
+            {"FORGE_BRIDGE_URL": "http://localhost:19191", "FORGE_BRIDGE_TOKEN": "fictional"}
+        ).model()
+
+        restored_model.client._client._transport = httpx2.MockTransport(
+            lambda request: (_ for _ in ()).throw(AssertionError("No replacement request"))
+        )
+        restored_model.client._client._mounts = {}
+
+        async def consume(checkpoint_digest, response_digest):
+            consumed.append((checkpoint_digest, response_digest))
+
+        original = completion({"content": "Original retained final answer"}, tokens=19)
+        replay = OriginalCompletion(checkpoint, original, consume)
+
+        async def retained(request, **kwargs):
+            body = await request.aread()
+            assert body == posts[-1]
+            again = restored.capture(body)
+            assert again.payload == checkpoint.payload and again.digest == checkpoint.digest
+            assert serialize_model_messages(again.history) == serialize_model_messages(checkpoint.history)
+            return httpx2.Response(200, content=await replay.expose(body), request=request)
+
+        monkeypatch.setattr(restored_model.client, "_send_request", retained)
+        try:
+            with (
+                models.override_allow_model_requests(False),
+                mock_model_requests(restored_model),
+                restored.invocation(),
+            ):
+                result = await agent(restored_model, restored).run(**checkpoint.resume_kwargs())
+            assert result.output == "Original retained final answer"
+            assert result.usage.requests == 3 and result.usage.tool_calls == 2
+            assert reads == ["1.py", "2.py"] and len(posts) == 3
+            assert consumed == [(checkpoint.digest, hashlib.sha256(original).hexdigest())]
+            with pytest.raises(ValueError, match="consum"):
+                await replay.expose(posts[-1])
+        finally:
+            await restored_model.client.close()
+    finally:
+        await model.client.close()
+
+
+@pytest.fixture
+async def large_checkpoint():
+    from pydantic_ai.messages import ModelResponse, TextPart
+    from pydantic_ai.models.function import FunctionModel
+
+    captures = []
+    boundary = AgenticBoundary(lambda: {"files_written": ["app.py"]})
+
+    def model(messages, info):
+        captures.append(boundary.capture(b"fictional-wire"))
+        return ModelResponse(parts=[TextPart("Fictional")])
+
+    with boundary.invocation():
+        await FireflyAgent(
+            name="large-codec", model=FunctionModel(model), auto_register=False, capabilities=[boundary]
+        ).run("Fictional source line.\n" * 6000)
+    return captures[0]
+
+
+def reseal_envelope(value):
+    payload = json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
+    return payload, hashlib.sha256(payload).hexdigest()
+
+
+@pytest.mark.parametrize(
+    "change",
+    [
+        "size-bool",
+        "too-large",
+        "short-size",
+        "wrong-hash",
+        "base64",
+        "truncated",
+        "trailing",
+        "concatenated",
+        "raw-noncanonical",
+        "bomb",
+        "extra",
+        "version-bool",
+        "codec",
+    ],
+)
+def test_compressed_envelope_refuses_noncanonical_corrupt_or_unbounded_input(large_checkpoint, change):
+    import base64
+    import zlib
+
+    value = json.loads(large_checkpoint.payload)
+    assert value["version"] == 2
+    raw = zlib.decompress(base64.b64decode(value["data"]))
+    if change == "size-bool":
+        value["raw_bytes"] = True
+    elif change == "too-large":
+        value["raw_bytes"] = 8 * 1024**2 + 1
+    elif change == "short-size":
+        value["raw_bytes"] -= 1
+    elif change == "wrong-hash":
+        value["raw_sha256"] = "0" * 64
+    elif change == "base64":
+        value["data"] += "\n"
+    elif change == "truncated":
+        value["data"] = base64.b64encode(base64.b64decode(value["data"])[:-1]).decode()
+    elif change in {"trailing", "concatenated"}:
+        suffix = b"fictional-extra" if change == "trailing" else zlib.compress(b"other")
+        value["data"] = base64.b64encode(base64.b64decode(value["data"]) + suffix).decode()
+    elif change == "raw-noncanonical":
+        raw += b"\n"
+        value["data"] = base64.b64encode(zlib.compress(raw, 9)).decode()
+        value["raw_sha256"] = hashlib.sha256(raw).hexdigest()
+        value["raw_bytes"] = len(raw)
+    elif change == "bomb":
+        raw = b"x" * (8 * 1024**2 + 1)
+        value["data"] = base64.b64encode(zlib.compress(raw, 9)).decode()
+        value["raw_sha256"] = hashlib.sha256(raw).hexdigest()
+        value["raw_bytes"] = 8 * 1024**2
+    elif change == "extra":
+        value["extra"] = "ignored"
+    elif change == "version-bool":
+        value["version"] = True
+    elif change == "codec":
+        value["codec"] = "gzip"
+    with pytest.raises(ValueError):
+        BoundaryCheckpoint.decode(*reseal_envelope(value))
+
+
+def test_legacy_raw_checkpoint_retains_immutable_encoding(large_checkpoint):
+    import base64
+    import zlib
+
+    large = json.loads(large_checkpoint.payload)
+    record = json.loads(zlib.decompress(base64.b64decode(large["data"])))
+    for message in record["history"]:
+        for part in message["parts"]:
+            if isinstance(part.get("content"), str):
+                part["content"] = "Fictional legacy source"
+    record["request_history"] = record["history"]
+    payload, digest = reseal_envelope(record)
+    assert len(payload) < MAX_PAYLOAD
+    checkpoint = BoundaryCheckpoint.decode(payload, digest)
+    assert checkpoint.payload == payload and checkpoint.digest == digest
+    assert checkpoint.record.model_dump(mode="json") == record
+    assert checkpoint.state == {"files_written": ["app.py"]}
+
+
+def test_valid_alternate_zlib_stream_retains_its_original_encoded_identity(large_checkpoint):
+    import base64
+    import zlib
+
+    value = json.loads(large_checkpoint.payload)
+    raw = zlib.decompress(base64.b64decode(value["data"]))
+    value["data"] = base64.b64encode(zlib.compress(raw, 1)).decode()
+    payload, digest = reseal_envelope(value)
+    restored = BoundaryCheckpoint.decode(payload, digest)
+    assert restored.payload == payload and restored.digest == digest
+    assert restored.canonical_payload == raw
+    assert restored.record == large_checkpoint.record
+
+
+@pytest.mark.parametrize("stage", ["capture", "consume", "exact", "journal", "journal-ambient"])
+async def test_compressed_history_current_credentials_refuse_custody_without_hiding_secret(
+    tmp_path, monkeypatch, large_checkpoint, stage
+):
+    from types import MethodType
+
+    from test_agentic_checkpoint_storage_host import setup
+    from test_bridge_inflight_cancel import RUN
+
+    from firefly_forge.agentic_checkpoint_boundary import _checkpoint_payload
+    from firefly_forge.store import Store
+
+    store, journal, manager, service, scope, descriptor, small, body, response = await setup(tmp_path, monkeypatch)
+    record = large_checkpoint.record.model_dump(mode="json")
+    record.update(wire_sha256=hashlib.sha256(body).hexdigest(), wire_bytes=len(body))
+    raw, _ = reseal_envelope(record)
+    payload = _checkpoint_payload(raw)
+    compressed = BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
+    run = await store.get_run(RUN)
+    task = await journal.intent(RUN, "implement")
+    scope = service.scope(run, task, capture=lambda wire: compressed)
+
+    async def reader(run_id, actor, **kwargs):
+        return await store.get_run(run_id)
+
+    monkeypatch.setattr(service.completions, "_reader", reader)
+    current = {}
+    store.credential_registry = lambda: current
+    monkeypatch.setattr(store, "reject_credentials", MethodType(Store.reject_credentials, store))
+    if stage != "capture":
+        intent = await scope.admit(descriptor, body)
+    current["controlled_token"] = "Fictional source line."
+    before = len(journal.records.rows)
+    with pytest.raises(ValueError, match="configured credentials"):
+        if stage == "capture":
+            await scope.admit(descriptor, body)
+        elif stage == "consume":
+            await scope.response(intent, response)
+        elif stage == "exact":
+            await service.exact(RUN, intent["idempotency_key"])
+        elif stage == "journal":
+            await journal.entries(RUN)
+        else:
+            from firefly_forge.store import prepared_credential_rejection
+
+            with prepared_credential_rejection(store):
+                async with store._unit():
+                    await journal.entries(RUN)
+    assert not any(row.kind == "agent_consume" for row in journal.records.rows)
+    assert len(journal.records.rows) == before + (1 if stage == "consume" else 0)
+
+
+def test_raw_record_bound_and_encoded_custody_bound_are_independent(large_checkpoint):
+    import base64
+
+    from firefly_forge.agentic_checkpoint_boundary import MAX_RAW_PAYLOAD, _checkpoint_payload
+
+    with pytest.raises(ValueError, match="8 MiB"):
+        _checkpoint_payload(b"x" * (MAX_RAW_PAYLOAD + 1))
+    record = large_checkpoint.record.model_dump(mode="json")
+    content = base64.b64encode(hashlib.shake_256(b"fictional-incompressible").digest(300000)).decode()
+    for message in record["history"]:
+        for part in message["parts"]:
+            if isinstance(part.get("content"), str):
+                part["content"] = content
+    record["request_history"] = record["history"]
+    raw, _ = reseal_envelope(record)
+    assert len(raw) < MAX_RAW_PAYLOAD
+    payload = _checkpoint_payload(raw)
+    assert len(payload) > MAX_PAYLOAD
+    with pytest.raises(ValueError, match="size"):
+        BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
+
+
+@pytest.mark.parametrize("encoding", ["whitespace", "duplicate-key", "schema-secret", "usage-secret"])
+def test_compressed_envelope_canonical_json_and_errors_do_not_expose_record_text(large_checkpoint, encoding):
+    envelope = json.loads(large_checkpoint.payload)
+    secret = "fictional-credential-must-not-appear-in-errors"
+    if encoding == "whitespace":
+        payload = json.dumps(envelope, indent=2).encode()
+    elif encoding == "duplicate-key":
+        payload = large_checkpoint.payload[:-1] + b',"version":2}'
+    else:
+        import base64
+        import zlib
+
+        raw = json.loads(large_checkpoint.canonical_payload)
+        if encoding == "usage-secret":
+            raw["usage"]["requests"] = secret
+        else:
+            raw["state"] = {"files_written": ["/" + secret]}
+        raw, _ = reseal_envelope(raw)
+        envelope.update(
+            raw_bytes=len(raw),
+            raw_sha256=hashlib.sha256(raw).hexdigest(),
+            data=base64.b64encode(zlib.compress(raw, 9)).decode(),
+        )
+        payload, _ = reseal_envelope(envelope)
+    with pytest.raises(ValueError) as error:
+        BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
+    assert secret not in str(error.value)
+
+
+@pytest.mark.parametrize("drift", [False, True])
+async def test_compressed_journal_checks_current_generation_in_prepared_ambient_unit(
+    tmp_path, monkeypatch, large_checkpoint, drift
+):
+    import copy
+    from types import MethodType
+
+    from pyfly.data.transaction import current_unit_of_work
+    from test_agentic_checkpoint_storage_host import setup
+    from test_bridge_inflight_cancel import RUN
+
+    from firefly_forge.agentic_checkpoint_boundary import _checkpoint_payload
+    from firefly_forge.configuration import ProviderConfiguration
+    from firefly_forge.store import Store, prepared_credential_rejection
+
+    store, journal, manager, service, _, descriptor, _, body, _ = await setup(tmp_path, monkeypatch)
+    record = large_checkpoint.record.model_dump(mode="json")
+    record.update(wire_sha256=hashlib.sha256(body).hexdigest(), wire_bytes=len(body))
+    raw, _ = reseal_envelope(record)
+    payload = _checkpoint_payload(raw)
+    checkpoint = BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
+    run, task = await store.get_run(RUN), await journal.intent(RUN, "implement")
+    await service.scope(run, task, capture=lambda wire: checkpoint).admit(descriptor, body)
+    store.credential_registry = lambda: store.configuration.resolve("bridge")
+    monkeypatch.setattr(store, "reject_credentials", MethodType(Store.reject_credentials, store))
+    admit = store.admit_credentials
+    scans = []
+
+    async def scan(value):
+        assert current_unit_of_work() is None
+        await admit(value)
+        if isinstance(value, str) and "Fictional source line." in value:
+            scans.append(len(value))
+            if drift:
+                store.configuration.update("bridge", ProviderConfiguration(values={"token": "Fictional source line."}))
+
+    monkeypatch.setattr(store, "admit_credentials", scan)
+    before = copy.deepcopy([r.data for r in journal.records.rows])
+    with prepared_credential_rejection(store):
+        async with store._unit():
+            if drift:
+                with pytest.raises(ValueError, match="Credential sources changed"):
+                    await journal.entries(RUN)
+            else:
+                entries = await journal.entries(RUN)
+                stored = next(r for r in entries if r["kind"] == "agent_checkpoint")
+                assert stored["payload"]["snapshot"].encode() == checkpoint.payload
+                assert "Fictional source line." not in stored["payload"]["snapshot"]
+    assert scans and [r.data for r in journal.records.rows] == before
+
+
+def test_sub192k_raw_history_compresses_before_binding_and_json_escaping_exceed_wal(large_checkpoint):
+    from firefly_forge.agent_checkpoint_models import CheckpointPayloadV2, InvocationBinding
+    from firefly_forge.agent_checkpoints import ENVELOPE_LIMIT, _size
+    from firefly_forge.agentic_checkpoint_boundary import _checkpoint_payload
+
+    record = large_checkpoint.record.model_dump(mode="json")
+    for message in record["history"]:
+        for part in message["parts"]:
+            if isinstance(part.get("content"), str):
+                part["content"] = '"\\\n' * 10000
+    record["request_history"] = record["history"]
+    raw, digest = reseal_envelope(record)
+    assert 64 * 1024 < len(raw) < MAX_PAYLOAD
+    binding = InvocationBinding(
+        invocation_id="1" * 32,
+        ordinal=1,
+        predecessor=None,
+        brief="F" * 99000,
+        backend="pyfly",
+        frontend="none",
+        round=1,
+        deadline_ms=1,
+        grants=[],
+        contract="0" * 64,
+        run_cut="0" * 64,
+        workspace={"path": "owned", "head": "0" * 40, "metadata": "0" * 64, "source": "0" * 64},
+    )
+    legacy = CheckpointPayloadV2(
+        version=2,
+        request_id="fbr1_" + "1" * 32,
+        intent_digest="0" * 64,
+        checkpoint_digest=digest,
+        snapshot=raw.decode(),
+        invocation=binding,
+    )
+    assert _size(legacy.model_dump(mode="json")) + 4096 > ENVELOPE_LIMIT
+    encoded = _checkpoint_payload(raw)
+    assert json.loads(encoded)["version"] == 2
+    compressed = legacy.model_copy(
+        update={"snapshot": encoded.decode(), "checkpoint_digest": hashlib.sha256(encoded).hexdigest()}
+    )
+    assert _size(compressed.model_dump(mode="json")) + 4096 < ENVELOPE_LIMIT
+    assert BoundaryCheckpoint.decode(encoded, hashlib.sha256(encoded).hexdigest()).canonical_payload == raw
+
+
+@pytest.mark.parametrize("source", ["http_response", "bridge_observation"])
+async def test_large_actual_engine_sdk_checkpoint_restores_known_or_observed_original(tmp_path, monkeypatch, source):
+    from test_agentic_checkpoint_activation_host import activated, controlled_source_snapshot, queue_original
+
+    from firefly_forge import agentic_runtime
+
+    build = agentic_runtime.build_instruction
+    monkeypatch.setattr(
+        agentic_runtime,
+        "build_instruction",
+        lambda *a, **kw: build(*a, **kw) + "\n" + "Fictional compressed native instruction.\n" * 5500,
+    )
+    env = await activated(tmp_path, monkeypatch)
+    try:
+        posts, intent, retained, body, request = await queue_original(env, monkeypatch, source=source)
+        checkpoint = BoundaryCheckpoint.decode(
+            retained["payload"]["snapshot"].encode(), retained["payload"]["checkpoint_digest"]
+        )
+        assert json.loads(checkpoint.payload)["version"] == 2 and len(checkpoint.canonical_payload) > MAX_PAYLOAD
+
+        async def snapshot(*a, **kw):
+            return ["service.py"], controlled_source_snapshot("Fictional retained patch"), "c" * 40
+
+        monkeypatch.setattr(env.engine, "_snapshot", snapshot)
+        before = (env.workspace / "service.py").stat().st_mtime_ns
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(request.request_id)
+        ticket = await env.requests.get(request.request_id)
+        assert ticket["status"] == "completed", ticket.get("result")
+        assert len(posts) == 2 and (env.workspace / "service.py").stat().st_mtime_ns == before
+        assert sum(r.kind == "agent_consume" for r in env.journal.records.rows) == 2
+    finally:
+        await env.model.client.close()
diff --git a/tests/test_agentic_checkpoint_codec_native.py b/tests/test_agentic_checkpoint_codec_native.py
new file mode 100644
index 00000000..53862a88
--- /dev/null
+++ b/tests/test_agentic_checkpoint_codec_native.py
@@ -0,0 +1,113 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Prepared isolated SQL custody/SDK controls; no real provider or original CRM access."""
+
+import hashlib
+import json
+from uuid import uuid4
+
+import pytest
+from pydantic_ai import models
+from test_agentic_checkpoint_storage_host import checkpoint_for
+from test_agentic_restore_receipt_native import native_restoration
+from test_bridge_completion_native import mock_model_requests, prepared
+from test_bridge_completion_records import snapshot
+
+from firefly_forge import agentic_runtime
+from firefly_forge.agent_checkpoint_models import RestoreInput
+from firefly_forge.agent_checkpoints import AgentCheckpoints
+from firefly_forge.agentic_checkpoint_boundary import MAX_PAYLOAD, BoundaryCheckpoint, _checkpoint_payload
+from firefly_forge.configuration import ProviderConfiguration
+from firefly_forge.journal import Journal
+
+
+async def compressed_for(body):
+    small = await checkpoint_for(body)
+    record = small.record.model_dump(mode="json")
+    for message in record["history"]:
+        for part in message["parts"]:
+            if isinstance(part.get("content"), str):
+                part["content"] = "Fictional native codec history.\n" * 6000
+    record["request_history"] = record["history"]
+    raw = json.dumps(record, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
+    assert len(raw) > MAX_PAYLOAD
+    payload = _checkpoint_payload(raw)
+    checkpoint = BoundaryCheckpoint.decode(payload, hashlib.sha256(payload).hexdigest())
+    assert checkpoint.canonical_payload == raw
+    return checkpoint
+
+
+async def test_native_compressed_checkpoint_consumes_once_and_retains_encoded_wal(store, tmp_path):
+    async with prepared(store, tmp_path) as (_, _, run, journal, completions, _, descriptor, body):
+        checkpoint = await compressed_for(body)
+        task = await journal.intent(run["id"], "implement")
+        scope = AgentCheckpoints(completions).scope(run, task, capture=lambda wire: checkpoint)
+        intent = await scope.admit(descriptor, body)
+        response = snapshot()[1]["terminal"]["result_json"].encode()
+        await scope.response(intent, response)
+        with pytest.raises(ValueError, match="consum"):
+            await scope.response(intent, response)
+        entries = await journal.entries(run["id"])
+        assert Journal.verify_chain(entries)
+        record = next(r for r in entries if r["kind"] == "agent_checkpoint")
+        assert record["payload"]["snapshot"].encode() == checkpoint.payload
+        assert json.loads(record["payload"]["snapshot"])["version"] == 2
+        assert sum(r["kind"] == "agent_consume" for r in entries) == 1
+
+
+async def test_native_compressed_journal_current_credential_refuses_normal_and_ambient_reads(store, tmp_path):
+    async with prepared(store, tmp_path) as (_, _, run, journal, completions, _, descriptor, body):
+        checkpoint = await compressed_for(body)
+        task = await journal.intent(run["id"], "implement")
+        scope = AgentCheckpoints(completions).scope(run, task, capture=lambda wire: checkpoint)
+        await scope.admit(descriptor, body)
+        store.credential_registry = lambda: store.configuration.resolve("bridge")
+        store.configuration.update("bridge", ProviderConfiguration(values={"token": "Fictional native codec history."}))
+        with pytest.raises(ValueError, match="configured credentials"):
+            await journal.entries(run["id"])
+        async with store._unit():
+            with pytest.raises(ValueError, match="configured credentials"):
+                await journal.entries(run["id"])
+
+
+async def test_native_large_sdk_retained_response_restores_without_replacement_post(store, tmp_path, monkeypatch):
+    build = agentic_runtime.build_instruction
+    monkeypatch.setattr(
+        agentic_runtime,
+        "build_instruction",
+        lambda *a, **kw: build(*a, **kw) + "\n" + "Fictional compressed native instruction.\n" * 5500,
+    )
+    async with native_restoration(store, tmp_path, monkeypatch) as env:
+        entries = await env.journal.entries(env.run_id)
+        encoded = [r["payload"]["snapshot"] for r in entries if r["kind"] == "agent_checkpoint"][-1]
+        assert json.loads(encoded)["version"] == 2
+        checkpoint = BoundaryCheckpoint.decode(encoded.encode(), hashlib.sha256(encoded.encode()).hexdigest())
+        assert len(checkpoint.canonical_payload) > MAX_PAYLOAD
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        ticket = await env.requests.get(env.request.request_id)
+        assert ticket["status"] == "completed", ticket.get("result")
+        assert len(env.posts) == 2
+        assert (env.workspace / "service.py").read_text() == "VALUE = 1\n"
+        assert env.schemas and set(env.schemas) == {store.schema}
+
+
+async def test_native_compressed_unknown_result_has_no_consume_or_replacement_authority(store, tmp_path):
+    async with prepared(store, tmp_path) as (_, _, run, journal, completions, _, descriptor, body):
+        checkpoint = await compressed_for(body)
+        task = await journal.intent(run["id"], "implement")
+        service = AgentCheckpoints(completions)
+        intent = await service.scope(run, task, capture=lambda wire: checkpoint).admit(descriptor, body)
+        entries = await journal.entries(run["id"])
+        retained = next(r for r in entries if r["kind"] == "agent_checkpoint")
+        request = RestoreInput.model_validate(
+            {
+                "request_id": uuid4().hex,
+                "expected_checkpoint_digest": retained["digest"],
+                "expected_intent_digest": intent["digest"],
+                "source": {"kind": "http_response", "record_digest": "0" * 64},
+            }
+        )
+        with pytest.raises((KeyError, ValueError)):
+            await service.restore_bundle(run["id"], descriptor["request_id"], request)
+        assert await journal.entries(run["id"]) == entries
+        assert not any(r["kind"] in {"agent_consume", "bridge_request_response"} for r in entries)
diff --git a/tests/test_agentic_checkpoint_frozen_design_host.py b/tests/test_agentic_checkpoint_frozen_design_host.py
new file mode 100644
index 00000000..61dce0bd
--- /dev/null
+++ b/tests/test_agentic_checkpoint_frozen_design_host.py
@@ -0,0 +1,142 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Frozen wireframe text is distinct from active QA tools or image history."""
+
+import copy
+import json
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+from pydantic_ai import models
+from test_agentic_checkpoint_activation_host import (
+    RUN,
+    activated,
+    controlled_source_snapshot,
+    queue_original,
+)
+from test_agentic_checkpoint_static_tools_host import GRANTS, nothing
+from test_bridge_completion_native import mock_model_requests
+from test_product_design import definition, review
+
+from firefly_forge.agent_checkpoint_models import CheckpointPayloadV2
+from firefly_forge.agentic_checkpoint_boundary import AgenticBoundary
+from firefly_forge.agentic_checkpoint_invocation import CheckpointInvocation, invocation_cut, runtime_contract
+from firefly_forge.configuration import ConfigurationStore
+from firefly_forge.engine import Engine
+from firefly_forge.product_design import ProductDesign
+
+
+@pytest.fixture
+async def frozen_run(tmp_path):
+    async def repository(key):
+        return {"id": key}
+
+    store = SimpleNamespace(configuration=ConfigurationStore(tmp_path / "design-configuration"), repository=repository)
+    bundle = await ProductDesign(store).preview("a" * 32, definition())
+    return {
+        "id": RUN,
+        "backend": "pyfly",
+        "frontend": "react",
+        "design_snapshot": bundle,
+        "product_definition": {
+            "revision": 1,
+            "definition": definition().model_copy(update={"design_review": review(bundle)}).model_dump(mode="json"),
+        },
+    }
+
+
+def attach(tmp_path, run, references, *, grants=GRANTS):
+    invocation = CheckpointInvocation(
+        SimpleNamespace(credential_registry=dict), SimpleNamespace(), run, {}, tmp_path, nothing
+    )
+    invocation.attach(
+        AgenticBoundary(lambda: {"files_written": []}),
+        "Build",
+        "pyfly",
+        run["frontend"],
+        SimpleNamespace(allowed_tools=grants, qa_references=references),
+        {},
+    )
+    return invocation
+
+
+async def test_real_reviewed_wireframe_descriptors_attach_as_frozen_text(tmp_path, frozen_run):
+    references = tuple(Engine._qa_reference_descriptors(frozen_run))
+    assert len(references) == 12 and all("source_sha256" in row for row in references)
+    assert "<svg" not in json.dumps(references)
+    invocation = attach(tmp_path, frozen_run, references)
+    assert invocation.binding is not None
+    assert invocation.binding.run_cut == invocation_cut(frozen_run)
+    assert invocation.binding.grants == sorted(GRANTS)
+
+
+@pytest.mark.parametrize(
+    "change", ["hash", "revision", "order", "review", "review_digest", "frontend", "float", "extra", "image", "missing"]
+)
+async def test_changed_or_unreviewed_reference_metadata_refuses_before_scope(tmp_path, frozen_run, change):
+    references = copy.deepcopy(Engine._qa_reference_descriptors(frozen_run))
+    if change == "hash":
+        references[0]["source_sha256"] = "f" * 64
+    elif change == "revision":
+        frozen_run["design_snapshot"]["digest"] = "f" * 64
+    elif change == "order":
+        references.reverse()
+    elif change == "review":
+        frozen_run["product_definition"]["definition"]["design_review"]["reviewed"] = False
+    elif change == "review_digest":
+        frozen_run["product_definition"]["definition"]["design_review"]["digest"] = "f" * 64
+    elif change == "frontend":
+        frozen_run["frontend"] = "none"
+    elif change == "float":
+        references[0]["zoom"] = 100.0
+    elif change == "extra":
+        references[0]["arbitrary"] = "not a native descriptor"
+    elif change == "image":
+        references[0]["image"] = b"\x89PNG\r\n\x1a\n"
+    else:
+        references.clear()
+    with pytest.raises(ValueError):
+        attach(tmp_path, frozen_run, tuple(references))
+
+
+@pytest.mark.parametrize("tool", ["browser_check", "browser_journey", "profile_python", "external_mcp"])
+async def test_frozen_text_does_not_grant_active_qa_or_other_dynamic_tools(tmp_path, frozen_run, tool):
+    references = tuple(Engine._qa_reference_descriptors(frozen_run))
+    with pytest.raises(ValueError, match="explicit static"):
+        attach(tmp_path, frozen_run, references, grants=GRANTS | {tool})
+
+
+def test_descriptor_generator_engine_bytes_are_part_of_checkpoint_runtime_contract(monkeypatch):
+    before = runtime_contract()
+    read = Path.read_bytes
+
+    def changed(path):
+        value = read(path)
+        return value + b"\n# controlled semantic drift" if path.name == "engine.py" else value
+
+    monkeypatch.setattr(Path, "read_bytes", changed)
+    assert runtime_contract() != before
+
+
+async def test_original_result_restores_with_the_same_frozen_text_and_no_image_tools(tmp_path, monkeypatch, frozen_run):
+    env = await activated(tmp_path, monkeypatch)
+    env.store.run.data.update({key: value for key, value in frozen_run.items() if key != "id"})
+    try:
+        posts, _, checkpoint, _, request = await queue_original(env, monkeypatch, source="http_response")
+        assert "source_sha256" in posts[0].decode()
+        binding = CheckpointPayloadV2.model_validate(checkpoint["payload"]).invocation
+        assert not {"browser_check", "browser_journey"}.intersection(binding.grants)
+        assert binding.run_cut == invocation_cut(await env.store.get_run(RUN))
+
+        async def snapshot(*args, **kwargs):
+            return ["service.py"], controlled_source_snapshot("Frozen textual design fixture"), "c" * 40
+
+        monkeypatch.setattr(env.engine, "_snapshot", snapshot)
+        before = (env.workspace / "service.py").stat().st_mtime_ns
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(request.request_id)
+        assert (await env.requests.get(request.request_id))["status"] == "completed"
+        assert len(posts) == 2 and (env.workspace / "service.py").stat().st_mtime_ns == before
+        assert len([row for row in env.journal.records.rows if row.kind == "agent_consume"]) == 2
+    finally:
+        await env.model.client.close()
diff --git a/tests/test_agentic_checkpoint_static_tools_host.py b/tests/test_agentic_checkpoint_static_tools_host.py
new file mode 100644
index 00000000..3960ef8b
--- /dev/null
+++ b/tests/test_agentic_checkpoint_static_tools_host.py
@@ -0,0 +1,222 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Static text tools retain checkpoints; unowned runner effects forbid graph restore."""
+
+from types import SimpleNamespace
+
+import pytest
+from pydantic_ai.messages import ModelResponse, TextPart, ToolCallPart, ToolReturnPart
+from pydantic_ai.models.function import FunctionModel
+from test_agentic_checkpoint_activation_host import RUN, activated, queue_original
+
+from firefly_forge.agent_checkpoint_models import CheckpointPayloadV2
+from firefly_forge.agent_roles import ProjectRoles, RoleRegistry
+from firefly_forge.agentic_checkpoint_boundary import AgenticBoundary
+from firefly_forge.agentic_checkpoint_invocation import CheckpointInvocation, checkpoint_invocation
+from firefly_forge.agentic_runtime import execute_agentic
+from firefly_forge.process import ProcessResult
+from firefly_forge.workspace_tools import ToolRuntimeContext
+
+GRANTS = frozenset(
+    {
+        "list_files",
+        "read_file",
+        "write_file",
+        "search_text",
+        "edit_lines",
+        "git_diff",
+        "execute_command",
+        "knowledge_lookup",
+        "read_run_evidence",
+    }
+)
+
+
+async def nothing(*args):
+    pass
+
+
+def invocation_for(tmp_path, *, restored=None):
+    return CheckpointInvocation(
+        SimpleNamespace(credential_registry=dict),
+        SimpleNamespace(),
+        {"id": RUN},
+        {},
+        tmp_path,
+        nothing,
+        restored=restored,
+    )
+
+
+@pytest.mark.parametrize(
+    "grants,qa",
+    [
+        (None, ()),
+        (frozenset(), ()),
+        (GRANTS | {"external_mcp"}, ()),
+        (GRANTS | {"browser_check"}, ()),
+        (GRANTS, ({"artifact_id": "qa"},)),
+    ],
+)
+def test_static_checkpoint_still_refuses_implicit_dynamic_and_qa_grants(tmp_path, grants, qa):
+    invocation = invocation_for(tmp_path)
+    with pytest.raises(ValueError, match="explicit static.*without QA|exact frozen textual QA"):
+        invocation.attach(
+            AgenticBoundary(lambda: {"files_written": []}),
+            "Build",
+            "pyfly",
+            "none",
+            SimpleNamespace(allowed_tools=grants, qa_references=qa),
+            {},
+        )
+
+
+def test_restored_static_grants_must_match_the_original_exactly(tmp_path):
+    original = invocation_for(tmp_path)
+    context = SimpleNamespace(allowed_tools=GRANTS, qa_references=())
+    original.attach(AgenticBoundary(lambda: {"files_written": []}), "Build", "pyfly", "none", context, {})
+    restored = SimpleNamespace(binding=original.binding)
+    invocation = invocation_for(tmp_path, restored=restored)
+    with pytest.raises(ValueError, match="grants or runtime contract changed"):
+        invocation.attach(
+            AgenticBoundary(lambda: {"files_written": []}),
+            "Build",
+            "pyfly",
+            "none",
+            SimpleNamespace(allowed_tools=GRANTS - {"execute_command"}, qa_references=()),
+            {},
+        )
+
+
+async def test_required_checkpoint_runs_actual_static_function_tools_and_captures_their_returns(tmp_path):
+    invocation = CheckpointInvocation(
+        SimpleNamespace(credential_registry=dict), SimpleNamespace(), {"id": RUN}, {}, tmp_path, nothing
+    )
+    calls, checkpoints = [], []
+
+    async def command(argv, timeout):
+        calls.append(("execute_command", argv, timeout))
+        (tmp_path / "service.py").write_text("VALUE = 2\n")
+        return ProcessResult(argv, 0, "created")
+
+    async def knowledge(query, refresh, request):
+        calls.append(("knowledge_lookup", query, refresh, request))
+        return {"text": "Recorded framework guidance"}
+
+    async def evidence(query):
+        calls.append(("read_run_evidence", query))
+        return {"text": "Recorded failed check"}
+
+    sequence = [
+        ("execute_command", {"argv": ["python", "build.py"], "timeout": 10}),
+        ("knowledge_lookup", {"query": "data transactions"}),
+        ("read_run_evidence", {"query": {"kind": "checks"}}),
+    ]
+
+    def model(messages, info):
+        assert {tool.name for tool in info.function_tools} == GRANTS
+        assert invocation.boundary is not None
+        checkpoints.append(invocation.boundary.capture(b"controlled-function-model-wire"))
+        returns = [part for msg in messages for part in msg.parts if isinstance(part, ToolReturnPart)]
+        if len(returns) < len(sequence):
+            name, args = sequence[len(returns)]
+            return ModelResponse(parts=[ToolCallPart(name, args, tool_call_id="static-" + str(len(returns)))])
+        return ModelResponse(parts=[TextPart('{"summary":"Prepared and inspected"}')])
+
+    context = ToolRuntimeContext(
+        tmp_path, tmp_path, GRANTS, command, knowledge_lookup=knowledge, read_run_evidence=evidence
+    )
+    with checkpoint_invocation(invocation):
+        summary, usage = await execute_agentic(
+            tmp_path,
+            "Build",
+            "pyfly",
+            "none",
+            nothing,
+            model=FunctionModel(model),
+            runtime_context=context,
+            settings={"FORGE_AGENTIC_CHECKPOINTS": "required", "FORGE_BRIDGE_COMPLETION_RECOVERY": "required"},
+            allow_output_token_cap=False,
+        )
+    assert summary == "Prepared and inspected"
+    assert [call[0] for call in calls] == [name for name, _ in sequence]
+    assert usage["files_written"] == ["service.py"]
+    assert checkpoints[-1].state == {"files_written": ["service.py"]}
+    assert invocation.binding is not None and invocation.binding.grants == sorted(GRANTS)
+    assert len(checkpoints) == 4
+
+
+def set_command_grants(env, tmp_path):
+    from test_sandbox_command_ordinals_host import Rows
+
+    env.journal.sandboxes = Rows()
+    catalog = RoleRegistry.tools()
+    for tool in catalog:
+        if tool["id"] in GRANTS:
+            tool["availability"] = "worker_unverified"
+    env.store.run.data["role_snapshot"] = RoleRegistry(tmp_path / "expanded-roles").snapshot(
+        ProjectRoles(disabled=["docs"], allowed_tools={"implementer": sorted(GRANTS)}), tool_catalog=catalog
+    )
+
+
+@pytest.mark.parametrize("effect", ["done", "unknown", "interrupted"])
+async def test_command_enabled_restore_admission_refuses_unowned_runner_history(tmp_path, monkeypatch, effect):
+    from firefly_forge.workspace_tools import WorkspaceTools
+
+    env = await activated(tmp_path, monkeypatch)
+    set_command_grants(env, tmp_path)
+    write = WorkspaceTools.write_file
+
+    async def orphan(tools, path, content):
+        await env.journal._append(
+            RUN,
+            "implement",
+            "orphan-command",
+            "sandbox_receipt",
+            {"execution_id": "c" * 32, "effect": "start", "evidence": {"outcome": effect}},
+        )
+        return await write(tools, path, content)
+
+    monkeypatch.setattr(WorkspaceTools, "write_file", orphan)
+    try:
+        with pytest.raises(ValueError, match="Prior runner.*restore"):
+            await queue_original(env, monkeypatch, source="http_response")
+        assert any(row.kind == "sandbox_receipt" for row in env.journal.records.rows)
+        assert not env.requests.records.rows
+    finally:
+        await env.model.client.close()
+
+
+async def test_command_enabled_restore_reentry_refuses_runner_effect_added_after_admission(tmp_path, monkeypatch):
+    env = await activated(tmp_path, monkeypatch)
+    set_command_grants(env, tmp_path)
+    try:
+        posts, _, checkpoint, _, request = await queue_original(env, monkeypatch, source="http_response")
+        assert CheckpointPayloadV2.model_validate(checkpoint["payload"]).invocation.grants == sorted(GRANTS)
+        await env.journal._append(
+            RUN,
+            "implement",
+            "orphan-command",
+            "sandbox_intent",
+            {"execution_id": "c" * 32, "effect": "start", "request": {}},
+        )
+        await env.restores.execute(request.request_id)
+        ticket = await env.requests.get(request.request_id)
+        assert ticket["status"] == "failed"
+        assert len(posts) == 2
+        assert len([row for row in env.journal.records.rows if row.kind == "agent_consume"]) == 1
+    finally:
+        await env.model.client.close()
+
+
+async def test_read_only_restore_does_not_consult_or_erase_runner_history(tmp_path, monkeypatch):
+    env = await activated(tmp_path, monkeypatch)
+
+    async def never(run_id):
+        raise AssertionError("File-only restoration must retain its existing behavior")
+
+    monkeypatch.setattr(env.journal, "sandbox_executions", never)
+    try:
+        await queue_original(env, monkeypatch, source="http_response")
+        assert len(env.requests.records.rows) == 1
+    finally:
+        await env.model.client.close()
diff --git a/tests/test_agentic_checkpoint_static_tools_native.py b/tests/test_agentic_checkpoint_static_tools_native.py
new file mode 100644
index 00000000..b4b60a3d
--- /dev/null
+++ b/tests/test_agentic_checkpoint_static_tools_native.py
@@ -0,0 +1,73 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Real SQL checkpoint custody and durable refusal; no external models or commands."""
+
+from uuid import uuid4
+
+import pytest
+from pydantic_ai import models
+from test_agentic_checkpoint_static_tools_host import GRANTS
+from test_agentic_restore_receipt_native import native_restoration
+from test_bridge_completion_native import mock_model_requests
+
+from firefly_forge.agentic_checkpoint_invocation import current_checkpoint_invocation
+from firefly_forge.workspace_tools import WorkspaceTools
+
+
+async def test_native_static_tools_restore_original_result_when_no_runner_effect_exists(store, tmp_path, monkeypatch):
+    async with native_restoration(store, tmp_path, monkeypatch, grants=sorted(GRANTS)) as env:
+        assert await env.journal.sandbox_executions(env.run_id) == []
+        before = (env.workspace / "service.py").stat().st_mtime_ns
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        ticket = await env.restores.get(env.run_id, env.intent["idempotency_key"], env.request.request_id)
+        assert ticket["status"] == "completed"
+        assert len(env.posts) == 2 and env.checks == [1]
+        assert (env.workspace / "service.py").stat().st_mtime_ns == before
+        entries = await env.journal.entries(env.run_id)
+        assert env.journal.verify_chain(entries)
+        assert sum(record["kind"] == "agent_consume" for record in entries) == 2
+
+
+@pytest.mark.parametrize("outcome", ["unknown", "done", "interrupted"])
+async def test_native_runner_history_blocks_restore_after_consumed_tool_without_reset(
+    store, tmp_path, monkeypatch, outcome
+):
+    original = WorkspaceTools.write_file
+    retained = {}
+
+    async def record_before_write(tools, path, content):
+        invocation = current_checkpoint_invocation()
+        assert invocation is not None
+        journal, run_id = invocation.journal, invocation.run["id"]
+        before = await journal.entries(run_id)
+        assert sum(record["kind"] == "agent_consume" for record in before) == 1
+        execution_id = uuid4().hex
+        payload = {
+            "parent_attempt": 1,
+            "ordinal": 1,
+            "container_name": "forge-fixture-" + execution_id,
+            "snapshot_digest": "a" * 64,
+            "request_digest": "b" * 64,
+        }
+        result = await journal.sandbox_effect_intent(
+            run_id, "implement", execution_id, effect="create", payload=payload
+        )
+        assert result["disposition"] == "execute"
+        if outcome != "unknown":
+            await journal.sandbox_effect_receipt(
+                run_id, "implement", execution_id, effect="create", evidence={"outcome": outcome}
+            )
+        retained.update(journal=journal, run_id=run_id, execution_id=execution_id)
+        return await original(tools, path, content)
+
+    monkeypatch.setattr(WorkspaceTools, "write_file", record_before_write)
+    with pytest.raises(ValueError, match="Prior runner.*restore"):
+        async with native_restoration(store, tmp_path, monkeypatch, grants=sorted(GRANTS)):
+            pytest.fail("Prior command custody must prevent a restore ticket")
+    journal, run_id = retained["journal"], retained["run_id"]
+    records = await journal.sandbox_executions(run_id)
+    assert len(records) == 1 and records[0]["execution_id"] == retained["execution_id"]
+    entries = await journal.entries(run_id)
+    assert journal.verify_chain(entries)
+    assert sum(record["kind"] == "agent_consume" for record in entries) == 1
+    assert sum(record["kind"] == "agent_checkpoint" for record in entries) == 2
diff --git a/tests/test_agentic_completed_commands_restore_host.py b/tests/test_agentic_completed_commands_restore_host.py
new file mode 100644
index 00000000..cb79567d
--- /dev/null
+++ b/tests/test_agentic_completed_commands_restore_host.py
@@ -0,0 +1,265 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Actual command executor/Journal controls with transactional memory rows, not SQL proof."""
+
+import copy
+import time
+from types import SimpleNamespace
+from uuid import uuid4
+
+import pytest
+from test_sandbox_command_ordinals_host import command
+
+from firefly_forge.agent_checkpoint_models import InvocationBinding
+from firefly_forge.agent_restores import AgentRestores
+
+pytest_plugins = ["test_sandbox_command_ordinals_host"]
+
+
+async def retained(case):
+    await command(case, ["completed-before-checkpoint"])
+    context = InvocationBinding(
+        invocation_id="a" * 32,
+        ordinal=2,
+        predecessor="b" * 64,
+        brief="Continue after the completed command without replay",
+        backend="pyfly",
+        frontend="none",
+        round=1,
+        deadline_ms=int(time.time() * 1000) + 60_000,
+        grants=["execute_command"],
+        contract="c" * 64,
+        run_cut="d" * 64,
+        workspace={"path": str(case.workspace), "head": "e" * 40, "metadata": "f" * 64, "source": "1" * 64},
+    )
+    checkpoint = await case.journal._append(
+        case.run_id,
+        "implement",
+        "fbr1_" + "2" * 32,
+        "agent_checkpoint",
+        {"invocation": context.model_dump(mode="json"), "intent_digest": "9" * 64},
+    )
+    service = AgentRestores(case.store, SimpleNamespace(), SimpleNamespace(journal=case.journal))
+    return service, context, checkpoint
+
+
+async def test_completed_native_command_can_restore_without_replay_or_counter_reset(command_case):
+    case = command_case
+    service, context, _ = await retained(case)
+    await service._command_restore(await case.store.get_run(case.run_id), context)
+    assert case.calls == [["completed-before-checkpoint"]]
+    await command(case, ["new-after-restoration"])
+    records = await case.journal.sandbox_executions(case.run_id)
+    assert [row["ordinal"] for row in records] == [1, 2]
+    assert case.calls == [["completed-before-checkpoint"], ["new-after-restoration"]]
+
+
+async def consumed(case, checkpoint):
+    ticket = {"id": "3" * 32, "generation": "4" * 32}
+    await case.journal._append(
+        case.run_id,
+        "implement",
+        checkpoint["idempotency_key"],
+        "agent_consume",
+        {
+            "version": 2,
+            "request_id": checkpoint["idempotency_key"],
+            "intent_digest": checkpoint["payload"]["intent_digest"],
+            "checkpoint_record_digest": checkpoint["digest"],
+            "source": {"kind": "http_response", "record_digest": "5" * 64},
+            "response_sha256": "6" * 64,
+            "response_bytes": 1,
+            "restore_request_id": ticket["id"],
+            "generation": ticket["generation"],
+        },
+    )
+    return ticket
+
+
+async def test_reentry_accepts_only_new_complete_effects_after_matching_consume(command_case):
+    case = command_case
+    service, context, checkpoint = await retained(case)
+    ticket = await consumed(case, checkpoint)
+    await command(case, ["new-after-consumption"])
+    await service._command_restore(await case.store.get_run(case.run_id), context, ticket=ticket)
+    assert case.calls == [["completed-before-checkpoint"], ["new-after-consumption"]]
+
+
+async def test_completed_effect_after_checkpoint_before_consume_is_not_restorable(command_case):
+    case = command_case
+    service, context, checkpoint = await retained(case)
+    await command(case, ["effect-outside-retained-history"])
+    ticket = await consumed(case, checkpoint)
+    with pytest.raises(ValueError, match="Prior runner"):
+        await service._command_restore(await case.store.get_run(case.run_id), context, ticket=ticket)
+    assert len(case.calls) == 2
+
+
+@pytest.mark.parametrize("field", ["generation", "id"])
+async def test_reentry_refuses_another_restore_ticket_or_generation(command_case, field):
+    case = command_case
+    service, context, checkpoint = await retained(case)
+    ticket = await consumed(case, checkpoint)
+    await command(case)
+    ticket[field] = "7" * 32
+    with pytest.raises(ValueError, match="Prior runner"):
+        await service._command_restore(await case.store.get_run(case.run_id), context, ticket=ticket)
+    assert len(case.calls) == 2
+
+
+@pytest.mark.parametrize(
+    "change",
+    [
+        "unknown",
+        "interrupted",
+        "unreconciled",
+        "ordinal",
+        "attempt",
+        "snapshot",
+        "legacy",
+        "output",
+        "orphan_row",
+        "orphan_wal",
+        "chain",
+        "budget",
+    ],
+)
+async def test_unknown_forged_or_orphan_command_custody_refuses_without_dispatch(command_case, change):
+    case = command_case
+    service, context, _ = await retained(case)
+    row = case.store.sandboxes.rows[0]
+    before = copy.deepcopy(case.calls)
+    if change == "unknown":
+        row.data["effects"]["start"]["status"] = "intent"
+    elif change == "interrupted":
+        row.data["effects"]["start"]["evidence"]["outcome"] = "interrupted"
+    elif change == "unreconciled":
+        row.data["effects"]["start"]["evidence"]["workspace_import"] = "requires_reconciliation"
+    elif change == "ordinal":
+        row.ordinal += 1
+    elif change == "attempt":
+        row.parent_attempt += 1
+    elif change == "snapshot":
+        row.snapshot_digest = "7" * 64
+    elif change == "legacy":
+        row.data["request"].pop("executor_contract")
+    elif change == "output":
+        row.data["effects"]["start"]["evidence"]["output"] = "forged"
+    elif change == "orphan_row":
+        case.store.sandboxes.rows.clear()
+    elif change == "orphan_wal":
+        row.id = uuid4()
+    elif change == "chain":
+        case.store.records.rows[0].digest = "0" * 64
+    else:
+        case.store.run.data["sandbox_snapshot"]["configuration"]["command_limit"] = 0
+    with pytest.raises(ValueError):
+        await service._command_restore(await case.store.get_run(case.run_id), context)
+    assert case.calls == before
+
+
+async def test_exhausted_command_budget_stays_spent_after_permitted_restoration(command_case):
+    from firefly_forge.sandbox_models import SandboxInput, capture_sandbox
+
+    case = command_case
+    case.store.run.data["sandbox_snapshot"] = capture_sandbox(SandboxInput(command_limit=1))
+    service, context, _ = await retained(case)
+    await service._command_restore(await case.store.get_run(case.run_id), context)
+    with pytest.raises(ValueError, match="budget"):
+        await command(case, ["over-budget"])
+    assert case.calls == [["completed-before-checkpoint"]]
+
+
+async def test_actual_sdk_graph_retains_complete_command_then_allocates_after_restore(tmp_path, monkeypatch):
+    from pydantic_ai import models
+    from test_agentic_checkpoint_activation_host import RUN, activated, controlled_source_snapshot, queue_original
+    from test_agentic_checkpoint_static_tools_host import set_command_grants
+    from test_bridge_completion_native import mock_model_requests
+
+    from firefly_forge import engine as engine_module
+    from firefly_forge.process import ProcessResult
+    from firefly_forge.sandbox import SandboxExecutor
+    from firefly_forge.workspace_tools import WorkspaceTools
+
+    env = await activated(tmp_path, monkeypatch)
+    set_command_grants(env, tmp_path)
+    dispatched = []
+
+    class Backend:
+        async def run(self, config, argv, cwd, timeout, output_limit):
+            dispatched.append(argv)
+            return ProcessResult(argv, 0, "completed")
+
+    backend = Backend()
+    original = WorkspaceTools.write_file
+
+    async def write(tools, path, content):
+        executor = SandboxExecutor(env.store, env.journal, SimpleNamespace(select=lambda config: backend))
+        await executor.execute(RUN, tools.root, tools.root, ["controlled", path], 2, "implement")
+        return await original(tools, path, content)
+
+    monkeypatch.setattr(WorkspaceTools, "write_file", write)
+    try:
+        posts, _, _, _, request = await queue_original(env, monkeypatch, source="http_response", next_tool=True)
+        assert dispatched == [["controlled", "service.py"]]
+        before = (env.workspace / "service.py").stat().st_mtime_ns
+        checked = engine_module.checked
+
+        async def head(argv, cwd, **kwargs):
+            if argv == ["git", "rev-parse", "HEAD"]:
+                return "b" * 40
+            return await checked(argv, cwd, **kwargs)
+
+        async def snapshot(*args, **kwargs):
+            return ["service.py", "later.py"], controlled_source_snapshot("Retained command graph"), "c" * 40
+
+        async def checkpoint(*args, **kwargs):
+            await env.store.update(RUN, checkpoint_revision="d" * 40)
+
+        async def artifact(*args, **kwargs):
+            await env.store.update(RUN, artifacts=[])
+
+        monkeypatch.setattr(engine_module, "checked", head)
+        monkeypatch.setattr(env.engine, "_snapshot", snapshot)
+        monkeypatch.setattr(env.engine, "_checkpoint_commit", checkpoint)
+        monkeypatch.setattr(env.engine, "_artifact", artifact)
+        # A third model result is a separately admitted new call after restoring the second result.
+        import httpx2
+        from test_agentic_checkpoint_activation_host import next_result
+        from test_bridge_completion_callbacks import CAPABILITY
+
+        def transport(request):
+            if request.method == "GET":
+                return httpx2.Response(200, json={"completionRecovery": CAPABILITY})
+            posts.append(request.content)
+            return httpx2.Response(200, json=next_result(False))
+
+        env.model.client._client._transport = httpx2.MockTransport(transport)
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(request.request_id)
+        ticket = await env.requests.get(request.request_id)
+        assert ticket["status"] == "completed", ticket.get("result")
+        assert dispatched == [["controlled", "service.py"], ["controlled", "later.py"]]
+        assert (env.workspace / "service.py").stat().st_mtime_ns == before
+        assert len(posts) == 3
+        assert [row["ordinal"] for row in await env.journal.sandbox_executions(RUN)] == [1, 2]
+        entries = [row.data for row in env.journal.records.rows]
+        assert env.journal.verify_chain(entries)
+        assert sum(row["kind"] == "agent_consume" for row in entries) == 3
+    finally:
+        await env.model.client.close()
+
+
+def test_restore_code_bytes_are_part_of_checkpoint_runtime_contract(monkeypatch):
+    from pathlib import Path
+
+    from firefly_forge.agentic_checkpoint_invocation import runtime_contract
+
+    before = runtime_contract()
+    original = Path.read_bytes
+
+    def changed(path):
+        value = original(path)
+        return value + b"\n# controlled restore semantic drift" if path.name == "agent_restores.py" else value
+
+    monkeypatch.setattr(Path, "read_bytes", changed)
+    assert runtime_contract() != before
diff --git a/tests/test_agentic_completed_commands_restore_native.py b/tests/test_agentic_completed_commands_restore_native.py
new file mode 100644
index 00000000..57f931d6
--- /dev/null
+++ b/tests/test_agentic_completed_commands_restore_native.py
@@ -0,0 +1,110 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Prepared native SQL restoration controls; controlled backend, no process or provider transport."""
+
+from types import SimpleNamespace
+from uuid import UUID
+
+import pytest
+from pydantic_ai import models
+from pyfly.data.transaction import current_unit_of_work
+from test_agentic_checkpoint_static_tools_host import GRANTS
+from test_agentic_restore_receipt_native import native_restoration
+from test_bridge_completion_native import mock_model_requests
+
+from firefly_forge.agentic_checkpoint_invocation import current_checkpoint_invocation
+from firefly_forge.process import ProcessResult
+from firefly_forge.sandbox import SandboxExecutor
+from firefly_forge.workspace_tools import WorkspaceTools
+
+
+def commands_before_each_write(monkeypatch, *, interrupt_second=False):
+    calls = []
+    original = WorkspaceTools.write_file
+
+    class Backend:
+        async def run(self, config, argv, cwd, timeout, output_limit):
+            assert current_unit_of_work() is None
+            calls.append(argv)
+            if interrupt_second and len(calls) == 2:
+                raise RuntimeError("Controlled command interruption after durable start")
+            return ProcessResult(argv, 0, "native completed command")
+
+    backend = Backend()
+
+    async def write(tools, path, content):
+        invocation = current_checkpoint_invocation()
+        assert invocation is not None
+        executor = SandboxExecutor(invocation.store, invocation.journal, SimpleNamespace(select=lambda config: backend))
+        await executor.execute(invocation.run["id"], tools.root, tools.root, ["controlled", path], 2, "implement")
+        return await original(tools, path, content)
+
+    monkeypatch.setattr(WorkspaceTools, "write_file", write)
+    return calls
+
+
+async def test_native_completed_command_graph_restores_then_allocates_new_slot(store, tmp_path, monkeypatch):
+    calls = commands_before_each_write(monkeypatch)
+    async with native_restoration(store, tmp_path, monkeypatch, grants=sorted(GRANTS), next_tool=True) as env:
+        assert calls == [["controlled", "service.py"]]
+        before = (env.workspace / "service.py").stat().st_mtime_ns
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        ticket = await env.requests.get(env.request.request_id)
+        assert ticket["status"] == "completed", ticket.get("result")
+        assert calls == [["controlled", "service.py"], ["controlled", "later.py"]]
+        assert (env.workspace / "service.py").stat().st_mtime_ns == before
+        rows = await env.journal.sandbox_executions(env.run_id)
+        assert [row["ordinal"] for row in rows] == [1, 2]
+        assert all(row["status"] == "removed" for row in rows)
+        entries = await env.journal.entries(env.run_id)
+        assert env.journal.verify_chain(entries)
+        assert sum(row["kind"] == "agent_consume" for row in entries) == 3
+        assert len(env.posts) == 3 and env.checks == [1]
+        assert env.schemas and set(env.schemas) == {store.schema}
+
+
+@pytest.mark.parametrize("drift", ["unknown", "cancel", "grants"])
+async def test_native_completed_command_restore_refuses_late_custody_or_authority_drift(
+    store, tmp_path, monkeypatch, drift
+):
+    calls = commands_before_each_write(monkeypatch)
+    async with native_restoration(store, tmp_path, monkeypatch, grants=sorted(GRANTS), next_tool=True) as env:
+        if drift == "unknown":
+            async with store._unit():
+                row = (await env.journal.sandboxes.for_run(UUID(env.run_id)))[0]
+                row.data = {**row.data, "effects": {**row.data["effects"], "start": {"status": "intent"}}}
+                await env.journal.sandboxes.save(row)
+        elif drift == "cancel":
+            await store.update(env.run_id, cancel_request={"status": "requested"})
+        else:
+            run = await store.get_run(env.run_id)
+            roles = run["role_snapshot"]
+            roles["digest"] = "0" * 64
+            await store.update(env.run_id, role_snapshot=roles)
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        ticket = await env.requests.get(env.request.request_id)
+        assert ticket["status"] == "failed"
+        assert calls == [["controlled", "service.py"]]
+        assert len(env.posts) == 2
+        entries = await env.journal.entries(env.run_id)
+        assert sum(row["kind"] == "agent_consume" for row in entries) == 1
+        assert env.journal.verify_chain(entries)
+
+
+async def test_native_new_interrupted_command_stays_unknown_without_replay(store, tmp_path, monkeypatch):
+    calls = commands_before_each_write(monkeypatch, interrupt_second=True)
+    async with native_restoration(store, tmp_path, monkeypatch, grants=sorted(GRANTS), next_tool=True) as env:
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        ticket = await env.requests.get(env.request.request_id)
+        assert ticket["status"] == "needs_reconciliation"
+        assert calls == [["controlled", "service.py"], ["controlled", "later.py"]]
+        assert len(env.posts) == 2
+        rows = await env.journal.sandbox_executions(env.run_id)
+        assert [row["ordinal"] for row in rows] == [1, 2]
+        assert rows[1]["effects"]["start"]["status"] == "intent"
+        with models.override_allow_model_requests(False), mock_model_requests(env.model):
+            await env.restores.execute(env.request.request_id)
+        assert len(calls) == 2 and len(env.posts) == 2
+        assert env.journal.verify_chain(await env.journal.entries(env.run_id))
diff --git a/tests/test_agentic_restore_receipt_native.py b/tests/test_agentic_restore_receipt_native.py
index 5b9840c1..c97cbcdb 100644
--- a/tests/test_agentic_restore_receipt_native.py
+++ b/tests/test_agentic_restore_receipt_native.py
@@ -6,6 +6,7 @@
 Agentic, SDK parsing, real file tools, native SQL/transactions/ACLs are not mocked.
 """
 
+import subprocess
 from contextlib import asynccontextmanager
 from types import SimpleNamespace
 from uuid import uuid4
@@ -31,7 +32,7 @@
 from firefly_forge.configuration import ProviderConfiguration
 from firefly_forge.engine import Engine
 from firefly_forge.execution_requests import ExecutionRequests
-from firefly_forge.git_workspace import metadata_digest
+from firefly_forge.git_workspace import git_environment, metadata_digest, trusted_git
 from firefly_forge.identity import Principal
 from firefly_forge.identity_persistence import ForgeIdentityUserEntity, ForgeIdentityUserRepository
 from firefly_forge.journal import Journal
@@ -43,8 +44,36 @@
 from firefly_forge.store import identifier
 
 
+def seed_restore_workspace(workspace):
+    workspace.mkdir(parents=True)
+    environment = git_environment({"PATH": "/usr/bin:/bin"})
+    for argv in (
+        ["git", "init", "-q"],
+        [
+            "git",
+            "-c",
+            "user.name=Controlled Source",
+            "-c",
+            "user.email=source@example.invalid",
+            "commit",
+            "--allow-empty",
+            "-qm",
+            "Seed source",
+        ],
+        ["git", "read-tree", "HEAD"],
+    ):
+        subprocess.run(trusted_git(argv), cwd=workspace, env=environment, check=True, capture_output=True, timeout=10)
+    return (
+        subprocess.check_output(trusted_git(["git", "rev-parse", "HEAD"]), cwd=workspace, env=environment, timeout=10)
+        .decode()
+        .strip()
+    )
+
+
 @asynccontextmanager
-async def native_restoration(store, tmp_path, monkeypatch, *, repair=False, outcome="success"):
+async def native_restoration(
+    store, tmp_path, monkeypatch, *, repair=False, outcome="success", grants=None, next_tool=False
+):
     async with prepared(store, tmp_path) as (_, actor, seeded, _, _, _, _, _):
         store.configuration.update("bridge", ProviderConfiguration(values={"checkpoints": "required"}))
         run = await store.create_run(
@@ -58,11 +87,17 @@ async def native_restoration(store, tmp_path, monkeypatch, *, repair=False, outc
         )
         run_id = run["id"]
         roles = RoleRegistry(tmp_path / "native-roles")
+        catalog = roles.tools()
+        if grants is not None:
+            for tool in catalog:
+                if tool["id"] in grants:
+                    tool["availability"] = "worker_unverified"
         await store.update(
             run_id,
             **store.configuration.snapshot("bridge"),
             role_snapshot=roles.snapshot(
-                ProjectRoles(disabled=["docs"], allowed_tools={"implementer": ["write_file"]})
+                ProjectRoles(disabled=["docs"], allowed_tools={"implementer": grants or ["write_file"]}),
+                tool_catalog=catalog,
             ),
             repair_budget=int(repair),
             resume_existing=True,
@@ -78,14 +113,13 @@ async def native_restoration(store, tmp_path, monkeypatch, *, repair=False, outc
         monkeypatch.setattr(provider, "model", lambda **kwargs: model)
         engine = Engine(store, tmp_path / "native-owned", lambda _: provider, journal=journal)
         workspace = engine.workspaces / run_id
-        (workspace / ".git").mkdir(parents=True)
-        (workspace / ".git/HEAD").write_text("b" * 40)
+        revision = seed_restore_workspace(workspace)
         await store.update(run_id, git_metadata_digest=metadata_digest(workspace))
 
         async def head(argv, cwd, **kwargs):
             assert current_unit_of_work() is None
             assert argv[-2:] == ["rev-parse", "HEAD"]
-            return "b" * 40
+            return revision
 
         async def engine_git(argv, cwd, **kwargs):
             assert current_unit_of_work() is None
@@ -98,7 +132,7 @@ async def declaration(argv, cwd, **kwargs):
             return ""
 
         async def inspect(*args, **kwargs):
-            return {"base_revision": "b" * 40, "head": "b" * 40, "source_tree": "c" * 40}
+            return {"base_revision": revision, "head": revision, "source_tree": "c" * 40}
 
         async def snapshot(*args, **kwargs):
             return ["service.py"], controlled_source_snapshot("Fictional native SQL control patch"), "c" * 40
@@ -160,6 +194,8 @@ def transport(request):
             if len(posts) == 1:
                 return httpx2.Response(200, json=result(tool=True))
             if len(posts) == 2:
+                return httpx2.Response(200, json=next_result(next_tool))
+            if next_tool and not repair:
                 return httpx2.Response(200, json=next_result(False))
             assert repair, "Original native result attempted a replacement POST"
             if outcome == "crash":
@@ -353,7 +389,15 @@ async def test_native_late_distinct_identity_revocation_prevents_original_result
         async def revoke(value):
             assert current_unit_of_work() is None
             await admit(value)
-            if not changed and isinstance(value, tuple) and len(value) == 3:
+            source = value[0] if isinstance(value, tuple) and len(value) == 2 else None
+            original_bundle = (
+                isinstance(source, tuple)
+                and len(source) == 3
+                and [record.get("kind") for record in source]
+                == ["bridge_request_intent", "agent_checkpoint", "bridge_request_response"]
+                and all(record.get("idempotency_key") == env.intent["idempotency_key"] for record in source)
+            )
+            if not changed and original_bundle:
                 async with store._unit():
                     users = ForgeIdentityUserRepository()
                     user = await users.find_by_id(revoked.id, lock=LockMode.PESSIMISTIC_WRITE)
diff --git a/tests/test_channel_actions.py b/tests/test_channel_actions.py
index a3eb341b..08663e82 100644
--- a/tests/test_channel_actions.py
+++ b/tests/test_channel_actions.py
@@ -549,9 +549,11 @@ async def product_channel(store, monkeypatch):
     )
     posted = []
 
-    async def write(repo, payload, issue, *, before_write=None):
+    async def write(repo, payload, issue, *, before_write=None, before_dispatch=None):
         if before_write is not None:
             await before_write()
+        if before_dispatch is not None:
+            await before_dispatch()
         posted.append(payload)
         return {"id": "comment-1"}
 
diff --git a/tests/test_checkpoint_source_identity_host.py b/tests/test_checkpoint_source_identity_host.py
new file mode 100644
index 00000000..b22841f1
--- /dev/null
+++ b/tests/test_checkpoint_source_identity_host.py
@@ -0,0 +1,206 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Real local Git source selection, without providers or installed dependencies."""
+
+import os
+import subprocess
+import tracemalloc
+
+import pytest
+
+from firefly_forge.agentic_checkpoint_invocation import workspace_cut
+from firefly_forge.source_diff_admission import SourceDiffAdmission
+
+
+def git(root, *args):
+    return subprocess.check_output(["git", *args], cwd=root, stderr=subprocess.STDOUT).decode().strip()
+
+
+def repository(tmp_path):
+    git(tmp_path, "init", "-q")
+    git(tmp_path, "config", "user.name", "Controlled Source")
+    git(tmp_path, "config", "user.email", "source@example.invalid")
+    (tmp_path / ".gitignore").write_text("node_modules/\ngenerated/\n")
+    (tmp_path / "package.json").write_text('{"name":"controlled-source","private":true}\n')
+    git(tmp_path, "add", ".")
+    git(tmp_path, "commit", "-qm", "Seed source")
+    return tmp_path
+
+
+class SourceStore:
+    def __init__(self, *, secret=None, observe=None):
+        self.secret, self.observe = secret, observe
+        self.checks = 0
+
+    def credential_registry(self):
+        return {"TOKEN": self.secret} if self.secret else {}
+
+    async def source_patch_scanner(self, **kwargs):
+        async def verify():
+            self.checks += 1
+            if self.observe:
+                self.observe()
+
+        return SourceDiffAdmission(
+            credentials=tuple(self.credential_registry().values()), matcher=None, packets=(), verify_current=verify
+        )
+
+
+async def test_checkpoint_source_survives_real_npm_style_ignored_dependency_links(tmp_path):
+    root = repository(tmp_path)
+    (root / "package-lock.json").write_text('{"lockfileVersion":3,"packages":{}}\n')
+    clean = await workspace_cut(SourceStore(), root)
+    package = root / "node_modules" / "typescript" / "bin"
+    package.mkdir(parents=True)
+    (package / "tsc").write_text("#!/usr/bin/env node\n")
+    bins = root / "node_modules" / ".bin"
+    bins.mkdir()
+    (bins / "tsc").symlink_to("../typescript/bin/tsc")
+    assert git(root, "check-ignore", "node_modules/.bin/tsc") == "node_modules/.bin/tsc"
+    assert await workspace_cut(SourceStore(), root) == clean
+    (root / "package-lock.json").write_text('{"lockfileVersion":3,"packages":{"x":{}}}\n')
+    assert (await workspace_cut(SourceStore(), root))["source"] != clean["source"]
+
+
+async def test_checkpoint_source_streams_large_valid_source_and_keeps_tracked_ignored_assets(tmp_path):
+    root = repository(tmp_path)
+    asset = root / "generated" / "branding.bin"
+    asset.parent.mkdir()
+    with asset.open("wb") as output:
+        for _ in range(300):
+            output.write(b"public-branding\x00" * 4096)
+    git(root, "add", "-f", "generated/branding.bin")
+    store = SourceStore()
+    assert asset.stat().st_size > 16_777_216
+    tracemalloc.start()
+    try:
+        before = await workspace_cut(store, root)
+        _, peak = tracemalloc.get_traced_memory()
+    finally:
+        tracemalloc.stop()
+    assert peak < 4 * 1024 * 1024
+    with asset.open("ab") as output:
+        output.write(b"real-asset-change")
+    assert (await workspace_cut(store, root))["source"] != before["source"]
+    assert store.checks >= 2
+
+
+@pytest.mark.parametrize("tracked", [False, True])
+async def test_checkpoint_source_refuses_selected_source_symlinks_even_when_tracked_ignored(tmp_path, tracked):
+    root = repository(tmp_path)
+    link = root / ("generated/source-link" if tracked else "source-link")
+    link.parent.mkdir(exist_ok=True)
+    link.symlink_to(root / "package.json")
+    if tracked:
+        git(root, "add", "-f", str(link.relative_to(root)))
+    with pytest.raises(ValueError, match="regular|link"):
+        await workspace_cut(SourceStore(), root)
+
+
+@pytest.mark.parametrize("name", [".env", "credentials.json"])
+async def test_checkpoint_source_rejects_tracked_private_paths(tmp_path, name):
+    root = repository(tmp_path)
+    (root / name).write_text("not-a-real-credential")
+    git(root, "add", "-f", name)
+    with pytest.raises(ValueError, match="private"):
+        await workspace_cut(SourceStore(), root)
+
+
+async def test_checkpoint_source_rejects_configured_credential_and_source_hardlink(tmp_path):
+    root = repository(tmp_path)
+    (root / "source.txt").write_text("fictional-source-test-token")
+    with pytest.raises(ValueError, match="credential"):
+        await workspace_cut(SourceStore(secret="fictional-source-test-token"), root)
+    (root / "source.txt").write_text("public source")
+    os.link(root / "source.txt", root / "alias.txt")
+    with pytest.raises(ValueError, match="link|regular"):
+        await workspace_cut(SourceStore(), root)
+
+
+async def test_checkpoint_source_excludes_only_git_ignored_untracked_outputs(tmp_path):
+    root = repository(tmp_path)
+    before = await workspace_cut(SourceStore(), root)
+    (root / "generated").mkdir()
+    (root / "generated/output.txt").write_text("ignored build output")
+    assert await workspace_cut(SourceStore(), root) == before
+    (root / "new-source.txt").write_text("untracked source is included")
+    assert (await workspace_cut(SourceStore(), root))["source"] != before["source"]
+
+
+async def test_checkpoint_source_final_admission_rejects_source_change(tmp_path):
+    root = repository(tmp_path)
+    store = SourceStore(observe=lambda: (root / "package.json").write_text("changed during final admission"))
+    with pytest.raises(ValueError, match="changed"):
+        await workspace_cut(store, root)
+
+
+async def test_checkpoint_source_requires_git_and_leaves_transport_archive_strict(tmp_path):
+    from firefly_forge.sandbox import pack_workspace
+
+    with pytest.raises((ValueError, RuntimeError)):
+        await workspace_cut(SourceStore(), tmp_path)
+    root = repository(tmp_path)
+    (root / "node_modules").mkdir()
+    (root / "node_modules/bin").symlink_to("../package.json")
+    with pytest.raises(ValueError, match="regular"):
+        pack_workspace(root, 65536)
+
+
+@pytest.mark.parametrize("change", ["new_file", "index", "head", "ignore_rules"])
+async def test_checkpoint_source_final_admission_fences_inventory_and_git_metadata(tmp_path, change):
+    root = repository(tmp_path)
+
+    def alter():
+        if change == "new_file":
+            (root / "late-source.txt").write_text("late source")
+        elif change == "index":
+            git(root, "update-index", "--chmod=+x", "package.json")
+        elif change == "head":
+            git(root, "commit", "--allow-empty", "-qm", "Different revision")
+        else:
+            (root / ".gitignore").write_text("*.json\n")
+
+    with pytest.raises(ValueError, match="changed"):
+        await workspace_cut(SourceStore(observe=alter), root)
+
+
+async def test_checkpoint_source_tracks_deletion_and_untracked_names_with_tabs(tmp_path):
+    root = repository(tmp_path)
+    before = await workspace_cut(SourceStore(), root)
+    (root / "package.json").unlink()
+    deleted = await workspace_cut(SourceStore(), root)
+    assert deleted["source"] != before["source"]
+    (root / "100644 literal 0\tnew-source.txt").write_text("literal source")
+    assert (await workspace_cut(SourceStore(), root))["source"] != deleted["source"]
+
+
+async def test_checkpoint_source_inventory_does_not_truncate_after_two_thousand_paths(tmp_path):
+    from firefly_forge.checkpoint_source_identity import stream_source_entries
+
+    root = repository(tmp_path)
+    for ordinal in range(2003):
+        (root / f"source-{ordinal:04d}.txt").touch()
+    observed = []
+
+    async def collect(entry):
+        observed.append(entry.path)
+
+    await stream_source_entries(root, collect)
+    assert len(observed) == 2005
+    assert "source-2002.txt" in observed
+
+
+async def test_checkpoint_source_includes_public_environment_template(tmp_path):
+    root = repository(tmp_path)
+    before = await workspace_cut(SourceStore(), root)
+    (root / ".env.example").write_text("PUBLIC_API_URL=https://example.invalid\n")
+    git(root, "add", ".env.example")
+    assert (await workspace_cut(SourceStore(), root))["source"] != before["source"]
+
+
+async def test_checkpoint_source_final_wait_cannot_add_source_in_an_empty_nested_directory(tmp_path):
+    root = repository(tmp_path)
+    empty = root / "unused" / "nested"
+    empty.mkdir(parents=True)
+    store = SourceStore(observe=lambda: (empty / "late-source.txt").write_text("late selected source"))
+    with pytest.raises(ValueError, match="changed"):
+        await workspace_cut(store, root)
diff --git a/tests/test_checkpoint_source_identity_native.py b/tests/test_checkpoint_source_identity_native.py
new file mode 100644
index 00000000..8625b246
--- /dev/null
+++ b/tests/test_checkpoint_source_identity_native.py
@@ -0,0 +1,93 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Prepared native Store/lease/source checks; controlled runner, no real npm or model."""
+
+from types import SimpleNamespace
+
+import pytest
+from pyfly.data.transaction import current_unit_of_work
+from test_checkpoint_source_identity_host import repository
+from test_runner_factory_authority import seed
+
+from firefly_forge.agentic_checkpoint_invocation import workspace_cut
+from firefly_forge.journal import Journal
+from firefly_forge.process import ProcessResult
+from firefly_forge.sandbox import SandboxExecutor
+
+
+async def test_native_completed_install_keeps_checkpoint_source_and_lock_provenance(store, tmp_path):
+    run, journal = await seed(store)
+    root = tmp_path / "source"
+    root.mkdir()
+    repository(root)
+    before = await workspace_cut(store, root)
+    calls = []
+
+    class Backend:
+        async def run(self, config, argv, cwd, timeout, output_limit):
+            assert current_unit_of_work() is None
+            calls.append(argv)
+            package = root / "node_modules" / "typescript" / "bin"
+            package.mkdir(parents=True)
+            (package / "tsc").write_text("controlled installed executable")
+            bins = root / "node_modules" / ".bin"
+            bins.mkdir()
+            (bins / "tsc").symlink_to("../typescript/bin/tsc")
+            (root / "package-lock.json").write_text('{"lockfileVersion":3,"packages":{}}\n')
+            return ProcessResult(argv, 0, "controlled install complete")
+
+    executor = SandboxExecutor(store, journal, SimpleNamespace(select=lambda config: Backend()))
+    outcome = await executor.execute(run["id"], root, root, ["npm", "install"], 2, "verify")
+    assert outcome.exit_code == 0 and calls == [["npm", "install"]]
+    installed = await workspace_cut(store, root)
+    assert installed["source"] != before["source"]
+    (root / "node_modules/typescript/bin/tsc").write_text("changed ignored dependency bytes")
+    assert await workspace_cut(store, root) == installed
+    (root / "package-lock.json").write_text('{"lockfileVersion":3,"packages":{"changed":{}}}\n')
+    assert (await workspace_cut(store, root))["source"] != installed["source"]
+    executions = await journal.sandbox_executions(run["id"])
+    assert len(executions) == 1 and executions[0]["ordinal"] == 1
+    assert all(executions[0]["effects"][kind]["status"] == "done" for kind in ("create", "start", "cleanup"))
+    assert Journal.verify_chain(await journal.entries(run["id"]))
+
+
+@pytest.mark.parametrize("change", ["credential_cut", "new_selected_file"])
+async def test_native_source_final_wait_refuses_changed_cut_without_runner_dispatch(
+    store, tmp_path, monkeypatch, change
+):
+    run, journal = await seed(store)
+    root = tmp_path / "source"
+    root.mkdir()
+    repository(root)
+    empty = root / "unused" / "nested"
+    empty.mkdir(parents=True)
+    registry = {"TOKEN": "fictional-native-original-token"}
+    store.credential_registry = lambda: dict(registry)
+    prepare = store.source_patch_scanner
+    changed = []
+
+    async def scanner(**kwargs):
+        value = await prepare(**kwargs)
+        verify = value._verify_current
+
+        async def final_wait():
+            await verify()
+            if not changed:
+                changed.append(change)
+                if change == "credential_cut":
+                    registry["TOKEN"] = "fictional-native-replaced-token"
+                    await verify()
+                else:
+                    (empty / "late-source.txt").write_text("late source")
+
+        value._verify_current = final_wait
+        return value
+
+    monkeypatch.setattr(store, "source_patch_scanner", scanner)
+    with pytest.raises(ValueError, match="changed"):
+        await workspace_cut(store, root)
+    assert changed == [change]
+    assert await journal.sandbox_executions(run["id"]) == []
+    plan = await journal.plan(run["id"])
+    task = next(item for item in plan["tasks"] if item["id"] == "verify")
+    assert task["status"] == "running" and task["attempt"] == 1
+    assert Journal.verify_chain(await journal.entries(run["id"]))
diff --git a/tests/test_collaboration_communication_host.py b/tests/test_collaboration_communication_host.py
index 2b63c4de..befdea2b 100644
--- a/tests/test_collaboration_communication_host.py
+++ b/tests/test_collaboration_communication_host.py
@@ -41,13 +41,13 @@ async def test_exact_deterministic_body_is_retained_before_comment_transport(del
     received(row, "status")
     original_write = service._remote_write
 
-    async def checked_write(repo, payload, issue, *, before_write=None):
+    async def checked_write(repo, payload, issue, *, before_write=None, before_dispatch=None):
         retained = row.data["feedback_intent"]
         assert retained["body"] == payload["body"]
         assert retained["body_sha256"] == hashlib.sha256(retained["body"].encode()).hexdigest()
         assert retained["communication"]["mode"] == "deterministic"
         assert retained["communication"]["reason"] == "unconfigured"
-        return await original_write(repo, payload, issue, before_write=before_write)
+        return await original_write(repo, payload, issue, before_write=before_write, before_dispatch=before_dispatch)
 
     service._remote_write = checked_write
     await service.process(RECEIPT)
@@ -84,7 +84,7 @@ def model(messages, info):
     service.communication_writer.model = reviewed_model(model)
     original_write = service._remote_write
 
-    async def checked_write(repo, payload, issue, *, before_write=None):
+    async def checked_write(repo, payload, issue, *, before_write=None, before_dispatch=None):
         intent = row.data["feedback_intent"]
         assert intent["body"] == payload["body"]
         assert intent["communication"]["mode"] == "ai"
@@ -92,7 +92,7 @@ async def checked_write(repo, payload, issue, *, before_write=None):
         assert intent["communication"]["profile"]["task"] == "communication"
         assert len(intent["communication"]["facts_sha256"]) == 64
         assert len(intent["communication"]["prompt_sha256"]) == 64
-        return await original_write(repo, payload, issue, before_write=before_write)
+        return await original_write(repo, payload, issue, before_write=before_write, before_dispatch=before_dispatch)
 
     service._remote_write = checked_write
     received(row, "status")
diff --git a/tests/test_initial_verification_contract_host.py b/tests/test_initial_verification_contract_host.py
index b67d341b..eef437ca 100644
--- a/tests/test_initial_verification_contract_host.py
+++ b/tests/test_initial_verification_contract_host.py
@@ -4,6 +4,7 @@
 import json
 
 import pytest
+from pydantic_ai.messages import ModelRequest, UserPromptPart
 from pydantic_ai.models.function import FunctionModel
 
 from firefly_forge import providers
@@ -37,7 +38,15 @@ async def stop_cli(argv, cwd, emit, **kwargs):
         raise providers.ProviderError("Controlled prompt capture; no CLI launched")
 
     def stop_model(messages, info):
-        captured.append(info.instructions)
+        user_parts = [
+            part.content
+            for message in messages
+            if isinstance(message, ModelRequest)
+            for part in message.parts
+            if isinstance(part, UserPromptPart) and isinstance(part.content, str)
+        ]
+        assert user_parts
+        captured.append("\n".join([info.instructions or "", *user_parts]))
         assert "run_configured_check" not in {tool.name for tool in info.function_tools}
         raise providers.ProviderError("Controlled prompt capture; no model contacted")
 
diff --git a/tests/test_mcp_prompt_templates.py b/tests/test_mcp_prompt_templates.py
index 476ee3cf..9dd9c9dd 100644
--- a/tests/test_mcp_prompt_templates.py
+++ b/tests/test_mcp_prompt_templates.py
@@ -77,7 +77,7 @@ def test_all_mcp_descriptions_are_empty_variable_native_resources():
     for tool in tools:
         assert entries["mcp/" + tool["name"]]["variables"] == {}
         assert catalog.text("mcp/" + tool["name"]) == tool["description"], tool["name"]
-    assert len(catalog.registry) == 311
+    assert len(catalog.registry) == 315
     assert entries["collaboration/decision-destination"]["variables"] == {"reference": "string"}
     assert entries["collaboration/decision-reply"]["variables"] == {"command": "string"}
     assert entries["collaboration/decision-resume"]["variables"] == {"command": "string"}
diff --git a/tests/test_product_context_projection_host.py b/tests/test_product_context_projection_host.py
new file mode 100644
index 00000000..24aa7a47
--- /dev/null
+++ b/tests/test_product_context_projection_host.py
@@ -0,0 +1,148 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Complete brand assets stay on disk; model context carries verified references."""
+
+import copy
+import hashlib
+import json
+
+import pytest
+from fireflyframework_agentic.model_utils import serialize_model_messages
+from pydantic_ai.messages import ModelResponse, ToolCallPart, ToolReturnPart
+from pydantic_ai.models.function import FunctionModel
+from test_agentic_checkpoint_activation_host import RUN, activated, lost_completion
+
+from firefly_forge.agentic_runtime import execute_agentic
+from firefly_forge.engine import Engine
+from firefly_forge.product_branding import BrandInput, ProductBranding
+from firefly_forge.workspace_tools import WorkspaceTools
+
+
+@pytest.fixture
+async def brand_case(tmp_path, monkeypatch):
+    env = await activated(tmp_path, monkeypatch)
+    brand = await ProductBranding(env.store).configure(
+        env.store.run.data["repository_id"], BrandInput(name="Support CRM")
+    )
+    env.store.run.data["branding_snapshot"] = brand
+    try:
+        yield env, brand
+    finally:
+        await env.model.client.close()
+
+
+async def test_frozen_brand_manifest_preserves_every_full_utf8_asset(brand_case):
+    _, brand = brand_case
+    manifest = Engine._branding_manifest(brand)
+    assert len(json.dumps(manifest)) < 4000
+    assert sum(len(text.encode()) for text in brand["files"].values()) > 30000
+    assert len(manifest["files"]) == len(brand["files"])
+    for item in manifest["files"]:
+        name = item["path"].rsplit("/", 1)[1]
+        assert item["path"] == "docs/brand/" + brand["digest"] + "/" + name
+        assert item["bytes"] == len(brand["files"][name].encode())
+        assert item["sha256"] == hashlib.sha256(brand["files"][name].encode()).hexdigest()
+    assert "data:font" not in json.dumps(manifest) and "<svg" not in json.dumps(manifest)
+
+
+@pytest.mark.parametrize("change", ["digest", "path"])
+async def test_brand_projection_refuses_tampering_before_any_file_effect(brand_case, change):
+    _, brand = brand_case
+    value = copy.deepcopy(brand)
+    if change == "digest":
+        value["files"]["brand-guide.md"] += "changed"
+    else:
+        value["files"]["../outside.css"] = "unsafe"
+        value["digest"] = hashlib.sha256(json.dumps(value["files"], sort_keys=True).encode()).hexdigest()
+    with pytest.raises(ValueError, match="branding"):
+        Engine._branding_manifest(value)
+
+
+async def test_native_brand_materialization_precedes_the_provider_and_is_idempotent(brand_case, monkeypatch):
+    env, brand = brand_case
+    posts, _, _ = await lost_completion(env, monkeypatch)
+    manifest = Engine._branding_manifest(brand)
+    for item in manifest["files"]:
+        path = env.workspace / item["path"]
+        assert path.read_text() == brand["files"][path.name]
+    wire = json.loads(posts[0])
+    assert "data:font/woff2;base64," not in json.dumps(wire)
+    assert "<svg" not in json.dumps(wire)
+    assert all(item["path"] in json.dumps(wire) for item in manifest["files"])
+    before = {item["path"]: (env.workspace / item["path"]).stat().st_mtime_ns for item in manifest["files"]}
+    await env.engine._materialize_branding(RUN, env.workspace, {})
+    assert before == {item["path"]: (env.workspace / item["path"]).stat().st_mtime_ns for item in manifest["files"]}
+
+
+async def test_conflicting_frozen_brand_content_is_never_overwritten(brand_case):
+    env, brand = brand_case
+    path = env.workspace / "docs/brand" / brand["digest"] / "tokens.json"
+    path.parent.mkdir(parents=True)
+    path.write_text("existing user content")
+    with pytest.raises(ValueError, match="brand|Brand"):
+        await env.engine._materialize_branding(RUN, env.workspace, {})
+    assert path.read_text() == "existing user content"
+    assert len(list(path.parent.iterdir())) == 1
+
+
+async def test_full_brand_files_keep_credential_admission_before_staging(brand_case):
+    env, brand = brand_case
+    secret = "configured-example-secret-89d9787019"
+    value = copy.deepcopy(brand)
+    value["files"]["brand-guide.md"] += secret
+    value["digest"] = hashlib.sha256(json.dumps(value["files"], sort_keys=True).encode()).hexdigest()
+    env.store.run.data["branding_snapshot"] = value
+    with pytest.raises(ValueError, match="credential"):
+        await env.engine._materialize_branding(RUN, env.workspace, {"FORGE_TEST_SECRET": secret})
+    assert not (env.workspace / "docs/brand").exists()
+
+
+async def test_brand_manifest_paths_are_relative_to_the_selected_monorepo_component(brand_case):
+    env, brand = brand_case
+    env.store.run.data["component_snapshot"] = {"path": "apps/customer-ui"}
+    await env.engine._materialize_branding(RUN, env.workspace, {})
+    manifest = Engine._branding_manifest(brand)
+    for item in manifest["files"]:
+        target = env.workspace / "apps/customer-ui" / item["path"]
+        assert hashlib.sha256(target.read_bytes()).hexdigest() == item["sha256"]
+    assert not (env.workspace / "docs/brand").exists()
+    assert (await env.store.get_run(RUN))["branding_materialized_paths"] == [
+        "apps/customer-ui/" + item["path"] for item in manifest["files"]
+    ]
+
+
+async def test_late_brand_conflict_is_refused_by_the_existing_file_cas(brand_case, monkeypatch):
+    env, brand = brand_case
+    write = WorkspaceTools.write_file
+
+    async def conflict(tools, path, content, **kwargs):
+        if path.endswith("/tokens.json"):
+            target = tools.root / path
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text("late user content")
+        return await write(tools, path, content, **kwargs)
+
+    monkeypatch.setattr(WorkspaceTools, "write_file", conflict)
+    with pytest.raises(ValueError, match="hash changed"):
+        await env.engine._materialize_branding(RUN, env.workspace, {})
+    target = env.workspace / "docs/brand" / brand["digest"] / "tokens.json"
+    assert target.read_text() == "late user content"
+    assert not (await env.store.get_run(RUN)).get("branding_materialized_digest")
+
+
+async def test_complete_brief_occurs_once_in_native_model_context(tmp_path):
+    marker = "SINGLE_CUSTOMER_REQUIREMENT_982fa70a"
+    brief = marker + "\nBuild the customer workflow without dropping any requirements."
+    observed = []
+
+    def model(messages, info):
+        text = json.dumps(serialize_model_messages(messages)) + (getattr(info, "instructions", "") or "")
+        observed.append(text.count(marker))
+        if not any(isinstance(part, ToolReturnPart) for message in messages for part in message.parts):
+            return ModelResponse(parts=[ToolCallPart("write_file", {"path": "service.py", "content": "VALUE = 1\n"})])
+        return ModelResponse(parts=[ToolCallPart(info.output_tools[0].name, {"summary": "Context inspected"})])
+
+    async def emit(*args):
+        pass
+
+    await execute_agentic(tmp_path, brief, "pyfly", "react", emit, model=FunctionModel(model))
+    assert observed == [1, 1]
diff --git a/tests/test_prompt_templates.py b/tests/test_prompt_templates.py
index 6559582e..07fac9e8 100644
--- a/tests/test_prompt_templates.py
+++ b/tests/test_prompt_templates.py
@@ -191,7 +191,7 @@ def test_every_packaged_resource_matches_its_reviewed_text_vector():
     fixture = json.loads((Path(__file__).parent / "fixtures/prompt-template-vectors-v2.json").read_text())
     catalog = prompt_catalog()
     assert len(fixture["vectors"]) == 77
-    assert len(catalog.registry) == 311
+    assert len(catalog.registry) == 315
     for vector in fixture["vectors"]:
         assert (
             catalog.text(vector["id"], version=vector.get("version", "1.0.0"), **vector["variables"]) == vector["text"]
diff --git a/tests/test_runner_pool_worker.py b/tests/test_runner_pool_worker.py
index 370a6bb7..ef12585a 100644
--- a/tests/test_runner_pool_worker.py
+++ b/tests/test_runner_pool_worker.py
@@ -355,10 +355,13 @@ async def test_cached_completion_rechecks_current_authority_after_journal_read(s
     entries = await journal.entries(run["id"])
     artifacts = {path.name: path.read_bytes() for path in worker.artifacts.directory.iterdir() if path.is_file()}
     changed = False
+    original_replay = journal.sandbox_command_replay
 
-    async def read_then_lose_authority(run_id):
+    async def replay_then_lose_authority(run_id, task_id, attempt, snapshot, payload, *, ordinal):
         nonlocal changed
-        rows = await original_read(run_id)
+        replay = await original_replay(run_id, task_id, attempt, snapshot, payload, ordinal=ordinal)
+        assert replay["execution"]["status"] == "removed"
+        assert replay["execution"]["effects"]["start"]["evidence"]["workspace_import"] == "complete"
         if not changed:
             if loss == "owner":
                 await store.release_ownership()
@@ -371,9 +374,9 @@ async def read_then_lose_authority(run_id):
                     user.enabled = False
                     await users.save(user)
             changed = True
-        return rows
+        return replay
 
-    journal.sandbox_executions = read_then_lose_authority
+    journal.sandbox_command_replay = replay_then_lose_authority
     with pytest.raises((RuntimeError, AccessDenied), match="owner|cancel|suspended"):
         await worker.execute(run["id"], workspace, workspace, ["git", "diff"], 5, "verify", ordinal=1)
     assert changed and controller.submissions == 1
diff --git a/tests/test_sandbox_command_ordinals.py b/tests/test_sandbox_command_ordinals.py
new file mode 100644
index 00000000..c4992e81
--- /dev/null
+++ b/tests/test_sandbox_command_ordinals.py
@@ -0,0 +1,114 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Dedicated PostgreSQL qualification of command allocation; no VM or provider transport."""
+
+import asyncio
+from types import SimpleNamespace
+
+import pytest
+from test_runner_factory_authority import seed
+
+from firefly_forge.journal import Journal, digest
+from firefly_forge.process import ProcessResult
+from firefly_forge.sandbox import SandboxExecutor, SandboxReconciliationRequired
+from firefly_forge.sandbox_models import SandboxInput, capture_sandbox
+
+
+async def setup(store):
+    run, journal = await seed(store)
+    calls = []
+
+    class Backend:
+        async def run(self, config, argv, cwd, timeout, output_limit):
+            from pyfly.data.transaction import current_unit_of_work
+
+            assert current_unit_of_work() is None
+            calls.append(argv)
+            return ProcessResult(argv, 0, str(len(calls)))
+
+    backends = SimpleNamespace(select=lambda config: Backend())
+    return run, journal, calls, lambda: SandboxExecutor(store, Journal(store), backends)
+
+
+@pytest.mark.parametrize("argv", [["same"], ["different"]])
+async def test_fresh_service_allocates_new_native_slot(store, tmp_path, argv):
+    run, journal, calls, fresh = await setup(store)
+    first = await fresh().execute(run["id"], tmp_path, tmp_path, ["same"], 2, "verify")
+    second = await fresh().execute(run["id"], tmp_path, tmp_path, argv, 2, "verify")
+    assert [first.output, second.output] == ["1", "2"]
+    assert [row["ordinal"] for row in await journal.sandbox_executions(run["id"])] == [1, 2]
+    assert Journal.verify_chain(await journal.entries(run["id"]))
+
+
+async def test_concurrent_native_writers_commit_one_create_before_another_dispatch(store, tmp_path):
+    run, journal, calls, fresh = await setup(store)
+    snapshot = run["sandbox_snapshot"]
+
+    def payload(number, identity, previous):
+        request = {"argv": ["controlled"], "configuration": snapshot["configuration"]}
+        return {
+            "parent_attempt": 1,
+            "ordinal": number,
+            "container_name": "forge-sandbox-" + identity,
+            "snapshot_digest": snapshot["digest"],
+            "request_digest": digest(request),
+            "request": request,
+        }
+
+    async def claim():
+        return await Journal(store).sandbox_command_intent(run["id"], "verify", 1, snapshot, payload)
+
+    values = await asyncio.gather(claim(), claim(), return_exceptions=True)
+    assert sum(isinstance(value, dict) for value in values) == 1
+    assert sum(isinstance(value, SandboxReconciliationRequired) for value in values) == 1
+    assert len(await journal.sandbox_executions(run["id"])) == 1 and calls == []
+    assert Journal.verify_chain(await journal.entries(run["id"]))
+
+
+async def test_native_explicit_replay_does_not_dispatch_twice(store, tmp_path):
+    run, journal, calls, fresh = await setup(store)
+    first = await fresh().execute(run["id"], tmp_path, tmp_path, ["same"], 2, "verify")
+    assert await fresh().execute(run["id"], tmp_path, tmp_path, ["same"], 2, "verify", ordinal=1) == first
+    with pytest.raises(ValueError, match="changed"):
+        await fresh().execute(run["id"], tmp_path, tmp_path, ["different"], 2, "verify", ordinal=1)
+    assert len(calls) == 1
+
+
+async def test_native_global_budget_survives_fresh_service_and_next_attempt(store, tmp_path):
+    run, journal, calls, fresh = await setup(store)
+    await store.update(run["id"], sandbox_snapshot=capture_sandbox(SandboxInput(command_limit=1)))
+    await fresh().execute(run["id"], tmp_path, tmp_path, ["same"], 2, "verify")
+    async with store._unit():
+        task = await journal._task(run["id"], "verify")
+        task.attempt += 1
+        await journal.tasks.save(task)
+    with pytest.raises(ValueError, match="total command budget"):
+        await fresh().execute(run["id"], tmp_path, tmp_path, ["different"], 2, "verify")
+    assert len(calls) == 1 and len(await journal.sandbox_executions(run["id"])) == 1
+
+
+async def test_native_pool_fresh_service_and_explicit_replay_share_the_allocator(store, tmp_path):
+    from test_runner_pool_worker import fixture
+
+    from firefly_forge.runner_pool_worker import RunnerPoolWorker
+
+    worker, controller, run, journal, workspace = await fixture(store, tmp_path)
+
+    def fresh():
+        executor = SandboxExecutor(store, Journal(store))
+        executor.pool_worker = RunnerPoolWorker(
+            store,
+            Journal(store),
+            worker.authority,
+            controller,
+            worker.git_snapshot,
+            worker.workspaces,
+            worker.artifacts.directory,
+        )
+        return executor
+
+    first = await fresh().execute(run["id"], workspace, workspace, ["same"], 2, "verify")
+    second = await fresh().execute(run["id"], workspace, workspace, ["same"], 2, "verify")
+    assert first.exit_code == second.exit_code == 0 and controller.submissions == 2
+    assert await fresh().execute(run["id"], workspace, workspace, ["same"], 2, "verify", ordinal=1) == first
+    assert controller.submissions == 2
+    assert [row["ordinal"] for row in await journal.sandbox_executions(run["id"])] == [1, 2]
diff --git a/tests/test_sandbox_command_ordinals_host.py b/tests/test_sandbox_command_ordinals_host.py
new file mode 100644
index 00000000..0226c12d
--- /dev/null
+++ b/tests/test_sandbox_command_ordinals_host.py
@@ -0,0 +1,631 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Real executor/Journal with transactional memory rows, not a PostgreSQL lock proof."""
+
+import asyncio
+import copy
+from contextlib import asynccontextmanager
+from contextvars import ContextVar
+from types import SimpleNamespace
+from uuid import uuid4
+
+import pytest
+
+from firefly_forge.journal import Journal
+from firefly_forge.process import ProcessResult
+from firefly_forge.sandbox import SandboxExecutor, SandboxReconciliationRequired
+from firefly_forge.sandbox_models import SandboxInput, capture_sandbox
+
+
+class Rows:
+    def __init__(self):
+        self.rows = []
+
+    async def find_by_id(self, key, **kwargs):
+        return next((row for row in self.rows if row.id == key), None)
+
+    async def save(self, row):
+        if row.id is None:
+            row.id = uuid4()
+        self.rows = [item for item in self.rows if item.id != row.id] + [row]
+        return row
+
+    async def find_for_run(self, key):
+        return [row for row in self.rows if row.run_id == key]
+
+    for_run = find_for_run
+
+    async def slot(self, run_id, task, attempt, ordinal):
+        return next(
+            (
+                row
+                for row in self.rows
+                if (row.run_id, row.task_id, row.parent_attempt, row.ordinal) == (run_id, task, attempt, ordinal)
+            ),
+            None,
+        )
+
+
+@pytest.fixture
+def command_case(tmp_path):
+    class Store:
+        path = tmp_path / "state"
+        schema = "controlled_command_test"
+
+        def __init__(self):
+            self.run_records, self.sandboxes, self.records, self.tasks = [Rows() for _ in range(4)]
+            self.lock = asyncio.Lock()
+            self.depth = ContextVar("command_fixture_unit", default=False)
+            self.owned = True
+            self.run = SimpleNamespace(id=uuid4(), data={"sandbox_snapshot": capture_sandbox(SandboxInput())})
+            self.run_records.rows = [self.run]
+            self.tasks.rows = [
+                SimpleNamespace(id=uuid4(), run_id=self.run.id, task_id="verify", attempt=1, status="running", data={})
+            ]
+
+        @asynccontextmanager
+        async def _unit(self):
+            if self.depth.get():
+                yield None
+                return
+            async with self.lock:
+                token = self.depth.set(True)
+                before = copy.deepcopy((self.sandboxes.rows, self.records.rows))
+                try:
+                    yield None
+                except BaseException:
+                    self.sandboxes.rows, self.records.rows = before
+                    raise
+                finally:
+                    self.depth.reset(token)
+
+        async def assert_ownership(self):
+            if not self.owned:
+                raise RuntimeError("Controlled ownership lost")
+
+        async def get_run(self, run_id):
+            assert run_id == self.run.id.hex
+            return {"id": run_id, **copy.deepcopy(self.run.data)}
+
+    store = Store()
+    journal = Journal(store, tasks=store.tasks, records=store.records, sandboxes=store.sandboxes)
+
+    async def plan(run_id):
+        return {"tasks": [{"id": row.task_id, "attempt": row.attempt} for row in store.tasks.rows]}
+
+    journal.plan = plan
+    calls = []
+
+    class Backend:
+        async def run(self, config, argv, cwd, timeout, output_limit):
+            assert not store.depth.get(), "Process crossed an uncommitted command allocation"
+            calls.append(argv)
+            return ProcessResult(argv, 0, str(len(calls)))
+
+    backend = Backend()
+    backends = SimpleNamespace(select=lambda config: backend)
+
+    def fresh():
+        return SandboxExecutor(store, journal, backends)
+
+    return SimpleNamespace(
+        store=store,
+        journal=journal,
+        fresh=fresh,
+        calls=calls,
+        workspace=tmp_path,
+        run_id=store.run.id.hex,
+        backend=backend,
+    )
+
+
+async def command(case, argv=None, *, ordinal=None):
+    return await case.fresh().execute(
+        case.run_id, case.workspace, case.workspace, argv or ["fixture"], 2, "verify", ordinal=ordinal
+    )
+
+
+async def test_new_service_same_argv_is_new_not_a_cached_result(command_case):
+    case = command_case
+    first = await command(case)
+    second = await command(case)
+    assert [first.output, second.output] == ["1", "2"]
+    assert [r["ordinal"] for r in await case.journal.sandbox_executions(case.run_id)] == [1, 2]
+    assert Journal.verify_chain([row.data for row in case.store.records.rows])
+
+
+async def test_new_service_different_argv_uses_next_durable_slot(command_case):
+    case = command_case
+    await command(case, ["one"])
+    await command(case, ["two"])
+    assert case.calls == [["one"], ["two"]]
+
+
+async def test_explicit_ordinal_preserves_exact_replay_and_refuses_changed_command(command_case):
+    case = command_case
+    first = await command(case)
+    assert await command(case, ordinal=1) == first
+    with pytest.raises((ValueError, SandboxReconciliationRequired), match="differs|changed"):
+        await command(case, ["other"], ordinal=1)
+    assert len(case.calls) == 1
+
+
+async def test_fresh_service_does_not_reset_global_budget(command_case):
+    case = command_case
+    case.store.run.data["sandbox_snapshot"] = capture_sandbox(SandboxInput(command_limit=1))
+    await command(case)
+    with pytest.raises(ValueError, match="budget"):
+        await command(case)
+    assert len(case.calls) == 1
+
+
+async def test_unknown_prior_effect_blocks_a_different_new_slot(command_case):
+    case = command_case
+    await command(case)
+    row = case.store.sandboxes.rows[0]
+    row.data["effects"]["start"] = {"status": "intent"}
+    row.status = "running"
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case, ["other"], ordinal=2)
+    assert len(case.calls) == 1
+
+
+async def test_concurrent_services_cannot_dispatch_past_unfinished_command(command_case):
+    case = command_case
+    reached, release = asyncio.Event(), asyncio.Event()
+    original = case.backend.run
+
+    async def waiting(*args):
+        reached.set()
+        await release.wait()
+        return await original(*args)
+
+    case.backend.run = waiting
+    first = asyncio.create_task(command(case))
+    await asyncio.wait_for(reached.wait(), 2)
+    try:
+        with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+            await command(case)
+    finally:
+        release.set()
+        await first
+    assert len(case.calls) == 1
+
+
+async def test_missing_effect_projection_cannot_reopen_an_already_executed_explicit_slot(command_case):
+    case = command_case
+    await command(case)
+    case.store.sandboxes.rows[0].data["effects"].pop("start")
+    case.store.sandboxes.rows[0].data["effects"].pop("cleanup")
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case, ordinal=1)
+    assert len(case.calls) == 1
+
+
+@pytest.mark.parametrize("field", ["ordinal", "parent_attempt", "execution_id", "run_id"])
+async def test_json_overlays_never_change_the_canonical_cursor(command_case, field):
+    case = command_case
+    await command(case)
+    case.store.sandboxes.rows[0].data[field] = 0
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    assert len(case.calls) == 1
+
+
+@pytest.mark.parametrize("field", ["ordinal", "parent_attempt", "container_name", "snapshot_digest"])
+async def test_request_identity_must_equal_scalar_columns_and_native_intent(command_case, field):
+    case = command_case
+    await command(case)
+    case.store.sandboxes.rows[0].data["request"][field] = "different"
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    assert len(case.calls) == 1
+
+
+async def test_wal_failure_rolls_back_slot_and_create_intent_together(command_case, monkeypatch):
+    case = command_case
+    original = case.store.records.save
+
+    async def fail(row):
+        await original(row)
+        raise ValueError("Controlled WAL failure")
+
+    monkeypatch.setattr(case.store.records, "save", fail)
+    with pytest.raises(ValueError, match="WAL failure"):
+        await command(case)
+    assert case.store.sandboxes.rows == [] and case.store.records.rows == [] and case.calls == []
+    monkeypatch.setattr(case.store.records, "save", original)
+    await command(case)
+    assert case.store.sandboxes.rows[0].ordinal == 1
+
+
+@pytest.mark.parametrize("change", ["attempt", "snapshot", "ownership", "cancel"])
+async def test_queued_allocation_rechecks_current_scope_before_intent(command_case, change):
+    case = command_case
+    entered = asyncio.Event()
+    original = case.journal.sandbox_command_intent
+
+    async def queued(*args, **kwargs):
+        entered.set()
+        await release.wait()
+        return await original(*args, **kwargs)
+
+    release = asyncio.Event()
+    case.journal.sandbox_command_intent = queued
+    pending = asyncio.create_task(command(case))
+    await asyncio.wait_for(entered.wait(), 2)
+    if change == "attempt":
+        case.store.tasks.rows[0].attempt = 2
+    elif change == "snapshot":
+        case.store.run.data["sandbox_snapshot"] = capture_sandbox(SandboxInput(command_limit=1))
+    elif change == "ownership":
+        case.store.owned = False
+    else:
+        case.store.run.data["cancel_request"] = {"status": "requested"}
+    release.set()
+    with pytest.raises((ValueError, RuntimeError, asyncio.CancelledError)):
+        await pending
+    assert not case.store.sandboxes.rows and not case.calls
+
+
+async def test_cancelled_process_leaves_wal_and_never_allows_automatic_replacement(command_case):
+    case = command_case
+
+    async def cancel(*args):
+        raise asyncio.CancelledError()
+
+    case.backend.run = cancel
+    with pytest.raises(asyncio.CancelledError):
+        await command(case)
+    rows = await case.journal.sandbox_executions(case.run_id)
+    assert rows[0]["effects"]["start"]["status"] == "intent"
+    assert rows[0]["effects"]["cleanup"]["status"] == "done"
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case, ordinal=2)
+    assert len(case.store.sandboxes.rows) == 1
+
+
+async def test_completed_prior_attempts_keep_the_global_budget(command_case):
+    case = command_case
+    case.store.run.data["sandbox_snapshot"] = capture_sandbox(SandboxInput(command_limit=2))
+    await command(case)
+    case.store.tasks.rows[0].attempt = 2
+    await command(case)
+    case.store.tasks.rows[0].attempt = 3
+    with pytest.raises(ValueError, match="total command budget"):
+        await command(case)
+    assert len(case.calls) == 2
+    assert [row.ordinal for row in case.store.sandboxes.rows] == [1, 1]
+
+
+async def test_reconciled_known_interruption_requires_native_task_retry_before_fresh_dispatch(command_case):
+    from uuid import NAMESPACE_URL, uuid5
+
+    case = command_case
+    original = case.backend.run
+
+    async def interrupted(*args):
+        raise asyncio.CancelledError()
+
+    case.backend.run = interrupted
+    with pytest.raises(asyncio.CancelledError):
+        await command(case)
+    execution = case.store.sandboxes.rows[0].id.hex
+    await case.journal.sandbox_effect_reconcile(
+        case.run_id, "verify", execution, effect="start", evidence={"observed_state": "absent"}, outcome="interrupted"
+    )
+    task = case.store.tasks.rows[0]
+    key = uuid5(NAMESPACE_URL, f"forge:{case.run_id}:verify:1").hex
+    task.data["idempotency_key"] = key
+    task.status = "needs_reconciliation"
+    task.attempt = 2
+    task.status = "running"
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    task.attempt, task.status = 1, "needs_reconciliation"
+    await case.journal.reconcile(case.run_id, key, evidence={"observed_command_drain": execution}, outcome="retry")
+    task.status = "running"
+    case.backend.run = original
+    await command(case)
+    assert len(case.calls) == 1
+    assert [row.parent_attempt for row in case.store.sandboxes.rows] == [1, 2]
+
+
+async def test_checkpoint_runtime_contract_changes_when_executor_semantics_change(monkeypatch):
+    from pathlib import Path
+
+    from firefly_forge.agentic_checkpoint_invocation import runtime_contract
+
+    before = runtime_contract()
+    original = Path.read_bytes
+
+    def changed(path):
+        value = original(path)
+        return value + b"\n# changed executor contract\n" if path.name == "sandbox_command_slots.py" else value
+
+    monkeypatch.setattr(Path, "read_bytes", changed)
+    assert runtime_contract() != before
+
+
+@pytest.fixture
+def pool_command_case(command_case, tmp_path):
+    from datetime import UTC, datetime
+    from pathlib import Path
+
+    from test_runner_pool_worker import ObservedController
+
+    from firefly_forge.runner_controller_config import RunnerWorkerTransport
+    from firefly_forge.runner_factory_models import FactoryPoolSelection, capture_factory_pool
+    from firefly_forge.runner_git_snapshot import RunnerGitSnapshot
+    from firefly_forge.runner_pool_models import FactoryFence, RunnerPoolProfile
+    from firefly_forge.runner_pool_worker import RunnerPoolWorker
+    from firefly_forge.sandbox import pack_workspace
+
+    case = command_case
+    image = "fixture/worker@sha256:" + "a" * 64
+    profile = RunnerPoolProfile(
+        profile_id="owned", daemon_id="controlled", approved_images=(image,), transfer_image=image
+    )
+    policy = FactoryPoolSelection(profile=profile, image=image)
+    case.store.run.data.update(repository_id=uuid4().hex, sandbox_snapshot=capture_factory_pool(policy))
+    workspaces = tmp_path / "workspaces"
+    workspaces.mkdir()
+    workspace = workspaces / case.run_id
+    workspace.mkdir()
+    (workspace / "main.txt").write_text("original\n")
+    result = tmp_path / "returned"
+    result.mkdir()
+    (result / "main.txt").write_text("controlled result\n")
+    returned, _ = pack_workspace(result, policy.workspace_max_bytes)
+    controller = ObservedController(profile, returned)
+    controller.transport = RunnerWorkerTransport(
+        active=True,
+        endpoint="https://127.0.0.1:9917",
+        certificate=tmp_path / "unused-cert.pem",
+        private_key=tmp_path / "unused-key.pem",
+        ca=tmp_path / "unused-ca.pem",
+        token="controlled-private-test-token-32-characters",
+        profile_id=profile.profile_id,
+        profile_revision=profile.revision,
+    )
+    fence = FactoryFence(factory_schema=case.store.schema, pid=1, backend_started_at=datetime.now(UTC))
+
+    class Authority:
+        async def authorize(self, run_id, task_id):
+            return {
+                "run": await case.store.get_run(run_id),
+                "attempt": case.store.tasks.rows[0].attempt,
+                "fence": fence,
+            }
+
+    case.store.credential_registry = dict
+    state = tmp_path / "pool-artifacts"
+    state.mkdir(mode=0o700)
+
+    def fresh():
+        executor = case.fresh()
+        executor.pool_worker = RunnerPoolWorker(
+            case.store,
+            case.journal,
+            Authority(),
+            controller,
+            RunnerGitSnapshot(Path("/usr/bin/git")),
+            workspaces,
+            state,
+        )
+        return executor
+
+    return SimpleNamespace(case=case, controller=controller, workspace=workspace, fresh=fresh)
+
+
+@pytest.mark.parametrize("second", [["fixture"], ["different"]])
+async def test_pool_fresh_service_uses_new_slot_without_controller_resubmission(pool_command_case, second):
+    pool = pool_command_case
+    for argv in (["fixture"], second):
+        result = await pool.fresh().execute(pool.case.run_id, pool.workspace, pool.workspace, argv, 2, "verify")
+        assert result.exit_code == 0
+    assert pool.controller.submissions == 2
+    assert sorted(row.ordinal for row in pool.case.store.sandboxes.rows) == [1, 2]
+
+
+async def test_pool_explicit_replay_never_repackages_or_calls_the_controller(pool_command_case):
+    pool = pool_command_case
+    executor = pool.fresh()
+    result = await executor.execute(pool.case.run_id, pool.workspace, pool.workspace, ["fixture"], 2, "verify")
+    replay = pool.fresh()
+
+    async def forbidden(*args):
+        raise AssertionError("Explicit known-result replay reached a controller or source preparation")
+
+    replay.pool_worker.probe = forbidden
+    replay.pool_worker.git_snapshot.build = forbidden
+    assert (
+        await replay.execute(pool.case.run_id, pool.workspace, pool.workspace, ["fixture"], 2, "verify", ordinal=1)
+        == result
+    )
+    assert pool.controller.submissions == 1
+
+
+async def test_pool_unknown_submission_blocks_a_new_automatic_identity(pool_command_case):
+    pool = pool_command_case
+    pool.controller.lost_response = True
+    with pytest.raises(RuntimeError, match="reconcil"):
+        await pool.fresh().execute(pool.case.run_id, pool.workspace, pool.workspace, ["fixture"], 2, "verify")
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await pool.fresh().execute(pool.case.run_id, pool.workspace, pool.workspace, ["different"], 2, "verify")
+    assert pool.controller.submissions == 1 and len(pool.case.store.sandboxes.rows) == 1
+
+
+async def test_missing_scalar_projection_cannot_reuse_a_slot_retained_in_wal(command_case):
+    case = command_case
+    await command(case)
+    case.store.sandboxes.rows.clear()
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    assert len(case.calls) == 1
+
+
+async def test_allocator_refuses_ambient_native_transaction_before_any_intent(command_case):
+    from pyfly.data.transaction import TransactionTemplate
+    from test_agentic_checkpoint_storage_host import MemoryManager
+
+    case = command_case
+    case.journal.plans = Rows()
+    manager = MemoryManager(case.store, case.journal)
+    async with TransactionTemplate(manager).transaction():
+        with pytest.raises(ValueError, match="transaction"):
+            await command(case)
+    assert case.store.sandboxes.rows == [] and case.calls == []
+
+
+@pytest.fixture
+def docker_command_case(command_case):
+    case = command_case
+    case.store.run.data["sandbox_snapshot"] = capture_sandbox(
+        SandboxInput(mode="docker", image="fixture/image@sha256:" + "a" * 64, context="controlled-only")
+    )
+    objects, dispatches = {}, []
+
+    def fresh():
+        executor = case.fresh()
+
+        async def docker(config, argv, *args, **kwargs):
+            assert not case.store.depth.get()
+            if argv[0] == "create":
+                name = argv[argv.index("--name") + 1]
+                objects[name] = "created"
+                return ProcessResult(argv, 0, name)
+            if argv[0] == "start":
+                name = argv[-1]
+                objects[name] = "exited"
+                dispatches.append(name)
+                return ProcessResult(argv, 0, str(len(dispatches)))
+            assert argv[:4] == ["container", "rm", "--force", "--volumes"]
+            objects.pop(argv[-1], None)
+            return ProcessResult(argv, 0, "")
+
+        async def inspect(config, name, labels):
+            return {"Id": name, "State": {"Status": objects[name], "ExitCode": 0}} if name in objects else None
+
+        executor._docker, executor._inspect = docker, inspect
+        return executor
+
+    return SimpleNamespace(case=case, fresh=fresh, dispatches=dispatches)
+
+
+async def test_docker_fresh_service_uses_durable_new_identity_and_explicit_replay(docker_command_case):
+    docker = docker_command_case
+    case = docker.case
+    first = await docker.fresh().execute(case.run_id, case.workspace, case.workspace, ["fixture"], 2, "verify")
+    second = await docker.fresh().execute(case.run_id, case.workspace, case.workspace, ["fixture"], 2, "verify")
+    assert [first.output, second.output] == ["1", "2"]
+    assert (
+        await docker.fresh().execute(case.run_id, case.workspace, case.workspace, ["fixture"], 2, "verify", ordinal=1)
+        == first
+    )
+    assert len(docker.dispatches) == 2
+
+
+async def test_lost_create_commit_acknowledgement_does_not_dispatch_or_reuse_slot(command_case):
+    case = command_case
+    original = case.store._unit
+    lost = True
+
+    @asynccontextmanager
+    async def commit_unknown():
+        nonlocal lost
+        outer = not case.store.depth.get()
+        async with original() as current:
+            yield current
+        if outer and lost and case.store.sandboxes.rows:
+            lost = False
+            raise TimeoutError("Controlled acknowledgement lost after durable commit")
+
+    case.store._unit = commit_unknown
+    with pytest.raises(TimeoutError, match="acknowledgement"):
+        await command(case)
+    assert case.calls == [] and len(case.store.sandboxes.rows) == 1
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    assert case.calls == [] and len(case.store.sandboxes.rows) == 1
+
+
+async def test_closed_preparation_advances_only_after_explicit_native_task_reconciliation(command_case):
+    from uuid import NAMESPACE_URL, uuid5
+
+    from firefly_forge.journal import digest
+
+    case = command_case
+    snapshot = case.store.run.data["sandbox_snapshot"]
+
+    def payload(number, identity, previous):
+        request = {"argv": ["never-dispatched"], "configuration": snapshot["configuration"]}
+        return {
+            "parent_attempt": 1,
+            "ordinal": number,
+            "container_name": "forge-sandbox-" + identity,
+            "snapshot_digest": snapshot["digest"],
+            "request_digest": digest(request),
+            "request": request,
+        }
+
+    intent = await case.journal.sandbox_command_intent(case.run_id, "verify", 1, snapshot, payload)
+    identity, request = intent["execution"]["execution_id"], intent["execution"]["request"]
+    await case.journal.sandbox_effect_receipt(
+        case.run_id, "verify", identity, effect="create", evidence={"mode": "host"}
+    )
+    await case.fresh()._cleanup_host(case.run_id, "verify", identity, request)
+    with pytest.raises(SandboxReconciliationRequired, match="reconcil"):
+        await command(case)
+    task = case.store.tasks.rows[0]
+    key = uuid5(NAMESPACE_URL, f"forge:{case.run_id}:verify:1").hex
+    task.data["idempotency_key"], task.status = key, "needs_reconciliation"
+    await case.journal.reconcile(case.run_id, key, evidence={"closed_preparation": identity}, outcome="retry")
+    task.status = "running"
+    await command(case)
+    assert len(case.calls) == 1 and len(case.store.sandboxes.rows) == 2
+
+
+@pytest.mark.parametrize("field", ["container_name", "request_digest"])
+async def test_invalid_prepared_payload_never_creates_a_durable_slot(command_case, field):
+    from firefly_forge.journal import digest
+
+    case = command_case
+    snapshot = case.store.run.data["sandbox_snapshot"]
+
+    def payload(number, identity, previous):
+        request = {"argv": ["controlled"], "configuration": snapshot["configuration"]}
+        value = {
+            "parent_attempt": 1,
+            "ordinal": number,
+            "container_name": "forge-sandbox-" + identity,
+            "snapshot_digest": snapshot["digest"],
+            "request_digest": digest(request),
+            "request": request,
+        }
+        value[field] = "changed"
+        return value
+
+    with pytest.raises(ValueError, match="payload"):
+        await case.journal.sandbox_command_intent(case.run_id, "verify", 1, snapshot, payload)
+    assert not case.store.sandboxes.rows and not case.store.records.rows
+
+
+@pytest.mark.parametrize("direct", [False, True])
+async def test_pool_refuses_ambient_native_transaction_before_readonly_controller_http(pool_command_case, direct):
+    from pyfly.data.transaction import TransactionTemplate
+    from test_agentic_checkpoint_storage_host import MemoryManager
+
+    pool = pool_command_case
+    pool.case.journal.plans = Rows()
+    manager = MemoryManager(pool.case.store, pool.case.journal)
+
+    async def forbidden():
+        raise AssertionError("Controller observation crossed the caller transaction")
+
+    pool.controller.profile = forbidden
+    executor = pool.fresh()
+    target = executor.pool_worker if direct else executor
+    async with TransactionTemplate(manager).transaction():
+        with pytest.raises(ValueError, match="transaction"):
+            await target.execute(pool.case.run_id, pool.workspace, pool.workspace, ["fixture"], 2, "verify")
+    assert not pool.case.store.sandboxes.rows and pool.controller.submissions == 0
diff --git a/tests/test_scm_maintain_dispatch_host.py b/tests/test_scm_maintain_dispatch_host.py
new file mode 100644
index 00000000..4a148209
--- /dev/null
+++ b/tests/test_scm_maintain_dispatch_host.py
@@ -0,0 +1,245 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Provider contention cannot turn fresh maintain consent into stale write authority."""
+
+import asyncio
+import copy
+
+import pytest
+from test_scm_maintain_ticket_host import poll_case as poll_case
+from test_scm_maintain_ticket_host import prepared_binding
+from test_scm_provider_contention_host import still_waiting
+
+from firefly_forge.scm_maintain_tickets import MaintainNotificationNotDispatched
+from firefly_forge.scm_provider_backoff import ProviderBackoff
+
+
+def scope_lock(case):
+    values = {**case.scm._definition("github")["defaults"], **case.scm._record("github")["values"]}
+    return ProviderBackoff(
+        case.scm.private.directory.parent,
+        [
+            "github",
+            case.scm._api("github"),
+            values.get("app_id", ""),
+            values.get("installation_id", ""),
+            values.get("workspace", ""),
+        ],
+    )
+
+
+@pytest.mark.parametrize("change", ["revoke", "head", "expire"])
+async def test_provider_wait_rechecks_current_native_consent_before_any_http(poll_case, monkeypatch, change):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        anchor = await case.collaboration.receipt(kept["outbox_id"])
+        lock = scope_lock(case)
+        await lock.lock.acquire()
+        previous = len(case.state["requests"])
+
+        async def local_admission():
+            assert case.state["depth"] == 0
+            await service.authorize_feedback(anchor)
+            assert case.state["depth"] == 0
+
+        task = asyncio.create_task(
+            case.scm._request(
+                "POST",
+                "https://api.github.com/repos/team/product/issues/3/comments",
+                json={"body": "not dispatched"},
+                before_dispatch=local_admission,
+            )
+        )
+        try:
+            await still_waiting(task)
+            if change == "revoke":
+                case.db["users"][case.user_id].enabled = False
+            elif change == "head":
+                state = case.db["settings"][case.repository].data["_github_poll_v1"]
+                state["heads"][kept["polling_scope"]["binding_key"]]["digest"] = "f" * 64
+            else:
+                import firefly_forge.scm_maintain_tickets as module
+
+                monkeypatch.setattr(module, "clock_ms", lambda: kept["expires_at_ms"])
+        finally:
+            await lock.lock.release()
+        with pytest.raises(MaintainNotificationNotDispatched):
+            await task
+        assert len(case.state["requests"]) == previous
+
+
+async def test_predispatch_refusal_is_held_and_unknown_post_is_never_replayed(poll_case, monkeypatch):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        original = case.scm._request
+
+        async def revoke_before_wait(method, url, **kwargs):
+            if method == "POST" and kwargs.get("before_dispatch"):
+                case.db["users"][case.user_id].enabled = False
+            return await original(method, url, **kwargs)
+
+        monkeypatch.setattr(case.scm, "_request", revoke_before_wait)
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(kept["outbox_id"])
+        refused = await case.collaboration.receipt(kept["outbox_id"])
+        assert refused["feedback_status"] == "held" and refused["reason"] == "native_maintain_authority_changed"
+        assert len(case.state["posts"]) == before
+
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        case.state["lost_reply"] = True
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(kept["outbox_id"])
+        unknown = copy.deepcopy(await case.collaboration.receipt(kept["outbox_id"]))
+        assert unknown["feedback_status"] == "needs_reconciliation"
+        await case.collaboration.feedback(kept["outbox_id"])
+        assert await case.collaboration.receipt(kept["outbox_id"]) == unknown
+        assert len(case.state["posts"]) == before + 1
+
+
+async def test_cancelled_waiter_does_not_unlock_another_provider_owner(poll_case, monkeypatch):
+    async with poll_case() as case:
+        lock = scope_lock(case)
+        await lock.lock.acquire()
+        calls = []
+
+        async def refuse():
+            calls.append(True)
+            raise MaintainNotificationNotDispatched("Controlled local refusal")
+
+        task = asyncio.create_task(
+            case.scm._request(
+                "POST", "https://api.github.com/repos/team/product/issues/3/comments", before_dispatch=refuse
+            )
+        )
+        try:
+            await still_waiting(task)
+            task.cancel()
+            with pytest.raises(asyncio.CancelledError):
+                await task
+            other = asyncio.create_task(
+                case.scm._request(
+                    "POST", "https://api.github.com/repos/team/product/issues/3/comments", before_dispatch=refuse
+                )
+            )
+            await still_waiting(other)
+            assert not calls
+        finally:
+            await lock.lock.release()
+        with pytest.raises(MaintainNotificationNotDispatched):
+            await other
+        assert calls == [True] and not case.state["posts"]
+
+
+async def test_connection_configuration_is_rechecked_after_awaited_local_admission(poll_case):
+    async with poll_case() as case:
+        entered, release = asyncio.Event(), asyncio.Event()
+        before = len(case.state["requests"])
+
+        async def admission():
+            assert case.state["depth"] == 0
+            entered.set()
+            await release.wait()
+
+        task = asyncio.create_task(
+            case.scm._request(
+                "POST", "https://api.github.com/repos/team/product/issues/3/comments", before_dispatch=admission
+            )
+        )
+        await entered.wait()
+        data = case.scm.private._read(case.scm.path)
+        data["github"]["revision"] = "changed-during-local-admission"
+        case.scm.private._write(case.scm.path, data)
+        release.set()
+        with pytest.raises(ValueError, match="settings changed during provider admission"):
+            await task
+        assert len(case.state["requests"]) == before
+
+
+async def test_connection_change_during_local_check_is_a_definitive_hold_not_an_unknown_post(poll_case, monkeypatch):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        original = case.scm._request
+
+        async def change_after_admission(method, url, **kwargs):
+            callback = kwargs.get("before_dispatch")
+            if method == "POST" and callback:
+
+                async def admit():
+                    await callback()
+                    data = case.scm.private._read(case.scm.path)
+                    data["github"]["revision"] = "changed-after-local-check"
+                    case.scm.private._write(case.scm.path, data)
+
+                kwargs["before_dispatch"] = admit
+            return await original(method, url, **kwargs)
+
+        monkeypatch.setattr(case.scm, "_request", change_after_admission)
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(kept["outbox_id"])
+        refused = await case.collaboration.receipt(kept["outbox_id"])
+        assert refused["feedback_status"] == "held" and refused["reason"] == "native_maintain_authority_changed"
+        assert len(case.state["posts"]) == before
+
+
+async def test_changed_communication_route_at_dispatch_is_held_without_http(poll_case, monkeypatch):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        original_request = case.scm._request
+        original_assert = case.collaboration.communication_writer.assert_current
+        at_dispatch = False
+
+        def current(value):
+            if at_dispatch:
+                raise ValueError("Controlled communication route changed")
+            return original_assert(value)
+
+        async def request(method, url, **kwargs):
+            nonlocal at_dispatch
+            callback = kwargs.get("before_dispatch")
+            if method == "POST" and callback:
+
+                async def admit():
+                    nonlocal at_dispatch
+                    at_dispatch = True
+                    await callback()
+
+                kwargs["before_dispatch"] = admit
+            return await original_request(method, url, **kwargs)
+
+        monkeypatch.setattr(case.scm, "_request", request)
+        monkeypatch.setattr(case.collaboration.communication_writer, "assert_current", current)
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(kept["outbox_id"])
+        refused = await case.collaboration.receipt(kept["outbox_id"])
+        assert refused["feedback_status"] == "held" and refused["reason"] == "native_maintain_authority_changed"
+        assert len(case.state["posts"]) == before
+
+
+async def test_changed_child_facts_while_waiting_are_not_posted_as_the_old_draft(poll_case, monkeypatch):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        original = case.scm._request
+
+        async def changed(method, url, **kwargs):
+            callback = kwargs.get("before_dispatch")
+            if method == "POST" and callback:
+
+                async def admit():
+                    case.db["runs"][request.run_id].data["status"] = "failed"
+                    await callback()
+
+                kwargs["before_dispatch"] = admit
+            return await original(method, url, **kwargs)
+
+        monkeypatch.setattr(case.scm, "_request", changed)
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(kept["outbox_id"])
+        refused = await case.collaboration.receipt(kept["outbox_id"])
+        assert refused["feedback_status"] == "held" and refused["reason"] == "native_maintain_authority_changed"
+        assert len(case.state["posts"]) == before
diff --git a/tests/test_scm_maintain_question_host.py b/tests/test_scm_maintain_question_host.py
new file mode 100644
index 00000000..50e6c7a3
--- /dev/null
+++ b/tests/test_scm_maintain_question_host.py
@@ -0,0 +1,264 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Configured maintain questions use the existing durable native answer path."""
+
+import copy
+from datetime import UTC, datetime, timedelta
+
+import pytest
+from test_scm_maintain_ticket_host import poll_case as poll_case
+from test_scm_maintain_ticket_host import prepared_binding
+
+from firefly_forge.agent_roles import WorkerFeedback
+from firefly_forge.scm_natural_models import NaturalDecision
+
+
+async def question(case, run_id):
+    feedback = WorkerFeedback(
+        id="maintain-feedback",
+        role_id="implementer",
+        task_id="implement",
+        attempt=1,
+        disposition="clarification",
+        summary="A decision is required for this maintenance unit",
+        request={
+            "id": "maintain-question",
+            "kind": "other",
+            "question": "Keep the existing contacts?",
+            "context": "This fresh maintenance unit preserves the original records.",
+            "choices": ["Keep", "Review"],
+        },
+    )
+    journal = case.collaboration.deployments.engine.journal
+    await journal._append(run_id, "implement", "maintain-feedback", "worker_feedback", feedback.model_dump(mode="json"))
+    case.db["runs"][run_id].status = "paused"
+    case.db["runs"][run_id].data.update(
+        status="paused",
+        active_task="implement",
+        pause={"kind": "worker_request"},
+        role_snapshot={"max_requests": 3},
+        worker_request={
+            **feedback.request.model_dump(),
+            "role_id": "implementer",
+            "task_id": "implement",
+            "attempt": 1,
+            "status": "pending",
+        },
+    )
+
+
+@pytest.mark.parametrize("change", [None, "revoke", "expire"])
+async def test_native_maintain_question_and_owner_reply_save_only_the_child_answer(
+    poll_case, monkeypatch, tmp_path, change
+):
+    from test_communication_writer import configured_store
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        parent = copy.deepcopy(c.db["runs"][c.run_id].data)
+        kept = await service.configure(c.project, c.repository, request)
+        await question(c, request.run_id)
+        await c.collaboration.feedback(kept["outbox_id"])
+        sent = await c.collaboration.receipt(kept["outbox_id"])
+        assert sent["feedback_status"] == "sent", sent
+        assert sent["feedback_intent"]["request_id"] == "maintain-question"
+        c.store.task_router = (await configured_store(tmp_path / "models")).task_router
+        from types import SimpleNamespace
+
+        async def old_resume_grant(*args, **kwargs):
+            raise AssertionError("Answer-only maintenance must not consult an unrelated resume grant")
+
+        c.collaboration.poll_resume_authority = SimpleNamespace(_grant=old_resume_grant)
+        seen = []
+
+        async def classify(message, context, settings):
+            seen.append(context)
+            if change == "revoke":
+                c.db["users"][c.user_id].enabled = False
+            elif change == "expire":
+                import firefly_forge.scm_maintain_tickets as module
+
+                monkeypatch.setattr(module, "clock_ms", lambda: kept["expires_at_ms"])
+            return NaturalDecision(intent="answer", message="Your answer is retained.")
+
+        monkeypatch.setattr("firefly_forge.scm_natural_tasks.classify", classify)
+        stamp = datetime.now(UTC)
+        bot = c.comment(101, sent["feedback_intent"]["body"])
+        bot["user"]["type"] = "Bot"
+        bot.update(created_at=stamp.isoformat(), updated_at=stamp.isoformat())
+        owner = c.comment(502, "Keep the existing contacts.")
+        owner.update(
+            created_at=(stamp + timedelta(seconds=1)).isoformat(), updated_at=(stamp + timedelta(seconds=1)).isoformat()
+        )
+        c.state["comments"].extend([bot, owner])
+        c.state["clock"] += 3600
+        for _ in range(3):
+            await c.service.step(c.repository)
+        reply = next(r.data for r in c.db["inbox"].values() if r.source_key == "comment:502")
+        result = await c.collaboration.process(reply["id"])
+        child = next(row for row in seen[0]["candidates"] if row["run_id"] == request.run_id)
+        assert child.get("origin") == "worker_journal" and child["question_id"] == "maintain-question", child
+        assert child["publication"]["receipt_id"] == kept["outbox_id"]
+        assert "read_only" not in child
+        if change is not None:
+            assert result["natural_turn"]["state"] == "needs_reconciliation"
+            assert not [r for r in c.db["journal"].values() if r.kind == "worker_response"]
+            assert c.db["runs"][request.run_id].data["worker_request"]["status"] == "pending"
+            assert c.db["runs"][c.run_id].data == parent
+            return
+        assert result["natural_turn"]["state"] == "answer_saved_pending_resume", result.get("natural_turn")
+        responses = [r.data for r in c.db["journal"].values() if r.kind == "worker_response"]
+        assert len(responses) == 1 and responses[0]["run_id"] == request.run_id
+        assert responses[0]["payload"]["answer"] == "Keep the existing contacts."
+        assert c.db["runs"][request.run_id].data["status"] == "paused"
+        assert c.db["runs"][c.run_id].data == parent
+        assert len(seen) == 1
+        assert not [r for r in c.db["journal"].values() if r.kind in {"resume", "provider_dispatch_intent"}]
+
+
+async def test_current_native_anchor_remains_proactive_after_the_owner_answer_receipt(poll_case, monkeypatch):
+    from types import SimpleNamespace
+    from uuid import UUID, uuid4
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        kept = await service.configure(c.project, c.repository, request)
+        await c.collaboration.feedback(kept["outbox_id"])
+        anchor = await c.collaboration.receipt(kept["outbox_id"])
+        reply_id = uuid4().hex
+        later = {
+            **copy.deepcopy(anchor),
+            "id": reply_id,
+            "maintain_ticket": None,
+            "natural_turn": {"state": "answer_saved_pending_resume"},
+        }
+        c.db["inbox"][reply_id] = SimpleNamespace(
+            id=UUID(reply_id),
+            repository_id=UUID(c.repository),
+            provider="github",
+            status="processed",
+            sequence=1000,
+            data=later,
+        )
+        assert await c.collaboration._feedback_head(anchor, proactive=True)
+        c.db["inbox"][reply_id].data["feedback_status"] = "needs_reconciliation"
+        assert not await c.collaboration._feedback_head(anchor, proactive=True)
+
+
+async def test_question_notifications_require_the_exact_immutable_native_feedback(poll_case, monkeypatch):
+    from firefly_forge.project_access import AccessDenied
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        kept = await service.configure(c.project, c.repository, request)
+        await question(c, request.run_id)
+        anchor = await c.collaboration.receipt(kept["outbox_id"])
+        assert (await service.current(anchor))["run"]["worker_request"]["id"] == "maintain-question"
+        c.db["journal"].clear()
+        with pytest.raises(AccessDenied):
+            await service.current(anchor)
+
+
+def test_answer_only_maintain_reference_cannot_resolve_a_resume():
+    from firefly_forge.scm_natural_models import resolve_task
+
+    scope = dict(
+        repository_id="a" * 32,
+        project_id="b" * 32,
+        issue={"kind": "issue", "number": 3},
+        actor="7",
+        binding_digest="c" * 64,
+        native_user_id="d" * 32,
+    )
+    row = {
+        **scope,
+        "run_id": "e" * 32,
+        "question_id": "exact-question",
+        "question_digest": "f" * 64,
+        "run_status": "paused",
+        "question_status": "answered",
+        "response_digest": "1" * 64,
+        "consumed": False,
+        "origin": "worker_journal",
+        "answer_only": True,
+    }
+    decision = NaturalDecision(intent="resume", message="The owner asks for continuation.")
+    held = resolve_task(scope, [row], decision, answer="Resume")
+    assert held.state == "waiting" and held.reason == "answer_only_reference"
+    ordinary = {k: v for k, v in row.items() if k != "answer_only"}
+    assert resolve_task(scope, [ordinary], decision, answer="Resume").state == "resume"
+
+
+async def test_known_unclassified_setup_reply_does_not_hide_a_real_worker_question(poll_case, monkeypatch):
+    from firefly_forge.scm_natural_tasks import SCMNaturalTasks
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        kept = await service.configure(c.project, c.repository, request)
+        await question(c, request.run_id)
+        await c.collaboration.feedback(kept["outbox_id"])
+        unclassified = await c.collaboration.process(request.observed_receipt_id)
+        assert unclassified["natural_turn"]["state"] == "waiting_configuration"
+        assert unclassified["feedback_status"] == "sent" and "decision" not in unclassified["natural_turn"]
+        delivery = {
+            "id": "0" * 32,
+            "repository_id": c.repository,
+            "actor": "7",
+            "provider": "github",
+            "issue": {"kind": "issue", "number": 3},
+        }
+        context_scope = kept["polling_scope"]
+        projected = await SCMNaturalTasks(c.collaboration).reply_source(
+            delivery, [context_scope], "Keep the existing contacts."
+        )
+        assert projected is not None
+        assert [ref.run_id for ref in projected.question_refs] == [request.run_id]
+        assert projected.question_refs[0].source_receipt_id == kept["outbox_id"]
+        c.db["inbox"][unclassified["id"]].data["natural_turn"]["classifier_outcome"] = "confirmed_valid"
+        with pytest.raises(KeyError, match="decision"):
+            await SCMNaturalTasks(c.collaboration).reply_source(
+                delivery, [context_scope], "Keep the existing contacts."
+            )
+
+
+def test_two_pending_native_questions_require_grounding_in_the_human_reply():
+    from firefly_forge.scm_natural_models import resolve_task
+
+    scope = dict(
+        repository_id="a" * 32,
+        project_id="b" * 32,
+        issue={"kind": "issue", "number": 3},
+        actor="7",
+        binding_digest="c" * 64,
+        native_user_id="d" * 32,
+    )
+    parent = {
+        **scope,
+        "run_id": "1" * 32,
+        "question_id": "parent-question",
+        "question_digest": "f" * 64,
+        "question": "Keep this source?",
+        "run_status": "paused",
+        "question_status": "pending",
+        "consumed": False,
+    }
+    child = {
+        **scope,
+        "run_id": "2" * 32,
+        "question_id": "child-question",
+        "question_digest": "e" * 64,
+        "question": "Keep the existing contacts?",
+        "run_status": "paused",
+        "question_status": "pending",
+        "consumed": False,
+        "answer_only": True,
+    }
+    bare = NaturalDecision(intent="answer", message="The answer is retained.")
+    assert resolve_task(scope, [parent, child], bare, answer="Keep the existing contacts.").state == "waiting"
+    grounded = NaturalDecision(
+        intent="answer",
+        message="The answer is retained.",
+        choice=2,
+        selection_evidence={"human_span": "existing contacts", "question_span": "existing contacts"},
+    )
+    result = resolve_task(scope, [parent, child], grounded, answer="Keep the existing contacts.")
+    assert result.state == "answer" and result.run_id == child["run_id"]
diff --git a/tests/test_scm_maintain_ticket_host.py b/tests/test_scm_maintain_ticket_host.py
new file mode 100644
index 00000000..0137b6d1
--- /dev/null
+++ b/tests/test_scm_maintain_ticket_host.py
@@ -0,0 +1,329 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""A native finite ticket binding is not an inherited run or source grant."""
+
+import importlib
+import importlib.util
+
+import pytest
+from pydantic import ValidationError
+from test_scm_polling import poll_case as poll_case
+
+
+def module():
+    assert importlib.util.find_spec("firefly_forge.scm_maintain_ticket_models"), (
+        "Native maintain-ticket contract is missing"
+    )
+    return importlib.import_module("firefly_forge.scm_maintain_ticket_models")
+
+
+def persisted_cut(case):
+    import copy
+
+    return {
+        kind: {
+            key: copy.deepcopy({name: value for name, value in vars(row).items() if name != "_sa_instance_state"})
+            for key, row in rows.items()
+        }
+        for kind, rows in case.db.items()
+    }
+
+
+def body():
+    return dict(
+        version=1,
+        request_id="a" * 32,
+        run_id="b" * 32,
+        creation_request_id="c" * 32,
+        expected_creation_digest="d" * 64,
+        observed_receipt_id="e" * 32,
+        expected_reference_digest="f" * 64,
+        expected_previous_digest=None,
+        lifetime_seconds=1800,
+        max_notifications=8,
+        allowed_actions=["status", "question", "answer"],
+        acknowledge_native_communication=True,
+    )
+
+
+def test_explicit_finite_native_communication_contract():
+    value = module().MaintainTicketInput.model_validate(body())
+    assert value.model_dump(mode="json") == body()
+
+
+@pytest.mark.parametrize(
+    "change",
+    [
+        {"issue_context": {}},
+        {"actor": "owner"},
+        {"lifetime_seconds": 0},
+        {"lifetime_seconds": 3601},
+        {"max_notifications": 33},
+        {"allowed_actions": ["resume"]},
+        {"allowed_actions": ["status", "status"]},
+        {"acknowledge_native_communication": False},
+        {"run_id": "foreign"},
+        {"expected_previous_digest": "bad"},
+        {"version": True},
+        {"acknowledge_native_communication": 1},
+        {"allowed_actions": ["status"]},
+    ],
+)
+def test_no_untyped_authority_or_unbounded_consent(change):
+    m = module()
+    with pytest.raises(ValidationError):
+        m.MaintainTicketInput.model_validate({**body(), **change})
+
+
+def test_exact_request_digest_and_remote_identity_are_not_type_coerced():
+    m = module()
+    request = m.MaintainTicketInput.model_validate(body())
+    assert m.request_digest(request) == m.request_digest(request.model_copy(deep=True))
+    expected = "https://github.com/team/product/issues/4#issuecomment-51"
+    assert m.confirmed_remote({"id": 51, "url": expected}, "https://github.com/team/product/issues/4") == {
+        "id": "51",
+        "url": expected,
+    }
+    for value in [True, 0, "051", None]:
+        with pytest.raises(ValueError):
+            m.confirmed_remote({"id": value, "url": expected}, "https://github.com/team/product/issues/4")
+    with pytest.raises(ValueError):
+        m.confirmed_remote(
+            {"id": 51, "url": expected.replace("issues/4", "issues/5")}, "https://github.com/team/product/issues/4"
+        )
+
+
+async def prepared_binding(case, monkeypatch):
+    import copy
+    from types import SimpleNamespace
+    from uuid import UUID, uuid4
+
+    from firefly_forge.journal import digest
+
+    service_module = importlib.import_module("firefly_forge.scm_maintain_tickets")
+    await case.ready()
+    await case.consent()
+    parent_status = await case.new_command("status")
+    await case.collaboration.process(parent_status["id"])
+    case.state["clock"] += 3600
+    case.state["comments"].append(case.comment(99, "@forge, keep me informed about the new maintenance unit"))
+    for _ in range(3):
+        await case.service.step(case.repository)
+    observed = next(row.data for row in case.db["inbox"].values() if row.source_key == "comment:99")
+    child = uuid4().hex
+    reference = dict(
+        version=1,
+        run_id=case.run_id,
+        request_id=uuid4().hex,
+        expected_checkpoint_digest="1" * 64,
+        expected_revision="2" * 40,
+    )
+    source = dict(
+        version=1,
+        operation="maintain",
+        reference=reference,
+        repository_id=case.repository,
+        project_id=case.project,
+        component_id="api",
+        revision="2" * 40,
+        source_tree="3" * 40,
+        branch="forge/retained",
+        remote_receipt_digest="4" * 64,
+        journal_head="5" * 64,
+        parent_scope_digest="6" * 64,
+    )
+    source["digest"] = digest(source)
+    run = {
+        **copy.deepcopy(case.db["runs"][case.run_id].data),
+        "id": child,
+        "operation": "maintain",
+        "publish": False,
+        "status": "queued",
+        "source_checkpoint": reference,
+        "source_checkpoint_snapshot": source,
+    }
+    for name in ("issue_context", "worker_request", "worker_response", "pause", "active_task"):
+        run.pop(name, None)
+    case.db["runs"][child] = SimpleNamespace(
+        id=UUID(child), repository_id=UUID(case.repository), status="queued", data=run
+    )
+    creation = dict(
+        request_id=uuid4().hex,
+        run_id=child,
+        repository_id=case.repository,
+        project_id=case.project,
+        component_id="api",
+        input=dict(operation="maintain", publish=False, source_checkpoint=reference),
+        source_checkpoint=source,
+    )
+    creation["digest"] = digest(creation)
+    service = service_module.MaintainTickets(case.collaboration)
+
+    async def retained_creation(self, request_id):
+        assert request_id == creation["request_id"]
+        return copy.deepcopy(creation)
+
+    monkeypatch.setattr(service_module.MaintainTickets, "_creation", retained_creation)
+    request = module().MaintainTicketInput.model_validate(
+        {
+            **body(),
+            "run_id": child,
+            "creation_request_id": creation["request_id"],
+            "expected_creation_digest": creation["digest"],
+            "observed_receipt_id": observed["id"],
+            "expected_reference_digest": digest(observed["verification"]),
+        }
+    )
+    return service, request
+
+
+async def test_native_configuration_queues_one_server_owned_feedback_anchor(poll_case, monkeypatch):
+    import copy
+
+    assert importlib.util.find_spec("firefly_forge.scm_maintain_tickets"), (
+        "Native maintain communication service is missing"
+    )
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        parent = copy.deepcopy(case.db["runs"][case.run_id].data)
+        previous_posts = copy.deepcopy(case.state["posts"])
+        result = await service.configure(case.project, case.repository, request)
+        assert result["request"] == request.model_dump(mode="json")
+        assert result["creation_digest"] == request.expected_creation_digest
+        assert result["parent_reference"]["run_id"] == case.run_id
+        anchor = await case.collaboration.receipt(result["outbox_id"])
+        assert anchor["maintain_ticket"]["binding_digest"] == result["digest"]
+        assert anchor["run_id"] == request.run_id and anchor["feedback_status"] == "pending"
+        assert "native_question" not in anchor and "issue_context" not in case.db["runs"][request.run_id].data
+        assert case.db["runs"][case.run_id].data == parent and case.state["posts"] == previous_posts
+        assert await service.configure(case.project, case.repository, request) == result
+
+
+async def test_configured_native_owner_loop_posts_once_without_a_writer_transaction(poll_case, monkeypatch):
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        result = await service.configure(case.project, case.repository, request)
+        before = len(case.state["posts"])
+        await case.collaboration.feedback(result["outbox_id"])
+        sent = await case.collaboration.receipt(result["outbox_id"])
+        assert sent["feedback_status"] == "sent", sent
+        assert len(case.state["posts"]) == before + 1
+        assert case.state["depth"] == 0
+        await case.collaboration.feedback(result["outbox_id"])
+        assert len(case.state["posts"]) == before + 1
+
+
+async def test_retained_binding_and_marker_have_exact_versioned_serialization(poll_case, monkeypatch):
+    import copy
+
+    m = module()
+    async with poll_case() as case:
+        service, request = await prepared_binding(case, monkeypatch)
+        kept = await service.configure(case.project, case.repository, request)
+        assert m.MaintainTicketReceipt.model_validate(kept).model_dump(mode="json") == kept
+        anchor = await case.collaboration.receipt(kept["outbox_id"])
+        assert (
+            m.MaintainTicketMarker.model_validate(anchor["maintain_ticket"]).model_dump(mode="json")
+            == anchor["maintain_ticket"]
+        )
+        for change in [
+            {"version": True},
+            {"revision": True},
+            {"expires_at_ms": str(kept["expires_at_ms"])},
+            {"creation_digest": "f" * 64},
+            {"request_digest": "f" * 64},
+            {"extra": "unrecognized"},
+        ]:
+            with pytest.raises(ValidationError):
+                m.MaintainTicketReceipt.model_validate({**copy.deepcopy(kept), **change})
+
+
+@pytest.mark.parametrize(
+    "change", [{"operation": "test"}, {"publish": True}, {"component_id": "foreign"}, {"repository_id": "f" * 32}]
+)
+async def test_binding_cannot_retarget_or_upgrade_the_frozen_native_creation(poll_case, monkeypatch, change):
+    from firefly_forge.project_access import AccessDenied
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        c.db["runs"][request.run_id].data.update(change)
+        before = len(c.db["inbox"]), len(c.db["events"])
+        with pytest.raises(AccessDenied):
+            await service.configure(c.project, c.repository, request)
+        assert (len(c.db["inbox"]), len(c.db["events"])) == before
+
+
+async def test_failed_atomic_configuration_retains_no_binding_event_or_outbox(poll_case, monkeypatch):
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        before = persisted_cut(c)
+        c.state["fail_save"] = True
+        with pytest.raises(ValueError, match="persistence"):
+            await service.configure(c.project, c.repository, request)
+        assert persisted_cut(c) == before
+
+
+async def test_idempotent_request_does_not_extend_expired_consent_and_unknown_cannot_be_regranted(
+    poll_case, monkeypatch
+):
+    from uuid import uuid4
+
+    import firefly_forge.scm_maintain_tickets as m
+    from firefly_forge.project_access import AccessDenied
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        kept = await service.configure(c.project, c.repository, request)
+        monkeypatch.setattr(m, "clock_ms", lambda: kept["expires_at_ms"])
+        assert await service.configure(c.project, c.repository, request) == kept
+        anchor = await c.collaboration.receipt(kept["outbox_id"])
+        with pytest.raises(AccessDenied):
+            await service.current(anchor)
+        c.db["inbox"][kept["outbox_id"]].data["feedback_status"] = "needs_reconciliation"
+        renewal = request.model_copy(update={"request_id": uuid4().hex, "expected_previous_digest": kept["digest"]})
+        before = persisted_cut(c)
+        with pytest.raises(AccessDenied, match="reconciliation"):
+            await service.configure(c.project, c.repository, renewal)
+        assert persisted_cut(c) == before
+
+
+@pytest.mark.parametrize("change", ["extra_pointer", "wrong_digest", "foreign_marker", "wrong_owner"])
+async def test_current_binding_rejects_changed_server_pointer_marker_or_owner(poll_case, monkeypatch, change):
+    from firefly_forge.project_access import AccessDenied
+    from firefly_forge.scm_maintain_tickets import STATE_KEY
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        kept = await service.configure(c.project, c.repository, request)
+        anchor = await c.collaboration.receipt(kept["outbox_id"])
+        if change == "extra_pointer":
+            c.db["settings"][c.repository].data[STATE_KEY]["heads"][request.run_id]["extra"] = True
+        elif change == "wrong_digest":
+            c.db["settings"][c.repository].data[STATE_KEY]["heads"][request.run_id]["digest"] = "f" * 64
+        elif change == "foreign_marker":
+            anchor["maintain_ticket"]["run_id"] = "f" * 32
+        else:
+            anchor["actor"] = "8"
+        with pytest.raises((AccessDenied, ValueError)):
+            await service.current(anchor)
+
+
+async def test_expiration_during_final_binding_save_rolls_back_the_complete_native_binding(poll_case, monkeypatch):
+    import firefly_forge.scm_maintain_tickets as module
+    from firefly_forge.project_access import AccessDenied
+
+    async with poll_case() as c:
+        service, request = await prepared_binding(c, monkeypatch)
+        tick = {"value": 1000}
+        monkeypatch.setattr(module, "clock_ms", lambda: tick["value"])
+        original = service.polling.settings.save
+
+        async def save(row):
+            result = await original(row)
+            tick["value"] = 1000 + request.lifetime_seconds * 1000
+            return result
+
+        monkeypatch.setattr(service.polling.settings, "save", save)
+        before = persisted_cut(c)
+        with pytest.raises(AccessDenied, match="finite consent expired"):
+            await service.configure(c.project, c.repository, request)
+        assert persisted_cut(c) == before
diff --git a/tests/test_scm_maintain_ticket_native.py b/tests/test_scm_maintain_ticket_native.py
new file mode 100644
index 00000000..e2eb1856
--- /dev/null
+++ b/tests/test_scm_maintain_ticket_native.py
@@ -0,0 +1,286 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Prepared native maintain communication; real Store/lease/Git, controlled transports only."""
+
+import asyncio
+import copy
+import json
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+import pytest
+from checkpoint_test_native_fixtures import checkpoint_native as checkpoint_native  # noqa: F401
+from natural_coordinator_model_fixture import native_coordinator
+from scm_polling_native_fixtures import native_poll as native_poll  # noqa: F401
+from test_addressed_status_native import natural
+from worker_reply_fixtures import authenticated_operator
+
+from firefly_forge.git_delivery_models import GitDeliveryPolicyInputV1
+from firefly_forge.git_delivery_policy import GitDeliveryPolicies
+from firefly_forge.identity_persistence import ForgeIdentityUserRepository
+from firefly_forge.journal import digest
+from firefly_forge.providers import AgentResult
+from firefly_forge.scm_conversations import SCMConversations
+
+
+@pytest.fixture
+def maintain_ticket(checkpoint_native):
+    c = checkpoint_native
+
+    async def disable_optional_git():
+        async with authenticated_operator(c.store):
+            current = await GitDeliveryPolicies(c.store).view(c.case.project["id"])
+            await GitDeliveryPolicies(c.store).configure(
+                c.case.project["id"],
+                GitDeliveryPolicyInputV1(
+                    version=1,
+                    request_id=uuid4().hex,
+                    expected_previous_digest=current["digest"],
+                    policy={**current["policy"], "enabled": False},
+                ),
+            )
+
+    c.case.http.portal.call(disable_optional_git)
+    body = copy.deepcopy(c.body)
+    body["input"].update(operation="maintain", brief="Ask one decision about this independent maintenance unit")
+    creation_id = uuid4().hex
+    response = c.case.http.post("/api/v1/run-creation-requests/" + creation_id, json=body)
+    assert response.status_code == 201, response.text
+    creation = response.json()
+    assert creation["run_id"] != c.parent["id"] and creation["source_checkpoint"]["operation"] == "maintain"
+    calls = []
+
+    class Worker:
+        async def execute(self, workspace, *args):
+            calls.append(workspace)
+            assert (workspace / "product.py").read_text() == "value = 2\n"
+            return AgentResult(
+                json.dumps(
+                    {
+                        "summary": "A maintenance decision is required",
+                        "feedback": {
+                            "id": "maintain-ticket-feedback",
+                            "role_id": "implementer",
+                            "task_id": "implement",
+                            "attempt": 1,
+                            "disposition": "clarification",
+                            "summary": "Choose the expected maintenance result",
+                            "request": {
+                                "id": "maintain-ticket-question",
+                                "kind": "other",
+                                "question": "Keep the existing contacts?",
+                                "context": "A fresh unit keeps the retained source and its records.",
+                                "choices": ["Keep", "Review"],
+                            },
+                        },
+                    }
+                ),
+                "controlled native maintain fixture",
+            )
+
+    c.engine.provider_factory = lambda _: Worker()
+
+    async def execute_child():
+        c.engine.active[creation["run_id"]] = asyncio.current_task()
+        try:
+            await c.engine.execute_run(creation["run_id"])
+        finally:
+            c.engine.active.pop(creation["run_id"], None)
+        child = await c.store.get_run(creation["run_id"])
+        assert child["status"] == "paused", child.get("error")
+        assert child["worker_request"]["id"] == "maintain-ticket-question"
+        assert "issue_context" not in child or child["issue_context"] == c.parent.get("issue_context")
+        assert len(calls) == 1 and child["implementation_rounds"] == 1
+        assert await c.store.get_run(c.parent["id"]) == c.parent
+        assert await c.journal.entries(c.parent["id"]) == c.prefix
+        await c.store.release_ownership()
+        await c.case.store.acquire_ownership()
+        return child
+
+    child = c.case.http.portal.call(execute_child)
+    c.case.ready()
+    c.case.consent()
+    c.case.run.clear()
+    c.case.run.update(c.parent)
+    prior = c.case.process(c.case.observe("status"))
+    assert prior["run_id"] == c.parent["id"]
+    observed = natural(c.case, "@forge keep me informed about this maintenance unit", number=801)
+    path = f"/api/v1/projects/{c.case.project['id']}/repositories/{c.case.repo['id']}/maintain-ticket-bindings"
+    request = dict(
+        version=1,
+        request_id=uuid4().hex,
+        run_id=child["id"],
+        creation_request_id=creation_id,
+        expected_creation_digest=creation["digest"],
+        observed_receipt_id=observed["id"],
+        expected_reference_digest=digest(observed["verification"]),
+        expected_previous_digest=None,
+        lifetime_seconds=1800,
+        max_notifications=8,
+        allowed_actions=["status", "question", "answer"],
+        acknowledge_native_communication=True,
+    )
+    return c, child, creation, observed, path, request
+
+
+def configure(values):
+    c, child, creation, observed, path, request = values
+    response = c.case.http.post(path, json=request)
+    assert response.status_code == 201, response.text
+    kept = response.json()
+    assert c.case.http.get(path + "/requests/" + request["request_id"]).json() == kept
+    assert c.case.http.post(path, json=request).json() == kept
+    return kept
+
+
+def test_native_bound_maintain_question_owner_answer_retains_pause_and_parent(maintain_ticket, monkeypatch):
+    c, child, creation, observed, path, request = maintain_ticket
+
+    async def readonly_before_binding():
+        service = SCMConversations(c.case.collaboration)
+        scopes = await service.scopes(observed, remote=False)
+        refs, _ = await service.references(observed, scopes, durable=True)
+        ref = next(ref for ref in refs if ref["run_id"] == child["id"])
+        assert ref["kind"] == "native_checkpoint_maintain"
+
+    c.case.http.portal.call(readonly_before_binding)
+    kept = configure(maintain_ticket)
+    previous = len(c.case.state["posts"])
+    c.case.http.portal.call(c.case.collaboration.sync_feedback)
+    anchor = c.case.http.portal.call(c.case.collaboration.receipt, kept["outbox_id"])
+    assert anchor["feedback_status"] == "sent" and anchor["feedback_intent"]["request_id"] == "maintain-ticket-question"
+    assert len(c.case.state["posts"]) >= previous + 1
+    assert not anchor.get("native_question") and anchor["maintain_ticket"]["binding_digest"] == kept["digest"]
+    c.case.http.portal.call(c.case.collaboration.feedback, anchor["id"])
+    assert c.case.http.portal.call(c.case.collaboration.receipt, anchor["id"]) == anchor
+    coordinator = native_coordinator(c.case, monkeypatch, intent="answer")
+
+    async def grounded_answer(message, context, settings):
+        from pydantic_ai.messages import ModelResponse, ToolCallPart
+        from pydantic_ai.models.function import FunctionModel
+
+        from firefly_forge.scm_natural_models import question_choices
+        from firefly_forge.scm_natural_runtime import classify
+
+        offered = next(row for row in question_choices(context) if row["run_id"] == child["id"])
+        matching = [row for row in context["candidates"] if "existing contacts" in (row.get("question") or "")]
+        assert len(matching) == 1 and matching[0]["run_id"] == child["id"]
+        assert "existing contacts" in message
+
+        def model(messages, info):
+            assert not info.function_tools
+            coordinator.append((message, context))
+            return ModelResponse(
+                parts=[
+                    ToolCallPart(
+                        info.output_tools[0].name,
+                        {
+                            "intent": "answer",
+                            "message": "Your maintenance answer is retained.",
+                            "choice": offered["choice"],
+                            "selection_evidence": {
+                                "human_span": "existing contacts",
+                                "question_span": "existing contacts",
+                            },
+                        },
+                    )
+                ]
+            )
+
+        return await classify(message, context, settings, model=FunctionModel(model))
+
+    monkeypatch.setattr("firefly_forge.scm_natural_tasks.classify", grounded_answer)
+    stamp = datetime.now(UTC)
+    # The controlled provider exposes every comment already confirmed by a native
+    # POST, including the still-pending parent question; it does not fabricate receipts.
+    for index, posted in enumerate(c.case.state["posts"], 1):
+        bot = c.case.comment(100 + index, posted["body"])
+        bot["user"]["type"] = "Bot"
+        posted_at = (stamp + timedelta(milliseconds=index)).isoformat()
+        bot.update(created_at=posted_at, updated_at=posted_at)
+        c.case.state["comments"].append(bot)
+    human = c.case.comment(850, "Keep the existing contacts.")
+    human.update(
+        created_at=(stamp + timedelta(seconds=1)).isoformat(), updated_at=(stamp + timedelta(seconds=1)).isoformat()
+    )
+    c.case.state["comments"].append(human)
+    c.case.state["clock"] += 3600
+    for _ in range(2):
+        c.case.http.portal.call(c.case.service.step, c.case.repo["id"])
+    reply = next(
+        row for row in c.case.http.portal.call(c.case.retained)[2] if row["verification"]["resource_id"] == "850"
+    )
+
+    async def retained_reply_projection():
+        # Exercise the same retained-reply reader under a physical native unit so a
+        # swallowed polling refusal has an actionable traceback before processing.
+        async with c.case.store._unit():
+            projected = await c.case.service._natural_reply_source(
+                c.case.repo["id"], reply["source_snapshot"], reply["verification"], False
+            )
+            assert projected is not None, {key: reply.get(key) for key in ("status", "reason", "command")}
+        return projected
+
+    projection = c.case.http.portal.call(retained_reply_projection)
+    assert projection.adapter == "retained_question_reply_v1"
+    assert reply["status"] == "received", reply
+    assert reply["command"]["adapter"] == "retained_question_reply_v1", reply
+    result = c.case.process(reply)
+    assert "natural_turn" in result, result
+    assert result["natural_turn"]["state"] == "answer_saved_pending_resume", result
+    assert len(coordinator) == 1
+
+    async def retained():
+        current = await c.store.get_run(child["id"])
+        entries = await c.journal.entries(child["id"])
+        responses = [entry for entry in entries if entry["kind"] == "worker_response"]
+        assert len(responses) == 1 and responses[0]["payload"]["answer"] == "Keep the existing contacts."
+        assert responses[0]["payload"]["responding_actor"]["user_id"] == c.case.mapped.id.hex
+        assert current["status"] == "paused" and current["implementation_rounds"] == child["implementation_rounds"]
+        assert not any(entry["kind"] in {"resume", "provider_dispatch_intent"} for entry in entries)
+        assert await c.store.get_run(c.parent["id"]) == c.parent
+        assert await c.journal.entries(c.parent["id"]) == c.prefix
+        assert await c.case.store.repository(c.case.repo["id"]) == await c.store.repository(c.case.repo["id"])
+
+    c.case.http.portal.call(retained)
+
+
+def test_native_maintain_owner_revocation_before_provider_dispatch_posts_nothing(maintain_ticket, monkeypatch):
+    c, child, _, _, _, _ = maintain_ticket
+    kept = configure(maintain_ticket)
+    original = c.case.scm._request
+
+    async def request(method, url, **kwargs):
+        if method == "POST" and kwargs.get("before_dispatch"):
+            async with c.case.store._unit():
+                users = ForgeIdentityUserRepository()
+                user = await users.find_by_id(c.case.mapped.id)
+                user.enabled = False
+                await users.save(user)
+        return await original(method, url, **kwargs)
+
+    monkeypatch.setattr(c.case.scm, "_request", request)
+    before = len(c.case.state["posts"])
+    c.case.http.portal.call(c.case.collaboration.feedback, kept["outbox_id"])
+    anchor = c.case.http.portal.call(c.case.collaboration.receipt, kept["outbox_id"])
+    assert anchor["feedback_status"] == "held" and anchor["reason"] == "native_maintain_authority_changed"
+    assert len(c.case.state["posts"]) == before
+    assert c.case.http.portal.call(c.store.get_run, child["id"]) == child
+    assert c.case.http.portal.call(c.store.get_run, c.parent["id"]) == c.parent
+
+
+def test_native_maintain_unknown_notification_never_reposts_or_silently_rebinds(maintain_ticket):
+    c, child, _, _, path, request = maintain_ticket
+    kept = configure(maintain_ticket)
+    before = len(c.case.state["posts"])
+    c.case.state["lost_reply"] = True
+    c.case.http.portal.call(c.case.collaboration.feedback, kept["outbox_id"])
+    anchor = c.case.http.portal.call(c.case.collaboration.receipt, kept["outbox_id"])
+    assert anchor["feedback_status"] == "needs_reconciliation"
+    c.case.http.portal.call(c.case.collaboration.feedback, kept["outbox_id"])
+    assert c.case.http.portal.call(c.case.collaboration.receipt, kept["outbox_id"]) == anchor
+    assert len(c.case.state["posts"]) == before + 1
+    renewal = {**request, "request_id": uuid4().hex, "expected_previous_digest": kept["digest"]}
+    denied = c.case.http.post(path, json=renewal)
+    assert denied.status_code == 403, denied.text
+    assert c.case.http.portal.call(c.store.get_run, child["id"]) == child
+    assert c.case.http.portal.call(c.store.get_run, c.parent["id"]) == c.parent
diff --git a/tests/test_scm_natural_trusted_links_host.py b/tests/test_scm_natural_trusted_links_host.py
new file mode 100644
index 00000000..4a5284a9
--- /dev/null
+++ b/tests/test_scm_natural_trusted_links_host.py
@@ -0,0 +1,196 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Controlled native-context facts permit exact delivery hrefs, never arbitrary model links."""
+
+import copy
+
+import pytest
+from markdown_it import MarkdownIt
+from test_scm_polling import poll_case as poll_case
+
+from firefly_forge.scm_natural_feedback import natural_card
+from firefly_forge.scm_natural_models import NaturalDecision
+
+HOST = "https://github.com"
+REPO = {"id": "a" * 32, "provider": "github", "url": HOST + "/team/factory-acceptance-product.git"}
+PR = HOST + "/team/factory-acceptance-product/pull/5"
+REVISION = "c5a383909352952893207e40aa4e0f4e165b8792"
+COMMIT = HOST + "/team/factory-acceptance-product/commit/" + REVISION
+
+
+def fixture(message):
+    scope = {
+        "repository_id": REPO["id"],
+        "project_id": "b" * 32,
+        "issue": {"kind": "issue", "number": 4},
+        "actor": "7",
+        "binding_digest": "d" * 64,
+        "native_user_id": "e" * 32,
+    }
+    return {
+        "provider": "github",
+        "repository_id": REPO["id"],
+        "actor": "7",
+        "issue": scope["issue"],
+        "command": {"language": "es"},
+        "natural_turn": {
+            "state": "status",
+            "reply": message,
+            "decision": {"intent": "status", "language": "es", "questions": []},
+            "context": {
+                "scope": scope,
+                "candidates": [
+                    {
+                        **scope,
+                        "run_id": "f" * 32,
+                        "delivery": {
+                            "evidence": "verified_native_journal",
+                            "checkpoint": {"revision": REVISION, "checkpoint_digest": "1" * 64},
+                            "remote": {"status": "draft", "pr_url": PR},
+                            "product_acceptance": "not_established_by_checkpoint",
+                        },
+                    }
+                ],
+            },
+        },
+    }
+
+
+def links(body):
+    return [
+        token.attrGet("href")
+        for block in MarkdownIt().parse(body)
+        for token in (block.children or [])
+        if token.type == "link_open"
+    ]
+
+
+def card(data, safe=lambda value: value):
+    return natural_card(data, safe, repository=REPO, host=HOST)
+
+
+def test_exact_native_pr_and_commit_markdown_links_are_clickable_without_product_completion_claim():
+    message = f"Avance guardado, todavía sin aceptación completa:\n[PR #5]({PR}) y [commit guardado]({COMMIT})."
+    body = card(fixture(message))
+    assert links(body) == [PR, COMMIT]
+    assert "Avance guardado" in body and "sin aceptación completa" in body
+    assert "\\[PR" not in body
+    assert "</a> y <a " in MarkdownIt().render(body)
+
+
+def test_bare_native_urls_and_trailing_sentence_punctuation_render_as_links():
+    body = card(fixture(f"Revisa {PR}.\nCódigo: {COMMIT}!"))
+    assert links(body) == [PR, COMMIT]
+    assert "Código:" in body and "Revisa <" in body
+
+
+@pytest.mark.parametrize(
+    "changed",
+    ["unverified", "unknown", "local_only", "foreign_scope", "foreign_repository", "foreign_host", "bad_revision"],
+)
+def test_model_text_cannot_make_a_href_trusted_without_exact_native_delivery_scope(changed):
+    data = fixture(f"[PR]({PR}) [commit]({COMMIT})")
+    candidate = data["natural_turn"]["context"]["candidates"][0]
+    if changed == "unverified":
+        candidate["delivery"]["evidence"] = "model_claim"
+    elif changed == "unknown":
+        candidate["delivery"]["remote"]["status"] = "unknown"
+    elif changed == "local_only":
+        candidate["delivery"]["remote"] = {"status": "not_requested", "pr_url": None}
+    elif changed == "foreign_scope":
+        candidate["project_id"] = "2" * 32
+    elif changed == "foreign_repository":
+        data["repository_id"] = "2" * 32
+    elif changed == "foreign_host":
+        candidate["delivery"]["remote"]["pr_url"] = "https://other.example/team/factory-acceptance-product/pull/5"
+    else:
+        candidate["delivery"]["checkpoint"]["revision"] = "not-a-commit"
+    assert links(card(data)) == []
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        PR + "?token=fictional-private-value",
+        PR + "#untrusted",
+        PR.replace("https://", "http://"),
+        PR.replace("github.com/", "github.com.evil.example/"),
+        PR.replace("/team/", "/someone/"),
+        PR.replace("/pull/5", "/pull/6"),
+        COMMIT[:-1] + "0",
+        "https://user:fictional-private-value@github.com/team/factory-acceptance-product/pull/5",
+        "https://github.com/team/factory-acceptance-product/commit/%2e%2e",
+        "javascript:alert(1)",
+    ],
+)
+def test_similar_arbitrary_or_token_bearing_model_urls_do_not_become_links(url):
+    body = card(fixture(f"[Review]({url})"))
+    assert links(body) == []
+    assert "fictional-private-value" not in body
+
+
+def test_native_links_do_not_relax_secret_absolute_path_html_or_mention_guards():
+    message = (
+        f"[PR @everyone]({PR}) <script>alert(1)</script> /private/owned/secret.txt "
+        "C:\\Private\\key.txt KEY=fixture-value"
+    )
+    body = card(fixture(message))
+    assert links(body) == [PR]
+    assert "@everyone" not in body and "<script>" not in body
+    assert "/private/owned" not in body and "Private" not in body and "fixture-value" not in body
+
+
+def test_current_credential_callback_runs_before_tokenization_and_can_remove_an_entire_link():
+    secret = f"[PR]({PR})"
+    seen = []
+
+    def safe(value):
+        seen.append(value)
+        return value.replace(secret, "redacted credential")
+
+    body = card(fixture(secret), safe)
+    assert secret in seen and links(body) == [] and "redacted credential" in body
+
+
+def test_a_retained_href_that_now_matches_a_credential_is_never_published():
+    body = card(fixture(f"[PR]({PR})"), lambda value: value.replace(PR, "private value omitted"))
+    assert links(body) == [] and PR not in body
+
+
+def test_raw_url_size_bound_prevents_late_public_quote_overflow_without_truncation():
+    message = "\n".join("x" * 360 + f" [saved]({COMMIT})" for _ in range(9))
+    with pytest.raises(ValueError, match="quote"):
+        NaturalDecision(intent="status", message=message)
+
+
+def test_no_repository_authority_keeps_existing_safe_unlinked_rendering():
+    data = fixture(f"[PR]({PR})")
+    before = copy.deepcopy(data)
+    assert links(natural_card(data, lambda value: value)) == []
+    assert data == before
+
+
+async def test_native_feedback_supplies_current_repository_and_host_to_the_link_renderer(poll_case, monkeypatch):
+    from test_scm_natural_intake_host import prepared
+
+    import firefly_forge.scm_natural_feedback as module
+
+    async with poll_case() as case:
+        _, receipt = await prepared(case, monkeypatch, intent="status")
+        original = module.natural_card
+        seen = []
+
+        def render(data, safe, *, repository, host):
+            seen.append((repository["id"], host))
+            return original(data, safe, repository=repository, host=host)
+
+        monkeypatch.setattr(module, "natural_card", render)
+        result = await case.collaboration.process(receipt)
+        assert result["feedback_status"] == "sent", result
+        assert seen and all(value == (case.repository, "https://github.com") for value in seen)
+        assert case.state["natural_calls"] == 1
+
+
+def test_settings_with_a_native_href_are_redacted_before_link_tokenization():
+    body = card(fixture(f"FORGE_URL={PR} [PR]({PR})"))
+    assert links(body) == [PR]
+    assert "FORGE_URL=" not in body
diff --git a/tests/test_source_budget_current_profile_host.py b/tests/test_source_budget_current_profile_host.py
index 3556ef7e..153e904d 100644
--- a/tests/test_source_budget_current_profile_host.py
+++ b/tests/test_source_budget_current_profile_host.py
@@ -20,7 +20,9 @@ def transition_case(tmp_path, monkeypatch, *, historical=False, current_first=Tr
     executable.write_text("#!/bin/sh\nexit 0\n")
     executable.chmod(0o700)
     current = register_fixture_profile(monkeypatch, executable)
-    previous = replace(current, version=6, loader_profile="codex-exec-restricted-source/v7")
+    previous = replace(
+        current, version=6, loader_profile="codex-exec-restricted-source/v7", admission_contract_digest=""
+    )
     if control is not None:
         previous = replace(previous, **control)
     previous = replace(previous, proof=replace(previous.proof, contract_digest=q.profile_contract_digest(previous)))
diff --git a/tests/test_source_budget_output_host.py b/tests/test_source_budget_output_host.py
index fdd50374..6beb35dd 100644
--- a/tests/test_source_budget_output_host.py
+++ b/tests/test_source_budget_output_host.py
@@ -389,13 +389,13 @@ def transport(request):
     assert calls[1].url.params["basis"] == "known_completed_output"
 
 
-def test_current_v9_declares_entire_new_allowance_module_without_relabeling_historical_registry():
+def test_current_v10_declares_entire_new_allowance_module_without_relabeling_historical_registry():
     from firefly_forge import source_edit_qualification as qualification
     from firefly_forge.source_edit_supported_profiles import PROFILES
 
-    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v9"
-    assert qualification.REGISTRY_VERSION == 8
-    assert len(qualification.LOADER_MODULES) == 21
+    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v12"
+    assert qualification.REGISTRY_VERSION == 11
+    assert len(qualification.LOADER_MODULES) == 22
     assert "source_budget_output.py" in qualification.LOADER_MODULES
     assert "known_completed_output_finite_activation" in qualification.SOURCE_BUDGET_CHECKS
     historical = {profile.loader_profile: profile for profile in PROFILES}
diff --git a/tests/test_source_budget_qualification_host.py b/tests/test_source_budget_qualification_host.py
index 27b01bd6..6420d911 100644
--- a/tests/test_source_budget_qualification_host.py
+++ b/tests/test_source_budget_qualification_host.py
@@ -23,11 +23,11 @@ def test_historical_profile_payload_preserves_exact_original_seal_bytes():
 
 
 def test_new_native_profile_measures_budget_modules_and_keeps_old_literal_historical():
-    assert module.LOADER_PROFILE == "codex-exec-restricted-source/v9"
+    assert module.LOADER_PROFILE == "codex-exec-restricted-source/v12"
     assert {"source_budget_allowances.py", "source_budget_output.py", "source_tool_budget.py", "tool_broker.py"} <= set(
         module.LOADER_MODULES
     )
-    assert len(module.LOADER_MODULES) == 21
+    assert len(module.LOADER_MODULES) == 22
     assert PROFILES[0].loader_profile == "codex-exec-restricted-source/v5"
     with pytest.raises(ValueError):
         module.require_profile(PROFILES[0])
diff --git a/tests/test_source_edit_supported_profile_host.py b/tests/test_source_edit_supported_profile_host.py
index 5483004d..1348d12c 100644
--- a/tests/test_source_edit_supported_profile_host.py
+++ b/tests/test_source_edit_supported_profile_host.py
@@ -21,9 +21,12 @@ def test_package_owns_measured_profile():
         "codex-exec-restricted-source/v6",
         "codex-exec-restricted-source/v7",
         "codex-exec-restricted-source/v8",
+        "codex-exec-restricted-source/v9",
+        "codex-exec-restricted-source/v10",
+        "codex-exec-restricted-source/v11",
         q.LOADER_PROFILE,
     }
-    assert len(profiles) == 5
+    assert len(profiles) == 8
     profile = registered_profile("codex-exec-restricted-source/v5")
     assert profile.profile_id == "codex-0163-darwin-arm64-source-v5"
     assert profile.executable_sha256 == "8813367285524ac798dd96d1b071aea30d58708c7226fd236cd275cf1cfdee31"
@@ -49,7 +52,7 @@ def test_historical_loader_and_policy_keep_their_exact_provenance():
     )
     assert profile.loader_hashes != q.loader_hashes()
     assert profile.loader_profile == "codex-exec-restricted-source/v5"
-    assert q.LOADER_PROFILE == "codex-exec-restricted-source/v9"
+    assert q.LOADER_PROFILE == "codex-exec-restricted-source/v12"
     assert profile.policy_digest == q.policy_digest()
     with pytest.raises(ValueError, match="qualified"):
         q.require_profile(profile)
@@ -82,9 +85,12 @@ def test_current_runtime_must_match_measured_profile_before_admission(measured_r
     profile = measured_runtime
     identity = {"sha256": profile.executable_sha256, "size": profile.executable_size}
     assert q.qualified_profile(identity, profile.model) == profile
-    assert profile.version == q.REGISTRY_VERSION == 8
-    assert profile.profile_id == "codex-0163-darwin-arm64-source-v9"
-    assert len(profile.loader_hashes) == 21
+    assert profile.version == q.REGISTRY_VERSION == 11
+    assert profile.profile_id == "codex-0163-darwin-arm64-source-v12"
+    from firefly_forge.source_budget_allowances import admission_contract_digest
+
+    assert profile.admission_contract_digest == admission_contract_digest()
+    assert len(profile.loader_hashes) == 22
     assert profile.loader_hashes == q.loader_hashes()
     assert profile.runtime_versions == q.runtime_versions()
     assert profile.proof.contract_digest == q.profile_contract_digest(profile)
diff --git a/tests/test_source_edit_v10_transition_host.py b/tests/test_source_edit_v10_transition_host.py
new file mode 100644
index 00000000..a6f2ada4
--- /dev/null
+++ b/tests/test_source_edit_v10_transition_host.py
@@ -0,0 +1,168 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""V10 is a new admission closure, never inherited authority from five historical profiles."""
+
+import ast
+import hashlib
+from pathlib import Path
+
+import pytest
+
+from firefly_forge import source_edit_qualification as qualification
+from firefly_forge.journal import digest
+from firefly_forge.source_budget_allowances import admission_contract_digest
+
+HISTORICAL = (
+    (4, "codex-exec-restricted-source/v5", "17320f82c0f2f9ab4b65c7e3bd8b89741a3716a8896dd5f674f6409ac1490c3c"),
+    (5, "codex-exec-restricted-source/v6", "20e13d34f87314b12fa9a25a0c6411e75e8eb70083a083d743c7fa5487cff76a"),
+    (6, "codex-exec-restricted-source/v7", "28f152b48aa9ff37c940ae300fd47f4af5ecc0053860b1980b79fa39a20886b6"),
+    (7, "codex-exec-restricted-source/v8", "ab6b1582f5d364e9341e5d25e0f8dd343c3033d0f2ed885e025f7b38ebb64a97"),
+    (8, "codex-exec-restricted-source/v9", "4c7d2eba0af54ab48ef33fbe2018e797fcb5cb7adc41a9846722c22dd944f3c8"),
+)
+
+
+def names():
+    root = Path(qualification.__file__).parent
+    tree = ast.parse((root / "source_budget_allowances.py").read_text())
+    fn = next(
+        node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == "admission_contract_digest"
+    )
+    return root, next(
+        ast.literal_eval(node) for node in ast.walk(fn) if isinstance(node, ast.Tuple) and len(node.elts) >= 32
+    )
+
+
+def test_v10_profile_remains_exact_historical_provenance_after_v11_transition():
+    profiles = qualification._profiles()
+    assert len(profiles) in {7, 8}
+    profile = profiles[5]
+    assert (profile.version, profile.loader_profile) == (9, "codex-exec-restricted-source/v10")
+    assert (
+        qualification.historical_profile_seal(profile)["profile_digest"]
+        == "da8231dc4b6bddb14cde5c619416be63c27ea45b316e02c6a24a84e2fab5777b"
+    )
+    with pytest.raises(ValueError):
+        qualification.require_profile(profile)
+
+
+def test_five_historical_literals_keep_their_exact_seals_without_current_authority():
+    profiles = qualification._profiles()
+    for profile, (version, loader, fingerprint) in zip(profiles[:5], HISTORICAL, strict=True):
+        assert (profile.version, profile.loader_profile) == (version, loader)
+        assert digest(qualification.profile_payload(profile)) == fingerprint
+        assert qualification.historical_profile_seal(profile)["profile_digest"] == fingerprint
+        with pytest.raises(ValueError):
+            qualification.require_profile(profile)
+
+
+def test_allocator_is_explicitly_the_thirty_third_native_admission_dependency():
+    root, declared = names()
+    assert len(declared[:33]) == len(set(declared[:33])) == 33
+    assert declared[32] == "sandbox_command_slots.py"
+    assert admission_contract_digest() == digest(
+        {name: hashlib.sha256((root / name).read_bytes()).hexdigest() for name in declared}
+    )
+
+
+def test_allocator_byte_change_invalidates_the_native_admission_contract(monkeypatch):
+    before = admission_contract_digest()
+    original = Path.read_bytes
+
+    def changed(path):
+        value = original(path)
+        return value + b"\n# changed allocator\n" if path.name == "sandbox_command_slots.py" else value
+
+    monkeypatch.setattr(Path, "read_bytes", changed)
+    assert admission_contract_digest() != before
+
+
+def measured_candidate(monkeypatch):
+    from dataclasses import fields, replace
+
+    assert "admission_contract_digest" in {field.name for field in fields(qualification.CapabilityProfile)}
+    historical = qualification._profiles()
+    previous = historical[4]
+    candidate = replace(
+        previous,
+        version=qualification.REGISTRY_VERSION,
+        system=qualification.platform.system(),
+        machine=qualification.platform.machine(),
+        profile_id="controlled-v10-profile",
+        loader_profile=qualification.LOADER_PROFILE,
+        loader_hashes=qualification.loader_hashes(),
+        policy_digest=qualification.policy_digest(),
+        runtime_versions=qualification.runtime_versions(),
+        admission_contract_digest=admission_contract_digest(),
+    )
+    candidate = replace(
+        candidate,
+        proof=replace(
+            candidate.proof, artifact_sha256="a" * 64, contract_digest=qualification.profile_contract_digest(candidate)
+        ),
+    )
+    monkeypatch.setattr(qualification, "_profiles", lambda: (*historical, candidate))
+    return candidate
+
+
+def test_a_qualified_profile_must_refuse_a_later_allocator_module_change(monkeypatch):
+    candidate = measured_candidate(monkeypatch)
+    qualification.require_profile(candidate)
+    original = Path.read_bytes
+
+    def changed(path):
+        value = original(path)
+        return value + b"\n# changed allocator\n" if path.name == "sandbox_command_slots.py" else value
+
+    monkeypatch.setattr(Path, "read_bytes", changed)
+    with pytest.raises(ValueError):
+        qualification.require_profile(candidate)
+
+
+def test_a_profile_without_the_exact_measured_admission_closure_is_refused(monkeypatch):
+    from dataclasses import replace
+
+    candidate = measured_candidate(monkeypatch)
+    candidate = replace(candidate, admission_contract_digest="0" * 64)
+    candidate = replace(
+        candidate, proof=replace(candidate.proof, contract_digest=qualification.profile_contract_digest(candidate))
+    )
+    registered = qualification._profiles()[:5]
+    monkeypatch.setattr(qualification, "_profiles", lambda: (*registered, candidate))
+    with pytest.raises(ValueError):
+        qualification.require_profile(candidate)
+
+
+def test_explicit_controlled_profile_fixture_binds_the_current_admission_digest(tmp_path, monkeypatch):
+    from source_edit_qualification_fixtures import register_fixture_profile
+
+    executable = tmp_path / "controlled-native"
+    executable.write_text("#!/bin/sh\nexit 0\n")
+    executable.chmod(0o700)
+    profile = register_fixture_profile(monkeypatch, executable)
+    qualification.require_profile(profile)
+    assert profile.admission_contract_digest == admission_contract_digest()
+
+
+@pytest.mark.parametrize("value", [None, True, 0, {}, [], "", "a" * 63])
+def test_a_profile_with_an_invalid_admission_digest_shape_is_refused(monkeypatch, value):
+    from dataclasses import replace
+
+    candidate = measured_candidate(monkeypatch)
+    candidate = replace(candidate, admission_contract_digest=value)
+    candidate = replace(
+        candidate, proof=replace(candidate.proof, contract_digest=qualification.profile_contract_digest(candidate))
+    )
+    historical = qualification._profiles()[:5]
+    monkeypatch.setattr(qualification, "_profiles", lambda: (*historical, candidate))
+    with pytest.raises(ValueError):
+        qualification.require_profile(candidate)
+
+
+def test_controlled_candidate_uses_the_current_host_without_mutating_historical_provenance(monkeypatch):
+    original = qualification._profiles()[4]
+    platform_before = original.system, original.machine
+    monkeypatch.setattr(qualification.platform, "system", lambda: "ControlledOS")
+    monkeypatch.setattr(qualification.platform, "machine", lambda: "controlled-machine")
+    candidate = measured_candidate(monkeypatch)
+    assert (candidate.system, candidate.machine) == ("ControlledOS", "controlled-machine")
+    assert (original.system, original.machine) == platform_before
+    qualification.require_profile(candidate)
diff --git a/tests/test_source_edit_v11_transition_host.py b/tests/test_source_edit_v11_transition_host.py
new file mode 100644
index 00000000..149a7471
--- /dev/null
+++ b/tests/test_source_edit_v11_transition_host.py
@@ -0,0 +1,47 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""The V11 codec profile and its decoder dependency remain immutable history."""
+
+import ast
+import hashlib
+from pathlib import Path
+
+import pytest
+from test_source_edit_v10_transition_host import HISTORICAL
+
+from firefly_forge import source_edit_qualification as q
+from firefly_forge.journal import digest
+from firefly_forge.source_budget_allowances import admission_contract_digest
+
+
+def test_v11_profile_keeps_its_exact_seal_without_current_authority():
+    profiles = q._profiles()
+    assert len(profiles) in {7, 8}
+    for profile in profiles[:7]:
+        with pytest.raises(ValueError):
+            q.require_profile(profile)
+    for profile, (_, _, expected) in zip(profiles[:5], HISTORICAL, strict=True):
+        assert q.historical_profile_seal(profile)["profile_digest"] == expected
+    assert q.historical_profile_seal(profiles[5])["profile_digest"] == (
+        "da8231dc4b6bddb14cde5c619416be63c27ea45b316e02c6a24a84e2fab5777b"
+    )
+    assert q.historical_profile_seal(profiles[6])["profile_digest"] == (
+        "61b578c54ad97e2ded38ce0e1d6a1f145b08c52cdebb0293e6de8b57615623af"
+    )
+
+
+def test_decoder_is_explicit_admission_dependency34_and_every_byte_is_bound(monkeypatch):
+    root = Path(q.__file__).parent
+    tree = ast.parse((root / "source_budget_allowances.py").read_text())
+    fn = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "admission_contract_digest")
+    names = next(ast.literal_eval(n) for n in ast.walk(fn) if isinstance(n, ast.Tuple) and len(n.elts) >= 33)
+    assert len(names[:34]) == len(set(names[:34])) == 34
+    assert names[32:34] == ("sandbox_command_slots.py", "agentic_checkpoint_boundary.py")
+    before = admission_contract_digest()
+    assert before == digest({name: hashlib.sha256((root / name).read_bytes()).hexdigest() for name in names})
+    read = Path.read_bytes
+    monkeypatch.setattr(
+        Path,
+        "read_bytes",
+        lambda p: read(p) + b"\nchanged\n" if p.name == "agentic_checkpoint_boundary.py" else read(p),
+    )
+    assert admission_contract_digest() != before
diff --git a/tests/test_source_edit_v12_transition_host.py b/tests/test_source_edit_v12_transition_host.py
new file mode 100644
index 00000000..fc989681
--- /dev/null
+++ b/tests/test_source_edit_v12_transition_host.py
@@ -0,0 +1,83 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Complete-source enumeration and paging require a fresh measured native profile."""
+
+import ast
+import hashlib
+from pathlib import Path
+
+import pytest
+
+from firefly_forge import source_edit_qualification as q
+from firefly_forge.journal import digest
+from firefly_forge.source_budget_allowances import admission_contract_digest
+
+HISTORICAL_SEALS = (
+    "17320f82c0f2f9ab4b65c7e3bd8b89741a3716a8896dd5f674f6409ac1490c3c",
+    "20e13d34f87314b12fa9a25a0c6411e75e8eb70083a083d743c7fa5487cff76a",
+    "28f152b48aa9ff37c940ae300fd47f4af5ecc0053860b1980b79fa39a20886b6",
+    "ab6b1582f5d364e9341e5d25e0f8dd343c3033d0f2ed885e025f7b38ebb64a97",
+    "4c7d2eba0af54ab48ef33fbe2018e797fcb5cb7adc41a9846722c22dd944f3c8",
+    "da8231dc4b6bddb14cde5c619416be63c27ea45b316e02c6a24a84e2fab5777b",
+    "61b578c54ad97e2ded38ce0e1d6a1f145b08c52cdebb0293e6de8b57615623af",
+)
+
+
+def _declared_admission_names():
+    tree = ast.parse(Path(q.__file__).with_name("source_budget_allowances.py").read_text())
+    fn = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "admission_contract_digest")
+    return next(ast.literal_eval(n) for n in ast.walk(fn) if isinstance(n, ast.Tuple) and len(n.elts) >= 34)
+
+
+def test_v12_requires_new_authority_and_keeps_seven_historical_profiles():
+    assert q.REGISTRY_VERSION == 11
+    assert q.LOADER_PROFILE == "codex-exec-restricted-source/v12"
+    profiles = q._profiles()
+    assert len(profiles) in {7, 8}
+    assert [(p.version, p.loader_profile) for p in profiles[:7]] == [
+        (n, f"codex-exec-restricted-source/v{n + 1}") for n in range(4, 11)
+    ]
+    for p, expected in zip(profiles[:7], HISTORICAL_SEALS, strict=True):
+        assert q.historical_profile_seal(p)["profile_digest"] == digest(q.profile_payload(p)) == expected
+        with pytest.raises(ValueError):
+            q.require_profile(p)
+
+
+def test_source_identity_helper_is_explicit_in_loader_and_admission():
+    names = _declared_admission_names()
+    assert len(names) == len(set(names)) == 35
+    assert names[-3:] == ("sandbox_command_slots.py", "agentic_checkpoint_boundary.py", "checkpoint_source_identity.py")
+    assert len(q.LOADER_MODULES) == len(set(q.LOADER_MODULES)) == 22
+    assert q.LOADER_MODULES[-1] == "checkpoint_source_identity.py"
+    root = Path(q.__file__).parent
+    assert admission_contract_digest() == digest(
+        {n: hashlib.sha256((root / n).read_bytes()).hexdigest() for n in names}
+    )
+
+
+def test_new_source_prompt_versions_are_selected_without_rewriting_history():
+    names = q.LOADER_MODULES
+    for family in ("list", "search"):
+        assert f"resources/prompts/v1/coding-runtime/source-{family}-1.0.2.yaml" in names
+        assert f"resources/prompts/v1/coding-runtime/source-{family}-1.0.1.yaml" not in names
+    assert "resources/prompts/v1/coding-runtime/source-read-1.0.1.yaml" in names
+
+
+def test_source_helper_mutation_invalidates_both_current_contracts(monkeypatch):
+    assert "checkpoint_source_identity.py" in _declared_admission_names()
+    before_admission, before_loader = admission_contract_digest(), q.loader_hashes()
+    read = Path.read_bytes
+    monkeypatch.setattr(
+        Path, "read_bytes", lambda p: read(p) + b"\nchanged\n" if p.name == "checkpoint_source_identity.py" else read(p)
+    )
+    assert admission_contract_digest() != before_admission
+    assert q.loader_hashes() != before_loader
+
+
+@pytest.mark.parametrize("name", ["workspace_tools.py", "checkpoint_source_identity.py"])
+def test_retained_graph_contract_binds_source_inventory_and_selection_bytes(monkeypatch, name):
+    from firefly_forge.agentic_checkpoint_invocation import runtime_contract
+
+    before = runtime_contract()
+    read = Path.read_bytes
+    monkeypatch.setattr(Path, "read_bytes", lambda p: read(p) + b"\nchanged\n" if p.name == name else read(p))
+    assert runtime_contract() != before
diff --git a/tests/test_source_edit_v9_transition_host.py b/tests/test_source_edit_v9_transition_host.py
index 339ff2c5..6a647cd7 100644
--- a/tests/test_source_edit_v9_transition_host.py
+++ b/tests/test_source_edit_v9_transition_host.py
@@ -22,8 +22,8 @@ def previous_profile():
 
 
 def test_protected_cleanup_has_a_distinct_current_profile():
-    assert qualification.REGISTRY_VERSION == 8
-    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v9"
+    assert qualification.REGISTRY_VERSION == 11
+    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v12"
 
 
 def test_registered_v8_remains_exact_historical_provenance_only():
diff --git a/tests/test_source_reader_contract_host.py b/tests/test_source_reader_contract_host.py
index b68695b8..f82d703c 100644
--- a/tests/test_source_reader_contract_host.py
+++ b/tests/test_source_reader_contract_host.py
@@ -16,7 +16,10 @@
 PROMPT_INPUTS = (
     "prompts.py",
     "resources/prompts/v1/manifest.json",
-    *(f"resources/prompts/v1/coding-runtime/source-{name}-1.0.1.yaml" for name in ("list", "read", "search")),
+    *(
+        f"resources/prompts/v1/coding-runtime/source-{name}-{'1.0.1' if name == 'read' else '1.0.2'}.yaml"
+        for name in ("list", "read", "search")
+    ),
 )
 
 
@@ -37,7 +40,7 @@ async def read(request):
     for tool, resource in (("list_files", "list"), ("read_file", "read"), ("search_text", "search")):
         name = "coding-runtime/source-" + resource
         description = tools[tool]["description"]
-        assert description == catalog.text(name, version="1.0.1")
+        assert description == catalog.text(name, version="1.0.1" if resource == "read" else "1.0.2")
         assert description != catalog.text(name, version="1.0.0")
         assert "32 lowercase hexadecimal" in description
         assert "Only declared fields" in description
@@ -87,8 +90,8 @@ def test_selected_prompt_or_renderer_drift_revokes_profile_before_admission(chan
 
 
 def test_reader_bound_proof_uses_a_new_registry_and_loader_contract():
-    assert qualification.REGISTRY_VERSION == 8
-    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v9"
+    assert qualification.REGISTRY_VERSION == 11
+    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v12"
     historical = [
         profile for profile in qualification._profiles() if profile.loader_profile == "codex-exec-restricted-source/v5"
     ]
diff --git a/tests/test_streaming_loader_v8_preparation_host.py b/tests/test_streaming_loader_v8_preparation_host.py
index 6cdcca59..bc5e8860 100644
--- a/tests/test_streaming_loader_v8_preparation_host.py
+++ b/tests/test_streaming_loader_v8_preparation_host.py
@@ -12,9 +12,9 @@
 
 
 def test_current_streaming_loader_requires_a_new_v9_measurement():
-    assert qualification.REGISTRY_VERSION == 8
-    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v9"
-    assert len(qualification.LOADER_MODULES) == 21
+    assert qualification.REGISTRY_VERSION == 11
+    assert qualification.LOADER_PROFILE == "codex-exec-restricted-source/v12"
+    assert len(qualification.LOADER_MODULES) == 22
 
 
 def test_three_historical_literals_and_provenance_remain_exact(monkeypatch):
diff --git a/tests/test_worker_reply_authority_host.py b/tests/test_worker_reply_authority_host.py
index 8f458147..20174db2 100644
--- a/tests/test_worker_reply_authority_host.py
+++ b/tests/test_worker_reply_authority_host.py
@@ -38,7 +38,8 @@ def __init__(self):
         }
         self.run.repository_id = UUID(self.run.data["repository_id"])
         self.run_records = self
-        self.configuration = SimpleNamespace()
+        self.configuration = SimpleNamespace(write_generation=object(), resolve=lambda _: {})
+        self.credential_registry = lambda: {str(index): value for index, value in enumerate(sorted(self.credentials))}
 
     @asynccontextmanager
     async def _unit(self, **kwargs):
diff --git a/tests/test_workspace_completeness.py b/tests/test_workspace_completeness.py
new file mode 100644
index 00000000..58ef16e2
--- /dev/null
+++ b/tests/test_workspace_completeness.py
@@ -0,0 +1,501 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Pages are bounded views; native source evidence must remain complete."""
+
+import hashlib
+import os
+
+import pytest
+
+from firefly_forge.workspace_tools import WorkspaceTools
+
+
+async def populate(root, count=2003):
+    for i in range(count):
+        (root / f"file-{i:05}.txt").write_text("plain source\n")
+    target = root / "zz-final"
+    target.mkdir()
+    (target / "service.py").write_text("late-needle\n")
+
+
+@pytest.mark.asyncio
+async def test_legacy_internal_listing_is_complete_beyond_old_2000(tmp_path):
+    await populate(tmp_path)
+    files = await WorkspaceTools(tmp_path).list_files()
+    assert len(files) == 2004
+    assert "zz-final/service.py" in files
+
+
+@pytest.mark.asyncio
+async def test_search_prefix_reaches_source_after_old_listing_limit(tmp_path):
+    await populate(tmp_path)
+    result = await WorkspaceTools(tmp_path).search_text("late-needle", path_prefix="zz-final")
+    assert [x["path"] for x in result["matches"]] == ["zz-final/service.py"]
+    assert result["complete"] is True
+
+
+@pytest.mark.asyncio
+async def test_versioned_file_pages_reach_all_source_and_bind_scope(tmp_path):
+    for i in range(7):
+        (tmp_path / f"{i}.py").write_text("source\n")
+    tools = WorkspaceTools(tmp_path)
+    first = await tools.list_files_page(page_size=3)
+    assert first["version"] == 1 and first["complete"] is False and len(first["files"]) == 3
+    second = await tools.list_files_page(cursor=first["next_cursor"], page_size=3)
+    third = await tools.list_files_page(cursor=second["next_cursor"], page_size=3)
+    assert first["files"] + second["files"] + third["files"] == await tools.list_files()
+    assert third["complete"] is True and third["next_cursor"] is None
+    with pytest.raises(ValueError, match="scope|cursor"):
+        await tools.list_files_page(path_prefix="elsewhere", cursor=first["next_cursor"])
+    (tmp_path / "new.py").write_text("changed selection")
+    with pytest.raises(ValueError, match="changed|stale"):
+        await tools.list_files_page(cursor=first["next_cursor"], page_size=3)
+
+
+@pytest.mark.asyncio
+async def test_large_text_search_and_binary_classification_are_explicit(tmp_path):
+    large = b"x" * 1_100_000 + b"\nlarge-needle\n"
+    (tmp_path / "large.py").write_bytes(large)
+    (tmp_path / "image.bin").write_bytes(b"\x00\xff\x01")
+    result = await WorkspaceTools(tmp_path).search_text("large-needle")
+    assert result["matches"][0]["sha256"] == hashlib.sha256(large).hexdigest()
+    assert result["classifications"]["binary"] == 1
+    assert result["complete"] is True
+
+
+@pytest.mark.asyncio
+async def test_source_manifest_hashes_large_binary_without_text_or_aggregate_limit(tmp_path):
+    data = b"\x00\xff" * 600_000
+    (tmp_path / "binary.dat").write_bytes(data)
+    (tmp_path / "source.py").write_text("print(1)\n")
+    actual = await WorkspaceTools(tmp_path).source_manifest()
+    assert actual == {
+        "binary.dat": hashlib.sha256(data).hexdigest(),
+        "source.py": hashlib.sha256(b"print(1)\n").hexdigest(),
+    }
+
+
+@pytest.mark.asyncio
+async def test_manifest_refuses_unreadable_and_hardlinked_selected_source(tmp_path):
+    outside = tmp_path.parent / (tmp_path.name + "-outside")
+    outside.write_text("private")
+    os.link(outside, tmp_path / "alias.py")
+    with pytest.raises(ValueError, match="link|alias"):
+        await WorkspaceTools(tmp_path).source_manifest()
+
+
+@pytest.mark.asyncio
+async def test_search_cursor_exposes_remaining_matches_and_rejects_other_query(tmp_path):
+    (tmp_path / "service.py").write_text("needle\n" * 7)
+    tools = WorkspaceTools(tmp_path)
+    first = await tools.search_text("needle", max_results=3)
+    second = await tools.search_text("needle", max_results=3, cursor=first["next_cursor"])
+    third = await tools.search_text("needle", max_results=3, cursor=second["next_cursor"])
+    assert [m["line"] for page in (first, second, third) for m in page["matches"]] == list(range(1, 8))
+    assert third["complete"] is True and third["next_cursor"] is None
+    with pytest.raises(ValueError, match="scope|cursor"):
+        await tools.search_text("different", max_results=3, cursor=first["next_cursor"])
+
+
+@pytest.mark.asyncio
+async def test_manifest_streams_beyond_old_aggregate_without_large_allocation(tmp_path):
+    size = 17 * 1024 * 1024
+    with (tmp_path / "large.bin").open("wb") as target:
+        target.truncate(size)
+    expected = hashlib.sha256()
+    for _ in range(size // 65536):
+        expected.update(bytes(65536))
+    assert (await WorkspaceTools(tmp_path).source_manifest())["large.bin"] == expected.hexdigest()
+
+
+@pytest.mark.asyncio
+async def test_unreadable_selected_source_refuses_instead_of_silently_skipping(tmp_path):
+    target = tmp_path / "locked.py"
+    target.write_text("hidden needle")
+    target.chmod(0)
+    try:
+        with pytest.raises(ValueError, match="unreadable"):
+            await WorkspaceTools(tmp_path).source_manifest()
+    finally:
+        target.chmod(0o600)
+
+
+def test_native_reader_paging_options_are_explicit_strict_and_source_bound():
+    from firefly_forge.source_edit_models import SourceReadRequest
+
+    request = SourceReadRequest(tool="list_files", request_id="a" * 32, path="services", cursor=None, page_size=2)
+    assert request.page_size == 2
+    with pytest.raises(ValueError):
+        SourceReadRequest(tool="read_file", request_id="a" * 32, path="service.py", cursor="bad")
+
+
+@pytest.mark.asyncio
+async def test_page_response_window_never_becomes_a_project_total(tmp_path):
+    for i in range(20):
+        (tmp_path / (str(i).zfill(2) + "-source-name.py")).write_text("source")
+    tools = WorkspaceTools(tmp_path, max_page_bytes=800)
+    cursor, found = None, []
+    while True:
+        page = await tools.list_files_page(cursor=cursor)
+        import json
+
+        assert len(json.dumps(page).encode()) <= 800
+        found.extend(page["files"])
+        if page["complete"]:
+            break
+        assert page["next_cursor"] and page["files"]
+        cursor = page["next_cursor"]
+    assert found == await tools.list_files() and len(found) == 20
+
+
+@pytest.mark.asyncio
+async def test_invalid_utf8_is_reported_and_long_line_excerpts_disclose_truncation(tmp_path):
+    (tmp_path / "binary.dat").write_bytes(b"\xff\xfe")
+    (tmp_path / "long.txt").write_text("x" * 70000 + "needle\n")
+    result = await WorkspaceTools(tmp_path).search_text("needle")
+    assert result["classifications"]["invalid_utf8"] == 1
+    assert result["matches"][0]["snippet_truncated"] is True
+    assert len(result["matches"][0]["snippet"]) == 300
+
+
+@pytest.mark.asyncio
+async def test_native_mcp_exposes_versioned_paging_without_new_tools():
+    import time
+
+    import httpx
+
+    from firefly_forge.coding_check_transport import CodingCheckServer
+
+    async def read(request):
+        raise AssertionError("A schema read must not inspect project source")
+
+    server = CodingCheckServer(None, expires_at_ms=int(time.time() * 1000) + 30000, source_callback=read)
+    app = server.application(19433)
+    headers = {"authorization": "Bearer " + server.token, "accept": "application/json, text/event-stream"}
+    async with (
+        app.router.lifespan_context(app),
+        httpx.AsyncClient(transport=httpx.ASGITransport(app), base_url="http://127.0.0.1:19433") as client,
+    ):
+        response = await client.post("/mcp", headers=headers, json={"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
+    tools = {x["name"]: x for x in response.json()["result"]["tools"]}
+    assert set(tools) == {"list_files", "read_file", "search_text"}
+    assert {"path", "cursor", "page_size"} <= set(tools["list_files"]["inputSchema"]["properties"])
+    assert "cursor" in tools["search_text"]["inputSchema"]["properties"]
+    assert "complete=true" in tools["list_files"]["description"]
+
+
+@pytest.mark.asyncio
+async def test_git_selection_includes_ignored_tracked_source_and_excludes_reproducible_dependencies(tmp_path):
+    import subprocess
+
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    (tmp_path / ".gitignore").write_text("node_modules/\nignored/\n")
+    (tmp_path / "ignored").mkdir()
+    (tmp_path / "ignored/tracked.py").write_text("tracked needle\n")
+    (tmp_path / "node_modules").mkdir()
+    (tmp_path / "node_modules/cache.js").write_text("dependency")
+    (tmp_path / "new.py").write_text("new source")
+    subprocess.run(["git", "-C", str(tmp_path), "add", "-f", ".gitignore", "ignored/tracked.py"], check=True)
+    tools = WorkspaceTools(tmp_path)
+    assert await tools.list_files() == [".gitignore", "ignored/tracked.py", "new.py"]
+    assert "node_modules/cache.js" not in await tools.source_manifest()
+    found = await tools.search_text("tracked needle", path_prefix="ignored")
+    assert found["matches"][0]["path"] == "ignored/tracked.py"
+
+
+@pytest.mark.asyncio
+async def test_git_component_scope_stays_confined_to_its_declared_repository(tmp_path):
+    import subprocess
+
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    component = tmp_path / "component"
+    component.mkdir()
+    (component / "service.py").write_text("inside")
+    (tmp_path / "outside.py").write_text("sibling")
+    tools = WorkspaceTools(component, repository_root=tmp_path)
+    assert await tools.list_files() == ["service.py"]
+    page = await tools.list_files_page()
+    assert page["files"] == ["service.py"] and page["complete"] is True
+
+
+@pytest.mark.asyncio
+async def test_present_malformed_git_metadata_never_falls_back_to_filesystem(tmp_path):
+    (tmp_path / ".git").mkdir()
+    (tmp_path / "service.py").write_text("source")
+    with pytest.raises(ValueError):
+        await WorkspaceTools(tmp_path).list_files_page()
+
+
+@pytest.mark.asyncio
+async def test_selected_git_link_refuses_instead_of_disappearing_from_manifest(tmp_path):
+    import subprocess
+
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    (tmp_path / "source.py").write_text("source")
+    (tmp_path / "link.py").symlink_to("source.py")
+    subprocess.run(["git", "-C", str(tmp_path), "add", "source.py", "link.py"], check=True)
+    with pytest.raises(ValueError, match="link|regular"):
+        await WorkspaceTools(tmp_path).source_manifest()
+
+
+@pytest.mark.asyncio
+async def test_boolean_cursor_version_is_not_an_integer_protocol_version(tmp_path):
+    import base64
+    import json
+
+    (tmp_path / "a.py").write_text("A")
+    (tmp_path / "b.py").write_text("B")
+    tools = WorkspaceTools(tmp_path)
+    page = await tools.list_files_page(page_size=1)
+    token = json.loads(base64.urlsafe_b64decode(page["next_cursor"]))
+    token["version"] = True
+    encoded = base64.urlsafe_b64encode(
+        json.dumps(token, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+    ).decode()
+    with pytest.raises(ValueError, match="cursor|scope"):
+        await tools.list_files_page(cursor=encoded, page_size=1)
+
+
+@pytest.mark.asyncio
+async def test_real_agentic_command_tool_tracks_large_binary_effects_completely(tmp_path):
+    from pydantic_ai.messages import ModelResponse, ToolCallPart, ToolReturnPart
+    from pydantic_ai.models.function import FunctionModel
+
+    from firefly_forge.agentic_runtime import execute_agentic
+    from firefly_forge.process import ProcessResult
+    from firefly_forge.workspace_tools import ToolRuntimeContext
+
+    target = tmp_path / "large.bin"
+    with target.open("wb") as stream:
+        stream.truncate(17 * 1024 * 1024)
+    calls = []
+
+    async def command(argv, timeout):
+        calls.append((argv, timeout))
+        with target.open("r+b") as stream:
+            stream.seek(16 * 1024 * 1024 + 3)
+            stream.write(b"\xff")
+        return ProcessResult(argv, 0, "Controlled command completed")
+
+    def model(messages, info):
+        returned = [part for message in messages for part in message.parts if isinstance(part, ToolReturnPart)]
+        if not returned:
+            return ModelResponse(
+                parts=[ToolCallPart("execute_command", {"argv": ["fixture", "write-binary"], "timeout": 1})]
+            )
+        return ModelResponse(
+            parts=[ToolCallPart(info.output_tools[0].name, {"summary": "Observed a binary source change"})]
+        )
+
+    async def emit(kind, message):
+        pass
+
+    summary, usage = await execute_agentic(
+        tmp_path,
+        "Observe source",
+        "pyfly",
+        "none",
+        emit,
+        model=FunctionModel(model),
+        runtime_context=ToolRuntimeContext(
+            tmp_path, tmp_path, allowed_tools=frozenset({"execute_command"}), command_executor=command
+        ),
+    )
+    assert summary == "Observed a binary source change"
+    assert usage["files_written"] == ["large.bin"]
+    assert calls == [(["fixture", "write-binary"], 1)]
+
+
+@pytest.mark.asyncio
+async def test_unreadable_standalone_directory_cannot_look_like_complete_empty_source(tmp_path):
+    locked = tmp_path / "locked"
+    locked.mkdir()
+    (locked / "source.py").write_text("source")
+    locked.chmod(0)
+    try:
+        with pytest.raises(ValueError, match="unreadable"):
+            await WorkspaceTools(tmp_path).list_files_page()
+    finally:
+        locked.chmod(0o700)
+
+
+@pytest.mark.asyncio
+async def test_file_page_refuses_selection_change_during_listing(tmp_path, monkeypatch):
+    (tmp_path / "first.py").write_text("first")
+    tools = WorkspaceTools(tmp_path)
+    original = tools._inventory
+    calls = 0
+
+    async def changing(*args):
+        nonlocal calls
+        value = await original(*args)
+        calls += 1
+        if calls == 1:
+            (tmp_path / "late.py").write_text("late")
+        return value
+
+    monkeypatch.setattr(tools, "_inventory", changing)
+    with pytest.raises(ValueError, match="changed"):
+        await tools.list_files_page()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("replacement", [None, "replacement.py"])
+@pytest.mark.parametrize("git_repository", [False, True])
+async def test_real_agentic_command_tool_records_deleted_source_paths(tmp_path, replacement, git_repository):
+    from pydantic_ai.messages import ModelResponse, ToolCallPart, ToolReturnPart
+    from pydantic_ai.models.function import FunctionModel
+
+    from firefly_forge.agentic_checkpoint_boundary import _State
+    from firefly_forge.agentic_runtime import execute_agentic
+    from firefly_forge.process import ProcessResult
+    from firefly_forge.workspace_tools import ToolRuntimeContext
+
+    target = tmp_path / "obsolete.py"
+    target.write_text("obsolete = True\n")
+    if git_repository:
+        import subprocess
+
+        (tmp_path / "keep.py").write_text("KEEP = True\n")
+        subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+        subprocess.run(["git", "-C", str(tmp_path), "add", "keep.py", "obsolete.py"], check=True)
+        subprocess.run(
+            [
+                "git",
+                "-C",
+                str(tmp_path),
+                "-c",
+                "user.name=Fixture",
+                "-c",
+                "user.email=fixture@example.invalid",
+                "commit",
+                "-qm",
+                "Seed source",
+            ],
+            check=True,
+        )
+    calls = []
+
+    async def command(argv, timeout):
+        calls.append((argv, timeout))
+        if replacement is None:
+            target.unlink()
+        else:
+            target.rename(tmp_path / replacement)
+        return ProcessResult(argv, 0, "Controlled refactor completed")
+
+    def model(messages, info):
+        returned = [part for message in messages for part in message.parts if isinstance(part, ToolReturnPart)]
+        if not returned:
+            return ModelResponse(
+                parts=[ToolCallPart("execute_command", {"argv": ["fixture", "remove-obsolete"], "timeout": 1})]
+            )
+        return ModelResponse(parts=[ToolCallPart(info.output_tools[0].name, {"summary": "Removed obsolete source"})])
+
+    async def emit(kind, message):
+        pass
+
+    summary, usage = await execute_agentic(
+        tmp_path,
+        "Remove obsolete source",
+        "pyfly",
+        "none",
+        emit,
+        model=FunctionModel(model),
+        runtime_context=ToolRuntimeContext(
+            tmp_path, tmp_path, allowed_tools=frozenset({"execute_command"}), command_executor=command
+        ),
+    )
+    expected = sorted(["obsolete.py", *([replacement] if replacement is not None else [])])
+    assert summary == "Removed obsolete source"
+    assert usage["files_written"] == expected
+    assert _State.model_validate({"files_written": expected}).files_written == expected
+    assert not target.exists()
+    assert calls == [(["fixture", "remove-obsolete"], 1)]
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("path", ["obsolete.py", "removed/obsolete.py"])
+async def test_git_tracked_absence_is_omitted_from_current_source_views(tmp_path, path):
+    import subprocess
+
+    target = tmp_path / path
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text("obsolete = True\n")
+    (tmp_path / "keep.py").write_text("KEEP = True\n")
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    subprocess.run(["git", "-C", str(tmp_path), "add", "."], check=True)
+    target.unlink()
+    if target.parent != tmp_path:
+        target.parent.rmdir()
+    tools = WorkspaceTools(tmp_path)
+    assert await tools.list_files() == ["keep.py"]
+    assert (await tools.list_files_page())["files"] == ["keep.py"]
+    assert await tools.source_manifest() == {"keep.py": hashlib.sha256(b"KEEP = True\n").hexdigest()}
+    assert (await tools.search_text("obsolete"))["matches"] == []
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("transient", [False, True])
+async def test_git_tracked_absence_reappearing_during_inventory_is_not_hidden(tmp_path, monkeypatch, transient):
+    import subprocess
+
+    from firefly_forge import checkpoint_source_identity
+
+    target = tmp_path / "obsolete.py"
+    target.write_text("source")
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    subprocess.run(["git", "-C", str(tmp_path), "add", "obsolete.py"], check=True)
+    target.unlink()
+    original = checkpoint_source_identity.stream_source_entries
+
+    async def changed(workspace, consume):
+        await original(workspace, consume)
+        target.write_text("replacement")
+        if transient:
+            target.unlink()
+
+    monkeypatch.setattr(checkpoint_source_identity, "stream_source_entries", changed)
+    with pytest.raises(ValueError, match="absen|changed"):
+        await WorkspaceTools(tmp_path).source_manifest()
+
+
+@pytest.mark.asyncio
+async def test_disappearing_untracked_git_source_still_refuses(tmp_path, monkeypatch):
+    import subprocess
+
+    from firefly_forge import checkpoint_source_identity
+
+    target = tmp_path / "new.py"
+    target.write_text("source")
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    original = checkpoint_source_identity.stream_source_entries
+
+    async def changed(workspace, consume):
+        async def disappear(entry):
+            target.unlink()
+            await consume(entry)
+
+        await original(workspace, disappear)
+
+    monkeypatch.setattr(checkpoint_source_identity, "stream_source_entries", changed)
+    with pytest.raises(ValueError, match="unreadable|changed"):
+        await WorkspaceTools(tmp_path).source_manifest()
+
+
+@pytest.mark.asyncio
+async def test_missing_tracked_file_under_replaced_symlink_parent_still_refuses(tmp_path):
+    import subprocess
+
+    folder = tmp_path / "removed"
+    folder.mkdir()
+    target = folder / "obsolete.py"
+    target.write_text("source")
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    subprocess.run(["git", "-C", str(tmp_path), "add", "removed/obsolete.py"], check=True)
+    target.unlink()
+    folder.rmdir()
+    outside = tmp_path.parent / (tmp_path.name + "-outside")
+    outside.mkdir()
+    folder.symlink_to(outside, target_is_directory=True)
+    with pytest.raises(ValueError, match="unreadable|linked"):
+        await WorkspaceTools(tmp_path).source_manifest()
diff --git a/tests/test_workspace_paging_native.py b/tests/test_workspace_paging_native.py
new file mode 100644
index 00000000..b13aef45
--- /dev/null
+++ b/tests/test_workspace_paging_native.py
@@ -0,0 +1,150 @@
+# Copyright 2026 Firefly Software Foundation. SPDX-License-Identifier: Apache-2.0
+"""Real SQL reader receipts and budgets; Git/source only, no real coding provider."""
+
+import hashlib
+from uuid import uuid4
+
+import pytest
+from test_source_edit_native import activation, prepared, started
+from worker_reply_fixtures import authenticated_operator
+
+from firefly_forge.source_edit_continuations import SourceEditInvocation
+from firefly_forge.source_edit_models import SourceReadRequest
+
+
+async def reader(store, tmp_path, monkeypatch, files, *, deleted_tracked=False):
+    import subprocess
+
+    import test_workspace_reconciliation_native as reconciliation_fixture
+
+    original_seed = reconciliation_fixture.seed_repository
+
+    async def seed_with_catalog(path):
+        repository = await original_seed(path)
+        catalog = {**files, **({"catalog/deleted.py": b"obsolete = True\n"} if deleted_tracked else {})}
+        for name, data in catalog.items():
+            target = repository / name
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_bytes(data)
+        subprocess.run(["git", "-C", str(repository), "add", "--", *catalog], check=True, timeout=10)
+        subprocess.run(
+            [
+                "git",
+                "-C",
+                str(repository),
+                "-c",
+                "user.name=Fixture",
+                "-c",
+                "user.email=fixture@example.invalid",
+                "commit",
+                "-qm",
+                "Seed source reader catalog",
+            ],
+            check=True,
+            timeout=10,
+        )
+        return repository
+
+    monkeypatch.setattr(reconciliation_fixture, "seed_repository", seed_with_catalog)
+    if deleted_tracked:
+        original_engine = reconciliation_fixture.Engine
+        applied = False
+
+        def engine_with_worker_effect(store, workspaces, provider_factory, **kwargs):
+            def provider(settings):
+                worker = provider_factory(settings)
+                original_execute = worker.execute
+
+                async def execute(workspace, *args):
+                    nonlocal applied
+                    if not applied:
+                        # A modeled worker effect precedes the existing verification cut.
+                        (workspace / "catalog/deleted.py").unlink()
+                        applied = True
+                    return await original_execute(workspace, *args)
+
+                worker.execute = execute
+                return worker
+
+            return original_engine(store, workspaces, provider, **kwargs)
+
+        monkeypatch.setattr(reconciliation_fixture, "Engine", engine_with_worker_effect)
+    env = await prepared(store, tmp_path, monkeypatch)
+    await env.service.activate_source_edit(env.run_id, activation(await env.service.source_candidate(env.run_id)))
+    return env, SourceEditInvocation(env.service.recoveries, env.run_id, await started(env))
+
+
+async def test_native_source_pages_keep_exact_receipts_and_spent_read_budget(store, tmp_path, monkeypatch):
+    async with authenticated_operator(store):
+        files = {f"catalog/{i:04}.py": b"VALUE = 1\n" for i in range(2003)}
+        env, runtime = await reader(store, tmp_path, monkeypatch, files, deleted_tracked=True)
+        first_request = SourceReadRequest(tool="list_files", request_id=uuid4().hex, path="catalog", page_size=1000)
+        first = await runtime.run(first_request)
+        assert await runtime.run(first_request) == first
+        second = await runtime.run(
+            SourceReadRequest(
+                tool="list_files", request_id=uuid4().hex, path="catalog", page_size=1000, cursor=first["next_cursor"]
+            )
+        )
+        third = await runtime.run(
+            SourceReadRequest(
+                tool="list_files", request_id=uuid4().hex, path="catalog", page_size=1000, cursor=second["next_cursor"]
+            )
+        )
+        assert len(first["files"] + second["files"] + third["files"]) == 2003 and third["complete"] is True
+        assert "catalog/deleted.py" not in first["files"] + second["files"] + third["files"]
+        rows = await env.engine.tool_broker.invocations(env.run_id)
+        assert len(rows) == 3 and all(row["status"] == "succeeded" for row in rows)
+        assert all(row["admission"]["tool"] == "list_files" for row in rows)
+        assert first["source_digest"] == second["source_digest"] == third["source_digest"]
+        assert len(env.calls) == 1 and len(env.checks) == 7
+
+
+async def test_native_source_cursor_drift_has_no_new_tool_or_command_authority(store, tmp_path, monkeypatch):
+    async with authenticated_operator(store):
+        env, runtime = await reader(store, tmp_path, monkeypatch, {"catalog/a.py": b"A\n", "catalog/b.py": b"B\n"})
+        request = SourceReadRequest(tool="list_files", request_id=uuid4().hex, path="catalog", page_size=1)
+        first = await runtime.run(request)
+        with pytest.raises(ValueError):
+            await runtime.run(
+                SourceReadRequest(
+                    tool="list_files",
+                    request_id=request.request_id,
+                    path="catalog",
+                    page_size=1,
+                    cursor=first["next_cursor"],
+                )
+            )
+        rows = await env.engine.tool_broker.invocations(env.run_id)
+        assert len(rows) == 1 and rows[0]["status"] == "succeeded"
+        assert await runtime.run(request) == first
+        assert len(env.calls) == 1 and len(env.checks) == 7
+
+
+async def test_native_large_text_search_pages_keep_scope_and_full_hash(store, tmp_path, monkeypatch):
+    async with authenticated_operator(store):
+        data = b"x" * 1_100_000 + b"\nlarge-needle\nlarge-needle\n"
+        env, runtime = await reader(
+            store, tmp_path, monkeypatch, {"catalog/large.py": data, "catalog/image.bin": b"\x00\xff"}
+        )
+        first = await runtime.run(
+            SourceReadRequest(
+                tool="search_text", request_id=uuid4().hex, text="large-needle", path="catalog", max_results=1
+            )
+        )
+        second = await runtime.run(
+            SourceReadRequest(
+                tool="search_text",
+                request_id=uuid4().hex,
+                text="large-needle",
+                path="catalog",
+                max_results=1,
+                cursor=first["next_cursor"],
+            )
+        )
+        assert first["matches"][0]["line"] == 2 and second["matches"][0]["line"] == 3
+        assert first["matches"][0]["sha256"] == second["matches"][0]["sha256"] == hashlib.sha256(data).hexdigest()
+        assert second["complete"] is True and second["classifications"]["binary"] == 1
+        rows = await env.engine.tool_broker.invocations(env.run_id)
+        assert len(rows) == 2 and all(row["status"] == "succeeded" for row in rows)
+        assert len(env.calls) == 1 and len(env.checks) == 7
diff --git a/uv.lock b/uv.lock
index ebed525e..e7038aee 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1023,7 +1023,7 @@ wheels = [
 
 [[package]]
 name = "firefly-forge"
-version = "0.2.42"
+version = "0.2.43"
 source = { editable = "." }
 dependencies = [
     { name = "click" },